@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.51

package/dist/doctor.js

@@ -1,17 +1,16 @@
-import { join } from 'node:path';
-import { userInfo, homedir } from 'node:os';
+import { userInfo } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { realExec } from './exec.js';
 import { isolationContextFor, loadConfig } from './config.js';
 import { getAdapter, productionAdapters } from './harness/registry.js';
 import { analyzeFleetPermissions, formatNative } from './permissions.js';
+import { managedCliReport } from './managed-cli.js';
 import { resolveBundledAcpAgent } from './harness/acp-agent.js';
 import { agentDir, deriveXdgRuntimeDir } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
-import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
@@ -37,25 +36,21 @@ function resolveMonitorProfiles(roles) {
     const profiles = [];
     for (const role of roles.filter(r => r.monitor?.mode === 'fleet')) {
         const env = { ...process.env, ...(role.env ?? {}) };
-        const client = readClientProfile(env);
-        if (client) {
-            const existing = profiles.find(p => p.client?.endpoint === client.endpoint
-                && p.client.expectedInstanceId === client.expectedInstanceId
-                && p.client.credentialPath === client.credentialPath);
-            if (existing)
-                existing.roles.push(role.name);
-            else
-                profiles.push({ client, roles: [role.name] });
+        let client;
+        try {
+            client = readClientProfile(env);
+        }
+        catch (error) {
+            profiles.push({ roles: [role.name], error: error instanceof Error ? error.message : 'Invalid gateway profile' });
             continue;
         }
-        const endpoint = resolveEndpoint(env);
-        const token = endpoint.headers['x-ours-api-token'];
-        const existing = profiles.find(p => p.endpoint?.origin === endpoint.origin
-            && p.endpoint.headers['x-ours-api-token'] === token);
+        const existing = profiles.find(p => p.client?.endpoint === client.endpoint
+            && p.client.expectedInstanceId === client.expectedInstanceId
+            && p.client.credentialPath === client.credentialPath);
         if (existing)
             existing.roles.push(role.name);
         else
-            profiles.push({ endpoint, roles: [role.name] });
+            profiles.push({ client, roles: [role.name] });
     }
     return profiles;
 }
@@ -156,7 +151,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
-        // Cowork socket reachability
+        // Cowork gateway reachability
         const coworkConfig = rooms.cowork?.config;
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -165,14 +160,14 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
             checks.push({
                 name: 'cowork', ok: reachable,
                 detail: reachable
-                    ? 'management socket reachable'
-                    : `management socket unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
+                    ? 'gateway management reachable'
+                    : `gateway management unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
             });
         }
         catch (e) {
             checks.push({
                 name: 'cowork', ok: false,
-                detail: `management socket error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
+                detail: `gateway management error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
             });
         }
         // Owner CID shape
@@ -219,17 +214,6 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     : `template '${defaultTemplate}' not found`,
             });
         }
-        // Shared-daemon selection coherence
-        if (rooms.cowork?.config) {
-            const { existsSync: exists } = await import('node:fs');
-            const configOk = exists(rooms.cowork.config);
-            checks.push({
-                name: 'rooms: cowork config', ok: configOk,
-                detail: configOk
-                    ? `cowork config at ${rooms.cowork.config}`
-                    : `cowork config not found: ${rooms.cowork.config}`,
-            });
-        }
         // Hard room-management capability check
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -273,20 +257,17 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
-    let managedSelection = false;
+    let managedSelection = true;
     try {
         // Mark explicit selection before validation so a damaged managed profile does
         // not produce advice to start an unrelated local daemon.
-        managedSelection = process.env.OURS_CONFIG !== undefined
-            || existsSync(join(process.env.HOME || homedir(), '.ours-client', 'profile.json'));
+        managedSelection = true;
         const selected = readClientProfile(process.env);
         managedSelection = selected !== undefined;
-        const client = await attachDaemon(selected ? {
+        const client = await attachDaemon({
             endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
             credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-        } : {
-            env: process.env, leaseToken: `ours-fleet-doctor-${process.pid}`, clientPid: process.pid,
