@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.61

package/dist/agent-ours/file-rpc.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { MAX_CHUNK_BYTES } from './wire.js';
+/** Bridge refusals of a current-chat file that are safe to relay verbatim. */
+const CHAT_FILE_REFUSAL = /^(INVALID_CHAT_FILE_PATH|CHAT_FILE_[A-Z_]{1,40}|FILE_EXCEEDS_20_MIB)$/;
 /** Call-scoped callbacks carry no daemon credentials or upload receipts. */
 export class FileCallbacks {
     wire;
@@ -16,7 +18,7 @@ export class FileCallbacks {
         this.pending.delete(frame.id);
         clearTimeout(p.timer);
         if (frame.error)
-            p.reject(Error('AGENT_FILE_OPERATION_FAILED'));
+            p.reject(Error(typeof frame.error === 'string' && CHAT_FILE_REFUSAL.test(frame.error) ? frame.error : 'AGENT_FILE_OPERATION_FAILED'));
         else
             p.resolve(frame.value);
     }
@@ -59,14 +61,26 @@ export class FileCallbacks {
         return (await this.rpc(String(extra.requestId), 'probe', { path }, extra.signal)) === true;
     }
     async read(path, extra) {
+        return this.openRead(path, extra);
+    }
+    /** Current-chat source: integrity-checked by the bridge, with its real path. */
+    async readChatFile(path, extra) {
+        return this.openRead(path, extra, true);
+    }
+    async openRead(path, extra, chat = false) {
         const call = String(extra.requestId), handle = randomUUID();
-        const meta = await this.rpc(call, 'read-open', { path, handle }, extra.signal);
+        const meta = await this.rpc(call, chat ? 'export-open' : 'read-open', { path, handle }, extra.signal);
         if (!meta ||
             typeof meta.filename !== 'string' ||
             !Number.isSafeInteger(meta.size) ||
-            meta.size < 0)
+            meta.size < 0 ||
+            (chat && typeof meta.path !== 'string'))
             throw Error('INVALID_FILE_METADATA');
+        let closed = false;
         const close = async () => {
+            if (closed)
+                return;
+            closed = true;
             await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
         };
         const body = new ReadableStream({
@@ -91,7 +105,7 @@ export class FileCallbacks {
             },
             cancel: close,
         });
-        return { filename: meta.filename, size: meta.size, body, close };
+        return { filename: meta.filename, size: meta.size, body, close, ...(chat ? { path: meta.path } : {}) };
     }
     async write(path, body, extra) {
         const call = String(extra.requestId), handle = randomUUID();

package/dist/agent-ours/harness.js

@@ -13,6 +13,7 @@ export function managedChildEnvironment(input) {
 }
 /** Replace ours only; retain the user's ordinary harness configuration and plugins. */
 export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
+    const child = managedChildEnvironment({ ...process.env, ...env });
     const bridge = fileURLToPath(new URL('./bridge.js', import.meta.url));
     const server = {
         name: 'ours',
@@ -20,21 +21,28 @@ export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
         args: [bridge],
         env: [{ name: 'FLEET_OURS_BRIDGE_DESCRIPTOR', value: descriptor }],
     };
+    // Portable allow covers bound identity messaging, not all tools on the server.
+    const tools = role.harness === 'codex' && role.permissions?.approval === 'allow'
+        ? Object.fromEntries([
+            'current_identity', 'get_messages', 'list_history', 'list_contacts', 'send_message',
+        ].map(name => [name, { approval_mode: 'approve' }]))
+        : undefined;
     const native = {
         mcp_servers: {
             ours: {
                 command: process.execPath,
                 args: [bridge],
                 env: { FLEET_OURS_BRIDGE_DESCRIPTOR: descriptor },
+                ...(tools ? { tools } : {}),
             },
         },
         plugins: { 'ours@ours-codex-marketplace': { enabled: false } },
     };
-    const child = managedChildEnvironment({ ...process.env, ...env });
     if (role.harness === 'codex') {
         const config = child.CODEX_CONFIG ? JSON.parse(child.CODEX_CONFIG) : {};
         child.CODEX_CONFIG = JSON.stringify({
             ...config,
+            mcp_servers: { ...config.mcp_servers, ...native.mcp_servers },
             plugins: { ...config.plugins, ...native.plugins },
         });
         // codex-acp otherwise prefers a same-name connector from the user's config.

