@ours.network/fleet 1.2.0-nightly.7 → 1.2.0-nightly.70

package/dist/doctor.js

@@ -1,17 +1,17 @@
-import { join } from 'node:path';
-import { userInfo, homedir } from 'node:os';
+import { describeRegistration, refreshServiceRegistrations, registrationDrift } from './supervisor/registration-refresh.js';
+import { userInfo } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { realExec } from './exec.js';
 import { isolationContextFor, loadConfig } from './config.js';
 import { getAdapter, productionAdapters } from './harness/registry.js';
 import { analyzeFleetPermissions, formatNative } from './permissions.js';
+import { managedCliReport } from './managed-cli.js';
 import { resolveBundledAcpAgent } from './harness/acp-agent.js';
 import { agentDir, deriveXdgRuntimeDir } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
-import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
@@ -37,25 +37,21 @@ function resolveMonitorProfiles(roles) {
     const profiles = [];
     for (const role of roles.filter(r => r.monitor?.mode === 'fleet')) {
         const env = { ...process.env, ...(role.env ?? {}) };
-        const client = readClientProfile(env);
-        if (client) {
-            const existing = profiles.find(p => p.client?.endpoint === client.endpoint
-                && p.client.expectedInstanceId === client.expectedInstanceId
-                && p.client.credentialPath === client.credentialPath);
-            if (existing)
-                existing.roles.push(role.name);
-            else
-                profiles.push({ client, roles: [role.name] });
+        let client;
+        try {
+            client = readClientProfile(env);
+        }
+        catch (error) {
+            profiles.push({ roles: [role.name], error: error instanceof Error ? error.message : 'Invalid gateway profile' });
             continue;
         }
-        const endpoint = resolveEndpoint(env);
-        const token = endpoint.headers['x-ours-api-token'];
-        const existing = profiles.find(p => p.endpoint?.origin === endpoint.origin
-            && p.endpoint.headers['x-ours-api-token'] === token);
+        const existing = profiles.find(p => p.client?.endpoint === client.endpoint
+            && p.client.expectedInstanceId === client.expectedInstanceId
+            && p.client.credentialPath === client.credentialPath);
         if (existing)
             existing.roles.push(role.name);
         else
-            profiles.push({ endpoint, roles: [role.name] });
+            profiles.push({ client, roles: [role.name] });
     }
     return profiles;
 }
@@ -101,6 +97,25 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // trustworthy as the answer, and a second install with the same semver and
     // different behaviour is invisible to `--version`.
     checks.push(...installChecks(opts.installScan));
+    if (opts.serviceRegistration) {
+        try {
+            const reports = await refreshServiceRegistrations({
+                ...opts.serviceRegistration, write: false, exec, platform,
+            });
+            for (const report of reports.filter(report => report.state !== 'absent'))
+                checks.push({
+                    name: `service: ${report.service}`,
+                    // Same predicate as `service check`, so a pending reload is drift here too.
+                    ok: registrationDrift([report]).length === 0,
+                    detail: describeRegistration(report).replace(/^\S+\s+/, '')
+                        + (report.state === 'stale' ? '; run: ours-fleet service refresh' : ''),
+                });
+        }
+        catch (error) {
+            checks.push({ name: 'service definitions', ok: false,
+                detail: `could not inspect: ${error?.message ?? String(error)}` });
+        }
+    }
     const major = Number(process.versions.node.split('.')[0]);
     checks.push({
         name: 'node', ok: major >= 20,
@@ -156,7 +171,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
-        // Cowork socket reachability
+        // Cowork gateway reachability
         const coworkConfig = rooms.cowork?.config;
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -165,14 +180,14 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
             checks.push({
                 name: 'cowork', ok: reachable,
                 detail: reachable
-                    ? 'management socket reachable'
-                    : `management socket unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
+                    ? 'gateway management reachable'
+                    : `gateway management unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
             });
         }
         catch (e) {
             checks.push({
                 name: 'cowork', ok: false,
-                detail: `management socket error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
+                detail: `gateway management error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
             });
         }
         // Owner CID shape
@@ -219,17 +234,6 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     : `template '${defaultTemplate}' not found`,
             });
         }
-        // Shared-daemon selection coherence
-        if (rooms.cowork?.config) {
-            const { existsSync: exists } = await import('node:fs');
-            const configOk = exists(rooms.cowork.config);
-            checks.push({
-                name: 'rooms: cowork config', ok: configOk,
-                detail: configOk
-                    ? `cowork config at ${rooms.cowork.config}`
-                    : `cowork config not found: ${rooms.cowork.config}`,
-            });
-        }
         // Hard room-management capability check
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -273,20 +277,17 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
-    let managedSelection = false;
+    let managedSelection = true;
     try {
         // Mark explicit selection before validation so a damaged managed profile does
