@ours.network/fleet 1.2.0-nightly.53 → 1.2.0-nightly.54

package/README.md

@@ -1920,3 +1920,5 @@ Prerelease rollout requires this Fleet capability to be published first, then th
 installer's normal generated version/integrity lock updated, then installer and
 App released. The currently pinned Fleet nightly.41 does not support v2 grants.
 These source changes do not publish, merge, or deploy any component.
+
+See [ACP file sending](docs/acp-files.md) for the opt-in same-chat `send_file` flow and supported configurations.

package/dist/agent-ours/bridge.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { openExportFile } from '../file-delivery/reader.js';
 import { createHash } from 'node:crypto';
 import { connect } from 'node:net';
 import { access, mkdir, open, readFile } from 'node:fs/promises';
@@ -71,7 +72,7 @@ export async function runBridge(descriptorPath) {
                         value = false;
                     }
                 }
-                else if (op === 'read-open' || op === 'write-open') {
+                else if (op === 'read-open' || op === 'write-open' || op === 'export-open') {
                     if (handles.size >= 32 ||
                         typeof args.handle !== 'string' ||
                         handles.has(args.handle) ||
@@ -80,8 +81,9 @@ export async function runBridge(descriptorPath) {
                     const path = resolve(args.path);
                     if (op === 'write-open')
                         await mkdir(dirname(path), { recursive: true });
-                    const file = await open(path, op === 'write-open' ? 'w' : 'r');
-                    handles.set(args.handle, { file, call, write: op === 'write-open' });
+                    const file = op === 'export-open' ? await openExportFile(args.root, process.cwd(), args.path) : await open(path, op === 'write-open' ? 'w' : 'r');
+                    const stat = await file.stat();
+                    handles.set(args.handle, { file, call, write: op === 'write-open', ...(op === 'export-open' ? { original: { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs } } : {}) });
                     value =
                         op === 'write-open'
                             ? path
@@ -105,6 +107,11 @@ export async function runBridge(descriptorPath) {
                             value = null;
                         }
                         else if (op === 'read' && !row.write) {
+                            if (row.original) {
+                                const stat = await row.file.stat();
+                                if (!stat.isFile() || stat.nlink !== 1 || stat.size !== row.original.size || stat.mtimeMs !== row.original.mtimeMs || stat.ctimeMs !== row.original.ctimeMs)
+                                    throw Error('EXPORT_SOURCE_CHANGED');
+                            }
                             const buffer = Buffer.alloc(MAX_CHUNK_BYTES);
                             const { bytesRead } = await row.file.read(buffer);
                             value = bytesRead ? buffer.subarray(0, bytesRead).toString('base64') : null;

package/dist/agent-ours/file-rpc.d.ts

@@ -1,3 +1,4 @@
+import type { ExportRoot } from '../file-delivery/reader.js';
 import type { FileExecutionContext } from '@ours.network/mcp/server';
 import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
 import { type Wire } from './wire.js';
@@ -16,6 +17,13 @@ export declare class FileCallbacks implements FileExecutionContext {
         body: ReadableStream<Uint8Array<ArrayBufferLike>>;
         close: () => Promise<void>;
     }>;
+    readExport(path: string, root: ExportRoot, extra: ToolRequestExtra): Promise<{
+        filename: any;
+        size: any;
+        body: ReadableStream<Uint8Array<ArrayBufferLike>>;
+        close: () => Promise<void>;
+    }>;
+    private openRead;
     write(path: string, body: ReadableStream<Uint8Array>, extra: ToolRequestExtra): Promise<{
         path: string;
         size: number;

package/dist/agent-ours/file-rpc.js

@@ -59,14 +59,24 @@ export class FileCallbacks {
         return (await this.rpc(String(extra.requestId), 'probe', { path }, extra.signal)) === true;
     }
     async read(path, extra) {
+        return this.openRead(path, extra);
+    }
+    async readExport(path, root, extra) {
+        return this.openRead(path, extra, root);
+    }
+    async openRead(path, extra, root) {
         const call = String(extra.requestId), handle = randomUUID();
-        const meta = await this.rpc(call, 'read-open', { path, handle }, extra.signal);
+        const meta = await this.rpc(call, root ? 'export-open' : 'read-open', { path, handle, ...(root ? { root } : {}) }, extra.signal);
         if (!meta ||
             typeof meta.filename !== 'string' ||
             !Number.isSafeInteger(meta.size) ||
             meta.size < 0)
             throw Error('INVALID_FILE_METADATA');
+        let closed = false;
         const close = async () => {
+            if (closed)
+                return;
+            closed = true;
             await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
         };
         const body = new ReadableStream({

