@ours.network/fleet 1.2.0-nightly.57 → 1.2.0-nightly.59

package/dist/session/codex-app-server.js

@@ -5,6 +5,7 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { boundedJson } from './conversation-normalizer.js';
 import { ConversationEventStore } from './conversation-store.js';
 import { SessionEvents } from './events.js';
+import { memberAuthority, memberBindings, pendingInventory, takeBatch, } from './prompt-batch.js';
 import { CodexAppServerTransport } from './codex-app-server-transport.js';
 import { CODEX_APP_SERVER_CANCEL_DEADLINE_EXCEEDED, SessionControlError, sessionBackendCapabilities, turnResult, } from './types.js';
 const PERMISSION_TIMEOUT_MS = 10 * 60_000;
@@ -75,6 +76,31 @@ export function nativePromptAdditionalContext(origin) {
         };
     return undefined;
 }
+const PROMPT_BATCH_CONTEXT_KEY = 'ours-fleet://prompt-batch';
+/**
+ * Application context for a turn that carries several admitted prompts.
+ *
+ * The single-prompt context says "the accompanying user text", which would
+ * cover every member. A shared turn therefore carries this one entry instead:
+ * each member is its own user text item, in order, and its route and exact
+ * bytes are stated here by the server. Text imitating this wording is still
+ * only user text; it cannot add an application-context entry.
+ */
+export function nativeBatchAdditionalContext(members) {
+    if (members.length === 1)
+        return nativePromptAdditionalContext(members[0].origin);
+    const bindings = memberBindings(members, origin => sourceFor(origin).source);
+    return {
+        [PROMPT_BATCH_CONTEXT_KEY]: {
+            kind: 'application',
+            value: `Fleet queued prompt batch: ${members.length} separately admitted prompts in submission order, `
+                + 'one user text item each. Server-generated provenance per item, describing only that item: '
+                + bindings.map(binding => `item ${binding.index} of ${binding.of} `
+                    + `(source=${binding.source}, bytes=${binding.bytes}, sha256=${binding.sha256}): `
+                    + `${memberAuthority(binding.source)}`).join('; ') + '.',
+        },
+    };
+}
 function toolItem(item) {
     switch (item.type) {
         case 'commandExecution': return {
@@ -123,6 +149,10 @@ export class CodexAppServerSession {
     exit = null;
     queueDepth = 0;
     promptTail = Promise.resolve();
+    /** Admitted prompts not yet handed to the app-server, in admission order. */
+    pendingPrompts = [];
+    /** Admitted prompt → the turn that carries it, while that turn is open. */
+    sharedTurns = new Map();
     activeTurn;
     controllerCount = 0;
     controllerGrace;
@@ -173,7 +203,9 @@ export class CodexAppServerSession {
             alive: this.isAlive(),
             readiness: this.readiness,
             sessionId: this.threadId,
-            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.origin.kind } : {}),
+            // A shared turn is a human console turn if any member is: inbox traffic must not cut it short.
+            ...(this.activeTurn?.origin ? { activePromptSource: this.activeTurn.console
+                    ? 'owner-admin-console' : this.activeTurn.origin.kind } : {}),
             lastError: this.lastError,
             pendingPermissionId: this.pendingPermissions.keys().next().value,
             runtimeModel: this.runtimeModel,
@@ -204,8 +236,7 @@ export class CodexAppServerSession {
         const queuedBehind = this.queueDepth;
         this.admit(promptId, text, queuedBehind, options);
         this.queueDepth++;
-        const run = this.promptTail.then(() => this.runPrompt(text, promptId, options.origin));
-        this.promptTail = run.then(() => undefined, () => undefined);
+        const run = this.enqueue(promptId, text, options.origin);
         const completion = run.then(result => {
             this.queueDepth = Math.max(0, this.queueDepth - 1);
             return result;
@@ -218,6 +249,42 @@ export class CodexAppServerSession {
             delivery: delivery ?? (queuedBehind ? 'queued' : 'started'),
         };
     }
+    /** The turn whose events and result answer this admitted prompt; itself unless a release shared it. */
+    sharedTurnId(promptId) {
+        return this.sharedTurns.get(promptId);
+    }
+    /** Each prompt keeps its own step in the chain; the step it reaches releases a whole snapshot. */
+    enqueue(promptId, text, origin) {
+        const entry = {
+            promptId, text, origin, ...sourceFor(origin), admittedAt: new Date().toISOString(),
+            // The one text the native session runs as an operation instead of a turn.
+            command: text.trim() === '/compact',
+        };
+        this.pendingPrompts.push(entry);
+        const run = this.promptTail.then(() => this.release(entry));
+        this.promptTail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    /**
+     * The turn boundary: the first waiting prompt to get here synchronously
+     * takes every pending prompt delivered with it into one turn. A prompt
+     * admitted afterwards stays pending for the next boundary, and a step whose
+     * prompt was already taken reports that turn's result.
+     */
+    release(entry) {
+        if (entry.released)
+            return entry.released;
+        const members = takeBatch(this.pendingPrompts, entry);
+        for (const member of members)
+            this.sharedTurns.set(member.promptId, members[0].promptId);
+        const run = this.runPrompt(members).finally(() => {
+            for (const member of members)
+                this.sharedTurns.delete(member.promptId);
+        });
+        for (const member of members)
