@ours.network/fleet 1.2.0-nightly.7 → 1.2.0-nightly.71

package/dist/file-delivery/reader.d.ts

@@ -0,0 +1,15 @@
+import { type FileHandle } from 'node:fs/promises';
+export declare const MAX_FILE_BYTES: number;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export declare function openDirectory(path: string): Promise<FileHandle>;
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export declare function chatFilePath(cwd: string, input: string): string;
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export declare function openChatFile(cwd: string, input: string): Promise<{
+    file: FileHandle;
+    path: string;
+}>;

package/dist/file-delivery/reader.js

@@ -0,0 +1,63 @@
+import { constants } from 'node:fs';
+import { open, readlink } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
+export const MAX_FILE_BYTES = 20 * 1024 * 1024;
+const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export async function openDirectory(path) {
+    if (process.platform !== 'linux' || !isAbsolute(path) || path !== resolve(path))
+        throw Error('FILE_DELIVERY_REQUIRES_LINUX_ROOT');
+    let dir = await open('/', FLAGS | constants.O_DIRECTORY);
+    try {
+        for (const part of path.split('/').filter(Boolean)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        return dir;
+    }
+    catch (error) {
+        await dir.close();
+        throw error;
+    }
+}
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export function chatFilePath(cwd, input) {
+    if (typeof input !== 'string' || !input || input.length > 4096 || /[\x00-\x1f]/.test(input))
+        throw Error('INVALID_CHAT_FILE_PATH');
+    return resolve(cwd, input);
+}
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export async function openChatFile(cwd, input) {
+    if (process.platform !== 'linux')
+        throw Error('CHAT_FILE_REQUIRES_LINUX');
+    let file;
+    try {
+        file = await open(chatFilePath(cwd, input), FLAGS);
+    }
+    catch (error) {
+        const code = error.code;
+        if (error instanceof Error && error.message === 'INVALID_CHAT_FILE_PATH')
+            throw error;
+        throw Error(code === 'ELOOP' ? 'CHAT_FILE_IS_SYMLINK' : code === 'ENOENT' || code === 'ENOTDIR' ? 'CHAT_FILE_NOT_FOUND'
+            : code === 'EACCES' || code === 'EPERM' ? 'CHAT_FILE_NOT_READABLE' : 'CHAT_FILE_OPEN_FAILED');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile())
+            throw Error('CHAT_FILE_NOT_REGULAR');
+        if (stat.nlink !== 1)
+            throw Error('CHAT_FILE_HARDLINKED');
+        if (stat.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        return { file, path: await readlink(`/proc/self/fd/${file.fd}`) };
+    }
+    catch (error) {
+        await file.close();
+        throw error;
+    }
+}

package/dist/file-delivery/store.d.ts

@@ -0,0 +1,15 @@
+import type { DeliveredFile, FileDeliveryBinding } from './types.js';
+export declare function artifactDirectory(stateDir: string): string;
+export declare class ArtifactStore {
+    private readonly stateDir;
+    constructor(stateDir: string);
+    copy(source: {
+        size: number;
+        body: ReadableStream<Uint8Array>;
+        close(): Promise<void>;
+    }, name: string, mimeType: string, binding: FileDeliveryBinding, signal: AbortSignal): Promise<DeliveredFile>;
+}
+export declare function readDeliveredFile(stateDir: string, id: string): Promise<{
+    record: DeliveredFile;
+    bytes: Buffer;
+}>;

