@ours.network/fleet 1.2.0-nightly.52 → 1.2.0-nightly.54

package/dist/session/acp.d.ts

@@ -1,3 +1,4 @@
+import type { FileDeliveryInput, CopyChatFile, DeliveredFile } from '../file-delivery/types.js';
 import { type TaskNoticeBinding, type TaskCreatedNotice } from './task-notice.js';
 import * as acp from '@agentclientprotocol/sdk';
 import type { CommonPermissions } from '../config.js';
@@ -176,6 +177,7 @@ export declare class AcpSession implements AgentSession {
     private stallTimer?;
     private stallAttempt?;
     private readonly toolBoundaryWaiters;
+    private fileExportBusy;
     private activeTurn?;
     private constructor();
     static start(options: AcpSessionOptions): Promise<AcpSession>;
@@ -303,6 +305,8 @@ export declare class AcpSession implements AgentSession {
      */
     private settlePendingAutomatically;
     exitResult(): ExitRecord | null;
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    sendFileToChat(input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile, policy: CommonPermissions): Promise<DeliveredFile>;
     close(): Promise<void>;
     /** ACP requires the field. Bundled agents treat [] as no client-added servers. */
     private declaredMcpServers;

package/dist/session/acp.js

@@ -278,6 +278,7 @@ export class AcpSession {
     stallTimer;
     stallAttempt;
     toolBoundaryWaiters = new Set();
+    fileExportBusy = false;
     activeTurn;
     constructor(options, child, connection) {
         this.options = options;
@@ -823,6 +824,8 @@ export class AcpSession {
         if (!this.sessionId)
             return;
         const active = this.activeTurn;
+        if (active)
+            active.fileDeliveryRevoked = true;
         const previousSource = active?.cancellationSource;
         if (active && (source === 'owner' || source === 'local-console' || !previousSource))
             active.cancellationSource = source;
@@ -1026,6 +1029,54 @@ export class AcpSession {
     exitResult() {
         return this.exit;
     }
+    /** One attempt, tied to the managed live turn captured before any approval/read. */
+    async sendFileToChat(input, signal, copy, policy) {
+        const active = this.activeTurn, sessionId = this.sessionId;
+        const check = () => {
+            signal.throwIfAborted();
+            if (!active || !sessionId || this.activeTurn !== active || this.sessionId !== sessionId || active.fileDeliveryRevoked
+                || active.cancellationSource || this.closing || !this.isAlive() || this.replaying || this.steeringOccupied
+                || active.origin?.kind === 'scheduled-loop' || policy.approval === 'deny')
+                throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
+        };
+        check();
+        if (this.fileExportBusy)
+            throw Error('FILE_DELIVERY_BUSY');
+        this.fileExportBusy = true;
+        const toolCallId = 'fleet-file-export-' + randomUUID();
+        try {
+            const onAbort = () => {
+                for (const [id, pending] of this.pendingPermissions)
+                    if (pending.toolCallId === toolCallId)
+                        this.settlePendingAutomatically(id, pending, 'cancelled', undefined, 'File send cancelled');
+            };
+            signal.addEventListener('abort', onAbort, { once: true });
+            let answer;
+            try {
+                answer = await this.requestPermission({ sessionId: sessionId, toolCall: {
+                        toolCallId, title: 'Send file to this ACP chat: ' + (input.filename ?? input.path), kind: 'read', status: 'pending',
+                        locations: [{ path: resolve(this.options.cwd, input.path) }],
+                    }, options: [{ optionId: 'send', name: 'Send file', kind: 'allow_once' }, { optionId: 'deny', name: 'Do not send', kind: 'reject_once' }] }, policy);
+            }
+            finally {
+                signal.removeEventListener('abort', onAbort);
+            }
+            check();
+            if (answer.outcome.outcome !== 'selected' || answer.outcome.optionId !== 'send')
+                throw Error('FILE_SEND_DENIED');
+            const attachment = await copy({ sessionGeneration: this.sessionGeneration, acpSessionId: sessionId, turnId: active.id });
+            // Synchronous check + durable append establishes order with cancellation/stop.