+            member.released = run;
+        return run;
+    }
     async submitPrompt(text, options = {}) {
         try {
             return await (await this.queuePrompt(text, options)).completion;
@@ -232,7 +299,7 @@ export class CodexAppServerSession {
     async interruptPrompt(generation, promptId) {
         if (generation !== this.sessionGeneration)
             throw new Error('session_changed: Agent session changed.');
-        if (this.activeTurn?.promptId !== promptId)
+        if (!this.activeTurn?.promptIds.includes(promptId))
             return { state: 'settled' };
         return this.interrupt('local-console');
     }
@@ -370,6 +437,7 @@ export class CodexAppServerSession {
             sessionGeneration: this.sessionGeneration,
             readiness: this.isAlive() ? this.readiness : 'offline',
             queueDepth: this.queueDepth,
+            ...pendingInventory(this.pendingPrompts),
             pendingPermissionIds: [...this.pendingPermissions.keys()],
             ...(this.conversation.degraded ? { historyDegraded: true } : {}),
         };
@@ -465,8 +533,7 @@ export class CodexAppServerSession {
             const origin = open.commandId
                 ? { kind: 'owner-admin-console', commandId: open.commandId }
                 : undefined;
-            const run = this.promptTail.then(() => this.runPrompt(open.text, open.promptId, origin));
-            this.promptTail = run.then(() => undefined, () => undefined);
+            const run = this.enqueue(open.promptId, open.text, origin);
             void run.finally(() => { this.queueDepth = Math.max(0, this.queueDepth - 1); });
         }
     }
@@ -498,21 +565,27 @@ export class CodexAppServerSession {
         else
             this.conversation.appendSafe(draft);
     }
-    async runPrompt(text, promptId, origin) {
+    async runPrompt(members) {
+        const { text, promptId, origin } = members[0];
         if (!this.threadId || !this.transport.isAlive())
             return turnResult(false, 'failed', this.lastError ?? 'Codex app-server session is offline');
         let settle;
         const settled = new Promise(resolveResult => { settle = resolveResult; });
-        const active = { promptId, origin, output: '', settled, settle };
+        const active = {
+            promptId, origin, output: '', settled, settle,
+            promptIds: members.map(member => member.promptId),
+            console: members.some(member => member.origin?.kind === 'owner-admin-console'),
+        };
         this.activeTurn = active;
         this.finalAnswerObserved = false;
         this.activeItems.clear();
         this.readiness = 'running';
         this.events.emit('state', { turnId: promptId, status: 'running', origin });
-        this.conversation.appendSafe({
+        members.forEach((member, index) => this.conversation.appendSafe({
             kind: 'prompt.started', sessionGeneration: this.sessionGeneration,
-            promptId, turnId: promptId, source: sourceFor(origin).source, payload: {},
-        });
+            promptId: member.promptId, turnId: promptId, source: sourceFor(member.origin).source,
+            payload: members.length > 1 ? { batch: { turnId: promptId, index, size: members.length } } : {},
+        }));
         try {
             if (text.trim() === '/compact') {
                 // The acknowledgement is not completion. Standard turn notifications
@@ -522,12 +595,13 @@ export class CodexAppServerSession {
             }
             const response = await this.transport.request('turn/start', {
                 threadId: this.threadId,
-                input: [{ type: 'text', text, text_elements: [] }],
+                // One unchanged user text item per admitted prompt, in admission order.
+                input: members.map(member => ({ type: 'text', text: member.text, text_elements: [] })),
                 approvalPolicy: this.options.approvalPolicy,
                 model: this.options.model ?? null,
                 effort: this.options.effort ?? null,
-                ...(nativePromptAdditionalContext(origin)
-                    ? { additionalContext: nativePromptAdditionalContext(origin) } : {}),
+                ...(nativeBatchAdditionalContext(members)
+                    ? { additionalContext: nativeBatchAdditionalContext(members) } : {}),
             });
             const turn = isObject(response.turn) ? response.turn : undefined;
             active.nativeTurnId ??= string(turn?.id);
@@ -806,14 +880,16 @@ export class CodexAppServerSession {
             cancellationSource: active.cancellationSource,
         });
         this.events.emit('state', { status: this.readiness });
-        this.conversation.appendSafe({
-            kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
-            promptId: active.promptId, turnId: active.promptId,
-            payload: {
-                outcome, ...(detail ? { stopReason: detail } : {}),
-                ...(active.cancellationSource ? { cancellationSource: active.cancellationSource } : {}),
-            },
-        });
+        // Every member closes with the shared outcome, so none is left waiting.
+        for (const member of active.promptIds)
+            this.conversation.appendSafe({
+                kind: 'turn.completed', sessionGeneration: this.sessionGeneration,
+                promptId: member, turnId: active.promptId,
+                payload: {
+                    outcome, ...(detail ? { stopReason: detail } : {}),
+                    ...(active.cancellationSource ? { cancellationSource: active.cancellationSource } : {}),
+                },
+            });
         active.settle(result);
     }
     /**

