@ours.network/fleet 1.2.0-nightly.52 → 1.2.0-nightly.54

package/dist/config.js

@@ -29,6 +29,15 @@ export const NOTIFY_EVENT_TYPES = [
  * Agent; never inferred from a role's name or persona, and never inherited.
  */
 export const MANAGED_CLI_WORKFLOW_IDS = ['task-workflow'];
+export function validateFileDelivery(value) {
+    if (value === undefined)
+        return undefined;
+    if (!isPlainObject(value) || Object.keys(value).some(k => !['enabled', 'directory'].includes(k))
+        || typeof value.enabled !== 'boolean' || typeof value.directory !== 'string'
+        || !value.directory || value.directory.split('/').some(p => !p || p.startsWith('.') || /[\\\x00-\x1f]/.test(p)))
+        throw new ConfigError('file_delivery requires enabled:boolean and a relative non-hidden directory');
+    return value;
+}
 /** Default wake sources when a role does not list its own. */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
 const MONITOR_KEYS = [
@@ -144,7 +153,7 @@ export const ROLE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ROLE_KEYS = [
     'harness', 'session', 'session_options', 'permissions', 'identity', 'cwd', 'coordinator', 'mission', 'persona', 'bio',
     'briefing_file', 'model', 'effort', 'model_chain', 'max_tokens', 'autocompact_pct', 'env', 'oversee', 'harness_options',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli', 'file_delivery',
 ];
 export const ROLE_PRESET_KEYS = ['mission', 'persona', 'bio', 'briefing_file'];
 export const BRAIN_PRESET_KEYS = [
@@ -153,7 +162,7 @@ export const BRAIN_PRESET_KEYS = [
 ];
 export const AGENT_KEYS = [
     'role', 'brain', 'permissions', 'identity', 'cwd', 'coordinator', 'env', 'oversee',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli', 'file_delivery',
 ];
 const AGENT_INSTANCE_KEYS = ['template', 'overrides'];
 const TEMPLATE_FORBIDDEN_KEYS = ['identity'];
@@ -199,6 +208,7 @@ export function validateBrainValue(value, file, pointer) {
 }
 /** Pure launch-boundary validation for a fully resolved temporary Agent definition. */
 export function validateEffectiveAgentTemplate(definition, id = 'room-member') {
+    validateFileDelivery(definition.file_delivery);
     const value = structuredClone(definition);
     const bad = Object.keys(value).filter(key => !AGENT_KEYS.includes(key));
     if (bad.length)
@@ -646,6 +656,7 @@ export function loadConfig(configPath, options = {}) {
             const bad = Object.keys(r).filter(k => !ROLE_KEYS.includes(k));
             if (bad.length)
                 throw new ConfigError(`${file}: role '${name}' has unknown key(s) ${bad.join(', ')}; allowed: ${ROLE_KEYS.join(', ')}`);
+            validateFileDelivery(r.file_delivery);
             const isolation = r.isolation ?? defaults.isolation;
             const session = resolveSession(r.session ?? defaults.session, file, name);
             const sessionOptions = resolveSessionOptions(defaults.session_options, r.session_options, session, file, name);

package/dist/file-delivery/reader.d.ts

@@ -0,0 +1,17 @@
+import { type FileHandle } from 'node:fs/promises';
+export declare const MAX_FILE_BYTES: number;
+export interface ExportRoot {
+    path: string;
+    dev: number;
+    ino: number;
+}
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export declare function openDirectory(path: string): Promise<FileHandle>;
+export declare function pinExportRoot(path: string): Promise<{
+    root: ExportRoot;
+    handle: FileHandle;
+}>;
+export declare function exportPath(root: ExportRoot, cwd: string, input: string): string[];
+/** Runs in the harness bridge, never in the supervisor's OS context. */
+export declare function openExportFile(root: ExportRoot, cwd: string, input: string): Promise<FileHandle>;
+export declare function ensureExportDirectory(cwd: string, directory: string): Promise<void>;