+            // No await, pending-send journal, replay or recovery exists after this point.
+            check();
+            this.conversation.append({ kind: 'file.attached', source: 'agent', sessionGeneration: this.sessionGeneration,
+                acpSessionId: sessionId, promptId: active.id, turnId: active.id, payload: { attachment } });
+            return attachment;
+        }
+        finally {
+            this.releaseTool(toolCallId);
+            this.fileExportBusy = false;
+        }
+    }
     async close() {
         this.closing = true;
         if (this.stallTimer)
@@ -1414,6 +1465,8 @@ export class AcpSession {
     }
     async steerPrompt(text) {
         this.steeringWasUsed = true;
+        if (this.activeTurn)
+            this.activeTurn.fileDeliveryRevoked = true;
         if (!this.sessionId || !this.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'ACP session is offline');
         this.steeringRequests++;
@@ -1445,7 +1498,7 @@ export class AcpSession {
             this.steeringRequests--;
         }
     }
-    requestPermission(params) {
+    requestPermission(params, neutralPolicy) {
         // `kinds` is a PRIORITY order. Scanning the agent's option array instead
         // (`options.find(o => kinds.includes(o.kind))`) hands the choice to whatever
         // order the agent happened to list, which is exactly how an automatic denial
@@ -1463,7 +1516,7 @@ export class AcpSession {
         // Permission is part of the tool lifecycle. Reserve before any policy or
         // human decision so a monitor wake cannot slip between request and answer.
         this.reservePermission(toolCallId, permissionId);
-        if (this.isEffectiveCodexProtectedMcpApproval(params)) {
+        if (!neutralPolicy && this.isEffectiveCodexProtectedMcpApproval(params)) {
             // Protected MCP approval is already the tool's narrow gate. Never turn
             // this one decision into an adapter-wide standing grant.
             const option = choose(['allow_once']);
@@ -1474,9 +1527,9 @@ export class AcpSession {
                 this.releasePermission(toolCallId, permissionId);
             return Promise.resolve(response);
         }
-        if (this.options.permissions.approval === 'allow' && this.withinAutomaticBoundary(params)) {
+        if ((neutralPolicy ?? this.options.permissions).approval === 'allow' && this.withinAutomaticBoundary(params, neutralPolicy)) {
             const option = choose(['allow_always', 'allow_once']);
-            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${this.options.permissions.filesystem} boundary`);
+            const response = this.settleAutomatically(params, option, 'allowed', 'permissions.approval=allow', `the request is inside the ${(neutralPolicy ?? this.options.permissions).filesystem} boundary`);
             if (option)
                 this.allowPermission(toolCallId, permissionId);
             else
@@ -1486,8 +1539,8 @@ export class AcpSession {
         // A live grace window still counts as attended: the controller may be
         // mid-reconnect, and denying instantly is exactly what the grace prevents.
         const unattended = this.controllerCount === 0 && !this.controllerGrace
-            && this.options.permissions.unattended === 'deny';
-        if (this.options.permissions.approval === 'deny' || unattended) {
+            && (neutralPolicy ?? this.options.permissions).unattended === 'deny';
+        if ((neutralPolicy ?? this.options.permissions).approval === 'deny' || unattended) {
             // reject_once FIRST: `reject_always` teaches the agent a standing rule from
             // a decision no human made, so one unattended denial would silently disable
             // the tool for the rest of the session.
@@ -1588,8 +1641,8 @@ export class AcpSession {
             ? { outcome: { outcome: 'selected', optionId: option.optionId } }
             : { outcome: { outcome: 'cancelled' } };
     }
-    withinAutomaticBoundary(params) {
-        const filesystem = this.options.permissions.filesystem;
+    withinAutomaticBoundary(params, policy) {
+        const filesystem = (policy ?? this.options.permissions).filesystem;
         if (filesystem === 'unrestricted')
             return true;
         if (filesystem === 'read-only' && params.toolCall.kind !== 'read')

