@ours.network/fleet 1.2.0-nightly.53 → 1.2.0-nightly.55

package/dist/application/task-layouts.js

@@ -16,6 +16,9 @@ import { launchFleetWorker } from '../rooms-tasks/external-worker.js';
 import { layoutSupervisorId } from '../rooms-tasks/layout-control.js';
 import { layoutRunPath, RoomLayoutService } from '../rooms-tasks/layout-service.js';
 import { FleetError } from './errors.js';
+import { ownedLayoutRetirementSeats } from '../rooms-tasks/layout-member-retirement.js';
+import { eraseMemberArtifacts } from '../rooms-tasks/erasure.js';
+import { assertTaskRegistrationsAbsent } from '../supervisor/catalog.js';
 /** Hash of the authorable definition only (never the source file path). */
 export function layoutDefinitionHash(definition) {
     const { version, description, participants, rooms } = definition;
@@ -238,8 +241,15 @@ export class TaskLayouts {
         const link = task.layout;
         if (!link)
             return;
-        if (this.runExists(link))
-            await this.service().open(link.run_id, true).close(layoutSupervisorId());
+        if (this.runExists(link)) {
+            const engine = this.service().open(link.run_id, true);
+            await engine.delete(layoutSupervisorId());
+            const state = engine.snapshot();
+            const rooms = Object.values(state.rooms).flatMap(room => room.native ? [room.native.room_id] : []);
+            assertTaskRegistrationsAbsent(task.task_id);
+            await eraseMemberArtifacts('task', task.task_id, ownedLayoutRetirementSeats(state, link.run_id), rooms);
+        }
+        assertTaskRegistrationsAbsent(task.task_id);
         await this.withTaskLock(link.run_id, async () => {
             for (const path of [layoutRunPath(link.run_id), this.provenancePath(link.run_id), taskBriefPath(task)])
                 rmSync(path, { force: true });

package/dist/application/task-room-service.js

@@ -378,23 +378,25 @@ export class TaskRoomApplicationService {
         const ready = task.state === 'active' && room?.state === 'active'
             && active === expected && launched === expected;
         const blocker = task.outcome?.summary ?? task.blocked?.reason ?? room?.saga.error;
-        const nextAction = task.terminal_intent
-            ? `Complete the accepted ${task.terminal_intent.kind} operation; do not restart provisioning.`
-            : room?.state === 'closing' || room?.state === 'closed'
-                ? `Complete room cleanup; do not restart provisioning.`
-                : room?.provisioning_detail === 'member_failed'
-                    ? `Inspect the failed launch, then run ours-fleet task start ${task.task_id}.`
-                    : room?.provisioning_detail === 'waiting_owner_authorization'
-                        ? `Ensure ours-cowork 1.3.0 or newer is running and available, then run ours-fleet task start ${task.task_id}.`
-                        : room?.provisioning_detail === 'waiting_owner_invite'
-                            ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
-                            : room?.provisioning_detail === 'owner_cid_mismatch'
-                                ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
-                                : room?.provisioning_detail === 'waiting_cowork'
-                                    ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
-                                    : failed
-                                        ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
-                                        : undefined;
+        const nextAction = blocker === 'FLEET_SERVICE_NOT_INSTALLED: run ours-fleet init'
+            ? `Run ours-fleet init, then retry ours-fleet task start ${task.task_id}.`
+            : task.terminal_intent
+                ? `Complete the accepted ${task.terminal_intent.kind} operation; do not restart provisioning.`
+                : room?.state === 'closing' || room?.state === 'closed'
+                    ? `Complete room cleanup; do not restart provisioning.`
+                    : room?.provisioning_detail === 'member_failed'
+                        ? `Inspect the failed launch, then run ours-fleet task start ${task.task_id}.`
+                        : room?.provisioning_detail === 'waiting_owner_authorization'
+                            ? `Ensure ours-cowork 1.3.0 or newer is running and available, then run ours-fleet task start ${task.task_id}.`
+                            : room?.provisioning_detail === 'waiting_owner_invite'
+                                ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
+                                : room?.provisioning_detail === 'owner_cid_mismatch'
+                                    ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
+                                    : room?.provisioning_detail === 'waiting_cowork'
+                                        ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
+                                        : failed
+                                            ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
+                                            : undefined;
         return {
             kind: failed ? 'failed' : ready ? 'ready' : 'in_progress', task, room,
             launch: {

package/dist/application/types.d.ts

@@ -26,6 +26,8 @@ export interface RoleRecord {
     id: string;
     lifetime: RoleLifetime;
     configured: boolean;
+    /** Read-only display ownership; never authorizes lifecycle operations. */
+    taskId?: string;
     config?: ResolvedRoleView;
     stateRef?: {
         lifetime: 'permanent' | 'temporary';