package/dist/session/conversation-types.d.ts

@@ -176,6 +176,12 @@ export interface PromptAdmittedPayload {
 }
 export interface PromptStartedPayload {
     queuedBehind?: number;
+    /** Present when one adapter turn carries several admitted prompts; `turnId` is the shared turn. */
+    batch?: {
+        turnId: string;
+        index: number;
+        size: number;
+    };
 }
 export interface PromptInterruptRequestedPayload {
     commandId?: string;
@@ -289,12 +295,25 @@ export interface PermissionDecisionCommand {
     sessionGeneration: string;
     optionId: string;
 }
+/** One admitted prompt not yet handed to the agent, as reported by the queue that owns it. */
+export interface PendingPromptSummary {
+    promptId: string;
+    source: ConversationSource;
+    admittedAt: string;
+    bytes: number;
+    /** A bounded preview, present only for a body the ledger already holds. */
+    text?: string;
+    textTruncated?: boolean;
+}
 export interface ConversationSnapshot {
     sessionGeneration: string;
     readiness: 'starting' | 'idle' | 'running' | 'awaiting_permission' | 'failed' | 'offline';
     queueDepth: number;
     pendingPermissionIds: string[];
     historyDegraded?: boolean;
+    /** Every waiting prompt, in delivery order; `pendingPromptCount` equals its length. */
+    pendingPrompts?: PendingPromptSummary[];
+    pendingPromptCount?: number;
 }
 export interface ConversationPage {
     events: ConversationEventV1[];