package/dist/session/conversation-types.d.ts

@@ -8,7 +8,7 @@ import type { PromptOrigin, TurnCancellationSource, TurnOutcome } from './types.
  * file touches the wire: transport updates are reduced into these shapes by a
  * session adapter, and the store assigns `seq`/`eventId`/timestamps.
  */
-export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
+export type ConversationEventKind = 'prompt.admitted' | 'prompt.started' | 'prompt.interrupt_requested' | 'message.chunk' | 'message.replace' | 'thought.chunk' | 'thought.replace' | 'plan.replace' | 'tool.upsert' | 'tool.content_chunk' | 'permission.requested' | 'permission.resolved' | 'file.attached' | 'fleet.task_created' | 'monitor.delivery' | 'usage.updated' | 'turn.state' | 'turn.completed' | 'session.state' | 'session.info' | 'capabilities.updated' | 'error'
 /** A well-formed transport update this version cannot represent. Bounded, never a crash. */
  | 'unsupported';
 /** Where a conversation record came from. Typed provenance, never prompt text. */
@@ -228,7 +228,9 @@ export interface BoundedJson {
     digest?: string;
     redacted?: true;
 }
-export type ConversationPayload = MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
+export type ConversationPayload = {
+    attachment: import('../file-delivery/types.js').DeliveredFile;
+} | MessageChunkPayload | ThoughtChunkPayload | PlanReplacePayload | ToolUpsertPayload | UsageUpdatedPayload | SessionStatePayload | SessionInfoPayload | CapabilitiesUpdatedPayload | UnsupportedPayload | PromptAdmittedPayload | PromptStartedPayload | PromptInterruptRequestedPayload | PermissionRequestedPayload | PermissionResolvedPayload | TurnStatePayload | TurnCompletedPayload | MonitorDeliveryPayload | SessionLifecyclePayload | ErrorPayload | TaskCreatedNotice;
 export interface ConversationEventV1 {
     schemaVersion: 1;
     roleId: string;

package/dist/session/types.d.ts

@@ -284,6 +284,7 @@ export interface ConversationHandlePage {
  * on any concrete transport which implements it.
  */
 export interface AgentSession {
+    sendFileToChat?: (input: import('../file-delivery/types.js').FileDeliveryInput, signal: AbortSignal, copy: import('../file-delivery/types.js').CopyChatFile, policy: import('../config.js').CommonPermissions) => Promise<import('../file-delivery/types.js').DeliveredFile>;
     readonly backend: SessionBackendId;
     readonly pid: number;
     /** Live capabilities; optional only for source compatibility with external adapters. */

package/dist/startup-prompt.d.ts

@@ -0,0 +1,4 @@
+/** Readiness is a separate turn after identity/profile and room admission succeed. */
+export declare function managedStartupPrompt(stateDir: string, mode: 'fresh' | 'resume', hasPriorBoot?: boolean): string;
+/** Configured work/continuity runs after readiness, never inside the fast turn. */
+export declare function managedTaskPrompt(stateDir: string, mode: 'fresh' | 'resume', hasPriorBoot?: boolean): string;

package/dist/startup-prompt.js

@@ -0,0 +1,36 @@
+import { join } from 'node:path';
+/** Readiness is a separate turn after identity/profile and room admission succeed. */
+export function managedStartupPrompt(stateDir, mode, hasPriorBoot = false) {
+    const briefing = join(stateDir, 'briefing.md');
+    const continuity = mode === 'resume' || hasPriorBoot
+        ? ` For a later continuation task, read ${join(stateDir, 'WORKLOG.md')} once for continuity.`
+        : '';
+    return 'Fleet readiness check. The supervisor has verified your assigned identity, configured Role profile, '
+        + 'and any required room admission. Reply with a short final console acknowledgement that you are ready, '
+        + 'then end this turn. Announce readiness before any tool calls or file reads. '
+        + 'Do not read briefing, routines, worklog, inbox, history, help or config during this readiness turn; '
+        + 'do not perform identity/profile setup or broad tool discovery. Do not claim task work has been done. '
+        + 'The supervisor delivers configured work separately; otherwise wait for a concrete task or supervisor wake. '
+        + `For a later task or mail wake, read ${briefing} once before acting and reuse it within that wake. `
+        + 'Read routines only for concrete work; an idle launch needs no detail reads. '
+        + 'The supervisor delivers initial unread mail and later arrivals as wakes; do not poll the inbox at startup.'
+        + continuity;
+}
+/** Configured work/continuity runs after readiness, never inside the fast turn. */
+export function managedTaskPrompt(stateDir, mode, hasPriorBoot = false) {
+    const briefing = join(stateDir, 'briefing.md');
+    const continuity = mode === 'resume' || hasPriorBoot
+        ? ` Read ${join(stateDir, 'WORKLOG.md')} once for continuity.`
+        : '';
+    return `Read and follow ${briefing} for the assigned work. Readiness has already been announced; `
+        + 'this is a separate task turn, so do not repeat the readiness acknowledgement.' + continuity + ' '
+        + 'Identify the concrete assignment in the briefing or unfinished work in the continuation log. '
+        + 'A role charter or public bio alone is not a new task. If there is no concrete work, end this turn '
+        + 'and await a task without reading routines, inbox, history, or unrelated files. '
+        + 'For concrete work, read any existing routines once, reuse details already read in this wake, '
+        + 'acknowledge the actual task and next action through its assigned reply route, and proceed. '
+        + (mode === 'fresh' && !hasPriorBoot ? 'On a fresh launch, do not read a worklog for initialization. ' : '')
+        + 'Use inbox/history only when a mail wake, unread pagination, or the actual task needs them. '
+        + 'The supervisor delivers initial unread mail; no model-owned startup poll is needed. '
+        + 'Identity/profile setup, help/config exploration and broad tool discovery are not startup rituals.';
+}