package/dist/file-delivery/reader.js

@@ -0,0 +1,94 @@
+import { constants } from 'node:fs';
+import { mkdir, open } from 'node:fs/promises';
+import { isAbsolute, relative, resolve } from 'node:path';
+export const MAX_FILE_BYTES = 20 * 1024 * 1024;
+const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export async function openDirectory(path) {
+    if (process.platform !== 'linux' || !isAbsolute(path) || path !== resolve(path))
+        throw Error('FILE_DELIVERY_REQUIRES_LINUX_ROOT');
+    let dir = await open('/', FLAGS | constants.O_DIRECTORY);
+    try {
+        for (const part of path.split('/').filter(Boolean)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        return dir;
+    }
+    catch (error) {
+        await dir.close();
+        throw error;
+    }
+}
+export async function pinExportRoot(path) {
+    const handle = await openDirectory(path);
+    try {
+        const stat = await handle.stat();
+        if (stat.uid !== process.getuid?.() || (stat.mode & 0o022))
+            throw Error('EXPORT_ROOT_NOT_PRIVATE_OWNED');
+        return { root: { path, dev: stat.dev, ino: stat.ino }, handle };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+export function exportPath(root, cwd, input) {
+    if (!input || input.length > 4096 || /[\\\x00-\x1f]/.test(input) || input.split('/').some(p => p === '.' || p === '..' || !p) && !isAbsolute(input))
+        throw Error('INVALID_EXPORT_PATH');
+    if (input.split('/').some(p => p === '..' || p === '.'))
+        throw Error('INVALID_EXPORT_PATH');
+    const path = relative(root.path, resolve(cwd, input));
+    const parts = path.split('/');
+    if (!path || isAbsolute(path) || parts.some(p => !p || p === '..' || p === '.' || p.startsWith('.') || /^(credentials?|secrets?|tokens?)(\.|$)/i.test(p)))
+        throw Error('OUTSIDE_EXPORT_DIRECTORY');
+    return parts;
+}
+/** Runs in the harness bridge, never in the supervisor's OS context. */
+export async function openExportFile(root, cwd, input) {
+    const parts = exportPath(root, cwd, input);
+    let dir = await openDirectory(root.path);
+    try {
+        const stat = await dir.stat();
+        if (stat.dev !== root.dev || stat.ino !== root.ino)
+            throw Error('EXPORT_ROOT_CHANGED');
+        for (const part of parts.slice(0, -1)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        const file = await open(`/proc/self/fd/${dir.fd}/${parts.at(-1)}`, FLAGS);
+        try {
+            const stat = await file.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || stat.size > MAX_FILE_BYTES)
+                throw Error('INVALID_EXPORT_FILE');
+            return file;
+        }
+        catch (error) {
+            await file.close();
+            throw error;
+        }
+    }
+    finally {
+        await dir.close();
+    }
+}
+export async function ensureExportDirectory(cwd, directory) {
+    let dir = await openDirectory(cwd);
+    try {
+        for (const part of directory.split('/')) {
+            if (!part || part.startsWith('.') || /[\\\x00-\x1f]/.test(part))
+                throw Error('INVALID_EXPORT_DIRECTORY');
+            const path = `/proc/self/fd/${dir.fd}/${part}`;
+            await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+                throw error; });
+            const next = await open(path, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+    }
+    finally {
+        await dir.close();
+    }
+}

package/dist/file-delivery/store.d.ts

@@ -0,0 +1,15 @@
+import type { DeliveredFile, FileDeliveryBinding } from './types.js';
+export declare function artifactDirectory(stateDir: string): string;
+export declare class ArtifactStore {
+    private readonly stateDir;
+    constructor(stateDir: string);
+    copy(source: {
+        size: number;
+        body: ReadableStream<Uint8Array>;
+        close(): Promise<void>;
+    }, name: string, mimeType: string, binding: FileDeliveryBinding, signal: AbortSignal): Promise<DeliveredFile>;
+}
+export declare function readDeliveredFile(stateDir: string, id: string): Promise<{
+    record: DeliveredFile;
+    bytes: Buffer;
+}>;