package/dist/file-delivery/store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, mkdirSync, readFileSync, readdirSync, lstatSync, openSync, fstatSync, closeSync, renameSync, writeFileSync } from 'node:fs';
+import { open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { openDirectory, MAX_FILE_BYTES } from './reader.js';
+export function artifactDirectory(stateDir) {
+    const incarnation = readFileSync(join(stateDir, '.session-id'), 'utf8').trim();
+    if (!/^[a-f0-9-]{36}$/.test(incarnation))
+        throw Error('INVALID_ROLE_INCARNATION');
+    const key = createHash('sha256').update(JSON.stringify([stateDir, incarnation])).digest('hex');
+    return join(stateRoot(), 'private-file-delivery', key);
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077)
+        throw Error('INVALID_ARTIFACT_DIRECTORY');
+}
+export class ArtifactStore {
+    stateDir;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+    }
+    async copy(source, name, mimeType, binding, signal) {
+        if (!Number.isSafeInteger(source.size) || source.size < 0 || source.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        const path = artifactDirectory(this.stateDir);
+        privateDirectory(join(stateRoot(), 'private-file-delivery'));
+        privateDirectory(path);
+        const root = await openDirectory(path);
+        const id = randomUUID(), base = `/proc/self/fd/${root.fd}/`, partial = base + id + '.part';
+        let file;
+        const reader = source.body.getReader();
+        try {
+            // Orphans count toward the same bounded quota. They are never republished.
+            const entries = readdirSync(base).filter(p => /\.(data|part)$/.test(p));
+            const bytes = entries.reduce((sum, p) => sum + lstatSync(base + p).size, 0);
+            if (entries.length >= 100 || bytes + source.size > 200 * 1024 * 1024)
+                throw Error('ARTIFACT_QUOTA_EXCEEDED');
+            file = await open(partial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            const hash = createHash('sha256');
+            let size = 0;
+            for (;;) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > source.size || size > MAX_FILE_BYTES)
+                    throw Error('SOURCE_SIZE_CHANGED');
+                hash.update(chunk.value);
+                let offset = 0;
+                while (offset < chunk.value.length) {
+                    const { bytesWritten } = await file.write(chunk.value, offset, chunk.value.length - offset);
+                    if (!bytesWritten)
+                        throw Error('SHORT_ARTIFACT_WRITE');
+                    offset += bytesWritten;
+                }
+            }
+            if (size !== source.size)
+                throw Error('SOURCE_SIZE_CHANGED');
+            signal.throwIfAborted();
+            await file.chmod(0o400);
+            await file.sync();
+            await file.close();
+            file = undefined;
+            const record = { id, name, mimeType, size, sha256: hash.digest('hex'), ...binding };
+            renameSync(partial, base + id + '.data');
+            writeFileSync(base + id + '.json', JSON.stringify(record), { flag: 'wx', mode: 0o400, flush: true });
+            // No pending-send record or recovery: a later failure leaves only unreferenced stored bytes.
+            await root.sync();
+            // The newly created incarnation directory and store root must also survive
+            // a crash before a durable conversation event can reference this file.
+            for (const parent of [join(stateRoot(), 'private-file-delivery'), stateRoot()]) {
+                const handle = await openDirectory(parent);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            return record;
+        }
+        finally {
+            await file?.close();
+            await reader.cancel().catch(() => { });
+            await source.close();
+            await unlink(partial).catch(() => { });
+            await root.close();
+        }
+    }
+}
+export async function readDeliveredFile(stateDir, id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error('ARTIFACT_NOT_FOUND');
+    const root = await openDirectory(artifactDirectory(stateDir));
+    const read = (suffix, max) => {
+        const fd = openSync(`/proc/self/fd/${root.fd}/${id}.${suffix}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+                throw Error('INVALID_STORED_ARTIFACT');
+            const bytes = readFileSync(fd);
+            if (bytes.length > max)
+                throw Error('ARTIFACT_TOO_LARGE');
+            return bytes;
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    try {
+        const record = JSON.parse(read('json', 4096).toString());
+        const bytes = read('data', MAX_FILE_BYTES);
+        if (record.id !== id || record.size !== bytes.length || record.sha256 !== createHash('sha256').update(bytes).digest('hex') || typeof record.name !== 'string')
+            throw Error('ARTIFACT_INTEGRITY_FAILED');
+        return { record, bytes };
+    }
+    finally {
+        await root.close();
+    }
+}

package/dist/file-delivery/types.d.ts

@@ -0,0 +1,19 @@
+export interface FileDeliveryBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    turnId: string;
+}
+export interface DeliveredFile extends FileDeliveryBinding {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+}
+export interface FileDeliveryInput {
+    path: string;
+    filename?: string;
+    mime?: string;
+}
+export type CopyChatFile = (binding: FileDeliveryBinding) => Promise<DeliveredFile>;
+export type SendChatFile = (input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile) => Promise<DeliveredFile>;

package/dist/file-delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/fleet-command-audit.d.ts