package/dist/startup-telemetry.d.ts

@@ -0,0 +1,16 @@
+import type { ConversationEventV1 } from './session/conversation-types.js';
+/** Body-free startup diagnostics. First output is an observation, not proof of useful work. */
+export declare class StartupTelemetry {
+    private readonly now;
+    private readonly log;
+    private readonly started;
+    private promptAt?;
+    private promptId?;
+    private firstOutput;
+    private completed;
+    private readonly tools;
+    constructor(now: () => number, log: (line: string) => void);
+    mark(stage: 'supervisor_started' | 'identity_prepare_started' | 'identity_ready' | 'harness_starting' | 'harness_ready' | 'startup_submitted' | 'readiness_turn_completed'): void;
+    observe(event: ConversationEventV1): void;
+    finish(): void;
+}

package/dist/startup-telemetry.js

@@ -0,0 +1,46 @@
+/** Body-free startup diagnostics. First output is an observation, not proof of useful work. */
+export class StartupTelemetry {
+    now;
+    log;
+    started;
+    promptAt;
+    promptId;
+    firstOutput = false;
+    completed = false;
+    tools = new Set();
+    constructor(now, log) {
+        this.now = now;
+        this.log = log;
+        this.started = now();
+    }
+    mark(stage) {
+        const at = this.now();
+        if (stage === 'startup_submitted')
+            this.promptAt = at;
+        this.log(`startup stage=${stage} elapsed_ms=${Math.max(0, at - this.started)}`);
+    }
+    observe(event) {
+        if (this.promptAt === undefined || this.completed || event.source === 'agent_replay')
+            return;
+        if (event.kind === 'prompt.started' && event.source === 'startup')
+            this.promptId = event.promptId;
+        if (this.promptId && event.promptId && event.promptId !== this.promptId)
+            return;
+        if (event.kind === 'tool.upsert' && 'toolCallId' in event.payload && event.payload.toolCallId)
+            this.tools.add(event.payload.toolCallId);
+        if (!this.firstOutput && ['message.chunk', 'message.replace'].includes(event.kind)
+            && 'role' in event.payload && event.payload.role === 'assistant'
+            && 'content' in event.payload && event.payload.content.type === 'text'
+            && event.payload.content.text.trim()) {
+            this.firstOutput = true;
+            const at = this.now();
+            this.log(`startup stage=first_assistant_output elapsed_ms=${Math.max(0, at - this.started)} model_and_tools_ms=${Math.max(0, at - this.promptAt)} tools=${this.tools.size}`);
+        }
+    }
+    finish() {
+        if (this.completed)
+            return;
+        this.completed = true;
+        this.log(`startup stage=turn_settled elapsed_ms=${Math.max(0, this.now() - this.started)} tools=${this.tools.size} first_output=${this.firstOutput}`);
+    }
+}