package/dist/file-delivery/store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, mkdirSync, readFileSync, readdirSync, lstatSync, openSync, fstatSync, closeSync, renameSync, writeFileSync } from 'node:fs';
+import { open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { openDirectory, MAX_FILE_BYTES } from './reader.js';
+export function artifactDirectory(stateDir) {
+    const incarnation = readFileSync(join(stateDir, '.session-id'), 'utf8').trim();
+    if (!/^[a-f0-9-]{36}$/.test(incarnation))
+        throw Error('INVALID_ROLE_INCARNATION');
+    const key = createHash('sha256').update(JSON.stringify([stateDir, incarnation])).digest('hex');
+    return join(stateRoot(), 'private-file-delivery', key);
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077)
+        throw Error('INVALID_ARTIFACT_DIRECTORY');
+}
+export class ArtifactStore {
+    stateDir;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+    }
+    async copy(source, name, mimeType, binding, signal) {
+        if (!Number.isSafeInteger(source.size) || source.size < 0 || source.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        const path = artifactDirectory(this.stateDir);
+        privateDirectory(join(stateRoot(), 'private-file-delivery'));
+        privateDirectory(path);
+        const root = await openDirectory(path);
+        const id = randomUUID(), base = `/proc/self/fd/${root.fd}/`, partial = base + id + '.part';
+        let file;
+        const reader = source.body.getReader();
+        try {
+            // Orphans count toward the same bounded quota. They are never republished.
+            const entries = readdirSync(base).filter(p => /\.(data|part)$/.test(p));
+            const bytes = entries.reduce((sum, p) => sum + lstatSync(base + p).size, 0);
+            if (entries.length >= 100 || bytes + source.size > 200 * 1024 * 1024)
+                throw Error('ARTIFACT_QUOTA_EXCEEDED');
+            file = await open(partial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            const hash = createHash('sha256');
+            let size = 0;
+            for (;;) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > source.size || size > MAX_FILE_BYTES)
+                    throw Error('SOURCE_SIZE_CHANGED');
+                hash.update(chunk.value);
+                let offset = 0;
+                while (offset < chunk.value.length) {
+                    const { bytesWritten } = await file.write(chunk.value, offset, chunk.value.length - offset);
+                    if (!bytesWritten)
+                        throw Error('SHORT_ARTIFACT_WRITE');
+                    offset += bytesWritten;
+                }
+            }
+            if (size !== source.size)
+                throw Error('SOURCE_SIZE_CHANGED');
+            signal.throwIfAborted();
+            await file.chmod(0o400);
+            await file.sync();
+            await file.close();
+            file = undefined;
+            const record = { id, name, mimeType, size, sha256: hash.digest('hex'), ...binding };
+            renameSync(partial, base + id + '.data');
+            writeFileSync(base + id + '.json', JSON.stringify(record), { flag: 'wx', mode: 0o400, flush: true });
+            // No pending-send record or recovery: a later failure leaves only unreferenced stored bytes.
+            await root.sync();
+            // The newly created incarnation directory and store root must also survive
+            // a crash before a durable conversation event can reference this file.
+            for (const parent of [join(stateRoot(), 'private-file-delivery'), stateRoot()]) {
+                const handle = await openDirectory(parent);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            return record;
+        }
+        finally {
+            await file?.close();
+            await reader.cancel().catch(() => { });
+            await source.close();
+            await unlink(partial).catch(() => { });
+            await root.close();
+        }
+    }
+}
+export async function readDeliveredFile(stateDir, id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error('ARTIFACT_NOT_FOUND');
+    const root = await openDirectory(artifactDirectory(stateDir));
+    const read = (suffix, max) => {
+        const fd = openSync(`/proc/self/fd/${root.fd}/${id}.${suffix}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+                throw Error('INVALID_STORED_ARTIFACT');
+            const bytes = readFileSync(fd);
+            if (bytes.length > max)
+                throw Error('ARTIFACT_TOO_LARGE');
+            return bytes;
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    try {
+        const record = JSON.parse(read('json', 4096).toString());
+        const bytes = read('data', MAX_FILE_BYTES);
+        if (record.id !== id || record.size !== bytes.length || record.sha256 !== createHash('sha256').update(bytes).digest('hex') || typeof record.name !== 'string')
+            throw Error('ARTIFACT_INTEGRITY_FAILED');
+        return { record, bytes };
+    }
+    finally {
+        await root.close();
+    }
+}

package/dist/file-delivery/types.d.ts

@@ -0,0 +1,19 @@
+export interface FileDeliveryBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    turnId: string;
+}
+export interface DeliveredFile extends FileDeliveryBinding {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+}
+export interface FileDeliveryInput {
+    path: string;
+    filename?: string;
+    mime?: string;
+}
+export type CopyChatFile = (binding: FileDeliveryBinding) => Promise<DeliveredFile>;
+export type SendChatFile = (input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile) => Promise<DeliveredFile>;

package/dist/file-delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/harness/claude-code.js