package/dist/agent-ours/harness.js

@@ -1,10 +1,13 @@
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { resolveBundledAcpAgent } from '../harness/acp-agent.js';
 /** Do not pass the supervisor's ours connection credentials to harness children. */
 export function managedChildEnvironment(input) {
     const out = {};
     for (const [key, value] of Object.entries(input)) {
-        if (value === undefined || (/^OURS_/i.test(key) && !key.startsWith('OURS_FLEET_')))
+        if (key === 'FLEET_CURRENT_CHAT_FILES' || value === undefined || (/^OURS_/i.test(key) && !key.startsWith('OURS_FLEET_')))
             continue;
         out[key] = value;
     }
@@ -13,6 +16,9 @@ export function managedChildEnvironment(input) {
 }
 /** Replace ours only; retain the user's ordinary harness configuration and plugins. */
 export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
+    const child = managedChildEnvironment({ ...process.env, ...env });
+    if (role.file_delivery?.enabled)
+        qualifyFileHarness(role, cwd, child);
     const bridge = fileURLToPath(new URL('./bridge.js', import.meta.url));
     const server = {
         name: 'ours',
@@ -37,7 +43,6 @@ export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
         },
         plugins: { 'ours@ours-codex-marketplace': { enabled: false } },
     };
-    const child = managedChildEnvironment({ ...process.env, ...env });
     if (role.harness === 'codex') {
         const config = child.CODEX_CONFIG ? JSON.parse(child.CODEX_CONFIG) : {};
         child.CODEX_CONFIG = JSON.stringify({
@@ -70,3 +75,42 @@ export function managedClaudeMeta(base) {
         },
     };
 }
+/** Bounded stock-adapter support; opt-in never silently erases unrelated tools. */
+function qualifyFileHarness(role, cwd, child) {
+    if (process.platform !== 'linux')
+        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: Linux required');
+    if (role.session !== 'acp' || role.session_options?.acp?.command)
+        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: stock ACP adapter required');
+    if (role.harness === 'claude-code') {
+        if (resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').version !== '0.63.0')
+            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: qualified Claude ACP 0.63.0 required');
+        const options = role.harness_options ?? {}, servers = options.mcp_servers;
+        if (options.mcp_servers_only !== true || !servers || Object.keys(servers).length !== 1 || !servers.ours)
+            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: Claude requires explicit mcp_servers_only and a single ours connector');
+        return;
+    }
+    if (role.harness !== 'codex' || !child.OURS_FLEET_CODEX_ACP_MANIFEST || child.OURS_FLEET_CODEX_DISABLE_INHERITED_MCP === '1')
+        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: managed Codex inventory proxy required');
+    const config = JSON.parse(child.CODEX_CONFIG ?? '{}');
+    if (config.mcp_servers?.ours?.enabled === false)
+        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: ours MCP disabled');
+    // Public inventory sees effective injected config. Before replacing ours, refuse
+    // inherited TOML connector configuration, including disabled/project/profile
+    // entries. No TOML guessing or override of an operator's explicit disable.
+    const home = child.CODEX_HOME ?? join(child.HOME ?? homedir(), '.codex');
+    const paths = [join(home, 'config.toml')];
+    const profile = role.harness_options?.profile;
+    if (typeof profile === 'string')
+        paths.push(join(home, profile + '.config.toml'));
+    for (let p = resolve(cwd); p !== resolve(child.HOME ?? homedir());) {
+        paths.push(join(p, '.codex/config.toml'));
+        const next = dirname(p);
+        if (next === p)
+            break;
+        p = next;
+    }
+    for (const path of new Set(paths))
+        if (existsSync(path) && /mcp_servers|mcpServers/.test(readFileSync(path, 'utf8')))
+            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: inherited Codex MCP configuration requires inventory support before replacement');
+    child.FLEET_CURRENT_CHAT_FILES = '1';
+}

