@ours.network/fleet 1.2.0-nightly.57 → 1.2.0-nightly.58

package/README.md

@@ -1929,4 +1929,4 @@ installer's normal generated version/integrity lock updated, then installer and
 App released. The currently pinned Fleet nightly.41 does not support v2 grants.
 These source changes do not publish, merge, or deploy any component.
 
-See [ACP file sending](docs/acp-files.md) for the opt-in same-chat `send_file` flow and supported configurations.
+See [ACP file sending](docs/acp-files.md) for the same-chat `send_file` flow, available to every Agent by default, and its supported sessions.

package/dist/agent-ours/bridge.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { openExportFile } from '../file-delivery/reader.js';
+import { openChatFile } from '../file-delivery/reader.js';
 import { createHash } from 'node:crypto';
 import { connect } from 'node:net';
 import { access, mkdir, open, readFile } from 'node:fs/promises';
@@ -7,6 +7,9 @@ import { constants } from 'node:fs';
 import { basename, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { MAX_CHUNK_BYTES, MAX_FRAME_BYTES, Wire } from './wire.js';
+/** A current-chat refusal the agent may see; it names a reason, never a path or content. */
+class ChatFileError extends Error {
+}
 /** Runs inside exactly the harness OS sandbox. Only this process opens agent paths. */
 export async function runBridge(descriptorPath) {
     const descriptor = JSON.parse(await readFile(descriptorPath, 'utf8'));
@@ -81,13 +84,20 @@ export async function runBridge(descriptorPath) {
                     const path = resolve(args.path);
                     if (op === 'write-open')
                         await mkdir(dirname(path), { recursive: true });
-                    const file = op === 'export-open' ? await openExportFile(args.root, process.cwd(), args.path) : await open(path, op === 'write-open' ? 'w' : 'r');
-                    const stat = await file.stat();
-                    handles.set(args.handle, { file, call, write: op === 'write-open', ...(op === 'export-open' ? { original: { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs } } : {}) });
-                    value =
-                        op === 'write-open'
-                            ? path
-                            : { filename: basename(path), size: (await file.stat()).size };
+                    if (op === 'export-open') {
+                        const opened = await openChatFile(process.cwd(), args.path).catch((error) => { throw new ChatFileError(error.message); });
+                        const stat = await opened.file.stat();
+                        handles.set(args.handle, { file: opened.file, call, write: false, original: { size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs } });
+                        value = { filename: basename(opened.path), size: stat.size, path: opened.path };
+                    }
+                    else {
+                        const file = await open(path, op === 'write-open' ? 'w' : 'r');
+                        handles.set(args.handle, { file, call, write: op === 'write-open' });
+                        value =
+                            op === 'write-open'
+                                ? path
+                                : { filename: basename(path), size: (await file.stat()).size };
+                    }
                 }
                 else {
                     const row = handles.get(args.handle);
@@ -110,7 +120,7 @@ export async function runBridge(descriptorPath) {
                             if (row.original) {
                                 const stat = await row.file.stat();
                                 if (!stat.isFile() || stat.nlink !== 1 || stat.size !== row.original.size || stat.mtimeMs !== row.original.mtimeMs || stat.ctimeMs !== row.original.ctimeMs)
-                                    throw Error('EXPORT_SOURCE_CHANGED');
+                                    throw new ChatFileError('CHAT_FILE_CHANGED');
                             }
                             const buffer = Buffer.alloc(MAX_CHUNK_BYTES);
                             const { bytesRead } = await row.file.read(buffer);
@@ -136,8 +146,8 @@ export async function runBridge(descriptorPath) {
                 }
                 await wire.send({ kind: 'fs-result', id: raw.id, value });
             }
-            catch {
-                await wire.send({ kind: 'fs-result', id: raw.id, error: 'FILE_OPERATION_FAILED' });
+            catch (error) {
+                await wire.send({ kind: 'fs-result', id: raw.id, error: error instanceof ChatFileError ? error.message : 'FILE_OPERATION_FAILED' });
             }
         })
             .catch(fail);

package/dist/agent-ours/file-rpc.d.ts

@@ -1,4 +1,3 @@
-import type { ExportRoot } from '../file-delivery/reader.js';
 import type { FileExecutionContext } from '@ours.network/mcp/server';
 import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
 import { type Wire } from './wire.js';
@@ -12,16 +11,21 @@ export declare class FileCallbacks implements FileExecutionContext {
     private rpc;
     canRead(path: string, extra: ToolRequestExtra): Promise<boolean>;
     read(path: string, extra: ToolRequestExtra): Promise<{
+        path?: string | undefined;
         filename: any;
         size: any;
         body: ReadableStream<Uint8Array<ArrayBufferLike>>;
         close: () => Promise<void>;
     }>;
-    readExport(path: string, root: ExportRoot, extra: ToolRequestExtra): Promise<{
+    /** Current-chat source: integrity-checked by the bridge, with its real path. */
+    readChatFile(path: string, extra: ToolRequestExtra): Promise<{
+        path?: string | undefined;
         filename: any;
         size: any;
         body: ReadableStream<Uint8Array<ArrayBufferLike>>;
         close: () => Promise<void>;
+    } & {
+        path: string;
     }>;
     private openRead;
     write(path: string, body: ReadableStream<Uint8Array>, extra: ToolRequestExtra): Promise<{