@@ -385,16 +385,17 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm an in-session Monitor. When such a line appears, run ' +
                 '**get_messages** to drain the mail.',
-            launchNote: name => `You were launched with \`--remote-control ${name}\`. Confirm you are running.`,
-            restartPrompt: (id, worklog, role) => `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
-                (role?.monitor?.mode === 'fleet'
-                    ? 'then continue from '
-                    : `then ${armMonitor(id)}, then continue from `) +
-                `${worklog}. Do not re-run whatever crashed you.` +
-                (role?.monitor?.mode === 'fleet'
-                    ? ' Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
-                        'do NOT arm an in-session Monitor.'
-                    : ''),
+            launchNote: name => `You were launched as Fleet role \`${name}\` under a Claude session. Announce console readiness before task details.`,
+            restartPrompt: (id, worklog, role) => role?.monitor?.mode === 'fleet'
+                ? `Session restarted. The supervisor has verified assigned identity "${id}"; ` +
+                    'accept that readiness and continue without rebinding or profile reconciliation. ' +
+                    'Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
+                    'do NOT arm an in-session Monitor. ' +
+                    'Announce console readiness first without tools, then end that readiness turn. ' +
+                    `For a separate continuation task, read ${worklog} once for continuity and reuse it in that wake. ` +
+                    'Do not re-run whatever crashed you.'
+                : `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
+                    `then ${armMonitor(id)}, then continue from ${worklog}. Do not re-run whatever crashed you.`,
         },
         exitPolicy: { cleanExitIsFresh: true, fastFailSecs: 20 },
     };

package/dist/harness/codex-app-server-proxy.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { CodexFileInventory } from './codex-file-inventory.js';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline';
@@ -446,6 +447,7 @@ export function runCodexAppServerProxy() {
             });
         }
     };
+    const inventory = process.env.FLEET_CURRENT_CHAT_FILES === '1' ? new CodexFileInventory(writeToChild, writeToClient) : undefined;
     const recovery = new CodexTerminalRecovery({
         sendToCodex: writeToChild,
         emitToClient: writeToClient,
@@ -456,6 +458,7 @@ export function runCodexAppServerProxy() {
             return;
         finished = true;
         recovery.close();
+        inventory?.close();
         input.close();
         process.stdin.destroy();
         // stdout/stderr are often pipes under Fleet and tests. Setting exitCode
@@ -488,10 +491,11 @@ export function runCodexAppServerProxy() {
             return;
         const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
-        writeToChild(rewritten);
+        if (!inventory || inventory.observeClientLine(rewritten))
+            writeToChild(rewritten);
     });
     output.on('line', line => {
-        if (!finished && recovery.observeServerLine(line))
+        if (!finished && (!inventory || inventory.observeServerLine(line)) && recovery.observeServerLine(line))
             writeToClient(line);
     });
     input.once('close', () => {

package/dist/harness/codex-file-inventory.d.ts

@@ -0,0 +1,15 @@
+export declare class CodexFileInventory {
+    private readonly sendToCodex;
+    private readonly emitToClient;
+    private checks;
+    private sequence;
+    constructor(sendToCodex: (line: string) => void, emitToClient: (line: string) => void);
+    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
+    observeClientLine(line: string): boolean;
+    observeServerLine(line: string): boolean;
+    close(): void;
+    private query;
+    private qualified;
+    private finish;
+    private reject;
+}