         });
         let daemonVersion;
         try {
@@ -368,6 +349,32 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     + `grants only ${analysis.capabilities.join(', ') || '(nothing)'}`,
         });
     }
+    // Managed CLI policy. Three separate rows on purpose: what Fleet generated
+    // (static), what the running session loaded, and what the supervisor audit
+    // ledger actually recorded. The first two never stand in for the third.
+    if (roles.some(role => role.managed_cli?.length)) {
+        const report = managedCliReport({ roles }, opts.configPath, { write: false, platform });
+        for (const role of report.roles.filter(item => item.setup.state !== 'not-declared')) {
+            checks.push({
+                name: `managed CLI setup: ${role.role}`,
+                ok: ['prepared', 'generated-at-launch', 'not-required'].includes(role.setup.state),
+                detail: `static: ${role.setup.state} — ${role.setup.detail}`
+                    + (['missing', 'stale'].includes(role.setup.state) ? '; run: ours-fleet managed-cli setup' : '')
+                    + (role.warnings.length ? `; ${role.warnings.join('; ')}` : ''),
+            });
+            if (role.session_policy !== 'not-applicable')
+                checks.push({
+                    name: `managed CLI session: ${role.role}`, ok: true,
+                    detail: role.session_policy === 'restart-required'
+                        ? 'the last launch loaded a different policy — restart this agent to load the current one'
+                        : role.session_policy === 'never-launched' ? 'not launched since setup; the policy loads at its next start'
+                            : 'the last launch loaded the current policy',
+                });
+            checks.push({
+                name: `managed CLI observed: ${role.role}`, ok: true, detail: role.observed.summary,
+            });
+        }
+    }
     for (const role of roles.filter(candidate => candidate.auth_proxy !== undefined)) {
         const proxy = role.auth_proxy;
         const credentialKeys = Object.keys(role.env ?? {}).filter(key => /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|AUTHORIZATION)$/i.test(key)
@@ -448,14 +455,18 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // shared-mode misconfig (401) surfaces here rather than as a silent deaf monitor.
     const monitorProfiles = resolveMonitorProfiles(roles);
     for (const profile of monitorProfiles) {
-        const { endpoint, client: selected } = profile;
+        const selected = profile.client;
         const checkName = monitorProfiles.length === 1
             ? 'monitor: daemon API'
             : `monitor: daemon API (${profile.roles.join(', ')})`;
-        let ok = false, detail;
+        let ok = false, detail = 'gateway profile unavailable';
+        if (profile.error) {
+            checks.push({ name: checkName, ok: false, detail: profile.error });
+            continue;
+        }
         try {
             if (selected) {
-                const daemon = await attachOursClient({
+                const daemon = await attachDaemon({
                     endpoint: selected.endpoint,
                     expectedInstanceId: selected.expectedInstanceId,
                     credentialPath: selected.credentialPath,
@@ -464,7 +475,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 });
                 try {
                     const [info, identities] = await Promise.all([
-                        daemon.version(), daemon.identities(),
+                        daemon.version(), daemon.identities?.(),
                     ]);
                     if (info.name !== 'ours' || !Array.isArray(identities))
                         throw new Error('selected daemon metadata is invalid');
@@ -477,27 +488,11 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 checks.push({ name: checkName, ok, detail });
                 continue;
             }
-            const live = await fetchImpl(`${endpoint.origin}/state-dir`, {});
-            if (!live.ok) {
-                detail = `daemon on :${endpoint.port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
-            }
-            else {
-                const auth = await fetchImpl(`${endpoint.origin}/identities`, { headers: endpoint.headers });
-                if (auth.status === 401)
-                    detail = `reachable on :${endpoint.port} but the API token was rejected (401) — ` +
-                        authResolutionHint(endpoint);
-                else if (!auth.ok)
-                    detail = `reachable on :${endpoint.port} but /identities returned HTTP ${auth.status}`;
-                else {
-                    ok = true;
-                    detail = `reachable on :${endpoint.port}, authorized — supervisor wake stream available`;
-                }
-            }
         }
         catch (e) {
-            const target = selected?.endpoint ?? `:${endpoint.port}`;
+            const target = selected.endpoint;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours-daemon start) [${e?.message ?? e}]`;
+                `(check the configured gateway and issued credential) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/erased-resources.d.ts