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.53",
-  "buildId": "bf5ca35d699f",
-  "commit": "cdf3842ad7869bd41fc843ff3e71859f4ef2f0f0",
+  "version": "1.2.0-nightly.55",
+  "buildId": "6e4199ab6d73",
+  "commit": "a66362bc99a9896700192f5ff2c8454a0e209766",
   "dirty": true,
-  "builtAt": "2026-10-07T22:04:37.157Z",
+  "builtAt": "2026-10-09T12:16:42.572Z",
   "capabilities": [
     "managed-cli.codex-reasoning-effort-v1",
     "managed-cli.setup-v1",

package/dist/cli.js

@@ -617,7 +617,7 @@ cOpt(program.command('status <name>').description('declared persistent Agent uni
             + `${ledger.lastTermination.runStartedAt ?? 'unknown'}) died without an orderly exit; `
             + `observed ${ledger.lastTermination.observedAt}`
             + `\n  abrupt terminations recorded: ${ledger.abruptTerminations ?? 1}`
-            + `\n  cause (signal / OOM-kill): journalctl --user -u ours-fleet-agent@${name}.service`);
+            + `\n  inspect member output: ours-fleet logs ${name}`);
     const modelStatus = joinPath(agentDir(name), '.model-status');
     if (existsSync(modelStatus)) {
         try {
@@ -1867,6 +1867,33 @@ program.command('_wait-daemon <name>', { hidden: true }).description('internal:
         die(e);
     }
 });
+program.command('_wait-temp-daemon <name>', { hidden: true })
+    .action(async (name) => {
+    try {
+        await waitForRoleDaemon(name, undefined, {}, true);
+    }
+    catch (error) {
+        die(error);
+    }
+});
+program.command('_run-fleet', { hidden: true }).action(async () => {
+    try {
+        const { runFleetManager } = await import('./supervisor/manager.js');
+        await runFleetManager(process.argv[1]);
+    }
+    catch (error) {
+        die(error);
+    }
+});
+program.command('_run-managed <key> <generation>', { hidden: true }).action(async (key, generation) => {
+    try {
+        const { runManagedMember } = await import('./supervisor/manager.js');
+        await runManagedMember(key, generation);
+    }
+    catch (error) {
+        die(error);
+    }
+});
 program.command('_run <name>', { hidden: true }).description('internal: supervisor entrypoint')
     .option('-c, --configuration <file>')
     .action(async (name, opts) => {
@@ -1889,9 +1916,10 @@ program.command('_run-temp <name>', { hidden: true }).description('internal: tem
     }
 });
 program.command('_run-temp-worker <name>', { hidden: true })
-    .action(async (name) => {
+    .option('--suspend-on-stop')
+    .action(async (name, options) => {
     try {
-        await runTemp(name);
+        await runTemp(name, { suspendOnStop: options.suspendOnStop === true });
     }
     catch (error) {
         if (error instanceof SupervisorRecycleRequiredError)