package/dist/harness/codex-file-inventory.js

@@ -0,0 +1,113 @@
+const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+const parse = (line) => { try {
+    const v = JSON.parse(line);
+    return object(v) ? v : undefined;
+}
+catch {
+    return undefined;
+} };
+export class CodexFileInventory {
+    sendToCodex;
+    emitToClient;
+    checks = new Map();
+    sequence = 0;
+    constructor(sendToCodex, emitToClient) {
+        this.sendToCodex = sendToCodex;
+        this.emitToClient = emitToClient;
+    }
+    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
+    observeClientLine(line) {
+        const message = parse(line);
+        if (message?.method !== 'turn/start')
+            return true;
+        const threadId = object(message.params) ? message.params.threadId : undefined;
+        if (typeof threadId !== 'string' || !threadId || message.id === undefined || this.checks.size >= 8) {
+            this.reject(message);
+            return false;
+        }
+        const check = { request: message, threadId, servers: [], cursors: new Set(), timer: setTimeout(() => {
+                for (const [id, c] of this.checks)
+                    if (c === check)
+                        this.checks.delete(id);
+                this.reject(message);
+            }, 30_000) };
+        this.query(check);
+        return false;
+    }
+    observeServerLine(line) {
+        const message = parse(line), id = message?.id;
+        if (typeof id !== 'string')
+            return true;
+        const check = this.checks.get(id);
+        if (!check)
+            return true;
+        this.checks.delete(id);
+        const result = message?.result;
+        if (!object(result) || !Array.isArray(result.data) || result.data.some(s => !object(s)) || check.servers.length + result.data.length > 1000) {
+            this.finish(check, false);
+            return false;
+        }
+        check.servers.push(...result.data);
+        if (result.nextCursor !== null) {
+            const cursor = result.nextCursor;
+            if (typeof cursor !== 'string' || !cursor || check.cursors.has(cursor) || check.cursors.size >= 10)
+                this.finish(check, false);
+            else {
+                check.cursors.add(cursor);
+                this.query(check, cursor);
+            }
+            return false;
+        }
+        this.finish(check, this.qualified(check.servers));
+        return false;
+    }
+    close() { for (const c of this.checks.values())
+        clearTimeout(c.timer); this.checks.clear(); }
+    query(check, cursor) {
+        const id = `ours-fleet-file-inventory-${++this.sequence}`;
+        this.checks.set(id, check);
+        this.sendToCodex(JSON.stringify({ id, method: 'mcpServerStatus/list', params: { threadId: check.threadId, detail: 'full', limit: 100, ...(cursor ? { cursor } : {}) } }));
+    }
+    qualified(servers) {
+        let managed = 0;
+        for (const server of servers) {
+            // Unknown or failed discovery cannot establish absence of another connector.
+            if (server.toolsError !== null || !object(server.tools))
+                return false;
+            if (!object(server.serverInfo) || typeof server.serverInfo.name !== 'string')
+                return false;
+            const tools = Object.values(server.tools).filter(object);
+            const names = new Set(tools.map(t => t.name));
+            if (server.name !== 'ours') {
+                if (server.serverInfo.name === 'ours')
+                    return false;
+                if (tools.some(t => t.name === 'send_file' && object(t.inputSchema) && object(t.inputSchema.properties) && 'contact' in t.inputSchema.properties))
+                    return false;
+                if (names.has('current_identity') && names.has('send_file') && names.has('get_messages'))
+                    return false;
+                continue;
+            }
+            managed++;
+            if (server.serverInfo.name !== 'ours' || server.runtimeStatus !== 'connected')
+                return false;
+            const files = tools.filter(t => t.name === 'send_file');
+            if (files.length !== 1 || !object(files[0].inputSchema))
+                return false;
+            const schema = files[0].inputSchema;
+            if (!object(schema.properties) || !object(schema.properties.contact) || schema.additionalProperties !== false
+                || (Array.isArray(schema.required) && schema.required.includes('contact')))
+                return false;
+        }
+        return managed === 1;
+    }
+    finish(check, allowed) {
+        clearTimeout(check.timer);
+        if (allowed)
+            this.sendToCodex(JSON.stringify(check.request));
+        else
+            this.reject(check.request);
+    }
+    reject(request) {
+        this.emitToClient(JSON.stringify({ id: request.id, error: { code: -32000, message: 'CURRENT_CHAT_DELIVERY_UNAVAILABLE: unqualified MCP inventory' } }));
+    }
+}