package/dist/web/server.js

@@ -1,3 +1,5 @@
+import { conversationHasAttachment } from '../application/conversation-history.js';
+import { readDeliveredFile } from '../file-delivery/store.js';
 import { WorkspaceDeviceAuthError } from './workspace-devices.js';
 import { readFileSync } from 'node:fs';
 import { packagedPresetRoot } from '../preset-bootstrap.js';
@@ -756,6 +758,28 @@ export async function buildWebServer(services, boundary, options = {}) {
         const page = await control.conversationPage({ after: request.query.after, limit });
         return { ...page, events: page.events.map(present) };
     });
+    app.get('/api/v1/roles/:id/artifacts/:artifactId', async (request, reply) => {
+        auth.authenticate(request);
+        const role = await services.repository.get(request.params.id);
+        if (!role)
+            throw new FleetError('role_not_found', 'Agent not found');
+        const stateDir = services.repository.stateDir(role);
+        if (!stateDir)
+            throw new FleetError('resource_not_found', 'Agent file not found');
+        try {
+            const { record, bytes } = await readDeliveredFile(stateDir, request.params.artifactId);
+            if (!await conversationHasAttachment(stateDir, record))
+                throw Error('ARTIFACT_NOT_PUBLISHED');
+            reply.header('Cache-Control', 'private, no-store');
+            reply.header('X-Content-Type-Options', 'nosniff');
+            reply.header('Content-Security-Policy', "default-src 'none'; sandbox");
+            reply.header('Content-Disposition', `attachment; filename*=UTF-8''${encodeURIComponent(record.name).replace(/'/g, '%27')}`);
+            return reply.type('application/octet-stream').send(bytes);
+        }
+        catch {
+            throw new FleetError('resource_not_found', 'Agent file unavailable');
+        }
+    });
     app.get('/api/v1/roles/:id/attachments/:attachmentId', async (request, reply) => {
         auth.authenticate(request);
         const role = await services.repository.get(request.params.id);

package/docs/acp-files.md

@@ -0,0 +1,102 @@
+# Sending files in an ACP chat
+
+An opted-in managed Agent uses the existing Ours `send_file` tool:
+
+```json
+{"path":"deliverables/report.pdf"}
+```
+
+Omitting `contact` sends to the current ACP chat. Supplying a non-empty contact
+keeps ordinary Ours delivery:
+
+```json
+{"contact":"Alice","path":"deliverables/report.pdf"}
+```
+
+Only an absent contact chooses the chat. Null, empty or whitespace-only contacts,
+unknown fields and unknown recipients fail without falling back to chat. Outside
+opt-in, contact remains required. Current-chat sending accepts `path`, optional
+`filename` and `mime`; inline base64 and Ours reply fields are unsupported.
+
+Each call makes one attempt. Failures are returned to the agent. There is no
+request ID, deduplication, automatic retry or recovery of failed sends. If a user
+asks to resend, another tool call makes a new attempt and can produce another
+attachment. UUIDs identify stored attachments; the stored SHA-256 checks integrity.
+Neither is a retry key.
+
+Set this on the Agent definition, not manifest defaults or a Brain:
+
+```yaml
+file_delivery:
+  enabled: true
+  directory: deliverables
+```
+
+The tool description advertises this directory and the 20 MiB limit to the Agent.
+The directory is a non-hidden subtree of the Agent's working directory. Both
+routes interpret relative paths from that working directory; absolute paths keep
+their usual meaning. Chat sending additionally enforces the export directory.
+The Agent should finish writing the file before calling `send_file`. Symlinks,
+hardlinks, hidden/credential paths, changed files and files over 20 MiB fail.
+
+Initial support requires Linux, the managed Ours connector, a stock Codex or
+Claude ACP adapter, and a tracked active turn. Idle, scheduled, steered, cancelled,
+replaced and unsupported sessions cannot export. Existing native tool approval
+and the neutral role permission policy both apply before bytes are read. An
+`ask` decision needs an attached controller; `deny` refuses. A native policy that
+refuses MCP execution (including Codex `never` without a native tool allowance)
+can still refuse before Fleet receives the call.
+
+Codex requires native runtime 0.159.0 or newer and Fleet's managed App Server
+proxy. Before each turn, its public exact-thread, paginated MCP inventory must
+show a connected managed `ours` with the expected optional-contact schema.
+Ours aliases, filtered aliases, ambiguous identity, failed discovery and an
+incompatible schema make the turn unavailable. Unrelated identified tools are
+preserved. Explicitly disabled Ours is rejected before replacement. Inherited
+TOML MCP settings, including project/profile sources, are conservatively
+unsupported until their disabling semantics can be qualified before replacement.
+Use a clean Codex configuration home for this initial opt-in.
+
+Claude ACP 0.63.0's installed wrapper has no public same-session inventory RPC. Initial
+support therefore requires an operator's explicit restricted MCP configuration:
+
+```yaml
+harness_options:
+  mcp_servers_only: true
+  mcp_servers:
+    ours: { command: ours-mcp, args: [proxy] }
+```
+
+Fleet replaces that connector with its bound bridge. Additional explicit MCP
+servers and custom ACP commands are unsupported for this feature. Default-off
+Agents retain their existing configuration.
+
+Successful sends copy complete bytes into private immutable storage and append a
+server-origin `file.attached` event containing the actual session generation,
+ACP session and managed turn. One export can run at a time. Cancellation or
+steering before publication revokes it; cancellation after publication does not
+undo it. Unpublished stored bytes are never replayed or republished. Storage is
+bounded to 100 files and 200 MiB per role incarnation, including incomplete and
+orphaned copies. Exhausted storage fails; no automatic recovery is performed.
+
+The App renders persisted file cards from these typed events. HTML and images
+also download as files. Downloads require authentication, the matching role
+incarnation, a published conversation event and intact bytes. Deleted, missing,
+changed or orphaned artifacts return unavailable. Remote workspaces fetch bytes
+using their existing device credential, limit the read to 20 MiB and prevent
+saving after a workspace change.
+
+## Release prerequisite and qualification
+
+This source requires the companion MCP implementation's
+`MANAGED_FILE_DELIVERY_VERSION = 1`. Fleet pins published
+`@ours.network/mcp@1.2.0-nightly.13`, which includes it. Older MCP packages without
+this capability fail closed when file delivery is enabled. Changes to the MCP
+pin require clean installed-package qualification without a built MCP overlay.
+
+The deterministic native fixture uses real ACP adapters, the real managed
+connector and an isolated daemon. A local scripted provider supplies only tool
+intents; approval, read, copy, publication and bytes come from the implementation.
+It does not qualify external-model inference, deployment or arbitrary native
+MCP request-to-ACP tool-call ID mapping. Correlation is the authenticated bridge
+and the actual active Fleet turn, which is revoked by cancellation/steering.