package/dist/agent-ours/mcp-endpoint.d.ts

@@ -1,5 +1,8 @@
+import type { FileDeliveryInput, DeliveredFile } from '../file-delivery/types.js';
+import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
 import type { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
 import type { OursClient } from '@ours.network/sdk/client';
+import { FileCallbacks } from './file-rpc.js';
 import type { AgentOursRuntime } from './runtime.js';
 export interface EndpointOptions {
     socket: string;
@@ -9,6 +12,7 @@ export interface EndpointOptions {
     client: OursClient;
     identities: ApplicationIdentityStore;
     remoteDaemonFiles: boolean;
+    currentChatFile?: (input: FileDeliveryInput, extra: ToolRequestExtra, files: FileCallbacks) => Promise<DeliveredFile>;
 }
 export declare function startMcpEndpoint(options: EndpointOptions): Promise<{
     close(): Promise<void>;

package/dist/agent-ours/mcp-endpoint.js

@@ -1,3 +1,4 @@
+import * as managedMcp from '@ours.network/mcp/server';
 import { createServer } from 'node:net';
 import { chmod, unlink } from 'node:fs/promises';
 import { timingSafeEqual } from 'node:crypto';
@@ -6,6 +7,9 @@ import { JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
 import { FileCallbacks } from './file-rpc.js';
 import { Wire } from './wire.js';
 export async function startMcpEndpoint(options) {
+    // Every managed Agent offers current-chat delivery, so a package without the contract is a broken install, not a quiet downgrade.
+    if (options.currentChatFile && managedMcp.MANAGED_FILE_DELIVERY_VERSION !== 1)
+        throw Error('INCOMPATIBLE_MANAGED_FILE_DELIVERY: installed @ours.network/mcp lacks MANAGED_FILE_DELIVERY_VERSION 1; reinstall Fleet with its pinned @ours.network/mcp');
     const sockets = new Set();
     const server = createServer((socket) => {
         if (sockets.size >= 4) {
@@ -33,6 +37,7 @@ export async function startMcpEndpoint(options) {
         };
         const mcp = createManagedOursMcpServer(options.client, 'managed-v1', options.identities, {
             remoteDaemonFiles: options.remoteDaemonFiles,
+            ...(options.currentChatFile ? { currentChatFile: (input, extra) => options.currentChatFile(input, extra, files) } : {}),
             fileContext: files,
             admit: async () => {
                 if (!authenticated || inFlight >= 32)

package/dist/agent-ours/runtime.d.ts

@@ -1,3 +1,4 @@
+import type { AgentHistoryQuery } from './correspondence.js';
 import type { OursClient } from '@ours.network/sdk/client';
 import { RuntimeJournal, type RuntimeState } from './state.js';
 export interface AssignedIdentity {
@@ -9,7 +10,9 @@ export interface AssignedIdentity {
     action: string;
     expectedCid?: string;
     allowCreate: boolean;
-    bio: string;
+    /** Omitted fields preserve an existing identity's custom profile. */
+    bio?: string;
+    persona?: string;
 }
 export interface RoomAdmission {
     id: string;
@@ -47,6 +50,11 @@ export declare class AgentOursRuntime {
     prepare(room?: RoomAdmission, timeoutMs?: number): Promise<void>;
     /** Admission covers SDK calls, response rendering and agent filesystem callbacks. */
     admit(): Promise<() => void>;
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    joinAdditionalRoom(invite: string, expectedRoomCid: string): Promise<void>;
+    readContacts(): Promise<unknown>;
+    readHistory(request: AgentHistoryQuery): Promise<unknown>;
     startHarness<T>(start: () => Promise<T>): Promise<T>;
     suspend(): Promise<void>;
     terminal(): Promise<void>;