package/dist/config.d.ts

@@ -42,6 +42,11 @@ export type MonitorInterrupt = boolean | 'after_tool';
  */
 export declare const MANAGED_CLI_WORKFLOW_IDS: readonly ["task-workflow"];
 export type ManagedCliWorkflowId = (typeof MANAGED_CLI_WORKFLOW_IDS)[number];
+export interface FileDeliveryConfig {
+    enabled: boolean;
+    directory: string;
+}
+export declare function validateFileDelivery(value: unknown): FileDeliveryConfig | undefined;
 export interface CommonPermissions {
     approval: ApprovalMode;
     filesystem: FilesystemMode;
@@ -154,6 +159,8 @@ export interface RoleConfig {
     auth_proxy?: Partial<AuthProxyConfig>;
     /** Fleet-prepared CLI workflows this role may run outside its command sandbox. */
     managed_cli?: ManagedCliWorkflowId[];
+    /** Explicit per-Agent export opt-in; not inherited from manifest defaults. */
+    file_delivery?: FileDeliveryConfig;
 }
 export type AgentSelection<T extends Record<string, unknown> = Record<string, unknown>> = {
     ref: string;
@@ -177,6 +184,8 @@ export interface AgentDefinition {
     auth_proxy?: Partial<AuthProxyConfig>;
     /** Fleet-prepared CLI workflows this Agent may run outside its command sandbox. */
     managed_cli?: ManagedCliWorkflowId[];
+    /** Explicit per-Agent export opt-in; not inherited from manifest defaults. */
+    file_delivery?: FileDeliveryConfig;
     /** Scheduled turns scoped only to temporary launches; persistent Agents reject this field. */
     loops?: AgentLoopsConfig;
 }
@@ -189,6 +198,8 @@ export interface AgentTemplateInstance {
 }
 /** Internal first-boot payload for a Fleet-provisioned Cowork room member. */
 export interface RoomMemberStartup {
+    /** Task ownership; absent for standalone rooms and legacy snapshots. */
+    task_id?: string;
     workspace?: import('./rooms-tasks/workspace.js').OwnedWorkspace;
     room_id: string;
     room_identity_cid: string;

package/dist/config.js

@@ -29,6 +29,15 @@ export const NOTIFY_EVENT_TYPES = [
  * Agent; never inferred from a role's name or persona, and never inherited.
  */
 export const MANAGED_CLI_WORKFLOW_IDS = ['task-workflow'];
+export function validateFileDelivery(value) {
+    if (value === undefined)
+        return undefined;
+    if (!isPlainObject(value) || Object.keys(value).some(k => !['enabled', 'directory'].includes(k))
+        || typeof value.enabled !== 'boolean' || typeof value.directory !== 'string'
+        || !value.directory || value.directory.split('/').some(p => !p || p.startsWith('.') || /[\\\x00-\x1f]/.test(p)))
+        throw new ConfigError('file_delivery requires enabled:boolean and a relative non-hidden directory');
+    return value;
+}
 /** Default wake sources when a role does not list its own. */
 export const DEFAULT_WAKE_SOURCES = ['message_received', 'file_received', 'local_contact_request', 'pending_message'];
 const MONITOR_KEYS = [
@@ -144,7 +153,7 @@ export const ROLE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ROLE_KEYS = [
     'harness', 'session', 'session_options', 'permissions', 'identity', 'cwd', 'coordinator', 'mission', 'persona', 'bio',
     'briefing_file', 'model', 'effort', 'model_chain', 'max_tokens', 'autocompact_pct', 'env', 'oversee', 'harness_options',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'managed_cli', 'file_delivery',
 ];
 export const ROLE_PRESET_KEYS = ['mission', 'persona', 'bio', 'briefing_file'];
 export const BRAIN_PRESET_KEYS = [
@@ -153,7 +162,7 @@ export const BRAIN_PRESET_KEYS = [
 ];
 export const AGENT_KEYS = [
     'role', 'brain', 'permissions', 'identity', 'cwd', 'coordinator', 'env', 'oversee',
-    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli',
+    'isolation', 'monitor', 'owner_channel', 'worklog', 'auth_proxy', 'loops', 'managed_cli', 'file_delivery',
 ];
 const AGENT_INSTANCE_KEYS = ['template', 'overrides'];
 const TEMPLATE_FORBIDDEN_KEYS = ['identity'];
@@ -199,6 +208,7 @@ export function validateBrainValue(value, file, pointer) {
 }
 /** Pure launch-boundary validation for a fully resolved temporary Agent definition. */
 export function validateEffectiveAgentTemplate(definition, id = 'room-member') {
+    validateFileDelivery(definition.file_delivery);
     const value = structuredClone(definition);
     const bad = Object.keys(value).filter(key => !AGENT_KEYS.includes(key));
     if (bad.length)
@@ -646,6 +656,7 @@ export function loadConfig(configPath, options = {}) {
             const bad = Object.keys(r).filter(k => !ROLE_KEYS.includes(k));
             if (bad.length)
                 throw new ConfigError(`${file}: role '${name}' has unknown key(s) ${bad.join(', ')}; allowed: ${ROLE_KEYS.join(', ')}`);
+            validateFileDelivery(r.file_delivery);
             const isolation = r.isolation ?? defaults.isolation;
             const session = resolveSession(r.session ?? defaults.session, file, name);
             const sessionOptions = resolveSessionOptions(defaults.session_options, r.session_options, session, file, name);