package/dist/harness/codex.js

@@ -262,6 +262,7 @@ function codexAcpEnvironment(role, dirs) {
     if (!source)
         throw new Error('Codex app-server proxy is missing; rebuild ours-fleet');
     writeFileSync(proxyModule, readFileSync(source, 'utf8'), { mode: 0o600 });
+    writeFileSync(join(runtimeDir, 'codex-file-inventory.js'), readFileSync(join(dirname(source), 'codex-file-inventory.js'), 'utf8'), { mode: 0o600 });
     const windows = process.platform === 'win32';
     const command = join(runtimeDir, windows ? 'codex-app-server-proxy.cmd' : 'codex-app-server-proxy');
     const script = windows
@@ -482,7 +483,7 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
                     catch (error) {
                         throw new Error(`Codex ACP runtime check failed: ${error.message}; check CODEX_PATH or reinstall Fleet with optional dependencies`);
                     }
-                    const minimum = role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
+                    const minimum = role.file_delivery?.enabled ? '0.159.0' : role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
                         ? '0.153.3' : '0.145.0';
                     if (!codexVersionAtLeast(runtime.version, minimum))
                         throw new Error(`${role.model ?? 'Codex ACP'} requires a newer Codex (>=${minimum}): ACP selects ${runtime.executable} (${runtime.version}); upgrade Fleet or set CODEX_PATH to a supported executable in the agent/service environment`);
@@ -621,12 +622,15 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm arm_monitor or foreground_monitor. When such a line ' +
                 'appears, call **get_messages**, handle the mail, and reply with send_message.',
-            launchNote: name => `You were launched as the fleet role \`${name}\` under a Codex session. Confirm you are running.`,
+            launchNote: name => `You were launched as the fleet role \`${name}\` under a Codex session. Announce console readiness before task details.`,
             restartPrompt: (id, worklog, configuredRole) => {
                 if (configuredRole?.monitor?.mode === 'fleet')
-                    return `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true); ` +
-                        'your mail wakes are delivered by the fleet supervisor as `[fleet-monitor]` console lines, so do ' +
-                        `NOT arm arm_monitor/foreground_monitor. Continue from ${worklog}. Do not re-run whatever crashed you.`;
+                    return `Session restarted. The supervisor has verified assigned identity "${id}"; ` +
+                        'accept that readiness and continue without rebinding or profile reconciliation. ' +
+                        'Mail wakes arrive as `[fleet-monitor]` lines; do NOT arm arm_monitor/foreground_monitor. ' +
+                        'Announce console readiness first without tools, then end that readiness turn. ' +
+                        `For a separate continuation task, read ${worklog} once for continuity and reuse it in that wake. ` +
+                        'Do not re-run whatever crashed you.';
                 const consented = configuredRole?.harness_options?.monitor === true;
                 return `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
                     (consented

package/dist/isolation/policy.js

@@ -1,3 +1,4 @@
+import { stateRoot } from '../paths.js';
 import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { BACKENDS, ON_UNAVAILABLE, NETWORK_MODES, } from './types.js';
@@ -57,7 +58,7 @@ const SYSTEM_RO = ['/usr', '/bin', '/sbin', '/lib', '/lib64', '/etc'];
 /** Ephemeral scratch mounts. */
 const scratchTmpfs = (home) => ['/tmp', join(home, '.cache')];
 /** Home-relative sensitive paths never exposed (the blocklist's teeth). */
-const SENSITIVE_HOME = ['.ssh', '.aws', '.docker', '.gnupg', '.ours', 'fleet.yaml', 'fleet.d'];
+const SENSITIVE_HOME = ['.ssh', '.aws', '.docker', '.gnupg', '.ours', '.ours-fleet/private-ours', '.ours-fleet/private-file-delivery', 'fleet.yaml', 'fleet.d'];
 const ISOLATION_KEYS = ['backend', 'on_unavailable', 'fs', 'network', 'allow_hosts', 'resources', 'secrets'];
 const FS_KEYS = ['read', 'write'];
 const RESOURCE_KEYS = ['cpu', 'mem', 'pids'];
@@ -189,6 +190,8 @@ export function resolveIsolation(cfg, ctx) {
     const agentsRoot = dirname(stateDir);
     const blocklist = [
         ...SENSITIVE_HOME.map(p => join(home, p)),
+        join(stateRoot(), 'private-ours'),
+        join(stateRoot(), 'private-file-delivery'),
         agentsRoot, // sibling agents' state dirs (this agent's own is explicitly mounted)
     ];
     // ENFORCE the list, before anything builds a backend argv. Until now it was

package/dist/monitor.d.ts

@@ -28,6 +28,10 @@ export type FetchLike = (url: string, init?: {
     signal?: AbortSignal;
 }) => Promise<FetchResponse>;
 export interface MonitorPageClient {
+    /** Body-free snapshot; never consumes messages or changes read status. */
+    unread(): Promise<{
+        identities: Array<Record<string, unknown>>;
+    }>;
     readNotificationPage(identity: string, options?: {
         since?: number | 'tip';
         signal?: AbortSignal;
@@ -179,6 +183,7 @@ export declare class Monitor {
     private stopped;
     private bootDeadline;
     private currentAbort;
+    private initialBacklogPending;
     private apiErrorStreak;
     private readonly turnFailThreshold;
     /** Active degradations, keyed by cause. Empty means armed. */
@@ -198,6 +203,7 @@ export declare class Monitor {
     /** Gather stragglers arriving within batch_ms so a burst lands as one line. */
     private coalesce;
     private deliver;
+    private deliverLine;
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     private recordTurn;
     /**
@@ -210,6 +216,7 @@ export declare class Monitor {
      */
     private doFetch;
     private profileClient;
+    private readInitialUnread;
     private disposeProfileClient;
     private advance;
     private persistCursor;