package/dist/agent-ours/file-rpc.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { MAX_CHUNK_BYTES } from './wire.js';
+/** Bridge refusals of a current-chat file that are safe to relay verbatim. */
+const CHAT_FILE_REFUSAL = /^(INVALID_CHAT_FILE_PATH|CHAT_FILE_[A-Z_]{1,40}|FILE_EXCEEDS_20_MIB)$/;
 /** Call-scoped callbacks carry no daemon credentials or upload receipts. */
 export class FileCallbacks {
     wire;
@@ -16,7 +18,7 @@ export class FileCallbacks {
         this.pending.delete(frame.id);
         clearTimeout(p.timer);
         if (frame.error)
-            p.reject(Error('AGENT_FILE_OPERATION_FAILED'));
+            p.reject(Error(typeof frame.error === 'string' && CHAT_FILE_REFUSAL.test(frame.error) ? frame.error : 'AGENT_FILE_OPERATION_FAILED'));
         else
             p.resolve(frame.value);
     }
@@ -61,16 +63,18 @@ export class FileCallbacks {
     async read(path, extra) {
         return this.openRead(path, extra);
     }
-    async readExport(path, root, extra) {
-        return this.openRead(path, extra, root);
+    /** Current-chat source: integrity-checked by the bridge, with its real path. */
+    async readChatFile(path, extra) {
+        return this.openRead(path, extra, true);
     }
-    async openRead(path, extra, root) {
+    async openRead(path, extra, chat = false) {
         const call = String(extra.requestId), handle = randomUUID();
-        const meta = await this.rpc(call, root ? 'export-open' : 'read-open', { path, handle, ...(root ? { root } : {}) }, extra.signal);
+        const meta = await this.rpc(call, chat ? 'export-open' : 'read-open', { path, handle }, extra.signal);
         if (!meta ||
             typeof meta.filename !== 'string' ||
             !Number.isSafeInteger(meta.size) ||
-            meta.size < 0)
+            meta.size < 0 ||
+            (chat && typeof meta.path !== 'string'))
             throw Error('INVALID_FILE_METADATA');
         let closed = false;
         const close = async () => {
@@ -101,7 +105,7 @@ export class FileCallbacks {
             },
             cancel: close,
         });
-        return { filename: meta.filename, size: meta.size, body, close };
+        return { filename: meta.filename, size: meta.size, body, close, ...(chat ? { path: meta.path } : {}) };
     }
     async write(path, body, extra) {
         const call = String(extra.requestId), handle = randomUUID();

package/dist/agent-ours/harness.js

@@ -1,13 +1,10 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { homedir } from 'node:os';
+import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { resolveBundledAcpAgent } from '../harness/acp-agent.js';
 /** Do not pass the supervisor's ours connection credentials to harness children. */
 export function managedChildEnvironment(input) {
     const out = {};
     for (const [key, value] of Object.entries(input)) {
-        if (key === 'FLEET_CURRENT_CHAT_FILES' || value === undefined || (/^OURS_/i.test(key) && !key.startsWith('OURS_FLEET_')))
+        if (value === undefined || (/^OURS_/i.test(key) && !key.startsWith('OURS_FLEET_')))
             continue;
         out[key] = value;
     }
@@ -17,8 +14,6 @@ export function managedChildEnvironment(input) {
 /** Replace ours only; retain the user's ordinary harness configuration and plugins. */
 export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
     const child = managedChildEnvironment({ ...process.env, ...env });
-    if (role.file_delivery?.enabled)
-        qualifyFileHarness(role, cwd, child);
     const bridge = fileURLToPath(new URL('./bridge.js', import.meta.url));
     const server = {
         name: 'ours',
@@ -75,42 +70,3 @@ export function managedClaudeMeta(base) {
         },
     };
 }
-/** Bounded stock-adapter support; opt-in never silently erases unrelated tools. */
-function qualifyFileHarness(role, cwd, child) {
-    if (process.platform !== 'linux')
-        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: Linux required');
-    if (role.session !== 'acp' || role.session_options?.acp?.command)
-        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: stock ACP adapter required');
-    if (role.harness === 'claude-code') {
-        if (resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').version !== '0.63.0')
-            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: qualified Claude ACP 0.63.0 required');
-        const options = role.harness_options ?? {}, servers = options.mcp_servers;
-        if (options.mcp_servers_only !== true || !servers || Object.keys(servers).length !== 1 || !servers.ours)
-            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: Claude requires explicit mcp_servers_only and a single ours connector');
-        return;
-    }
-    if (role.harness !== 'codex' || !child.OURS_FLEET_CODEX_ACP_MANIFEST || child.OURS_FLEET_CODEX_DISABLE_INHERITED_MCP === '1')
-        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: managed Codex inventory proxy required');
-    const config = JSON.parse(child.CODEX_CONFIG ?? '{}');
-    if (config.mcp_servers?.ours?.enabled === false)
-        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: ours MCP disabled');
-    // Public inventory sees effective injected config. Before replacing ours, refuse
-    // inherited TOML connector configuration, including disabled/project/profile
-    // entries. No TOML guessing or override of an operator's explicit disable.
-    const home = child.CODEX_HOME ?? join(child.HOME ?? homedir(), '.codex');
-    const paths = [join(home, 'config.toml')];
-    const profile = role.harness_options?.profile;
-    if (typeof profile === 'string')
-        paths.push(join(home, profile + '.config.toml'));
-    for (let p = resolve(cwd); p !== resolve(child.HOME ?? homedir());) {
-        paths.push(join(p, '.codex/config.toml'));
-        const next = dirname(p);
-        if (next === p)
-            break;
-        p = next;
-    }
-    for (const path of new Set(paths))
-        if (existsSync(path) && /mcp_servers|mcpServers/.test(readFileSync(path, 'utf8')))
-            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: inherited Codex MCP configuration requires inventory support before replacement');
-    child.FLEET_CURRENT_CHAT_FILES = '1';
-}

package/dist/agent-ours/mcp-endpoint.d.ts

@@ -12,7 +12,6 @@ export interface EndpointOptions {
     client: OursClient;
     identities: ApplicationIdentityStore;
     remoteDaemonFiles: boolean;
-    currentChatFileDirectory?: string;
     currentChatFile?: (input: FileDeliveryInput, extra: ToolRequestExtra, files: FileCallbacks) => Promise<DeliveredFile>;
 }
 export declare function startMcpEndpoint(options: EndpointOptions): Promise<{