         // not produce advice to start an unrelated local daemon.
-        managedSelection = process.env.OURS_CONFIG !== undefined
-            || existsSync(join(process.env.HOME || homedir(), '.ours-client', 'profile.json'));
+        managedSelection = true;
         const selected = readClientProfile(process.env);
         managedSelection = selected !== undefined;
-        const client = await attachDaemon(selected ? {
+        const client = await attachDaemon({
             endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
             credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-        } : {
-            env: process.env, leaseToken: `ours-fleet-doctor-${process.pid}`, clientPid: process.pid,
         });
         let daemonVersion;
         try {
@@ -368,6 +369,32 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     + `grants only ${analysis.capabilities.join(', ') || '(nothing)'}`,
         });
     }
+    // Managed CLI policy. Three separate rows on purpose: what Fleet generated
+    // (static), what the running session loaded, and what the supervisor audit
+    // ledger actually recorded. The first two never stand in for the third.
+    if (roles.some(role => role.managed_cli?.length)) {
+        const report = managedCliReport({ roles }, opts.configPath, { write: false, platform });
+        for (const role of report.roles.filter(item => item.setup.state !== 'not-declared')) {
+            checks.push({
+                name: `managed CLI setup: ${role.role}`,
+                ok: ['prepared', 'generated-at-launch', 'not-required'].includes(role.setup.state),
+                detail: `static: ${role.setup.state} — ${role.setup.detail}`
+                    + (['missing', 'stale'].includes(role.setup.state) ? '; run: ours-fleet managed-cli setup' : '')
+                    + (role.warnings.length ? `; ${role.warnings.join('; ')}` : ''),
+            });
+            if (role.session_policy !== 'not-applicable')
+                checks.push({
+                    name: `managed CLI session: ${role.role}`, ok: true,
+                    detail: role.session_policy === 'restart-required'
+                        ? 'the last launch loaded a different policy — restart this agent to load the current one'
+                        : role.session_policy === 'never-launched' ? 'not launched since setup; the policy loads at its next start'
+                            : 'the last launch loaded the current policy',
+                });
+            checks.push({
+                name: `managed CLI observed: ${role.role}`, ok: true, detail: role.observed.summary,
+            });
+        }
+    }
     for (const role of roles.filter(candidate => candidate.auth_proxy !== undefined)) {
         const proxy = role.auth_proxy;
         const credentialKeys = Object.keys(role.env ?? {}).filter(key => /^(ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|AUTHORIZATION)$/i.test(key)
@@ -448,14 +475,18 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // shared-mode misconfig (401) surfaces here rather than as a silent deaf monitor.
     const monitorProfiles = resolveMonitorProfiles(roles);
     for (const profile of monitorProfiles) {
-        const { endpoint, client: selected } = profile;
+        const selected = profile.client;
         const checkName = monitorProfiles.length === 1
             ? 'monitor: daemon API'
             : `monitor: daemon API (${profile.roles.join(', ')})`;
-        let ok = false, detail;
+        let ok = false, detail = 'gateway profile unavailable';
+        if (profile.error) {
+            checks.push({ name: checkName, ok: false, detail: profile.error });
+            continue;
+        }
         try {
             if (selected) {
-                const daemon = await attachOursClient({
+                const daemon = await attachDaemon({
                     endpoint: selected.endpoint,
                     expectedInstanceId: selected.expectedInstanceId,
                     credentialPath: selected.credentialPath,
@@ -464,7 +495,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 });
                 try {
                     const [info, identities] = await Promise.all([
-                        daemon.version(), daemon.identities(),
+                        daemon.version(), daemon.identities?.(),
                     ]);
                     if (info.name !== 'ours' || !Array.isArray(identities))
                         throw new Error('selected daemon metadata is invalid');
@@ -477,27 +508,11 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 checks.push({ name: checkName, ok, detail });
                 continue;
             }
-            const live = await fetchImpl(`${endpoint.origin}/state-dir`, {});
-            if (!live.ok) {
-                detail = `daemon on :${endpoint.port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
-            }
-            else {
-                const auth = await fetchImpl(`${endpoint.origin}/identities`, { headers: endpoint.headers });
-                if (auth.status === 401)
-                    detail = `reachable on :${endpoint.port} but the API token was rejected (401) — ` +
-                        authResolutionHint(endpoint);
-                else if (!auth.ok)
-                    detail = `reachable on :${endpoint.port} but /identities returned HTTP ${auth.status}`;
-                else {
-                    ok = true;
-                    detail = `reachable on :${endpoint.port}, authorized — supervisor wake stream available`;
-                }
-            }
         }
         catch (e) {
-            const target = selected?.endpoint ?? `:${endpoint.port}`;
+            const target = selected.endpoint;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours-daemon start) [${e?.message ?? e}]`;
+                `(check the configured gateway and issued credential) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/erased-resources.d.ts