@@ -0,0 +1,9 @@
+export declare const erasedArg: (value: string) => string;
+export declare function redactErasedContent<T>(value: T): T;
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export declare function writePrivacyFilteredLedger(path: string, value: unknown): void;
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export declare function eraseResourcePresentations(resources: ReadonlyArray<{
+    kind: 'task' | 'room' | 'agent';
+    id: string;
+}>): void;

package/dist/erased-resources.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot } from './paths.js';
+const registryPath = () => join(stateRoot(), 'erased-resources.json');
+const lockPath = () => join(stateRoot(), 'locks', 'audit-erasure');
+const ledgerNames = ['.fleet-command-audit.json', '.owner-channel-command-audit.json', '.owner-channel-lifecycle-outbox.json'];
+export const erasedArg = (value) => `[erased:${createHash('sha256').update(value).digest('hex')}]`;
+function registry() {
+    if (!existsSync(registryPath()))
+        return new Set();
+    const value = JSON.parse(readFileSync(registryPath(), 'utf8'));
+    if (!Array.isArray(value) || value.some(v => typeof v !== 'string'))
+        throw new Error('Invalid erasure registry');
+    return new Set(value);
+}
+/** Preserve delivery/deduplication metadata while removing owned presentation content. */
+function redact(value, erased) {
+    if (Array.isArray(value))
+        return value.map(item => redact(item, erased));
+    if (!value || typeof value !== 'object')
+        return value;
+    const next = { ...value };
+    const kind = value.kind === 'lifecycle_failure' ? value.resource?.toLowerCase() : value.kind === 'agent_started' ? 'agent' : value.kind;
+    if (typeof value.id === 'string' && erased.has(`${kind}:${value.id}`)) {
+        for (const key of ['title', 'reason', 'roomName', 'label', 'template', 'configuration', 'model', 'permissions'])
+            delete next[key];
+        if (kind === 'task')
+            next.agents = [];
+        if (kind === 'room') {
+            delete next.name;
+            next.participants = [];
+        }
+        if (kind === 'agent') {
+            next.name = 'erased';
+            next.brain = '[erased]';
+            next.role = '[erased]';
+            next.inherited = [];
+        }
+    }
+    if (typeof value.roomId === 'string' && erased.has(`room:${value.roomId}`)) {
+        delete next.roomName;
+        if (kind === 'task')
+            next.agents = [];
+    }
+    const resources = value.outcome?.resourceIds;
+    const ownsAttempt = resources && Object.entries(resources).some(([key, id]) => erased.has(`${key}:${id}`));
+    const ownsPresentation = value.outcome?.presentations?.some((p) => erased.has(`${p.kind === 'agent_started' ? 'agent' : p.kind}:${p.id}`));
+    if ((ownsAttempt || ownsPresentation) && Array.isArray(value.argv) && !value.erased) {
+        next.argv = value.argv.map(erasedArg);
+        next.erased = true;
+    }
+    for (const key of Object.keys(next))
+        if (typeof next[key] === 'object')
+            next[key] = redact(next[key], erased);
+    return next;
+}
+export function redactErasedContent(value) { return redact(value, registry()); }
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export function writePrivacyFilteredLedger(path, value) {
+    withSynchronousFileLock(lockPath(), () => replaceFileAtomically(path, JSON.stringify(redact(value, registry())) + '\n'));
+}
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export function eraseResourcePresentations(resources) {
+    withSynchronousFileLock(lockPath(), () => {
+        const erased = registry();
+        for (const resource of resources)
+            erased.add(`${resource.kind}:${resource.id}`);
+        replaceFileAtomically(registryPath(), JSON.stringify([...erased]));
+        for (const root of [join(stateRoot(), 'agents'), join(stateRoot(), 'tmp'), join(stateRoot(), 'recovery', 'temporary')]) {
+            if (!existsSync(root))
+                continue;
+            for (const entry of readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+                for (const name of ledgerNames) {
+                    const path = join(root, entry.name, name);
+                    if (!existsSync(path) || !lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+                        continue;
+                    const old = JSON.parse(readFileSync(path, 'utf8'));
+                    replaceFileAtomically(path, JSON.stringify(redact(old, erased)) + '\n');
+                }
+            }
+        }
+    });
+}