package/dist/agent-ours/runtime.js

@@ -62,6 +62,7 @@ export class AgentOursRuntime {
             actual.isRoot)
             throw Error('IDENTITY_PROOF_MISMATCH');
         this.deps.assertFence();
+        return actual;
     }
     async prepare(room, timeoutMs = 30_000) {
         if (['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED', 'QUIESCING'].includes(this.state.phase))
@@ -92,7 +93,7 @@ export class AgentOursRuntime {
                 this.transition('RECOVERING');
                 const args = {
                     name: this.state.name,
-                    bio: this.assignment.bio,
+                    bio: this.assignment.bio ?? '',
                     exposeLocal: false,
                     localAutoAccept: true,
                 };
@@ -104,7 +105,18 @@ export class AgentOursRuntime {
                 this.transition('OWNED', { cid: created.info.cid });
             }
         }
-        await this.verify();
+        const profile = await this.verify();
+        // The supervisor owns profile setup, just like identity binding. Apply only
+        // explicitly configured fields, under the verified owner, before publishing
+        // readiness or admitting the harness. Repeating a prepare is idempotent.
+        if (this.assignment.bio !== undefined && profile.bio !== this.assignment.bio) {
+            this.deps.assertFence();
+            await this.deps.client.setBio({ bio: this.assignment.bio });
+        }
+        if (this.assignment.persona !== undefined && profile.persona !== this.assignment.persona) {
+            this.deps.assertFence();
+            await this.deps.client.setPersona({ persona: this.assignment.persona });
+        }
         if (!room && (this.state.room || this.state.admissionIntent))
             throw Error('ROOM_DESCRIPTOR_REQUIRED');
         if (room) {
@@ -201,6 +213,42 @@ export class AgentOursRuntime {
             throw error;
         }
     }
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    async joinAdditionalRoom(invite, expectedRoomCid) {
+        const release = await this.admit();
+        try {
+            const contact = await this.deps.client.addContact({ invite });
+            if (contact.cid !== expectedRoomCid)
+                throw Error('ADDITIONAL_ROOM_CID_MISMATCH');
+            await this.verify();
+        }
+        finally {
+            release();
+        }
+    }
+    async readContacts() {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listContacts();
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
+    async readHistory(request) {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listHistory(request);
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
     async startHarness(start) {
         if (!this.accepting || this.state.phase !== 'READY')
             throw Error('RUNTIME_NOT_READY');

package/dist/agent-ours/service.d.ts

@@ -1,12 +1,29 @@
+import type { AgentSession } from '../session/types.js';
+import { ArtifactStore } from '../file-delivery/store.js';
 import type { ResolvedRole } from '../config.js';
 import { AgentOursRuntime } from './runtime.js';
+import { startMcpEndpoint } from './mcp-endpoint.js';
 export declare const privateRuntimeRoot: () => string;
 export interface ManagedAgentService {
     runtime: AgentOursRuntime;
     descriptor: string;
     privatePaths: string[];
+    setFileDelivery?(sender: AgentSession['sendFileToChat']): void;
     close(terminal: boolean): Promise<void>;
 }
+/**
+ * `send_file` without a contact, offered to every managed Agent with no Agent
+ * setting and no export directory. A backend without a tracked ACP turn gets a
+ * precise refusal instead of a missing tool.
+ */
+export declare function currentChatFileHandler(options: {
+    role: Pick<ResolvedRole, 'harness' | 'session' | 'permissions'>;
+    cwd: string;
+    store: Pick<ArtifactStore, 'copy'>;
+    sender: () => AgentSession['sendFileToChat'];
+    /** Fleet's own credentials and stored attachments are never chat content. */
+    privateState: string[];
+}): NonNullable<Parameters<typeof startMcpEndpoint>[0]['currentChatFile']>;
 /** Only trusted launch orchestration may write this descriptor, never the child. */
 export declare function storeRoomSecret(role: ResolvedRole): void;
 export declare function storeTemporaryLaunch(role: ResolvedRole, action: string): void;
@@ -20,4 +37,7 @@ export declare function readRoomReadiness(roomCid: string, name: string): {
     generation: number;
 } | undefined;
 /** Explicit logical-instance termination, independent of harness/bridge transport. */
-export declare function releaseManagedAgent(role: ResolvedRole): Promise<void>;
+export declare function releaseManagedAgent(role: ResolvedRole, expected?: {
+    cid: string;
+    action: string;
+}): Promise<void>;