package/dist/agent-ours/mcp-endpoint.js

@@ -7,8 +7,9 @@ import { JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
 import { FileCallbacks } from './file-rpc.js';
 import { Wire } from './wire.js';
 export async function startMcpEndpoint(options) {
+    // Every managed Agent offers current-chat delivery, so a package without the contract is a broken install, not a quiet downgrade.
     if (options.currentChatFile && managedMcp.MANAGED_FILE_DELIVERY_VERSION !== 1)
-        throw Error('INCOMPATIBLE_MANAGED_FILE_DELIVERY');
+        throw Error('INCOMPATIBLE_MANAGED_FILE_DELIVERY: installed @ours.network/mcp lacks MANAGED_FILE_DELIVERY_VERSION 1; reinstall Fleet with its pinned @ours.network/mcp');
     const sockets = new Set();
     const server = createServer((socket) => {
         if (sockets.size >= 4) {
@@ -36,7 +37,7 @@ export async function startMcpEndpoint(options) {
         };
         const mcp = createManagedOursMcpServer(options.client, 'managed-v1', options.identities, {
             remoteDaemonFiles: options.remoteDaemonFiles,
-            ...(options.currentChatFile ? { currentChatFileDirectory: options.currentChatFileDirectory, currentChatFile: (input, extra) => options.currentChatFile(input, extra, files) } : {}),
+            ...(options.currentChatFile ? { currentChatFile: (input, extra) => options.currentChatFile(input, extra, files) } : {}),
             fileContext: files,
             admit: async () => {
                 if (!authenticated || inFlight >= 32)

package/dist/agent-ours/service.d.ts

@@ -1,6 +1,8 @@
 import type { AgentSession } from '../session/types.js';
+import { ArtifactStore } from '../file-delivery/store.js';
 import type { ResolvedRole } from '../config.js';
 import { AgentOursRuntime } from './runtime.js';
+import { startMcpEndpoint } from './mcp-endpoint.js';
 export declare const privateRuntimeRoot: () => string;
 export interface ManagedAgentService {
     runtime: AgentOursRuntime;
@@ -9,6 +11,19 @@ export interface ManagedAgentService {
     setFileDelivery?(sender: AgentSession['sendFileToChat']): void;
     close(terminal: boolean): Promise<void>;
 }
+/**
+ * `send_file` without a contact, offered to every managed Agent with no Agent
+ * setting and no export directory. A backend without a tracked ACP turn gets a
+ * precise refusal instead of a missing tool.
+ */
+export declare function currentChatFileHandler(options: {
+    role: Pick<ResolvedRole, 'harness' | 'session' | 'permissions'>;
+    cwd: string;
+    store: Pick<ArtifactStore, 'copy'>;
+    sender: () => AgentSession['sendFileToChat'];
+    /** Fleet's own credentials and stored attachments are never chat content. */
+    privateState: string[];
+}): NonNullable<Parameters<typeof startMcpEndpoint>[0]['currentChatFile']>;
 /** Only trusted launch orchestration may write this descriptor, never the child. */
 export declare function storeRoomSecret(role: ResolvedRole): void;
 export declare function storeTemporaryLaunch(role: ResolvedRole, action: string): void;

package/dist/agent-ours/service.js

@@ -1,4 +1,4 @@
-import { pinExportRoot, exportPath, ensureExportDirectory } from '../file-delivery/reader.js';
+import { chatFilePath } from '../file-delivery/reader.js';
 import { ArtifactStore } from '../file-delivery/store.js';
 import { resolve, basename, extname } from 'node:path';
 import { socketPath as privateSocketPath } from '../socket-path.js';
@@ -16,6 +16,42 @@ import { atomicPrivateWrite, binderKey } from './state.js';
 import { AgentOursRuntime } from './runtime.js';
 import { startMcpEndpoint } from './mcp-endpoint.js';
 export const privateRuntimeRoot = () => join(stateRoot(), 'private-ours');
+/**
+ * `send_file` without a contact, offered to every managed Agent with no Agent
+ * setting and no export directory. A backend without a tracked ACP turn gets a
+ * precise refusal instead of a missing tool.
+ */
+export function currentChatFileHandler(options) {
+    const { role, cwd, store } = options, privateState = options.privateState.map(p => resolve(p));
+    const isPrivate = (path) => privateState.some(p => path === p || path.startsWith(p + '/'));
+    return async (input, extra, files) => {
+        if (role.session !== 'acp' || !['codex', 'claude-code'].includes(role.harness))
+            throw Error(`CURRENT_CHAT_DELIVERY_UNAVAILABLE: sending a file to this chat requires a Codex or Claude ACP session; this Agent runs ${role.harness}/${role.session}. Pass contact to send through Ours instead`);
+        const sender = options.sender();
+        if (!sender)
+            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: this session has no ACP chat to attach to');
+        if (isPrivate(chatFilePath(cwd, input.path)))
+            throw Error('PRIVATE_STATE_CANNOT_BE_SENT'); // before approval/read
+        const name = input.filename ?? basename(input.path);
+        if (!name || Buffer.byteLength(name) > 240 || /[\/\\\x00-\x1f]/.test(name) || name === '.' || name === '..')
+            throw Error('INVALID_FILENAME');
+        const mime = input.mime ?? { '.txt': 'text/plain', '.md': 'text/markdown', '.pdf': 'application/pdf', '.json': 'application/json', '.html': 'text/html', '.png': 'image/png' }[extname(name).toLowerCase()] ?? 'application/octet-stream';
+        if (mime.length > 200 || !/^[A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+$/.test(mime))
+            throw Error('INVALID_MIME');
+        return sender(input, extra.signal, async (binding) => {
+            const source = await files.readChatFile(input.path, extra);
+            try {
+                // The bridge reports the opened file's real path, so a symlinked ancestor cannot reach private state.
+                if (isPrivate(source.path))
+                    throw Error('PRIVATE_STATE_CANNOT_BE_SENT');
+                return await store.copy(source, name, mime, binding, extra.signal);
+            }
+            finally {
+                await source.close();
+            }
+        }, role.permissions);
+    };
+}
 function roomSecretPath(role) {
     const startup = role.roomMemberStartup;
     return join(privateRuntimeRoot(), 'room-inputs', binderKey(startup.room_identity_cid, JSON.stringify([role.name, startup.invite_id])) + '.json');
@@ -98,7 +134,6 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
     }
     const controller = await RuntimeController.acquire(root, profile.expectedInstanceId, role.identity, instance);
     let closeClient;
-    let exportRoot;
     let fileSender;
     let partialEndpoint;
     try {
@@ -217,17 +252,6 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         mkdirSync(bridgeDir, { recursive: true, mode: 0o700 });
         const capability = randomBytes(32).toString('hex'), socket = privateSocketPath(join(bridgeDir, `g${generation}.sock`));
         const cwd = role.cwd && existsSync(role.cwd) ? resolve(role.cwd) : resolve(stateDir);
-        if (role.file_delivery?.enabled) {
-            if (role.session !== 'acp' || !['codex', 'claude-code'].includes(role.harness))
-                throw Error('FILE_DELIVERY_REQUIRES_CODEX_OR_CLAUDE_ACP');
-            const rootPath = resolve(cwd, role.file_delivery.directory);
-            const forbidden = [privateRuntimeRoot(), join(stateRoot(), 'private-file-delivery'), profile.configPath, profile.credentialPath];
-            if (forbidden.some(p => rootPath === resolve(p) || rootPath.startsWith(resolve(p) + '/') || resolve(p).startsWith(rootPath + '/')))
-                throw Error('PRIVATE_STATE_CANNOT_BE_EXPORTED');
-            await ensureExportDirectory(cwd, role.file_delivery.directory);
-            exportRoot = await pinExportRoot(rootPath);
-        }
-        const artifactStore = new ArtifactStore(stateDir);
         const endpoint = await startMcpEndpoint({
             socket,
             capability,
@@ -236,26 +260,10 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
             client,
             identities,
             remoteDaemonFiles: true,
-            ...(exportRoot ? { currentChatFileDirectory: role.file_delivery.directory, currentChatFile: (async (input, extra, files) => {
-                    if (!fileSender || !exportRoot)
-                        throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE');
-                    exportPath(exportRoot.root, cwd, input.path); // validate before approval/read
-                    const name = input.filename ?? basename(input.path);
-                    if (!name || Buffer.byteLength(name) > 240 || /[\/\\\x00-\x1f]/.test(name) || name === '.' || name === '..')
-                        throw Error('INVALID_FILENAME');
-                    const mime = input.mime ?? { '.txt': 'text/plain', '.md': 'text/markdown', '.pdf': 'application/pdf', '.json': 'application/json', '.html': 'text/html', '.png': 'image/png' }[extname(name).toLowerCase()] ?? 'application/octet-stream';
-                    if (mime.length > 200 || !/^[A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+$/.test(mime))
-                        throw Error('INVALID_MIME');
-                    return fileSender(input, extra.signal, async (binding) => {
-                        const source = await files.readExport(input.path, exportRoot.root, extra);
-                        try {
-                            return await artifactStore.copy(source, name, mime, binding, extra.signal);
-                        }
-                        finally {
-                            await source.close();
-                        }
-                    }, role.permissions);
-                }) } : {}),
+            currentChatFile: currentChatFileHandler({
+                role, cwd, store: new ArtifactStore(stateDir), sender: () => fileSender,
+                privateState: [privateRuntimeRoot(), join(stateRoot(), 'private-file-delivery'), profile.configPath, profile.credentialPath],
+            }),
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
@@ -269,7 +277,6 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
                 try {
                     fileSender = undefined;
                     await endpoint.close();
-                    await exportRoot?.handle.close();
                     if (terminal)
                         await runtime.terminal();
                     else
@@ -289,7 +296,6 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
     catch (error) {
         try {
             await partialEndpoint?.close();
-            await exportRoot?.handle.close();
         }
         finally {
             try {