package/dist/file-delivery/reader.d.ts

@@ -0,0 +1,17 @@
+import { type FileHandle } from 'node:fs/promises';
+export declare const MAX_FILE_BYTES: number;
+export interface ExportRoot {
+    path: string;
+    dev: number;
+    ino: number;
+}
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export declare function openDirectory(path: string): Promise<FileHandle>;
+export declare function pinExportRoot(path: string): Promise<{
+    root: ExportRoot;
+    handle: FileHandle;
+}>;
+export declare function exportPath(root: ExportRoot, cwd: string, input: string): string[];
+/** Runs in the harness bridge, never in the supervisor's OS context. */
+export declare function openExportFile(root: ExportRoot, cwd: string, input: string): Promise<FileHandle>;
+export declare function ensureExportDirectory(cwd: string, directory: string): Promise<void>;

package/dist/file-delivery/reader.js

@@ -0,0 +1,94 @@
+import { constants } from 'node:fs';
+import { mkdir, open } from 'node:fs/promises';
+import { isAbsolute, relative, resolve } from 'node:path';
+export const MAX_FILE_BYTES = 20 * 1024 * 1024;
+const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export async function openDirectory(path) {
+    if (process.platform !== 'linux' || !isAbsolute(path) || path !== resolve(path))
+        throw Error('FILE_DELIVERY_REQUIRES_LINUX_ROOT');
+    let dir = await open('/', FLAGS | constants.O_DIRECTORY);
+    try {
+        for (const part of path.split('/').filter(Boolean)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        return dir;
+    }
+    catch (error) {
+        await dir.close();
+        throw error;
+    }
+}
+export async function pinExportRoot(path) {
+    const handle = await openDirectory(path);
+    try {
+        const stat = await handle.stat();
+        if (stat.uid !== process.getuid?.() || (stat.mode & 0o022))
+            throw Error('EXPORT_ROOT_NOT_PRIVATE_OWNED');
+        return { root: { path, dev: stat.dev, ino: stat.ino }, handle };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+export function exportPath(root, cwd, input) {
+    if (!input || input.length > 4096 || /[\\\x00-\x1f]/.test(input) || input.split('/').some(p => p === '.' || p === '..' || !p) && !isAbsolute(input))
+        throw Error('INVALID_EXPORT_PATH');
+    if (input.split('/').some(p => p === '..' || p === '.'))
+        throw Error('INVALID_EXPORT_PATH');
+    const path = relative(root.path, resolve(cwd, input));
+    const parts = path.split('/');
+    if (!path || isAbsolute(path) || parts.some(p => !p || p === '..' || p === '.' || p.startsWith('.') || /^(credentials?|secrets?|tokens?)(\.|$)/i.test(p)))
+        throw Error('OUTSIDE_EXPORT_DIRECTORY');
+    return parts;
+}
+/** Runs in the harness bridge, never in the supervisor's OS context. */
+export async function openExportFile(root, cwd, input) {
+    const parts = exportPath(root, cwd, input);
+    let dir = await openDirectory(root.path);
+    try {
+        const stat = await dir.stat();
+        if (stat.dev !== root.dev || stat.ino !== root.ino)
+            throw Error('EXPORT_ROOT_CHANGED');
+        for (const part of parts.slice(0, -1)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        const file = await open(`/proc/self/fd/${dir.fd}/${parts.at(-1)}`, FLAGS);
+        try {
+            const stat = await file.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || stat.size > MAX_FILE_BYTES)
+                throw Error('INVALID_EXPORT_FILE');
+            return file;
+        }
+        catch (error) {
+            await file.close();
+            throw error;
+        }
+    }
+    finally {
+        await dir.close();
+    }
+}
+export async function ensureExportDirectory(cwd, directory) {
+    let dir = await openDirectory(cwd);
+    try {
+        for (const part of directory.split('/')) {
+            if (!part || part.startsWith('.') || /[\\\x00-\x1f]/.test(part))
+                throw Error('INVALID_EXPORT_DIRECTORY');
+            const path = `/proc/self/fd/${dir.fd}/${part}`;
+            await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
+                throw error; });
+            const next = await open(path, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+    }
+    finally {
+        await dir.close();
+    }
+}