package/dist/agent-ours/service.js

@@ -1,8 +1,13 @@
+import { chatFilePath } from '../file-delivery/reader.js';
+import { ArtifactStore } from '../file-delivery/store.js';
+import { resolve, basename, extname } from 'node:path';
+import { socketPath as privateSocketPath } from '../socket-path.js';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
+import { assertSafeAncestors } from '../rooms-tasks/workspace.js';
 import { readClientProfile } from '../client-profile.js';
 import { stateRoot } from '../paths.js';
 import { createCoworkAdapter } from '../rooms-tasks/cowork-adapter.js';
@@ -11,6 +16,42 @@ import { atomicPrivateWrite, binderKey } from './state.js';
 import { AgentOursRuntime } from './runtime.js';
 import { startMcpEndpoint } from './mcp-endpoint.js';
 export const privateRuntimeRoot = () => join(stateRoot(), 'private-ours');
+/**
+ * `send_file` without a contact, offered to every managed Agent with no Agent
+ * setting and no export directory. A backend without a tracked ACP turn gets a
+ * precise refusal instead of a missing tool.
+ */
+export function currentChatFileHandler(options) {
+    const { role, cwd, store } = options, privateState = options.privateState.map(p => resolve(p));
+    const isPrivate = (path) => privateState.some(p => path === p || path.startsWith(p + '/'));
+    return async (input, extra, files) => {
+        if (role.session !== 'acp' || !['codex', 'claude-code'].includes(role.harness))
+            throw Error(`CURRENT_CHAT_DELIVERY_UNAVAILABLE: sending a file to this chat requires a Codex or Claude ACP session; this Agent runs ${role.harness}/${role.session}. Pass contact to send through Ours instead`);
+        const sender = options.sender();
+        if (!sender)
+            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: this session has no ACP chat to attach to');
+        if (isPrivate(chatFilePath(cwd, input.path)))
+            throw Error('PRIVATE_STATE_CANNOT_BE_SENT'); // before approval/read
+        const name = input.filename ?? basename(input.path);
+        if (!name || Buffer.byteLength(name) > 240 || /[\/\\\x00-\x1f]/.test(name) || name === '.' || name === '..')
+            throw Error('INVALID_FILENAME');
+        const mime = input.mime ?? { '.txt': 'text/plain', '.md': 'text/markdown', '.pdf': 'application/pdf', '.json': 'application/json', '.html': 'text/html', '.png': 'image/png' }[extname(name).toLowerCase()] ?? 'application/octet-stream';
+        if (mime.length > 200 || !/^[A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+$/.test(mime))
+            throw Error('INVALID_MIME');
+        return sender(input, extra.signal, async (binding) => {
+            const source = await files.readChatFile(input.path, extra);
+            try {
+                // The bridge reports the opened file's real path, so a symlinked ancestor cannot reach private state.
+                if (isPrivate(source.path))
+                    throw Error('PRIVATE_STATE_CANNOT_BE_SENT');
+                return await store.copy(source, name, mime, binding, extra.signal);
+            }
+            finally {
+                await source.close();
+            }
+        }, role.permissions);
+    };
+}
 function roomSecretPath(role) {
     const startup = role.roomMemberStartup;
     return join(privateRuntimeRoot(), 'room-inputs', binderKey(startup.room_identity_cid, JSON.stringify([role.name, startup.invite_id])) + '.json');
@@ -93,6 +134,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
     }
     const controller = await RuntimeController.acquire(root, profile.expectedInstanceId, role.identity, instance);
     let closeClient;
+    let fileSender;
     let partialEndpoint;
     try {
         let prior = controller.journal.read();
@@ -145,7 +187,8 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
             action: launch?.action ?? prior?.action ?? randomUUID(),
             expectedCid: pin?.cid,
             allowCreate: true,
-            bio: role.bio ?? '',
+            bio: role.bio,
+            persona: role.persona,
         }, {
             client,
             journal: controller.journal,
@@ -207,7 +250,8 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         await identities.add(role.identity);
         const bridgeDir = join(stateDir, '.ours-bridge');
         mkdirSync(bridgeDir, { recursive: true, mode: 0o700 });
-        const capability = randomBytes(32).toString('hex'), socket = join(bridgeDir, `g${generation}.sock`);
+        const capability = randomBytes(32).toString('hex'), socket = privateSocketPath(join(bridgeDir, `g${generation}.sock`));
+        const cwd = role.cwd && existsSync(role.cwd) ? resolve(role.cwd) : resolve(stateDir);
         const endpoint = await startMcpEndpoint({
             socket,
             capability,