@@ -0,0 +1,9 @@
+export declare const erasedArg: (value: string) => string;
+export declare function redactErasedContent<T>(value: T): T;
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export declare function writePrivacyFilteredLedger(path: string, value: unknown): void;
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export declare function eraseResourcePresentations(resources: ReadonlyArray<{
+    kind: 'task' | 'room' | 'agent';
+    id: string;
+}>): void;

package/dist/erased-resources.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot } from './paths.js';
+const registryPath = () => join(stateRoot(), 'erased-resources.json');
+const lockPath = () => join(stateRoot(), 'locks', 'audit-erasure');
+const ledgerNames = ['.fleet-command-audit.json', '.owner-channel-command-audit.json', '.owner-channel-lifecycle-outbox.json'];
+export const erasedArg = (value) => `[erased:${createHash('sha256').update(value).digest('hex')}]`;
+function registry() {
+    if (!existsSync(registryPath()))
+        return new Set();
+    const value = JSON.parse(readFileSync(registryPath(), 'utf8'));
+    if (!Array.isArray(value) || value.some(v => typeof v !== 'string'))
+        throw new Error('Invalid erasure registry');
+    return new Set(value);
+}
+/** Preserve delivery/deduplication metadata while removing owned presentation content. */
+function redact(value, erased) {
+    if (Array.isArray(value))
+        return value.map(item => redact(item, erased));
+    if (!value || typeof value !== 'object')
+        return value;
+    const next = { ...value };
+    const kind = value.kind === 'lifecycle_failure' ? value.resource?.toLowerCase() : value.kind === 'agent_started' ? 'agent' : value.kind;
+    if (typeof value.id === 'string' && erased.has(`${kind}:${value.id}`)) {
+        for (const key of ['title', 'reason', 'roomName', 'label', 'template', 'configuration', 'model', 'permissions'])
+            delete next[key];
+        if (kind === 'task')
+            next.agents = [];
+        if (kind === 'room') {
+            delete next.name;
+            next.participants = [];
+        }
+        if (kind === 'agent') {
+            next.name = 'erased';
+            next.brain = '[erased]';
+            next.role = '[erased]';
+            next.inherited = [];
+        }
+    }
+    if (typeof value.roomId === 'string' && erased.has(`room:${value.roomId}`)) {
+        delete next.roomName;
+        if (kind === 'task')
+            next.agents = [];
+    }
+    const resources = value.outcome?.resourceIds;
+    const ownsAttempt = resources && Object.entries(resources).some(([key, id]) => erased.has(`${key}:${id}`));
+    const ownsPresentation = value.outcome?.presentations?.some((p) => erased.has(`${p.kind === 'agent_started' ? 'agent' : p.kind}:${p.id}`));
+    if ((ownsAttempt || ownsPresentation) && Array.isArray(value.argv) && !value.erased) {
+        next.argv = value.argv.map(erasedArg);
+        next.erased = true;
+    }
+    for (const key of Object.keys(next))
+        if (typeof next[key] === 'object')
+            next[key] = redact(next[key], erased);
+    return next;
+}
+export function redactErasedContent(value) { return redact(value, registry()); }
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export function writePrivacyFilteredLedger(path, value) {
+    withSynchronousFileLock(lockPath(), () => replaceFileAtomically(path, JSON.stringify(redact(value, registry())) + '\n'));
+}
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export function eraseResourcePresentations(resources) {
+    withSynchronousFileLock(lockPath(), () => {
+        const erased = registry();
+        for (const resource of resources)
+            erased.add(`${resource.kind}:${resource.id}`);
+        replaceFileAtomically(registryPath(), JSON.stringify([...erased]));
+        for (const root of [join(stateRoot(), 'agents'), join(stateRoot(), 'tmp'), join(stateRoot(), 'recovery', 'temporary')]) {
+            if (!existsSync(root))
+                continue;
+            for (const entry of readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+                for (const name of ledgerNames) {
+                    const path = join(root, entry.name, name);
+                    if (!existsSync(path) || !lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+                        continue;
+                    const old = JSON.parse(readFileSync(path, 'utf8'));
+                    replaceFileAtomically(path, JSON.stringify(redact(old, erased)) + '\n');
+                }
+            }
+        }
+    });
+}