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.57",
-  "buildId": "e1efd9a9bfd5",
-  "commit": "c94b8b63da1f7f0bab4ba1dec0c43a9e455b2366",
+  "version": "1.2.0-nightly.58",
+  "buildId": "724339272df9",
+  "commit": "adcfbe7c6d818a2068b0d22274c39bc66f159c9a",
   "dirty": true,
-  "builtAt": "2026-10-10T18:15:52.108Z",
+  "builtAt": "2026-10-13T06:33:11.731Z",
   "capabilities": [
     "managed-cli.codex-reasoning-effort-v1",
     "managed-cli.setup-v1",

package/dist/config.d.ts

@@ -42,10 +42,16 @@ export type MonitorInterrupt = boolean | 'after_tool';
  */
 export declare const MANAGED_CLI_WORKFLOW_IDS: readonly ["task-workflow"];
 export type ManagedCliWorkflowId = (typeof MANAGED_CLI_WORKFLOW_IDS)[number];
+/** Retired opt-in. Both keys are accepted so existing manifests load, and neither has any effect. */
 export interface FileDeliveryConfig {
-    enabled: boolean;
-    directory: string;
+    enabled?: boolean;
+    directory?: string;
 }
+/**
+ * Current-chat file delivery is on for every Agent and takes the path the Agent
+ * provides. A legacy block is shape-checked only: `enabled: false` does not turn
+ * delivery off and `directory` does not restrict or create anything.
+ */
 export declare function validateFileDelivery(value: unknown): FileDeliveryConfig | undefined;
 export interface CommonPermissions {
     approval: ApprovalMode;
@@ -159,7 +165,7 @@ export interface RoleConfig {
     auth_proxy?: Partial<AuthProxyConfig>;
     /** Fleet-prepared CLI workflows this role may run outside its command sandbox. */
     managed_cli?: ManagedCliWorkflowId[];
-    /** Explicit per-Agent export opt-in; not inherited from manifest defaults. */
+    /** Retired and ignored; current-chat file delivery needs no Agent setting. */
     file_delivery?: FileDeliveryConfig;
 }
 export type AgentSelection<T extends Record<string, unknown> = Record<string, unknown>> = {
@@ -184,7 +190,7 @@ export interface AgentDefinition {
     auth_proxy?: Partial<AuthProxyConfig>;
     /** Fleet-prepared CLI workflows this Agent may run outside its command sandbox. */
     managed_cli?: ManagedCliWorkflowId[];
-    /** Explicit per-Agent export opt-in; not inherited from manifest defaults. */
+    /** Retired and ignored; current-chat file delivery needs no Agent setting. */
     file_delivery?: FileDeliveryConfig;
     /** Scheduled turns scoped only to temporary launches; persistent Agents reject this field. */
     loops?: AgentLoopsConfig;