package/dist/session/prompt-batch.d.ts

@@ -0,0 +1,63 @@
+import type { ConversationSource, PendingPromptSummary } from './conversation-types.js';
+import type { PromptOrigin, TurnResult } from './types.js';
+/**
+ * A prompt the session has admitted and not yet handed to the adapter.
+ *
+ * Every admitted prompt keeps its own id, ledger records and completion. What
+ * changes at a turn boundary is how many of them one adapter turn carries.
+ */
+export interface PendingPrompt {
+    promptId: string;
+    text: string;
+    origin?: PromptOrigin;
+    source: ConversationSource;
+    /** Whether the ledger already holds this body; an external body is never copied out of the queue. */
+    persistBody: boolean;
+    admittedAt: string;
+    /** Whether the session recognised the text, at admission, as one of its own control operations. */
+    command?: boolean;
+    /** Set when a release takes this prompt; every member of that turn shares it. */
+    released?: Promise<TurnResult>;
+}
+/**
+ * How a waiting prompt takes part in a release.
+ *
+ *  - `message`: something a person or a peer route submitted for the agent to
+ *    read — the paired console, the owner channel, the local console, a
+ *    monitor wake. Every waiting message is delivered at one boundary, in
+ *    admission order, whatever its route.
+ *  - `command`: a control operation the session itself supports — the native
+ *    `/compact`, a command the ACP adapter advertised. It must reach the
+ *    adapter as the entire prompt, so it is its own turn and a boundary
+ *    between the messages before and after it. The session decides this at
+ *    admission; text that merely starts with a slash is an ordinary message.
+ *  - `internal`: startup, scheduled-loop and stall-watchdog prompts. They own
+ *    their turn's lifecycle (and, for a loop, the redaction of its whole
+ *    transcript), run alone, and never split the messages around them.
+ */
+export type PromptClass = 'message' | 'command' | 'internal';
+export declare function promptClass(prompt: Pick<PendingPrompt, 'origin' | 'command'>): PromptClass;
+/** The command name a prompt invokes, when its whole text has the shape of one. */
+export declare function commandName(text: string): string | undefined;
+/**
+ * Detach, in admission order, every pending prompt that is delivered with
+ * `head`. Synchronous on purpose: this is the snapshot boundary, and a prompt
+ * admitted after it returns belongs to the next release.
+ */
+export declare function takeBatch(pending: PendingPrompt[], head: PendingPrompt): PendingPrompt[];
+/** Exact, server-computed identity of one member's body inside a shared turn. */
+export interface MemberBinding {
+    index: number;
+    of: number;
+    source: ConversationSource;
+    bytes: number;
+    sha256: string;
+}
+export declare function memberBindings(members: ReadonlyArray<Pick<PendingPrompt, 'text' | 'origin'>>, sourceOf: (origin: PromptOrigin | undefined) => ConversationSource): MemberBinding[];
+/** What the server asserts about a member's route; never derived from the member's text. */
+export declare function memberAuthority(source: ConversationSource): string;
+/** What a client may show for prompts still waiting: all of them, in order, and never an unpersisted body. */
+export declare function pendingInventory(pending: readonly PendingPrompt[]): {
+    pendingPrompts: PendingPromptSummary[];
+    pendingPromptCount: number;
+};

package/dist/session/prompt-batch.js

@@ -0,0 +1,86 @@
+import { createHash } from 'node:crypto';
+/**
+ * The inventory names every waiting prompt — a client must be able to show the
+ * whole queue, not a count of what it could not see. What keeps a snapshot
+ * small is the body: each entry carries a short preview, not the prompt.
+ */
+const INVENTORY_TEXT_CHARS = 200;
+const INTERNAL = new Set(['startup', 'scheduled-loop', 'stall-watchdog']);
+export function promptClass(prompt) {
+    if (INTERNAL.has(prompt.origin?.kind ?? 'local-console'))
+        return 'internal';
+    return prompt.command ? 'command' : 'message';
+}
+/** The command name a prompt invokes, when its whole text has the shape of one. */
+export function commandName(text) {
+    return /^\/([a-z][a-z0-9_-]*)(?:\s|$)/i.exec(text.trim())?.[1];
+}
+/**
+ * Detach, in admission order, every pending prompt that is delivered with
+ * `head`. Synchronous on purpose: this is the snapshot boundary, and a prompt
+ * admitted after it returns belongs to the next release.
+ */
+export function takeBatch(pending, head) {
+    const members = [];
+    if (promptClass(head) !== 'message')
+        members.push(head);
+    else {
+        for (const prompt of pending) {
+            const kind = promptClass(prompt);
+            if (kind === 'command')
+                break;
+            if (kind === 'message')
+                members.push(prompt);
+        }
+        if (!members.includes(head))
+            members.unshift(head);
+    }
+    for (const member of members) {
+        const at = pending.indexOf(member);
+        if (at >= 0)
+            pending.splice(at, 1);
+    }
+    return members;
+}
+export function memberBindings(members, sourceOf) {
+    return members.map((member, at) => ({
+        index: at + 1,
+        of: members.length,
+        source: sourceOf(member.origin),
+        bytes: Buffer.byteLength(member.text),
+        sha256: createHash('sha256').update(member.text).digest('hex'),
+    }));
+}
+/** What the server asserts about a member's route; never derived from the member's text. */
+export function memberAuthority(source) {
+    switch (source) {
+        case 'owner_admin_console':
+            return 'direct owner input from the server-authenticated paired console';
+        case 'owner_channel':
+            return 'admitted through the authenticated Fleet owner channel';
+        case 'fleet_monitor':
+            return 'a Fleet monitor notification, not owner input';
+        default:
+            return 'local console input, not authenticated owner-console or owner-channel input';
+    }
+}
+/** What a client may show for prompts still waiting: all of them, in order, and never an unpersisted body. */
+export function pendingInventory(pending) {
+    return {
+        pendingPromptCount: pending.length,
+        pendingPrompts: pending.map(prompt => {
+            const display = prompt.origin?.kind === 'owner' ? prompt.origin.displayText
+                : prompt.persistBody ? prompt.text : undefined;
+            return {
+                promptId: prompt.promptId,
+                source: prompt.source,
+                admittedAt: prompt.admittedAt,
+                bytes: Buffer.byteLength(prompt.text),
+                ...(display === undefined ? {} : {
+                    text: display.slice(0, INVENTORY_TEXT_CHARS),
+                    ...(display.length > INVENTORY_TEXT_CHARS ? { textTruncated: true } : {}),
+                }),
+            };
+        }),
+    };
+}