package/dist/file-delivery/reader.d.ts

@@ -0,0 +1,15 @@
+import { type FileHandle } from 'node:fs/promises';
+export declare const MAX_FILE_BYTES: number;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export declare function openDirectory(path: string): Promise<FileHandle>;
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export declare function chatFilePath(cwd: string, input: string): string;
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export declare function openChatFile(cwd: string, input: string): Promise<{
+    file: FileHandle;
+    path: string;
+}>;

package/dist/file-delivery/reader.js

@@ -0,0 +1,63 @@
+import { constants } from 'node:fs';
+import { open, readlink } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
+export const MAX_FILE_BYTES = 20 * 1024 * 1024;
+const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export async function openDirectory(path) {
+    if (process.platform !== 'linux' || !isAbsolute(path) || path !== resolve(path))
+        throw Error('FILE_DELIVERY_REQUIRES_LINUX_ROOT');
+    let dir = await open('/', FLAGS | constants.O_DIRECTORY);
+    try {
+        for (const part of path.split('/').filter(Boolean)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        return dir;
+    }
+    catch (error) {
+        await dir.close();
+        throw error;
+    }
+}
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export function chatFilePath(cwd, input) {
+    if (typeof input !== 'string' || !input || input.length > 4096 || /[\x00-\x1f]/.test(input))
+        throw Error('INVALID_CHAT_FILE_PATH');
+    return resolve(cwd, input);
+}
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export async function openChatFile(cwd, input) {
+    if (process.platform !== 'linux')
+        throw Error('CHAT_FILE_REQUIRES_LINUX');
+    let file;
+    try {
+        file = await open(chatFilePath(cwd, input), FLAGS);
+    }
+    catch (error) {
+        const code = error.code;
+        if (error instanceof Error && error.message === 'INVALID_CHAT_FILE_PATH')
+            throw error;
+        throw Error(code === 'ELOOP' ? 'CHAT_FILE_IS_SYMLINK' : code === 'ENOENT' || code === 'ENOTDIR' ? 'CHAT_FILE_NOT_FOUND'
+            : code === 'EACCES' || code === 'EPERM' ? 'CHAT_FILE_NOT_READABLE' : 'CHAT_FILE_OPEN_FAILED');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile())
+            throw Error('CHAT_FILE_NOT_REGULAR');
+        if (stat.nlink !== 1)
+            throw Error('CHAT_FILE_HARDLINKED');
+        if (stat.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        return { file, path: await readlink(`/proc/self/fd/${file.fd}`) };
+    }
+    catch (error) {
+        await file.close();
+        throw error;
+    }
+}

package/dist/file-delivery/store.d.ts

@@ -0,0 +1,15 @@
+import type { DeliveredFile, FileDeliveryBinding } from './types.js';
+export declare function artifactDirectory(stateDir: string): string;
+export declare class ArtifactStore {
+    private readonly stateDir;
+    constructor(stateDir: string);
+    copy(source: {
+        size: number;
+        body: ReadableStream<Uint8Array>;
+        close(): Promise<void>;
+    }, name: string, mimeType: string, binding: FileDeliveryBinding, signal: AbortSignal): Promise<DeliveredFile>;
+}
+export declare function readDeliveredFile(stateDir: string, id: string): Promise<{
+    record: DeliveredFile;
+    bytes: Buffer;
+}>;