package/dist/config.js

@@ -29,13 +29,18 @@ export const NOTIFY_EVENT_TYPES = [
  * Agent; never inferred from a role's name or persona, and never inherited.
  */
 export const MANAGED_CLI_WORKFLOW_IDS = ['task-workflow'];
+/**
+ * Current-chat file delivery is on for every Agent and takes the path the Agent
+ * provides. A legacy block is shape-checked only: `enabled: false` does not turn
+ * delivery off and `directory` does not restrict or create anything.
+ */
 export function validateFileDelivery(value) {
     if (value === undefined)
         return undefined;
     if (!isPlainObject(value) || Object.keys(value).some(k => !['enabled', 'directory'].includes(k))
-        || typeof value.enabled !== 'boolean' || typeof value.directory !== 'string'
-        || !value.directory || value.directory.split('/').some(p => !p || p.startsWith('.') || /[\\\x00-\x1f]/.test(p)))
-        throw new ConfigError('file_delivery requires enabled:boolean and a relative non-hidden directory');
+        || (value.enabled !== undefined && typeof value.enabled !== 'boolean')
+        || (value.directory !== undefined && typeof value.directory !== 'string'))
+        throw new ConfigError('file_delivery is retired and ignored; it accepts only the legacy enabled:boolean and directory:string keys');
     return value;
 }
 /** Default wake sources when a role does not list its own. */

package/dist/file-delivery/reader.d.ts

@@ -1,17 +1,15 @@
 import { type FileHandle } from 'node:fs/promises';
 export declare const MAX_FILE_BYTES: number;
-export interface ExportRoot {
-    path: string;
-    dev: number;
-    ino: number;
-}
 /** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
 export declare function openDirectory(path: string): Promise<FileHandle>;
-export declare function pinExportRoot(path: string): Promise<{
-    root: ExportRoot;
-    handle: FileHandle;
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export declare function chatFilePath(cwd: string, input: string): string;
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export declare function openChatFile(cwd: string, input: string): Promise<{
+    file: FileHandle;
+    path: string;
 }>;
-export declare function exportPath(root: ExportRoot, cwd: string, input: string): string[];
-/** Runs in the harness bridge, never in the supervisor's OS context. */
-export declare function openExportFile(root: ExportRoot, cwd: string, input: string): Promise<FileHandle>;
-export declare function ensureExportDirectory(cwd: string, directory: string): Promise<void>;

package/dist/file-delivery/reader.js

@@ -1,6 +1,6 @@
 import { constants } from 'node:fs';
-import { mkdir, open } from 'node:fs/promises';
-import { isAbsolute, relative, resolve } from 'node:path';
+import { open, readlink } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
 export const MAX_FILE_BYTES = 20 * 1024 * 1024;
 const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
 /** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
@@ -21,74 +21,43 @@ export async function openDirectory(path) {
         throw error;
     }
 }
-export async function pinExportRoot(path) {
-    const handle = await openDirectory(path);
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export function chatFilePath(cwd, input) {
+    if (typeof input !== 'string' || !input || input.length > 4096 || /[\x00-\x1f]/.test(input))
+        throw Error('INVALID_CHAT_FILE_PATH');
+    return resolve(cwd, input);
+}
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export async function openChatFile(cwd, input) {
+    if (process.platform !== 'linux')
+        throw Error('CHAT_FILE_REQUIRES_LINUX');
+    let file;
     try {
-        const stat = await handle.stat();
-        if (stat.uid !== process.getuid?.() || (stat.mode & 0o022))
-            throw Error('EXPORT_ROOT_NOT_PRIVATE_OWNED');
-        return { root: { path, dev: stat.dev, ino: stat.ino }, handle };
+        file = await open(chatFilePath(cwd, input), FLAGS);
     }
     catch (error) {
-        await handle.close();
-        throw error;
-    }
-}
-export function exportPath(root, cwd, input) {
-    if (!input || input.length > 4096 || /[\\\x00-\x1f]/.test(input) || input.split('/').some(p => p === '.' || p === '..' || !p) && !isAbsolute(input))
-        throw Error('INVALID_EXPORT_PATH');
-    if (input.split('/').some(p => p === '..' || p === '.'))
-        throw Error('INVALID_EXPORT_PATH');
-    const path = relative(root.path, resolve(cwd, input));
-    const parts = path.split('/');
-    if (!path || isAbsolute(path) || parts.some(p => !p || p === '..' || p === '.' || p.startsWith('.') || /^(credentials?|secrets?|tokens?)(\.|$)/i.test(p)))
-        throw Error('OUTSIDE_EXPORT_DIRECTORY');
-    return parts;
-}
-/** Runs in the harness bridge, never in the supervisor's OS context. */
-export async function openExportFile(root, cwd, input) {
-    const parts = exportPath(root, cwd, input);
-    let dir = await openDirectory(root.path);
-    try {
-        const stat = await dir.stat();
-        if (stat.dev !== root.dev || stat.ino !== root.ino)
-            throw Error('EXPORT_ROOT_CHANGED');
-        for (const part of parts.slice(0, -1)) {
-            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
-            await dir.close();
-            dir = next;
-        }
-        const file = await open(`/proc/self/fd/${dir.fd}/${parts.at(-1)}`, FLAGS);
-        try {
-            const stat = await file.stat();
-            if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || stat.size > MAX_FILE_BYTES)
-                throw Error('INVALID_EXPORT_FILE');
-            return file;
-        }
-        catch (error) {
-            await file.close();
+        const code = error.code;
+        if (error instanceof Error && error.message === 'INVALID_CHAT_FILE_PATH')
             throw error;
-        }
-    }
-    finally {
-        await dir.close();
+        throw Error(code === 'ELOOP' ? 'CHAT_FILE_IS_SYMLINK' : code === 'ENOENT' || code === 'ENOTDIR' ? 'CHAT_FILE_NOT_FOUND'
+            : code === 'EACCES' || code === 'EPERM' ? 'CHAT_FILE_NOT_READABLE' : 'CHAT_FILE_OPEN_FAILED');
     }
-}
-export async function ensureExportDirectory(cwd, directory) {
-    let dir = await openDirectory(cwd);
     try {
-        for (const part of directory.split('/')) {
-            if (!part || part.startsWith('.') || /[\\\x00-\x1f]/.test(part))
-                throw Error('INVALID_EXPORT_DIRECTORY');
-            const path = `/proc/self/fd/${dir.fd}/${part}`;
-            await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
-                throw error; });
-            const next = await open(path, FLAGS | constants.O_DIRECTORY);
-            await dir.close();
-            dir = next;
-        }
+        const stat = await file.stat();
+        if (!stat.isFile())
+            throw Error('CHAT_FILE_NOT_REGULAR');
+        if (stat.nlink !== 1)
+            throw Error('CHAT_FILE_HARDLINKED');
+        if (stat.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        return { file, path: await readlink(`/proc/self/fd/${file.fd}`) };
     }
-    finally {
-        await dir.close();
+    catch (error) {
+        await file.close();
+        throw error;
     }
 }