package/dist/session/types.d.ts

@@ -307,6 +307,11 @@ export interface AgentSession {
      * Hand the session a prompt and return as soon as it has accepted
      * responsibility for it. Throws `SessionControlError` if it cannot.
      */
+    /**
+     * The turn that carries an admitted prompt when one adapter turn delivered
+     * several; absent means the prompt's own id is its turn id.
+     */
+    sharedTurnId?(promptId: string): string | undefined;
     queuePrompt(text: string, options?: SubmitPromptOptions): Promise<QueuedPrompt>;
     /** Queue a prompt and wait for its terminal result. */
     submitPrompt(text: string, options?: SubmitPromptOptions): Promise<TurnResult>;

package/docs/acp-files.md

@@ -1,22 +1,24 @@
 # Sending files in an ACP chat
 
-An opted-in managed Agent uses the existing Ours `send_file` tool:
+Every managed Agent can attach a file to its current ACP chat with the existing
+Ours `send_file` tool. No Agent setting turns this on and no export directory is
+configured or created:
 
 ```json
-{"path":"deliverables/report.pdf"}
+{"path":"/home/me/project/build/report.pdf"}
 ```
 
 Omitting `contact` sends to the current ACP chat. Supplying a non-empty contact
 keeps ordinary Ours delivery:
 
 ```json
-{"contact":"Alice","path":"deliverables/report.pdf"}
+{"contact":"Alice","path":"build/report.pdf"}
 ```
 
 Only an absent contact chooses the chat. Null, empty or whitespace-only contacts,
-unknown fields and unknown recipients fail without falling back to chat. Outside
-opt-in, contact remains required. Current-chat sending accepts `path`, optional
-`filename` and `mime`; inline base64 and Ours reply fields are unsupported.
+unknown fields and unknown recipients fail without falling back to chat.
+Current-chat sending accepts `path`, optional `filename` and `mime`; inline
+base64 and Ours reply fields are unsupported.
 
 Each call makes one attempt. Failures are returned to the agent. There is no
 request ID, deduplication, automatic retry or recovery of failed sends. If a user
@@ -24,52 +26,84 @@ asks to resend, another tool call makes a new attempt and can produce another
 attachment. UUIDs identify stored attachments; the stored SHA-256 checks integrity.
 Neither is a retry key.
 