package/dist/file-delivery/store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, mkdirSync, readFileSync, readdirSync, lstatSync, openSync, fstatSync, closeSync, renameSync, writeFileSync } from 'node:fs';
+import { open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { openDirectory, MAX_FILE_BYTES } from './reader.js';
+export function artifactDirectory(stateDir) {
+    const incarnation = readFileSync(join(stateDir, '.session-id'), 'utf8').trim();
+    if (!/^[a-f0-9-]{36}$/.test(incarnation))
+        throw Error('INVALID_ROLE_INCARNATION');
+    const key = createHash('sha256').update(JSON.stringify([stateDir, incarnation])).digest('hex');
+    return join(stateRoot(), 'private-file-delivery', key);
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077)
+        throw Error('INVALID_ARTIFACT_DIRECTORY');
+}
+export class ArtifactStore {
+    stateDir;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+    }
+    async copy(source, name, mimeType, binding, signal) {
+        if (!Number.isSafeInteger(source.size) || source.size < 0 || source.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        const path = artifactDirectory(this.stateDir);
+        privateDirectory(join(stateRoot(), 'private-file-delivery'));
+        privateDirectory(path);
+        const root = await openDirectory(path);
+        const id = randomUUID(), base = `/proc/self/fd/${root.fd}/`, partial = base + id + '.part';
+        let file;
+        const reader = source.body.getReader();
+        try {
+            // Orphans count toward the same bounded quota. They are never republished.
+            const entries = readdirSync(base).filter(p => /\.(data|part)$/.test(p));
+            const bytes = entries.reduce((sum, p) => sum + lstatSync(base + p).size, 0);
+            if (entries.length >= 100 || bytes + source.size > 200 * 1024 * 1024)
+                throw Error('ARTIFACT_QUOTA_EXCEEDED');
+            file = await open(partial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            const hash = createHash('sha256');
+            let size = 0;
+            for (;;) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > source.size || size > MAX_FILE_BYTES)
+                    throw Error('SOURCE_SIZE_CHANGED');
+                hash.update(chunk.value);
+                let offset = 0;
+                while (offset < chunk.value.length) {
+                    const { bytesWritten } = await file.write(chunk.value, offset, chunk.value.length - offset);
+                    if (!bytesWritten)
+                        throw Error('SHORT_ARTIFACT_WRITE');
+                    offset += bytesWritten;
+                }
+            }
+            if (size !== source.size)
+                throw Error('SOURCE_SIZE_CHANGED');
+            signal.throwIfAborted();
+            await file.chmod(0o400);
+            await file.sync();
+            await file.close();
+            file = undefined;
+            const record = { id, name, mimeType, size, sha256: hash.digest('hex'), ...binding };
+            renameSync(partial, base + id + '.data');
+            writeFileSync(base + id + '.json', JSON.stringify(record), { flag: 'wx', mode: 0o400, flush: true });
+            // No pending-send record or recovery: a later failure leaves only unreferenced stored bytes.
+            await root.sync();
+            // The newly created incarnation directory and store root must also survive
+            // a crash before a durable conversation event can reference this file.
+            for (const parent of [join(stateRoot(), 'private-file-delivery'), stateRoot()]) {
+                const handle = await openDirectory(parent);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            return record;
+        }
+        finally {
+            await file?.close();
+            await reader.cancel().catch(() => { });
+            await source.close();
+            await unlink(partial).catch(() => { });
+            await root.close();
+        }
+    }
+}
+export async function readDeliveredFile(stateDir, id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error('ARTIFACT_NOT_FOUND');
+    const root = await openDirectory(artifactDirectory(stateDir));
+    const read = (suffix, max) => {
+        const fd = openSync(`/proc/self/fd/${root.fd}/${id}.${suffix}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+                throw Error('INVALID_STORED_ARTIFACT');
+            const bytes = readFileSync(fd);
+            if (bytes.length > max)
+                throw Error('ARTIFACT_TOO_LARGE');
+            return bytes;
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    try {
+        const record = JSON.parse(read('json', 4096).toString());
+        const bytes = read('data', MAX_FILE_BYTES);
+        if (record.id !== id || record.size !== bytes.length || record.sha256 !== createHash('sha256').update(bytes).digest('hex') || typeof record.name !== 'string')
+            throw Error('ARTIFACT_INTEGRITY_FAILED');
+        return { record, bytes };
+    }
+    finally {
+        await root.close();
+    }
+}

package/dist/file-delivery/types.d.ts

@@ -0,0 +1,19 @@
+export interface FileDeliveryBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    turnId: string;
+}
+export interface DeliveredFile extends FileDeliveryBinding {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+}
+export interface FileDeliveryInput {
+    path: string;
+    filename?: string;
+    mime?: string;
+}
+export type CopyChatFile = (binding: FileDeliveryBinding) => Promise<DeliveredFile>;
+export type SendChatFile = (input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile) => Promise<DeliveredFile>;

package/dist/file-delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/fleet-command-audit.d.ts

@@ -113,6 +113,7 @@ export interface FleetCommandClassification {
     decision: FleetCommandDecision;
 }
 export interface FleetAuditAttempt {
+    erased?: boolean;
     version: 1;
     correlationId: string;
     requestId: string;
@@ -144,6 +145,12 @@ export declare const fleetProxyTopLevelInventory: Readonly<{
 }>;
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export declare function classifyFleetArgv(argv: readonly string[]): FleetCommandClassification;
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export declare const managedPinMarker: (configuration: string) => string;
 /** Faithful ordered argv with deterministic structural redaction. */
 export declare function redactFleetArgv(argv: readonly string[]): string[];
 /** Durable write-once attempt ledger; contains redacted argv only. */