package/dist/agent-ours/mcp-endpoint.d.ts

@@ -1,5 +1,8 @@
+import type { FileDeliveryInput, DeliveredFile } from '../file-delivery/types.js';
+import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
 import type { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
 import type { OursClient } from '@ours.network/sdk/client';
+import { FileCallbacks } from './file-rpc.js';
 import type { AgentOursRuntime } from './runtime.js';
 export interface EndpointOptions {
     socket: string;
@@ -9,6 +12,8 @@ export interface EndpointOptions {
     client: OursClient;
     identities: ApplicationIdentityStore;
     remoteDaemonFiles: boolean;
+    currentChatFileDirectory?: string;
+    currentChatFile?: (input: FileDeliveryInput, extra: ToolRequestExtra, files: FileCallbacks) => Promise<DeliveredFile>;
 }
 export declare function startMcpEndpoint(options: EndpointOptions): Promise<{
     close(): Promise<void>;

package/dist/agent-ours/mcp-endpoint.js

@@ -1,3 +1,4 @@
+import * as managedMcp from '@ours.network/mcp/server';
 import { createServer } from 'node:net';
 import { chmod, unlink } from 'node:fs/promises';
 import { timingSafeEqual } from 'node:crypto';
@@ -6,6 +7,8 @@ import { JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
 import { FileCallbacks } from './file-rpc.js';
 import { Wire } from './wire.js';
 export async function startMcpEndpoint(options) {
+    if (options.currentChatFile && managedMcp.MANAGED_FILE_DELIVERY_VERSION !== 1)
+        throw Error('INCOMPATIBLE_MANAGED_FILE_DELIVERY');
     const sockets = new Set();
     const server = createServer((socket) => {
         if (sockets.size >= 4) {
@@ -33,6 +36,7 @@ export async function startMcpEndpoint(options) {
         };
         const mcp = createManagedOursMcpServer(options.client, 'managed-v1', options.identities, {
             remoteDaemonFiles: options.remoteDaemonFiles,
+            ...(options.currentChatFile ? { currentChatFileDirectory: options.currentChatFileDirectory, currentChatFile: (input, extra) => options.currentChatFile(input, extra, files) } : {}),
             fileContext: files,
             admit: async () => {
                 if (!authenticated || inFlight >= 32)

package/dist/agent-ours/service.d.ts

@@ -1,3 +1,4 @@
+import type { AgentSession } from '../session/types.js';
 import type { ResolvedRole } from '../config.js';
 import { AgentOursRuntime } from './runtime.js';
 export declare const privateRuntimeRoot: () => string;
@@ -5,6 +6,7 @@ export interface ManagedAgentService {
     runtime: AgentOursRuntime;
     descriptor: string;
     privatePaths: string[];
+    setFileDelivery?(sender: AgentSession['sendFileToChat']): void;
     close(terminal: boolean): Promise<void>;
 }
 /** Only trusted launch orchestration may write this descriptor, never the child. */