package/dist/harness/codex-app-server-proxy.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { CodexFileInventory } from './codex-file-inventory.js';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createInterface } from 'node:readline';
@@ -447,7 +446,6 @@ export function runCodexAppServerProxy() {
             });
         }
     };
-    const inventory = process.env.FLEET_CURRENT_CHAT_FILES === '1' ? new CodexFileInventory(writeToChild, writeToClient) : undefined;
     const recovery = new CodexTerminalRecovery({
         sendToCodex: writeToChild,
         emitToClient: writeToClient,
@@ -458,7 +456,6 @@ export function runCodexAppServerProxy() {
             return;
         finished = true;
         recovery.close();
-        inventory?.close();
         input.close();
         process.stdin.destroy();
         // stdout/stderr are often pipes under Fleet and tests. Setting exitCode
@@ -491,11 +488,10 @@ export function runCodexAppServerProxy() {
             return;
         const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
-        if (!inventory || inventory.observeClientLine(rewritten))
-            writeToChild(rewritten);
+        writeToChild(rewritten);
     });
     output.on('line', line => {
-        if (!finished && (!inventory || inventory.observeServerLine(line)) && recovery.observeServerLine(line))
+        if (!finished && recovery.observeServerLine(line))
             writeToClient(line);
     });
     input.once('close', () => {

package/dist/harness/codex.js

@@ -262,7 +262,6 @@ function codexAcpEnvironment(role, dirs) {
     if (!source)
         throw new Error('Codex app-server proxy is missing; rebuild ours-fleet');
     writeFileSync(proxyModule, readFileSync(source, 'utf8'), { mode: 0o600 });
-    writeFileSync(join(runtimeDir, 'codex-file-inventory.js'), readFileSync(join(dirname(source), 'codex-file-inventory.js'), 'utf8'), { mode: 0o600 });
     const windows = process.platform === 'win32';
     const command = join(runtimeDir, windows ? 'codex-app-server-proxy.cmd' : 'codex-app-server-proxy');
     const script = windows
@@ -483,7 +482,7 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
                     catch (error) {
                         throw new Error(`Codex ACP runtime check failed: ${error.message}; check CODEX_PATH or reinstall Fleet with optional dependencies`);
                     }
-                    const minimum = role.file_delivery?.enabled ? '0.159.0' : role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
+                    const minimum = role.model === 'gpt-6-astra' || resolution.version === '1.10.0'
                         ? '0.153.3' : '0.145.0';
                     if (!codexVersionAtLeast(runtime.version, minimum))
                         throw new Error(`${role.model ?? 'Codex ACP'} requires a newer Codex (>=${minimum}): ACP selects ${runtime.executable} (${runtime.version}); upgrade Fleet or set CODEX_PATH to a supported executable in the agent/service environment`);

package/docs/acp-files.md

@@ -1,22 +1,24 @@
 # Sending files in an ACP chat
 
-An opted-in managed Agent uses the existing Ours `send_file` tool:
+Every managed Agent can attach a file to its current ACP chat with the existing
+Ours `send_file` tool. No Agent setting turns this on and no export directory is
+configured or created:
 
 ```json
-{"path":"deliverables/report.pdf"}
+{"path":"/home/me/project/build/report.pdf"}
 ```
 
 Omitting `contact` sends to the current ACP chat. Supplying a non-empty contact
 keeps ordinary Ours delivery:
 
 ```json
-{"contact":"Alice","path":"deliverables/report.pdf"}
+{"contact":"Alice","path":"build/report.pdf"}
 ```
 
 Only an absent contact chooses the chat. Null, empty or whitespace-only contacts,
-unknown fields and unknown recipients fail without falling back to chat. Outside
-opt-in, contact remains required. Current-chat sending accepts `path`, optional
-`filename` and `mime`; inline base64 and Ours reply fields are unsupported.
+unknown fields and unknown recipients fail without falling back to chat.
+Current-chat sending accepts `path`, optional `filename` and `mime`; inline
+base64 and Ours reply fields are unsupported.
 
 Each call makes one attempt. Failures are returned to the agent. There is no
 request ID, deduplication, automatic retry or recovery of failed sends. If a user
@@ -24,52 +26,84 @@ asks to resend, another tool call makes a new attempt and can produce another
 attachment. UUIDs identify stored attachments; the stored SHA-256 checks integrity.
 Neither is a retry key.
 