package/dist/fleet-command-audit.d.ts

@@ -113,6 +113,7 @@ export interface FleetCommandClassification {
     decision: FleetCommandDecision;
 }
 export interface FleetAuditAttempt {
+    erased?: boolean;
     version: 1;
     correlationId: string;
     requestId: string;
@@ -144,6 +145,12 @@ export declare const fleetProxyTopLevelInventory: Readonly<{
 }>;
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export declare function classifyFleetArgv(argv: readonly string[]): FleetCommandClassification;
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export declare const managedPinMarker: (configuration: string) => string;
 /** Faithful ordered argv with deterministic structural redaction. */
 export declare function redactFleetArgv(argv: readonly string[]): string[];
 /** Durable write-once attempt ledger; contains redacted argv only. */

package/dist/fleet-command-audit.js

@@ -1,7 +1,7 @@
+import { erasedArg, redactErasedContent, writePrivacyFilteredLedger } from './erased-resources.js';
 import { existsSync, readFileSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { replaceFileAtomically } from './atomic-file.js';
 import { isSensitiveConfigKey } from './sensitive-config.js';
 import { mandatoryConfigurationFits } from './lifecycle-summary.js';
 import { MARKDOWN_MAX_BYTES, MARKDOWN_MAX_CODE_POINTS, markdownCode, markdownProse, } from './rooms-tasks/markdown.js';
@@ -91,7 +91,7 @@ export function recordFleetAuditPresentation(value) {
                 : value.kind === 'lifecycle_failure'
                     ? { label: fleetPresentationLabel(value.label) }
                     : {};
-        const presentation = structuredClone({ ...value, ...labels, eventId: basis });
+        const presentation = redactErasedContent(structuredClone({ ...value, ...labels, eventId: basis }));
         const digest = lifecycleEventDigestBasis(presentation);
         if (!collection.presentations.some(existing => lifecycleEventDigestBasis(existing) === digest))
             collection.presentations.push(presentation);
@@ -117,6 +117,7 @@ export function consumeFleetAuditCollection() {
 const SAFE_READ = new Set(['docs', 'version', 'config', 'ls', 'peek', 'logs', 'status', 'doctor']);
 const AGENT_SURFACES = {
     spawn: new Set(['<none>']),
+    ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
         'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
@@ -134,7 +135,8 @@ export const fleetProxyTopLevelInventory = Object.freeze({
     ], denied: [...DENIED],
     hidden: ['_run', '_run-temp', '_run-temp-worker', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
 });
-const globalValueOptions = new Set(['-c', '--configuration']);
+// `--managed-configuration <file>` is the pinned managed entry form (src/managed-cli.ts).
+const globalValueOptions = new Set(['-c', '--configuration', '--managed-configuration']);
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export function classifyFleetArgv(argv) {
     let command = '';
@@ -185,11 +187,17 @@ export function classifyFleetArgv(argv) {
     return { command, route: 'supervisor-proxy/public', decision: 'allow' };
 }
 const marker = (value) => value === '' ? '[REDACTED:empty]' : '[REDACTED:value]';
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export const managedPinMarker = (configuration) => `[PIN:${createHash('sha256').update(configuration).digest('hex').slice(0, 16)}]`;
 const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
-    '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
-    '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
+    '--configuration', '-c', '--managed-configuration', '--public-invite', '--public-invite-file', '--invite-file',
+    '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
 ]);
 function redactUrl(value) {
@@ -248,6 +256,11 @@ export function redactFleetArgv(argv) {
             result[index] = `${equal[1]}=${marker(equal[2])}`;
             continue;
         }
+        if (index === 0 && arg === '--managed-configuration' && result.length > 1) {
+            result[1] = managedPinMarker(result[1]);
+            index++;
+            continue;
+        }
         if (sensitiveValueFlags.has(arg) && index + 1 < result.length) {
             result[index + 1] = marker(result[index + 1]);
             index++;
@@ -304,11 +317,12 @@ export class FleetCommandAuditStore {
         if (recovered)
             this.persist();
     }
-    list() { return this.attempts.map(item => structuredClone(item)); }
+    list() { return redactErasedContent(this.attempts).map(item => structuredClone(item)); }
     begin(requestId, caller, argv) {
+        this.attempts = redactErasedContent(this.attempts);
         const existing = this.attempts.find(item => item.caller === caller && item.requestId === requestId);
         if (existing) {
-            if (JSON.stringify(existing.argv) !== JSON.stringify(redactFleetArgv(argv)))
+            if (JSON.stringify(existing.argv) !== JSON.stringify(existing.erased ? redactFleetArgv(argv).map(erasedArg) : redactFleetArgv(argv)))
                 throw new Error('fleet command request ID was reused with different argv');
             return structuredClone(existing);
         }
@@ -328,6 +342,8 @@ export class FleetCommandAuditStore {
         return structuredClone(attempt);
     }
     finish(correlationId, caller, outcome) {
+        this.attempts = redactErasedContent(this.attempts);
+        outcome = redactErasedContent({ outcome }).outcome;
         const attempt = this.owned(correlationId, caller);
         if (!attempt.outcome)
             attempt.outcome = { ...outcome, completedAt: this.deps.now().toISOString(), delivery: 'sending' };
@@ -359,7 +375,8 @@ export class FleetCommandAuditStore {
         return attempt;
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, attempts: this.attempts })}\n`, 0o600);
+        this.attempts = redactErasedContent(this.attempts);
+        writePrivacyFilteredLedger(this.path, { version: 1, attempts: this.attempts });
     }
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