package/dist/agent-ours/service.js

@@ -1,3 +1,6 @@
+import { pinExportRoot, exportPath, ensureExportDirectory } from '../file-delivery/reader.js';
+import { ArtifactStore } from '../file-delivery/store.js';
+import { resolve, basename, extname } from 'node:path';
 import { socketPath as privateSocketPath } from '../socket-path.js';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
@@ -94,6 +97,8 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
     }
     const controller = await RuntimeController.acquire(root, profile.expectedInstanceId, role.identity, instance);
     let closeClient;
+    let exportRoot;
+    let fileSender;
     let partialEndpoint;
     try {
         let prior = controller.journal.read();
@@ -210,6 +215,18 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         const bridgeDir = join(stateDir, '.ours-bridge');
         mkdirSync(bridgeDir, { recursive: true, mode: 0o700 });
         const capability = randomBytes(32).toString('hex'), socket = privateSocketPath(join(bridgeDir, `g${generation}.sock`));
+        const cwd = role.cwd && existsSync(role.cwd) ? resolve(role.cwd) : resolve(stateDir);
+        if (role.file_delivery?.enabled) {
+            if (role.session !== 'acp' || !['codex', 'claude-code'].includes(role.harness))
+                throw Error('FILE_DELIVERY_REQUIRES_CODEX_OR_CLAUDE_ACP');
+            const rootPath = resolve(cwd, role.file_delivery.directory);
+            const forbidden = [privateRuntimeRoot(), join(stateRoot(), 'private-file-delivery'), profile.configPath, profile.credentialPath];
+            if (forbidden.some(p => rootPath === resolve(p) || rootPath.startsWith(resolve(p) + '/') || resolve(p).startsWith(rootPath + '/')))
+                throw Error('PRIVATE_STATE_CANNOT_BE_EXPORTED');
+            await ensureExportDirectory(cwd, role.file_delivery.directory);
+            exportRoot = await pinExportRoot(rootPath);
+        }
+        const artifactStore = new ArtifactStore(stateDir);
         const endpoint = await startMcpEndpoint({
             socket,
             capability,
@@ -218,6 +235,26 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
             client,
             identities,
             remoteDaemonFiles: true,
+            ...(exportRoot ? { currentChatFileDirectory: role.file_delivery.directory, currentChatFile: (async (input, extra, files) => {
+                    if (!fileSender || !exportRoot)
+                        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
+                    exportPath(exportRoot.root, cwd, input.path); // validate before approval/read
+                    const name = input.filename ?? basename(input.path);
+                    if (!name || Buffer.byteLength(name) > 240 || /[\/\\\x00-\x1f]/.test(name) || name === '.' || name === '..')
+                        throw Error('INVALID_FILENAME');
+                    const mime = input.mime ?? { '.txt': 'text/plain', '.md': 'text/markdown', '.pdf': 'application/pdf', '.json': 'application/json', '.html': 'text/html', '.png': 'image/png' }[extname(name).toLowerCase()] ?? 'application/octet-stream';
+                    if (mime.length > 200 || !/^[A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+$/.test(mime))
+                        throw Error('INVALID_MIME');
+                    return fileSender(input, extra.signal, async (binding) => {
+                        const source = await files.readExport(input.path, exportRoot.root, extra);
+                        try {
+                            return await artifactStore.copy(source, name, mime, binding, extra.signal);
+                        }
+                        finally {
+                            await source.close();
+                        }
+                    }, role.permissions);
+                }) } : {}),
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
@@ -225,10 +262,13 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         return {
             runtime,
             descriptor,
-            privatePaths: [root, profile.configPath, profile.credentialPath],
+            privatePaths: [root, profile.configPath, profile.credentialPath, join(stateRoot(), 'private-file-delivery')],
+            setFileDelivery: sender => { fileSender = sender; },
             close: async (terminal) => {
                 try {
+                    fileSender = undefined;
                     await endpoint.close();
+                    await exportRoot?.handle.close();
                     if (terminal)
                         await runtime.terminal();
                     else
@@ -248,6 +288,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
     catch (error) {
         try {
             await partialEndpoint?.close();
+            await exportRoot?.handle.close();
         }
         finally {
             try {

package/dist/application/conversation-history.d.ts

@@ -23,3 +23,5 @@ export declare function resumedConversationPage(stateDir: string, request: {
     after?: string;
     limit?: number;
 }, live: ConversationPageView, expectedSessionId: string): Promise<ConversationPageView>;
+/** Download authorization requires an actual published attachment, never an orphan copy. */
+export declare function conversationHasAttachment(stateDir: string, attachment: import('../file-delivery/types.js').DeliveredFile): Promise<boolean>;