-Set this on the Agent definition, not manifest defaults or a Brain:
+## Paths
+
+The Agent passes the path of the file it wants to send. Relative paths resolve
+from the Agent's working directory; `..`, absolute paths, hidden directories and
+symlinked parent directories are all accepted. The file does not have to be
+inside the working directory or any particular subtree. It is opened by the
+Fleet bridge inside the Agent's own OS sandbox, so the Agent can send exactly
+what it can already read.
+
+The file itself must pass ordinary integrity checks, each with its own result:
+
+| Result | Meaning |
+| --- | --- |
+| `CHAT_FILE_NOT_FOUND` | nothing exists at the path |
+| `CHAT_FILE_NOT_READABLE` | the Agent's OS user or sandbox cannot read it |
+| `CHAT_FILE_IS_SYMLINK` | the named file is itself a symlink; pass its target |
+| `CHAT_FILE_HARDLINKED` | the file has more than one hard link |
+| `CHAT_FILE_NOT_REGULAR` | a directory, FIFO, socket or device |
+| `FILE_EXCEEDS_20_MIB` | larger than the 20 MiB limit |
+| `CHAT_FILE_CHANGED` / `SOURCE_SIZE_CHANGED` | modified while it was being read; finish writing first |
+| `CHAT_FILE_REQUIRES_LINUX` | the Agent's bridge is not running on Linux |
+| `PRIVATE_STATE_CANNOT_BE_SENT` | Fleet's own credentials, connector profile or stored attachments |
+
+`PRIVATE_STATE_CANNOT_BE_SENT` covers only Fleet's private Ours runtime
+directory, its attachment store and the connector profile and credential files,
+checked on the provided path before approval and on the opened file's real path
+afterwards. It is not configurable and is not a general path policy.
+
+## Supported sessions
+
+Current-chat delivery needs Linux, the managed Ours connector and a Codex or
+Claude ACP session with a tracked active turn. Those Agents need no special
+`harness_options`, MCP restriction or clean configuration home: inherited and
+additional MCP connectors stay as they are, and Fleet's bound bridge is the
+`ours` connector as it already is for every managed Agent.
+
+Any other backend still sees the optional `contact`, and omitting it returns a
+precise result rather than a missing tool:
 
-```yaml
-file_delivery:
-  enabled: true
-  directory: deliverables
 ```
+CURRENT_CHAT_DELIVERY_UNAVAILABLE: sending a file to this chat requires a Codex or Claude ACP session; this Agent runs <harness>/<session>. Pass contact to send through Ours instead
+```
+
+Idle, scheduled, steered, cancelled and replaced turns return
+`CURRENT_CHAT_DELIVERY_UNAVAILABLE`; a second send while one is in progress
+returns `FILE_DELIVERY_BUSY`.
+
+A file is published only for a call that arrives over the Agent's
+capability-authenticated bridge and binds to the turn that is live in that
+Agent's own session. Connector inventory is not consulted, so unrelated or
+similarly named connectors neither enable nor block delivery.
 
-The tool description advertises this directory and the 20 MiB limit to the Agent.
-The directory is a non-hidden subtree of the Agent's working directory. Both
-routes interpret relative paths from that working directory; absolute paths keep
-their usual meaning. Chat sending additionally enforces the export directory.
-The Agent should finish writing the file before calling `send_file`. Symlinks,
-hardlinks, hidden/credential paths, changed files and files over 20 MiB fail.
-
-Initial support requires Linux, the managed Ours connector, a stock Codex or
-Claude ACP adapter, and a tracked active turn. Idle, scheduled, steered, cancelled,
-replaced and unsupported sessions cannot export. Existing native tool approval
-and the neutral role permission policy both apply before bytes are read. An
-`ask` decision needs an attached controller; `deny` refuses. A native policy that
-refuses MCP execution (including Codex `never` without a native tool allowance)
-can still refuse before Fleet receives the call.
-
-Codex requires native runtime 0.159.0 or newer and Fleet's managed App Server
-proxy. Before each turn, its public exact-thread, paginated MCP inventory must
-show a connected managed `ours` with the expected optional-contact schema.
-Ours aliases, filtered aliases, ambiguous identity, failed discovery and an
-incompatible schema make the turn unavailable. Unrelated identified tools are
-preserved. Explicitly disabled Ours is rejected before replacement. Inherited
-TOML MCP settings, including project/profile sources, are conservatively
-unsupported until their disabling semantics can be qualified before replacement.
-Use a clean Codex configuration home for this initial opt-in.
-
-Claude ACP 0.63.0's installed wrapper has no public same-session inventory RPC. Initial
-support therefore requires an operator's explicit restricted MCP configuration:
+## Permissions
+
+Existing native tool approval and the neutral role permission policy both apply
+before bytes are read. With `approval: allow`, a path inside the role's
+`filesystem` boundary is allowed automatically; a path outside it is put to the
+attached controller like any other out-of-boundary request, and is denied when
+nobody is attached and `unattended: deny`. An `ask` decision needs an attached
+controller; `deny` refuses with `CURRENT_CHAT_DELIVERY_UNAVAILABLE`, and a
+declined request returns `FILE_SEND_DENIED`. A native policy that refuses MCP
+execution (including Codex `never` without a native tool allowance) can still
+refuse before Fleet receives the call.
+
+## Retired configuration
+
+`file_delivery` is retired. An existing block still loads so manifests need no
+edit, and has no effect:
 