@@ -216,16 +260,22 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
             client,
             identities,
             remoteDaemonFiles: true,
+            currentChatFile: currentChatFileHandler({
+                role, cwd, store: new ArtifactStore(stateDir), sender: () => fileSender,
+                privateState: [privateRuntimeRoot(), join(stateRoot(), 'private-file-delivery'), profile.configPath, profile.credentialPath],
+            }),
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
-        atomicPrivateWrite(descriptor, { socket, capability, generation });
+        atomicPrivateWrite(descriptor, { socket, capability, generation, role: role.name, identity: role.identity, cid: runtime.snapshot.cid });
         return {
             runtime,
             descriptor,
-            privatePaths: [root, profile.configPath, profile.credentialPath],
+            privatePaths: [root, profile.configPath, profile.credentialPath, join(stateRoot(), 'private-file-delivery')],
+            setFileDelivery: sender => { fileSender = sender; },
             close: async (terminal) => {
                 try {
+                    fileSender = undefined;
                     await endpoint.close();
                     if (terminal)
                         await runtime.terminal();
@@ -267,8 +317,10 @@ export async function preparePermanentAssignment(role) {
         endpoint: profile.endpoint,
         expectedInstanceId: profile.expectedInstanceId,
         credentialPath: profile.credentialPath,
-        sessionMode: 'local',
-        requiredCapabilities: ['local-pid-v1', 'root-first-identities-v1'],
+        sessionMode: 'external',
+        leaseToken: randomUUID(),
+        requiredCapabilities: ['external-sessions-v1', 'root-first-identities-v1'],
+        env: {},
     });
     try {
         const rows = await client.listIdentities(), row = rows.find((r) => r.name === role.identity);
@@ -295,7 +347,12 @@ export async function preparePermanentAssignment(role) {
         return 'verified';
     }
     finally {
-        await client.close();
+        try {
+            await client.releaseLease();
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 export function readRoomReadiness(roomCid, name) {
@@ -309,24 +366,47 @@ export function readRoomReadiness(roomCid, name) {
     }
 }
 /** Explicit logical-instance termination, independent of harness/bridge transport. */
-export async function releaseManagedAgent(role) {
+export async function releaseManagedAgent(role, expected) {
     const profile = readClientProfile({ ...process.env, ...role.env });
     if (!profile)
         throw Error('MANAGED_OURS_REQUIRES_EXPLICIT_DAEMON_PROFILE');
     const root = privateRuntimeRoot(), dir = join(root, binderKey(profile.expectedInstanceId, role.identity));
-    if (!existsSync(join(dir, 'instance.json')))
+    if (!existsSync(join(dir, 'instance.json'))) {
+        if (expected)
+            throw Error('MEMBER_RUNTIME_RETIREMENT_MISSING');
         return;
-    const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+    }
+    const read = (file) => {
+        const path = join(dir, file);
+        if (expected) {
+            assertSafeAncestors(dir);
+            const stat = lstatSync(path);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+                throw Error('MEMBER_RUNTIME_UNSAFE_PROOF');
+        }
+        return JSON.parse(readFileSync(path, 'utf8'));
+    };
+    const instance = read('instance.json');
+    if (expected) {
+        read('state.json');
+        read('owner.json');
+    }
     if (instance.role !== role.name)
         throw Error('IDENTITY_ASSIGNED_TO_OTHER_ROLE');
     const controller = await RuntimeController.acquire(root, profile.expectedInstanceId, role.identity, instance.instance);
     try {
         const state = controller.journal.read();
-        if (!state || state.phase === 'RELEASED')
+        if (expected && (!state || state.name !== role.identity || state.daemon !== profile.expectedInstanceId
+            || state.instance !== instance.instance || state.lifetime !== 'temporary' || instance.temporary !== true
+            || state.cid !== expected.cid || state.action !== expected.action))
+            throw Error('MEMBER_RUNTIME_RETIREMENT_MISMATCH');
+        if (!state)
             return;
-        const owner = JSON.parse(readFileSync(join(dir, 'owner.json'), 'utf8'));
-        if (owner.instance !== state.instance)
+        const owner = read('owner.json');
+        if (owner.instance !== state.instance || typeof owner.token !== 'string' || !owner.token)
             throw Error('OWNER_RECORD_MISMATCH');
+        if (state.phase === 'RELEASED')
+            return;
         const client = await attachOursClient({
             endpoint: profile.endpoint,
             expectedInstanceId: profile.expectedInstanceId,