-Set this on the Agent definition, not manifest defaults or a Brain:
+## Paths
+
+The Agent passes the path of the file it wants to send. Relative paths resolve
+from the Agent's working directory; `..`, absolute paths, hidden directories and
+symlinked parent directories are all accepted. The file does not have to be
+inside the working directory or any particular subtree. It is opened by the
+Fleet bridge inside the Agent's own OS sandbox, so the Agent can send exactly
+what it can already read.
+
+The file itself must pass ordinary integrity checks, each with its own result:
+
+| Result | Meaning |
+| --- | --- |
+| `CHAT_FILE_NOT_FOUND` | nothing exists at the path |
+| `CHAT_FILE_NOT_READABLE` | the Agent's OS user or sandbox cannot read it |
+| `CHAT_FILE_IS_SYMLINK` | the named file is itself a symlink; pass its target |
+| `CHAT_FILE_HARDLINKED` | the file has more than one hard link |
+| `CHAT_FILE_NOT_REGULAR` | a directory, FIFO, socket or device |
+| `FILE_EXCEEDS_20_MIB` | larger than the 20 MiB limit |
+| `CHAT_FILE_CHANGED` / `SOURCE_SIZE_CHANGED` | modified while it was being read; finish writing first |
+| `CHAT_FILE_REQUIRES_LINUX` | the Agent's bridge is not running on Linux |
+| `PRIVATE_STATE_CANNOT_BE_SENT` | Fleet's own credentials, connector profile or stored attachments |
+
+`PRIVATE_STATE_CANNOT_BE_SENT` covers only Fleet's private Ours runtime
+directory, its attachment store and the connector profile and credential files,
+checked on the provided path before approval and on the opened file's real path
+afterwards. It is not configurable and is not a general path policy.
+
+## Supported sessions
+
+Current-chat delivery needs Linux, the managed Ours connector and a Codex or
+Claude ACP session with a tracked active turn. Those Agents need no special
+`harness_options`, MCP restriction or clean configuration home: inherited and
+additional MCP connectors stay as they are, and Fleet's bound bridge is the
+`ours` connector as it already is for every managed Agent.
+
+Any other backend still sees the optional `contact`, and omitting it returns a
+precise result rather than a missing tool:
 
-```yaml
-file_delivery:
-  enabled: true
-  directory: deliverables
 ```
+CURRENT_CHAT_DELIVERY_UNAVAILABLE: sending a file to this chat requires a Codex or Claude ACP session; this Agent runs <harness>/<session>. Pass contact to send through Ours instead
+```
+
+Idle, scheduled, steered, cancelled and replaced turns return
+`CURRENT_CHAT_DELIVERY_UNAVAILABLE`; a second send while one is in progress
+returns `FILE_DELIVERY_BUSY`.
+
+A file is published only for a call that arrives over the Agent's
+capability-authenticated bridge and binds to the turn that is live in that
+Agent's own session. Connector inventory is not consulted, so unrelated or
+similarly named connectors neither enable nor block delivery.
 
-The tool description advertises this directory and the 20 MiB limit to the Agent.
-The directory is a non-hidden subtree of the Agent's working directory. Both
-routes interpret relative paths from that working directory; absolute paths keep
-their usual meaning. Chat sending additionally enforces the export directory.
-The Agent should finish writing the file before calling `send_file`. Symlinks,
-hardlinks, hidden/credential paths, changed files and files over 20 MiB fail.
-
-Initial support requires Linux, the managed Ours connector, a stock Codex or
-Claude ACP adapter, and a tracked active turn. Idle, scheduled, steered, cancelled,
-replaced and unsupported sessions cannot export. Existing native tool approval
-and the neutral role permission policy both apply before bytes are read. An
-`ask` decision needs an attached controller; `deny` refuses. A native policy that
-refuses MCP execution (including Codex `never` without a native tool allowance)
-can still refuse before Fleet receives the call.
-
-Codex requires native runtime 0.159.0 or newer and Fleet's managed App Server
-proxy. Before each turn, its public exact-thread, paginated MCP inventory must
-show a connected managed `ours` with the expected optional-contact schema.
-Ours aliases, filtered aliases, ambiguous identity, failed discovery and an
-incompatible schema make the turn unavailable. Unrelated identified tools are
-preserved. Explicitly disabled Ours is rejected before replacement. Inherited
-TOML MCP settings, including project/profile sources, are conservatively
-unsupported until their disabling semantics can be qualified before replacement.
-Use a clean Codex configuration home for this initial opt-in.
-
-Claude ACP 0.63.0's installed wrapper has no public same-session inventory RPC. Initial
-support therefore requires an operator's explicit restricted MCP configuration:
+## Permissions
+
+Existing native tool approval and the neutral role permission policy both apply
+before bytes are read. With `approval: allow`, a path inside the role's
+`filesystem` boundary is allowed automatically; a path outside it is put to the
+attached controller like any other out-of-boundary request, and is denied when
+nobody is attached and `unattended: deny`. An `ask` decision needs an attached
+controller; `deny` refuses with `CURRENT_CHAT_DELIVERY_UNAVAILABLE`, and a
+declined request returns `FILE_SEND_DENIED`. A native policy that refuses MCP
+execution (including Codex `never` without a native tool allowance) can still
+refuse before Fleet receives the call.
+
+## Retired configuration
+
+`file_delivery` is retired. An existing block still loads so manifests need no
+edit, and has no effect:
 