package/dist/harness/claude-code.js

@@ -6,7 +6,8 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { bundledAcpAgent } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
+import { hostClaude } from './claude-runtime.js';
 import { ClaudeCodeAgentSessionAdapter } from './claude-code-session.js';
 const OPTION_KEYS = [
     'plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode', 'effort',
@@ -283,6 +284,13 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             };
             if (!memPalace)
                 env.MEMPALACE_DISABLED = 'true';
+            // The bundled adapter runs the Claude Code shipped with its SDK unless told otherwise. A host
+            // Claude Code at least as new as that copy is the one the person updates, so sessions run it.
+            if (!customAcpCommand(role)) {
+                const host = hostClaude(resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').manifestPath, { ...process.env, ...role.env }, dirs.runCwd);
+                if (host)
+                    env.CLAUDE_CODE_EXECUTABLE = host.path;
+            }
             // Per-role harness runtime home. Created before sandbox entry so the
             // bind has something to mount; harmless for un-isolated roles.
             // Only a role that declares `isolation:` gets a sandbox, and only a

package/dist/harness/claude-runtime.d.ts

@@ -0,0 +1,12 @@
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export declare function bundledClaudeVersion(adapterManifest: string): string | undefined;
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export declare function hostClaude(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;

package/dist/harness/claude-runtime.js

@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { codexVersionAtLeast, executableOnPath } from './codex-runtime.js';
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedClaudeVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export function bundledClaudeVersion(adapterManifest) {
+    try {
+        const sdk = dirname(createRequire(adapterManifest).resolve('@anthropic-ai/claude-agent-sdk'));
+        const version = JSON.parse(readFileSync(join(sdk, 'package.json'), 'utf8')).claudeCodeVersion;
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export function hostClaude(adapterManifest, env, cwd = process.cwd(), version = installedClaudeVersion) {
+    if (env.CLAUDE_CODE_EXECUTABLE !== undefined || !adapterManifest)
+        return undefined;
+    const bundled = bundledClaudeVersion(adapterManifest);
+    if (!bundled)
+        return undefined;
+    let path;
+    try {
+        path = executableOnPath('claude', env, cwd);
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}

package/dist/harness/codex-app-server-proxy.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+type JsonObject = Record<string, unknown>;
 interface TerminalRecoveryOptions {
     sendToCodex(line: string): void;
     emitToClient(line: string): void;
@@ -39,6 +40,8 @@ export declare class CodexTerminalRecovery {
     private finishTurn;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean): string;
+export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean, managedOursTools?: JsonObject): string;
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export declare function managedCodexToolPolicy(env: NodeJS.ProcessEnv): JsonObject | undefined;
 export declare function runCodexAppServerProxy(): void;
 export {};