package/dist/application/conversation-history.js

@@ -2,7 +2,7 @@ import { createReadStream } from 'node:fs';
 import { open, readFile, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
-const HISTORICAL_KINDS = ['fleet.task_created', 'prompt.admitted', 'message.chunk', 'message.replace', 'tool.upsert', 'tool.content_chunk', 'turn.completed'];
+const HISTORICAL_KINDS = ['file.attached', 'fleet.task_created', 'prompt.admitted', 'message.chunk', 'message.replace', 'tool.upsert', 'tool.content_chunk', 'turn.completed'];
 /** Whether a ledger event belongs in the conversation: the live generation, or history of the resumed ACP session. */
 export function conversationEventVisible(event, sessionGeneration, resumedSessionId) {
     return event.source !== 'agent_replay' && (event.sessionGeneration === sessionGeneration || (!!resumedSessionId && HISTORICAL_KINDS.includes(event.kind) && event.acpSessionId === resumedSessionId));
@@ -162,7 +162,7 @@ export async function resumedConversationPage(stateDir, request, live, expectedS
                 const cursor = Number(event.seq);
                 if (!Number.isSafeInteger(cursor) || cursor <= after)
                     continue;
-                const historical = ['fleet.task_created', 'prompt.admitted', 'message.chunk', 'message.replace', 'tool.upsert', 'tool.content_chunk', 'turn.completed'].includes(event.kind);
+                const historical = ['file.attached', 'fleet.task_created', 'prompt.admitted', 'message.chunk', 'message.replace', 'tool.upsert', 'tool.content_chunk', 'turn.completed'].includes(event.kind);
                 const visible = event.source !== 'agent_replay' && (event.sessionGeneration === live.snapshot.sessionGeneration || (historical && event.acpSessionId === sessionId));
                 if (!visible) {
                     next = String(cursor);
@@ -187,3 +187,26 @@ export async function resumedConversationPage(stateDir, request, live, expectedS
         return live;
     return { ...live, events, firstAvailableCursor: first, nextCursor: next, hasMore };
 }
+/** Download authorization requires an actual published attachment, never an orphan copy. */
+export async function conversationHasAttachment(stateDir, attachment) {
+    const dir = join(stateDir, '.conversation');
+    const names = (await readdir(dir)).filter(n => /^events-\d+\.jsonl$/.test(n)).sort().reverse();
+    let found = false;
+    for (const name of names) {
+        await readLinesBackward(join(dir, name), line => {
+            try {
+                const e = JSON.parse(line);
+                const a = e.payload.attachment;
+                if (e.kind === 'file.attached' && e.source === 'agent' && a?.id === attachment.id
+                    && e.sessionGeneration === attachment.sessionGeneration && e.acpSessionId === attachment.acpSessionId
+                    && e.turnId === attachment.turnId && JSON.stringify(a) === JSON.stringify(attachment))
+                    found = true;
+            }
+            catch { /* unreadable lines cannot authorize a download */ }
+            return !found;
+        });
+        if (found)
+            break;
+    }
+    return found;
+}

package/dist/application/supervisor-ours-tools.js

@@ -1,3 +1,4 @@
+import { socketPath } from '../socket-path.js';
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -35,7 +36,8 @@ export class SupervisorOursTools {
         const identity = legacy
             ? legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation)
             : { name: identityName, cid: descriptor.cid, generation: descriptor.generation };
-        if (legacy && descriptor.socket !== join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`))
+        const legacySocket = join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`);
+        if (legacy && descriptor.socket !== legacySocket && descriptor.socket !== socketPath(legacySocket))
             throw new FleetError('capability_unavailable', 'legacy supervisor socket does not match the selected agent');
         if ((!legacy && (descriptor.role !== role || descriptor.identity !== identityName))
             || !/^[a-f0-9]{64}$/i.test(identity.cid ?? '') || !Number.isSafeInteger(descriptor.generation) || descriptor.generation < 1)

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.53",
-  "buildId": "bf5ca35d699f",
-  "commit": "cdf3842ad7869bd41fc843ff3e71859f4ef2f0f0",
+  "version": "1.2.0-nightly.54",
+  "buildId": "b10c893ceda0",
+  "commit": "4da7d4782c1caf686836806bc8606fc50887edc5",
   "dirty": true,
-  "builtAt": "2026-10-07T22:04:37.157Z",
+  "builtAt": "2026-10-08T10:22:35.148Z",
   "capabilities": [
     "managed-cli.codex-reasoning-effort-v1",
     "managed-cli.setup-v1",

package/dist/config.d.ts

@@ -42,6 +42,11 @@ export type MonitorInterrupt = boolean | 'after_tool';
  */
 export declare const MANAGED_CLI_WORKFLOW_IDS: readonly ["task-workflow"];
 export type ManagedCliWorkflowId = (typeof MANAGED_CLI_WORKFLOW_IDS)[number];
+export interface FileDeliveryConfig {
+    enabled: boolean;
+    directory: string;
+}
+export declare function validateFileDelivery(value: unknown): FileDeliveryConfig | undefined;
 export interface CommonPermissions {
     approval: ApprovalMode;
     filesystem: FilesystemMode;
@@ -154,6 +159,8 @@ export interface RoleConfig {
     auth_proxy?: Partial<AuthProxyConfig>;
     /** Fleet-prepared CLI workflows this role may run outside its command sandbox. */
     managed_cli?: ManagedCliWorkflowId[];
+    /** Explicit per-Agent export opt-in; not inherited from manifest defaults. */
+    file_delivery?: FileDeliveryConfig;
 }
 export type AgentSelection<T extends Record<string, unknown> = Record<string, unknown>> = {
     ref: string;
@@ -177,6 +184,8 @@ export interface AgentDefinition {
     auth_proxy?: Partial<AuthProxyConfig>;
     /** Fleet-prepared CLI workflows this Agent may run outside its command sandbox. */
     managed_cli?: ManagedCliWorkflowId[];
+    /** Explicit per-Agent export opt-in; not inherited from manifest defaults. */
+    file_delivery?: FileDeliveryConfig;
     /** Scheduled turns scoped only to temporary launches; persistent Agents reject this field. */
     loops?: AgentLoopsConfig;
 }