 ```yaml
-harness_options:
-  mcp_servers_only: true
-  mcp_servers:
-    ours: { command: ours-mcp, args: [proxy] }
+file_delivery:
+  enabled: false        # ignored: delivery stays available
+  directory: deliverables   # ignored: not created, not enforced
 ```
 
-Fleet replaces that connector with its bound bridge. Additional explicit MCP
-servers and custom ACP commands are unsupported for this feature. Default-off
-Agents retain their existing configuration.
+Remove it at your convenience. Unknown keys inside it are still rejected.
+
+## Storage and download
 
 Successful sends copy complete bytes into private immutable storage and append a
 server-origin `file.attached` event containing the actual session generation,
@@ -90,13 +124,23 @@ saving after a workspace change.
 
 This source requires the companion MCP implementation's
 `MANAGED_FILE_DELIVERY_VERSION = 1`. Fleet pins published
-`@ours.network/mcp@1.2.0-nightly.13`, which includes it. Older MCP packages without
-this capability fail closed when file delivery is enabled. Changes to the MCP
-pin require clean installed-package qualification without a built MCP overlay.
-
-The deterministic native fixture uses real ACP adapters, the real managed
-connector and an isolated daemon. A local scripted provider supplies only tool
-intents; approval, read, copy, publication and bytes come from the implementation.
-It does not qualify external-model inference, deployment or arbitrary native
-MCP request-to-ACP tool-call ID mapping. Correlation is the authenticated bridge
-and the actual active Fleet turn, which is revoked by cancellation/steering.
+`@ours.network/mcp@1.2.0-nightly.13`, which includes it and already treats the
+export-directory hint as optional, so default delivery needs no MCP change. An
+installed MCP package without the capability fails Agent startup with
+`INCOMPATIBLE_MANAGED_FILE_DELIVERY` instead of quietly requiring a contact.
+Changes to the MCP pin require clean installed-package qualification without a
+built MCP overlay.
+
+The deterministic native fixture (`test/file-delivery-native.integration.mjs`)
+uses real ACP adapters, the real managed connector and an isolated daemon. Its
+Agent has no `file_delivery` block and no MCP restriction, and it sends a file
+from a hidden directory outside the working directory. It then downloads the
+generated attachment over the authenticated HTTP route and compares bytes and
+SHA-256, after checking that an anonymous and a forged-cookie request are
+refused. `FLEET_FILE_NATIVE_VARIANT=connectors` adds unrelated MCP connectors
+and requires them to stay usable. A local scripted provider supplies only tool
+intents; approval, read, copy, publication and bytes come from the
+implementation. It does not qualify external-model inference, deployment or
+arbitrary native MCP request-to-ACP tool-call ID mapping. Correlation is the
+authenticated bridge and the actual active Fleet turn, which is revoked by
+cancellation/steering.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.57",
+  "version": "1.2.0-nightly.58",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/dist/harness/codex-file-inventory.d.ts

@@ -1,15 +0,0 @@
-export declare class CodexFileInventory {
-    private readonly sendToCodex;
-    private readonly emitToClient;
-    private checks;
-    private sequence;
-    constructor(sendToCodex: (line: string) => void, emitToClient: (line: string) => void);
-    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
-    observeClientLine(line: string): boolean;
-    observeServerLine(line: string): boolean;
-    close(): void;
-    private query;
-    private qualified;
-    private finish;
-    private reject;
-}

package/dist/harness/codex-file-inventory.js

@@ -1,113 +0,0 @@
-const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-const parse = (line) => { try {
-    const v = JSON.parse(line);
-    return object(v) ? v : undefined;
-}
-catch {
-    return undefined;
-} };
-export class CodexFileInventory {
-    sendToCodex;
-    emitToClient;
-    checks = new Map();
-    sequence = 0;
-    constructor(sendToCodex, emitToClient) {
-        this.sendToCodex = sendToCodex;
-        this.emitToClient = emitToClient;
-    }
-    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
-    observeClientLine(line) {
-        const message = parse(line);
-        if (message?.method !== 'turn/start')
-            return true;
-        const threadId = object(message.params) ? message.params.threadId : undefined;
-        if (typeof threadId !== 'string' || !threadId || message.id === undefined || this.checks.size >= 8) {
-            this.reject(message);
-            return false;
-        }
-        const check = { request: message, threadId, servers: [], cursors: new Set(), timer: setTimeout(() => {
-                for (const [id, c] of this.checks)
-                    if (c === check)
-                        this.checks.delete(id);
-                this.reject(message);
-            }, 30_000) };
-        this.query(check);
-        return false;
-    }
-    observeServerLine(line) {
-        const message = parse(line), id = message?.id;
-        if (typeof id !== 'string')
-            return true;
-        const check = this.checks.get(id);
-        if (!check)
-            return true;
-        this.checks.delete(id);
-        const result = message?.result;
-        if (!object(result) || !Array.isArray(result.data) || result.data.some(s => !object(s)) || check.servers.length + result.data.length > 1000) {
-            this.finish(check, false);
-            return false;
-        }
-        check.servers.push(...result.data);
-        if (result.nextCursor !== null) {
-            const cursor = result.nextCursor;
-            if (typeof cursor !== 'string' || !cursor || check.cursors.has(cursor) || check.cursors.size >= 10)
-                this.finish(check, false);
-            else {
-                check.cursors.add(cursor);
-                this.query(check, cursor);
-            }
-            return false;
-        }
-        this.finish(check, this.qualified(check.servers));
-        return false;
-    }
-    close() { for (const c of this.checks.values())
-        clearTimeout(c.timer); this.checks.clear(); }
-    query(check, cursor) {
-        const id = `ours-fleet-file-inventory-${++this.sequence}`;
-        this.checks.set(id, check);
-        this.sendToCodex(JSON.stringify({ id, method: 'mcpServerStatus/list', params: { threadId: check.threadId, detail: 'full', limit: 100, ...(cursor ? { cursor } : {}) } }));
-    }
-    qualified(servers) {
-        let managed = 0;
-        for (const server of servers) {
-            // Unknown or failed discovery cannot establish absence of another connector.
-            if (server.toolsError !== null || !object(server.tools))
-                return false;
-            if (!object(server.serverInfo) || typeof server.serverInfo.name !== 'string')
-                return false;
-            const tools = Object.values(server.tools).filter(object);
-            const names = new Set(tools.map(t => t.name));
-            if (server.name !== 'ours') {
-                if (server.serverInfo.name === 'ours')
-                    return false;
-                if (tools.some(t => t.name === 'send_file' && object(t.inputSchema) && object(t.inputSchema.properties) && 'contact' in t.inputSchema.properties))
-                    return false;
-                if (names.has('current_identity') && names.has('send_file') && names.has('get_messages'))
-                    return false;
-                continue;
-            }
-            managed++;
-            if (server.serverInfo.name !== 'ours' || server.runtimeStatus !== 'connected')
-                return false;
-            const files = tools.filter(t => t.name === 'send_file');
-            if (files.length !== 1 || !object(files[0].inputSchema))
-                return false;
-            const schema = files[0].inputSchema;
-            if (!object(schema.properties) || !object(schema.properties.contact) || schema.additionalProperties !== false
-                || (Array.isArray(schema.required) && schema.required.includes('contact')))
-                return false;
-        }
-        return managed === 1;
-    }
-    finish(check, allowed) {
-        clearTimeout(check.timer);
-        if (allowed)
-            this.sendToCodex(JSON.stringify(check.request));
-        else
-            this.reject(check.request);
-    }
-    reject(request) {
-        this.emitToClient(JSON.stringify({ id: request.id, error: { code: -32000, message: 'CURRENT_CHAT_DELIVERY_UNAVAILABLE: unqualified MCP inventory' } }));
-    }
-}