package/dist/application/codex-models.d.ts

@@ -0,0 +1,15 @@
+import { type OfferedModels } from '../subscriptions/cli.js';
+export interface CodexModelDiscoveryDeps {
+    /** The Codex executable ACP sessions will run, and its version. */
+    runtime(): Promise<{
+        executable: string;
+        version: string;
+    }>;
+    ask(executable: string, env: NodeJS.ProcessEnv): Promise<OfferedModels>;
+    now(): number;
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export declare function createCodexModelDiscovery(overrides?: Partial<CodexModelDiscoveryDeps>): () => Promise<OfferedModels>;

package/dist/application/codex-models.js

@@ -0,0 +1,56 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveBundledAcpAgent } from '../harness/acp-agent.js';
+import { probeCodexRuntime } from '../harness/codex-runtime.js';
+import { codexOfferedModels, profileEnv } from '../subscriptions/cli.js';
+import { profileHome, readSubscriptionState } from '../subscriptions/store.js';
+const KNOWN_FOR_MS = 5 * 60_000;
+const UNKNOWN_FOR_MS = 10_000;
+/** When the profile's sign-in last changed; a new sign-in must not reuse another account's answer. */
+function signInStamp(home) {
+    try {
+        return statSync(join(home, 'auth.json')).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export function createCodexModelDiscovery(overrides = {}) {
+    const deps = {
+        runtime: () => probeCodexRuntime(resolveBundledAcpAgent('@agentclientprotocol/codex-acp', 'codex-acp', 'codex-acp'), process.env),
+        ask: codexOfferedModels,
+        now: Date.now,
+        ...overrides,
+    };
+    let cached;
+    let pending;
+    return async () => {
+        let key, executable, env;
+        try {
+            const profileId = readSubscriptionState().providers.codex.activeProfileId;
+            const profile = profileHome('codex', profileId);
+            const runtime = await deps.runtime();
+            executable = runtime.executable;
+            env = profileEnv('CODEX_HOME', profileId, profile);
+            key = [runtime.executable, runtime.version, profileId, signInStamp(profile)].join('\n');
+        }
+        catch (error) {
+            return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+        }
+        if (cached && cached.key === key && cached.until > deps.now())
+            return cached.value;
+        if (pending?.key === key)
+            return pending.answer;
+        const answer = deps.ask(executable, env).then(value => {
+            cached = { key, until: deps.now() + (value.state === 'known' ? KNOWN_FOR_MS : UNKNOWN_FOR_MS), value };
+            return value;
+        }).finally(() => { if (pending?.key === key)
+            pending = undefined; });
+        pending = { key, answer };
+        return answer;
+    };
+}

package/dist/application/conversation-history.d.ts

@@ -0,0 +1,27 @@
+import type { ConversationEventV1 } from '../session/conversation-types.js';
+import type { ConversationPageView } from './session-control.js';
+/** Whether a ledger event belongs in the conversation: the live generation, or history of the resumed ACP session. */
+export declare function conversationEventVisible(event: ConversationEventV1, sessionGeneration: string, resumedSessionId?: string): boolean;
+export interface ConversationTailPage extends ConversationPageView {
+    /** Pass as `before` to read the next older page. */
+    olderCursor?: string;
+    hasOlder: boolean;
+    /** Latest page only: older events the view still needs, the current session's latest capabilities and still-pending permission requests. */
+    context: ConversationEventV1[];
+}
+/**
+ * The newest `limit` visible events before `before` (or the newest overall),
+ * read backwards from the ledger so opening a long session costs one page.
+ * `nextCursor` is the newest ledger position seen, for forward `after` paging.
+ */
+export declare function conversationTailPage(stateDir: string, request: {
+    before?: string;
+    limit?: number;
+}, snapshot: ConversationPageView['snapshot'], resumedSessionId?: string): Promise<ConversationTailPage>;
+/** Read the existing ACP session ledger without opening its writer/recovery store. */
+export declare function resumedConversationPage(stateDir: string, request: {
+    after?: string;
+    limit?: number;
+}, live: ConversationPageView, expectedSessionId: string): Promise<ConversationPageView>;
+/** Download authorization requires an actual published attachment, never an orphan copy. */
+export declare function conversationHasAttachment(stateDir: string, attachment: import('../file-delivery/types.js').DeliveredFile): Promise<boolean>;