package/dist/config.js

@@ -29,6 +29,15 @@ export const NOTIFY_EVENT_TYPES = [
  * Agent; never inferred from a role's name or persona, and never inherited.
  */
 export const MANAGED_CLI_WORKFLOW_IDS = ['task-workflow'];
+export function validateFileDelivery(value) {
+    if (value === undefined)
+        return undefined;
+    if (!isPlainObject(value) || Object.keys(value).some(k => !['enabled', 'directory'].includes(k))
+        || typeof value.enabled !== 'boolean' || typeof value.directory !== 'string'
+        || !value.directory || value.directory.split('/').some(p => !p || p.startsWith('.') || /[\\\x00-\x1f]/.test(p)))
+        throw new ConfigError('file_delivery requires enabled:boolean and a relative non-hidden directory');
+    return value;
+}
 /** Default wake sources when a role does not list its own. */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
 const MONITOR_KEYS = [
@@ -144,7 +153,7 @@ export const ROLE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ROLE_KEYS = [
     'harness', 'session', 'session_options', 'permissions', 'identity', 'cwd', 'coordinator', 'mission', 'persona', 'bio',
     'briefing_file', 'model', 'effort', 'model_chain', 'max_tokens', 'autocompact_pct', 'env', 'oversee', 'harness_options',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli', 'file_delivery',
 ];
 export const ROLE_PRESET_KEYS = ['mission', 'persona', 'bio', 'briefing_file'];
 export const BRAIN_PRESET_KEYS = [
@@ -153,7 +162,7 @@ export const BRAIN_PRESET_KEYS = [
 ];
 export const AGENT_KEYS = [
     'role', 'brain', 'permissions', 'identity', 'cwd', 'coordinator', 'env', 'oversee',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli', 'file_delivery',
 ];
 const AGENT_INSTANCE_KEYS = ['template', 'overrides'];
 const TEMPLATE_FORBIDDEN_KEYS = ['identity'];
@@ -199,6 +208,7 @@ export function validateBrainValue(value, file, pointer) {
 }
 /** Pure launch-boundary validation for a fully resolved temporary Agent definition. */
 export function validateEffectiveAgentTemplate(definition, id = 'room-member') {
+    validateFileDelivery(definition.file_delivery);
     const value = structuredClone(definition);
     const bad = Object.keys(value).filter(key => !AGENT_KEYS.includes(key));
     if (bad.length)
@@ -646,6 +656,7 @@ export function loadConfig(configPath, options = {}) {
             const bad = Object.keys(r).filter(k => !ROLE_KEYS.includes(k));
             if (bad.length)
                 throw new ConfigError(`${file}: role '${name}' has unknown key(s) ${bad.join(', ')}; allowed: ${ROLE_KEYS.join(', ')}`);
+            validateFileDelivery(r.file_delivery);
             const isolation = r.isolation ?? defaults.isolation;
             const session = resolveSession(r.session ?? defaults.session, file, name);
             const sessionOptions = resolveSessionOptions(defaults.session_options, r.session_options, session, file, name);

package/dist/file-delivery/reader.d.ts

@@ -0,0 +1,17 @@
+import { type FileHandle } from 'node:fs/promises';
+export declare const MAX_FILE_BYTES: number;
+export interface ExportRoot {
+    path: string;
+    dev: number;
+    ino: number;
+}
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export declare function openDirectory(path: string): Promise<FileHandle>;
+export declare function pinExportRoot(path: string): Promise<{
+    root: ExportRoot;
+    handle: FileHandle;
+}>;
+export declare function exportPath(root: ExportRoot, cwd: string, input: string): string[];
+/** Runs in the harness bridge, never in the supervisor's OS context. */
+export declare function openExportFile(root: ExportRoot, cwd: string, input: string): Promise<FileHandle>;
+export declare function ensureExportDirectory(cwd: string, directory: string): Promise<void>;