package/dist/file-delivery/store.d.ts

@@ -0,0 +1,15 @@
+import type { DeliveredFile, FileDeliveryBinding } from './types.js';
+export declare function artifactDirectory(stateDir: string): string;
+export declare class ArtifactStore {
+    private readonly stateDir;
+    constructor(stateDir: string);
+    copy(source: {
+        size: number;
+        body: ReadableStream<Uint8Array>;
+        close(): Promise<void>;
+    }, name: string, mimeType: string, binding: FileDeliveryBinding, signal: AbortSignal): Promise<DeliveredFile>;
+}
+export declare function readDeliveredFile(stateDir: string, id: string): Promise<{
+    record: DeliveredFile;
+    bytes: Buffer;
+}>;

package/dist/file-delivery/store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, mkdirSync, readFileSync, readdirSync, lstatSync, openSync, fstatSync, closeSync, renameSync, writeFileSync } from 'node:fs';
+import { open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { openDirectory, MAX_FILE_BYTES } from './reader.js';
+export function artifactDirectory(stateDir) {
+    const incarnation = readFileSync(join(stateDir, '.session-id'), 'utf8').trim();
+    if (!/^[a-f0-9-]{36}$/.test(incarnation))
+        throw Error('INVALID_ROLE_INCARNATION');
+    const key = createHash('sha256').update(JSON.stringify([stateDir, incarnation])).digest('hex');
+    return join(stateRoot(), 'private-file-delivery', key);
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077)
+        throw Error('INVALID_ARTIFACT_DIRECTORY');
+}
+export class ArtifactStore {
+    stateDir;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+    }
+    async copy(source, name, mimeType, binding, signal) {
+        if (!Number.isSafeInteger(source.size) || source.size < 0 || source.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        const path = artifactDirectory(this.stateDir);
+        privateDirectory(join(stateRoot(), 'private-file-delivery'));
+        privateDirectory(path);
+        const root = await openDirectory(path);
+        const id = randomUUID(), base = `/proc/self/fd/${root.fd}/`, partial = base + id + '.part';
+        let file;
+        const reader = source.body.getReader();
+        try {
+            // Orphans count toward the same bounded quota. They are never republished.
+            const entries = readdirSync(base).filter(p => /\.(data|part)$/.test(p));
+            const bytes = entries.reduce((sum, p) => sum + lstatSync(base + p).size, 0);
+            if (entries.length >= 100 || bytes + source.size > 200 * 1024 * 1024)
+                throw Error('ARTIFACT_QUOTA_EXCEEDED');
+            file = await open(partial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            const hash = createHash('sha256');
+            let size = 0;
+            for (;;) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > source.size || size > MAX_FILE_BYTES)
+                    throw Error('SOURCE_SIZE_CHANGED');
+                hash.update(chunk.value);
+                let offset = 0;
+                while (offset < chunk.value.length) {
+                    const { bytesWritten } = await file.write(chunk.value, offset, chunk.value.length - offset);
+                    if (!bytesWritten)
+                        throw Error('SHORT_ARTIFACT_WRITE');
+                    offset += bytesWritten;
+                }
+            }
+            if (size !== source.size)
+                throw Error('SOURCE_SIZE_CHANGED');
+            signal.throwIfAborted();
+            await file.chmod(0o400);
+            await file.sync();
+            await file.close();
+            file = undefined;
+            const record = { id, name, mimeType, size, sha256: hash.digest('hex'), ...binding };
+            renameSync(partial, base + id + '.data');
+            writeFileSync(base + id + '.json', JSON.stringify(record), { flag: 'wx', mode: 0o400, flush: true });
+            // No pending-send record or recovery: a later failure leaves only unreferenced stored bytes.
+            await root.sync();
+            // The newly created incarnation directory and store root must also survive
+            // a crash before a durable conversation event can reference this file.
+            for (const parent of [join(stateRoot(), 'private-file-delivery'), stateRoot()]) {
+                const handle = await openDirectory(parent);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            return record;
+        }
+        finally {
+            await file?.close();
+            await reader.cancel().catch(() => { });
+            await source.close();
+            await unlink(partial).catch(() => { });
+            await root.close();
+        }
+    }
+}
+export async function readDeliveredFile(stateDir, id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error('ARTIFACT_NOT_FOUND');
+    const root = await openDirectory(artifactDirectory(stateDir));
+    const read = (suffix, max) => {
+        const fd = openSync(`/proc/self/fd/${root.fd}/${id}.${suffix}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+                throw Error('INVALID_STORED_ARTIFACT');
+            const bytes = readFileSync(fd);
+            if (bytes.length > max)
+                throw Error('ARTIFACT_TOO_LARGE');
+            return bytes;
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    try {
+        const record = JSON.parse(read('json', 4096).toString());
+        const bytes = read('data', MAX_FILE_BYTES);
+        if (record.id !== id || record.size !== bytes.length || record.sha256 !== createHash('sha256').update(bytes).digest('hex') || typeof record.name !== 'string')
+            throw Error('ARTIFACT_INTEGRITY_FAILED');
+        return { record, bytes };
+    }
+    finally {
+        await root.close();
+    }
+}