package/dist/harness/codex-app-server-proxy.js

@@ -300,9 +300,9 @@ function sandboxMode(policy) {
  * Fleet keeps the preset's sandbox policy, but restores the independently
  * configured approval policy on the request Codex actually executes.
  */
-function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
+function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp, managedOursTools) {
     if (Array.isArray(value))
-        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp));
+        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     if (!isObject(value) || !isObject(value.params))
         return value;
     if (value.method === 'turn/start') {
@@ -318,17 +318,52 @@ function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
             params: { ...value.params, config: { ...config, mcp_servers: {} } },
         };
     }
+    if (managedOursTools
+        && (value.method === 'thread/start' || value.method === 'thread/resume')) {
+        const config = isObject(value.params.config) ? value.params.config : {};
+        const servers = isObject(config.mcp_servers) ? config.mcp_servers : {};
+        const ours = servers.ours;
+        // Policy cannot create or re-enable a connector that ACP did not inject.
+        if (!isObject(ours) || ours.enabled === false)
+            return value;
+        const tools = isObject(ours.tools) ? { ...ours.tools } : {};
+        for (const [name, policy] of Object.entries(managedOursTools)) {
+            if (isObject(policy))
+                tools[name] = {
+                    ...(isObject(tools[name]) ? tools[name] : {}), ...policy,
+                };
+        }
+        return { ...value, params: { ...value.params, config: { ...config,
+                    mcp_servers: { ...servers, ours: { ...ours, tools } },
+                } } };
+    }
     return value;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false) {
+export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false, managedOursTools) {
     try {
-        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp));
+        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     }
     catch {
         return line;
     }
 }
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export function managedCodexToolPolicy(env) {
+    if (env.FLEET_OURS_MANAGED !== '1')
+        return undefined;
+    try {
+        const config = JSON.parse(env.CODEX_CONFIG ?? '{}');
+        const servers = isObject(config) ? config.mcp_servers : undefined;
+        const ours = isObject(servers) ? servers.ours : undefined;
+        return isObject(ours) && ours.enabled !== false && isObject(ours.tools)
+            ? ours.tools : undefined;
+    }
+    catch {
+        // Invalid config never grants tool approval. ACP owns config diagnostics.
+        return undefined;
+    }
+}
 function requiredChoice(name, allowed) {
     const value = process.env[name];
     if (value && allowed.has(value))
@@ -355,6 +390,7 @@ export function runCodexAppServerProxy() {
     const approval = requiredChoice(APPROVAL_ENV, APPROVAL_POLICIES);
     const expectedSandbox = requiredChoice(SANDBOX_ENV, SANDBOX_MODES);
     const disableInheritedMcp = process.env[DISABLE_INHERITED_MCP_ENV] === '1';
+    const managedOursTools = managedCodexToolPolicy(process.env);
     const launch = realCodexLaunch();
     const env = { ...process.env };
     delete env.CODEX_PATH;
@@ -450,7 +486,7 @@ export function runCodexAppServerProxy() {
     input.on('line', line => {
         if (finished)
             return;
-        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp);
+        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
         writeToChild(rewritten);
     });

package/dist/harness/codex-reasoning.d.ts

@@ -0,0 +1,5 @@
+/** Efforts supported by Fleet's Codex Brain contract. Keep native eligibility in sync. */
+export declare const CODEX_REASONING_EFFORTS: readonly ["low", "medium", "high", "xhigh", "max", "ultra"];
+export declare function isCodexReasoningEffort(value: unknown): value is string;
+/** Only inspected model tuning may bypass the managed CLI native-config guard. */
+export declare function isManagedCliCodexConfig(config: unknown): boolean;

package/dist/harness/codex-reasoning.js

@@ -0,0 +1,12 @@
+/** Efforts supported by Fleet's Codex Brain contract. Keep native eligibility in sync. */
+export const CODEX_REASONING_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
+export function isCodexReasoningEffort(value) {
+    return typeof value === 'string' && CODEX_REASONING_EFFORTS.includes(value);
+}
+/** Only inspected model tuning may bypass the managed CLI native-config guard. */
+export function isManagedCliCodexConfig(config) {
+    if (config == null)
+        return true;
+    return typeof config === 'object' && !Array.isArray(config)
+        && Object.entries(config).every(([key, value]) => key === 'model_reasoning_effort' && isCodexReasoningEffort(value));
+}