package/dist/file-delivery/reader.js

@@ -0,0 +1,94 @@
+import { constants } from 'node:fs';
+import { mkdir, open } from 'node:fs/promises';
+import { isAbsolute, relative, resolve } from 'node:path';
+export const MAX_FILE_BYTES = 20 * 1024 * 1024;
+const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export async function openDirectory(path) {
+    if (process.platform !== 'linux' || !isAbsolute(path) || path !== resolve(path))
+        throw Error('FILE_DELIVERY_REQUIRES_LINUX_ROOT');
+    let dir = await open('/', FLAGS | constants.O_DIRECTORY);
+    try {
+        for (const part of path.split('/').filter(Boolean)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        return dir;
+    }
+    catch (error) {
+        await dir.close();
+        throw error;
+    }
+}
+export async function pinExportRoot(path) {
+    const handle = await openDirectory(path);
+    try {
+        const stat = await handle.stat();
+        if (stat.uid !== process.getuid?.() || (stat.mode & 0o022))
+            throw Error('EXPORT_ROOT_NOT_PRIVATE_OWNED');
+        return { root: { path, dev: stat.dev, ino: stat.ino }, handle };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+export function exportPath(root, cwd, input) {
+    if (!input || input.length > 4096 || /[\\\x00-\x1f]/.test(input) || input.split('/').some(p => p === '.' || p === '..' || !p) && !isAbsolute(input))
+        throw Error('INVALID_EXPORT_PATH');
+    if (input.split('/').some(p => p === '..' || p === '.'))
+        throw Error('INVALID_EXPORT_PATH');
+    const path = relative(root.path, resolve(cwd, input));
+    const parts = path.split('/');
+    if (!path || isAbsolute(path) || parts.some(p => !p || p === '..' || p === '.' || p.startsWith('.') || /^(credentials?|secrets?|tokens?)(\.|$)/i.test(p)))
+        throw Error('OUTSIDE_EXPORT_DIRECTORY');
+    return parts;
+}
+/** Runs in the harness bridge, never in the supervisor's OS context. */
+export async function openExportFile(root, cwd, input) {
+    const parts = exportPath(root, cwd, input);
+    let dir = await openDirectory(root.path);
+    try {
+        const stat = await dir.stat();
+        if (stat.dev !== root.dev || stat.ino !== root.ino)
+            throw Error('EXPORT_ROOT_CHANGED');
+        for (const part of parts.slice(0, -1)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        const file = await open(`/proc/self/fd/${dir.fd}/${parts.at(-1)}`, FLAGS);
+        try {
+            const stat = await file.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || stat.size > MAX_FILE_BYTES)
+                throw Error('INVALID_EXPORT_FILE');
+            return file;
+        }
+        catch (error) {
+            await file.close();
+            throw error;
+        }
+    }
+    finally {
+        await dir.close();
+    }
+}
+export async function ensureExportDirectory(cwd, directory) {
+    let dir = await openDirectory(cwd);
+    try {
+        for (const part of directory.split('/')) {
+            if (!part || part.startsWith('.') || /[\\\x00-\x1f]/.test(part))
+                throw Error('INVALID_EXPORT_DIRECTORY');
+            const path = `/proc/self/fd/${dir.fd}/${part}`;
+            await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+                throw error; });
+            const next = await open(path, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+    }
+    finally {
+        await dir.close();
+    }
+}

package/dist/file-delivery/store.d.ts

@@ -0,0 +1,15 @@
+import type { DeliveredFile, FileDeliveryBinding } from './types.js';
+export declare function artifactDirectory(stateDir: string): string;
+export declare class ArtifactStore {
+    private readonly stateDir;
+    constructor(stateDir: string);
+    copy(source: {
+        size: number;
+        body: ReadableStream<Uint8Array>;
+        close(): Promise<void>;
+    }, name: string, mimeType: string, binding: FileDeliveryBinding, signal: AbortSignal): Promise<DeliveredFile>;
+}
+export declare function readDeliveredFile(stateDir: string, id: string): Promise<{
+    record: DeliveredFile;
+    bytes: Buffer;
+}>;