 ```yaml
-harness_options:
-  mcp_servers_only: true
-  mcp_servers:
-    ours: { command: ours-mcp, args: [proxy] }
+file_delivery:
+  enabled: false        # ignored: delivery stays available
+  directory: deliverables   # ignored: not created, not enforced
 ```
 
-Fleet replaces that connector with its bound bridge. Additional explicit MCP
-servers and custom ACP commands are unsupported for this feature. Default-off
-Agents retain their existing configuration.
+Remove it at your convenience. Unknown keys inside it are still rejected.
+
+## Storage and download
 
 Successful sends copy complete bytes into private immutable storage and append a
 server-origin `file.attached` event containing the actual session generation,
@@ -90,13 +124,23 @@ saving after a workspace change.
 
 This source requires the companion MCP implementation's
 `MANAGED_FILE_DELIVERY_VERSION = 1`. Fleet pins published
-`@ours.network/mcp@1.2.0-nightly.13`, which includes it. Older MCP packages without
-this capability fail closed when file delivery is enabled. Changes to the MCP
-pin require clean installed-package qualification without a built MCP overlay.
-
-The deterministic native fixture uses real ACP adapters, the real managed
-connector and an isolated daemon. A local scripted provider supplies only tool
-intents; approval, read, copy, publication and bytes come from the implementation.
-It does not qualify external-model inference, deployment or arbitrary native
-MCP request-to-ACP tool-call ID mapping. Correlation is the authenticated bridge
-and the actual active Fleet turn, which is revoked by cancellation/steering.
+`@ours.network/mcp@1.2.0-nightly.13`, which includes it and already treats the
+export-directory hint as optional, so default delivery needs no MCP change. An
+installed MCP package without the capability fails Agent startup with
+`INCOMPATIBLE_MANAGED_FILE_DELIVERY` instead of quietly requiring a contact.
+Changes to the MCP pin require clean installed-package qualification without a
+built MCP overlay.
+
+The deterministic native fixture (`test/file-delivery-native.integration.mjs`)
+uses real ACP adapters, the real managed connector and an isolated daemon. Its
+Agent has no `file_delivery` block and no MCP restriction, and it sends a file
+from a hidden directory outside the working directory. It then downloads the
+generated attachment over the authenticated HTTP route and compares bytes and
+SHA-256, after checking that an anonymous and a forged-cookie request are
+refused. `FLEET_FILE_NATIVE_VARIANT=connectors` adds unrelated MCP connectors
+and requires them to stay usable. A local scripted provider supplies only tool
+intents; approval, read, copy, publication and bytes come from the
+implementation. It does not qualify external-model inference, deployment or
+arbitrary native MCP request-to-ACP tool-call ID mapping. Correlation is the
+authenticated bridge and the actual active Fleet turn, which is revoked by
+cancellation/steering.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.57",
+  "version": "1.2.0-nightly.59",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/dist/harness/codex-file-inventory.d.ts

@@ -1,15 +0,0 @@
-export declare class CodexFileInventory {
-    private readonly sendToCodex;
-    private readonly emitToClient;
-    private checks;
-    private sequence;
-    constructor(sendToCodex: (line: string) => void, emitToClient: (line: string) => void);
-    /** Hold only a turn/start; unrelated tools/configuration are preserved. */
-    observeClientLine(line: string): boolean;
-    observeServerLine(line: string): boolean;
-    close(): void;
-    private query;
-    private qualified;
-    private finish;
-    private reject;
-}