package/docs/task-workspaces.md

@@ -80,6 +80,37 @@ any remaining original archive and still refuse replacement live member state
 or a recreated identity even after the archive has been consumed. Failed deletion
 remains retryable with its recorded error.
 
+Explicit deletion restores missing owner read/write/traversal bits on real
+directories inside a proven owned workspace or retired archive before the Git
+audit and removal. This handles restrictive artifacts left by tests even when
+they belong to the same Unix user. It adds no group/other access, follows no
+artifact symlinks, crosses no mounted device boundary, and never changes the
+owner. Only Git pointer files that the audit must read may gain owner-read;
+hardlinked unreadable pointers are refused to avoid changing an outside alias.
+Permission changes target a verified open inode. Readable foreign-UID directories
+may be traversed unchanged; missing owner access is never repaired for another
+UID. On Linux, traversal and Git pointer reads use pinned directory/file
+descriptors, and a detected pathname replacement stops cleanup before descending.
+Unreadable entries
+use an `O_PATH` descriptor through `/proc/self/fd`; other platforms retain the
+error if they cannot open the entry safely. A restricted workspace root is
+temporarily accessible to verify its exact ownership marker; failed marker
+verification restores its original mode. Partial token-derived deletion
+tombstones resume directory cleanup without re-reading already-removed Git
+metadata. List, show, and ordinary Git audit do not repair permissions.
+
+An accepted deletion is hidden from ordinary task lists while cleanup settles.
+Use `ours-fleet task list --include-deleting --json` (or the API's
+`includeDeleting=true`) to include retained cleanup intents, and `task show ID`
+to see pending/error/retry information. Disappearance from the ordinary list is
+not proof of completed deletion; successful deletion removes the task record
+after workspace and member cleanup.
+Cowork HTTP transport failures record the RPC method, failing stage and a
+bounded error category in the cleanup intent. Credential rejection remains an
+explicit `unauthorized` protocol error. Transport diagnostics do not include
+request bodies, credentials, URLs or raw exception text, and failed mutations
+are never automatically replayed.
+
 Deletion rejects traversal, foreign recorded paths, changed markers and symlinked
 workspace ancestors. Ordinary artifact symlinks are unlinked without following
 their targets. Git control symlinks and foreign pointers are refused. As with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.52",
+  "version": "1.2.0-nightly.54",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -22,7 +22,8 @@
     "docs/live-voice.md",
     "docs/room-layouts.md",
     "docs/validation/managed-cli-permissions.md",
-    "LICENSE"
+    "LICENSE",
+    "docs/acp-files.md"
   ],
   "engines": {
     "node": ">=22.13.0"
@@ -43,7 +44,7 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
     "@ours.network/cli": "2.8.1-nightly.15",
-    "@ours.network/mcp": "1.2.0-nightly.12",
+    "@ours.network/mcp": "1.2.0-nightly.13",
     "@ours.network/sdk": "3.8.1-nightly.17",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",