package/dist/file-delivery/types.d.ts

@@ -0,0 +1,19 @@
+export interface FileDeliveryBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    turnId: string;
+}
+export interface DeliveredFile extends FileDeliveryBinding {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+}
+export interface FileDeliveryInput {
+    path: string;
+    filename?: string;
+    mime?: string;
+}
+export type CopyChatFile = (binding: FileDeliveryBinding) => Promise<DeliveredFile>;
+export type SendChatFile = (input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile) => Promise<DeliveredFile>;

package/dist/file-delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/harness/agent-session.d.ts

@@ -30,6 +30,8 @@ export interface AgentSessionStartOptions {
     cwd: string;
     stateDir: string;
     mode: 'fresh' | 'resume';
+    /** Durable task context must never silently fall back to a fresh session. */
+    requireResume?: boolean;
     permissions: CommonPermissions;
     permissionMode: {
         fleetMode: FleetPermissionMode;

package/dist/harness/claude-code-session.js

@@ -24,7 +24,7 @@ export class ClaudeCodeAgentSessionAdapter {
         return this.transport({
             name: role.name, harness: role.harness,
             argv: launch.argv, cwd: options.cwd, env: launch.env,
-            stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+            stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
             mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
             inheritEnvironment: options.managedOurs ? false : undefined,

package/dist/harness/codex-app-server-proxy.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { CodexFileInventory } from './codex-file-inventory.js';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline';
@@ -446,6 +447,7 @@ export function runCodexAppServerProxy() {
             });
         }
     };
+    const inventory = process.env.FLEET_CURRENT_CHAT_FILES === '1' ? new CodexFileInventory(writeToChild, writeToClient) : undefined;
     const recovery = new CodexTerminalRecovery({
         sendToCodex: writeToChild,
         emitToClient: writeToClient,
@@ -456,6 +458,7 @@ export function runCodexAppServerProxy() {
             return;
         finished = true;
         recovery.close();
+        inventory?.close();
         input.close();
         process.stdin.destroy();
         // stdout/stderr are often pipes under Fleet and tests. Setting exitCode
@@ -488,10 +491,11 @@ export function runCodexAppServerProxy() {
             return;
         const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
-        writeToChild(rewritten);
+        if (!inventory || inventory.observeClientLine(rewritten))
+            writeToChild(rewritten);
     });
     output.on('line', line => {
-        if (!finished && recovery.observeServerLine(line))
+        if (!finished && (!inventory || inventory.observeServerLine(line)) && recovery.observeServerLine(line))
             writeToClient(line);
     });
     input.once('close', () => {

package/dist/harness/codex-file-inventory.d.ts

@@ -0,0 +1,15 @@
+export declare class CodexFileInventory {
+    private readonly sendToCodex;
+    private readonly emitToClient;
+    private checks;
+    private sequence;
+    constructor(sendToCodex: (line: string) => void, emitToClient: (line: string) => void);
+    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
+    observeClientLine(line: string): boolean;
+    observeServerLine(line: string): boolean;
+    close(): void;
+    private query;
+    private qualified;
+    private finish;
+    private reject;
+}