@@ -113,6 +113,7 @@ export interface FleetCommandClassification {
     decision: FleetCommandDecision;
 }
 export interface FleetAuditAttempt {
+    erased?: boolean;
     version: 1;
     correlationId: string;
     requestId: string;
@@ -144,6 +145,12 @@ export declare const fleetProxyTopLevelInventory: Readonly<{
 }>;
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export declare function classifyFleetArgv(argv: readonly string[]): FleetCommandClassification;
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export declare const managedPinMarker: (configuration: string) => string;
 /** Faithful ordered argv with deterministic structural redaction. */
 export declare function redactFleetArgv(argv: readonly string[]): string[];
 /** Durable write-once attempt ledger; contains redacted argv only. */

package/dist/fleet-command-audit.js

@@ -1,7 +1,7 @@
+import { erasedArg, redactErasedContent, writePrivacyFilteredLedger } from './erased-resources.js';
 import { existsSync, readFileSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { replaceFileAtomically } from './atomic-file.js';
 import { isSensitiveConfigKey } from './sensitive-config.js';
 import { mandatoryConfigurationFits } from './lifecycle-summary.js';
 import { MARKDOWN_MAX_BYTES, MARKDOWN_MAX_CODE_POINTS, markdownCode, markdownProse, } from './rooms-tasks/markdown.js';
@@ -91,7 +91,7 @@ export function recordFleetAuditPresentation(value) {
                 : value.kind === 'lifecycle_failure'
                     ? { label: fleetPresentationLabel(value.label) }
                     : {};
-        const presentation = structuredClone({ ...value, ...labels, eventId: basis });
+        const presentation = redactErasedContent(structuredClone({ ...value, ...labels, eventId: basis }));
         const digest = lifecycleEventDigestBasis(presentation);
         if (!collection.presentations.some(existing => lifecycleEventDigestBasis(existing) === digest))
             collection.presentations.push(presentation);
@@ -135,7 +135,8 @@ export const fleetProxyTopLevelInventory = Object.freeze({
     ], denied: [...DENIED],
     hidden: ['_run', '_run-temp', '_run-temp-worker', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
 });
-const globalValueOptions = new Set(['-c', '--configuration']);
+// `--managed-configuration <file>` is the pinned managed entry form (src/managed-cli.ts).
+const globalValueOptions = new Set(['-c', '--configuration', '--managed-configuration']);
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export function classifyFleetArgv(argv) {
     let command = '';
@@ -186,10 +187,16 @@ export function classifyFleetArgv(argv) {
     return { command, route: 'supervisor-proxy/public', decision: 'allow' };
 }
 const marker = (value) => value === '' ? '[REDACTED:empty]' : '[REDACTED:value]';
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export const managedPinMarker = (configuration) => `[PIN:${createHash('sha256').update(configuration).digest('hex').slice(0, 16)}]`;
 const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
-    '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
+    '--configuration', '-c', '--managed-configuration', '--public-invite', '--public-invite-file', '--invite-file',
     '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
 ]);
@@ -249,6 +256,11 @@ export function redactFleetArgv(argv) {
             result[index] = `${equal[1]}=${marker(equal[2])}`;
             continue;
         }
+        if (index === 0 && arg === '--managed-configuration' && result.length > 1) {
+            result[1] = managedPinMarker(result[1]);
+            index++;
+            continue;
+        }
         if (sensitiveValueFlags.has(arg) && index + 1 < result.length) {
             result[index + 1] = marker(result[index + 1]);
             index++;
@@ -305,11 +317,12 @@ export class FleetCommandAuditStore {
         if (recovered)
             this.persist();
     }
-    list() { return this.attempts.map(item => structuredClone(item)); }
+    list() { return redactErasedContent(this.attempts).map(item => structuredClone(item)); }
     begin(requestId, caller, argv) {
+        this.attempts = redactErasedContent(this.attempts);
         const existing = this.attempts.find(item => item.caller === caller && item.requestId === requestId);
         if (existing) {
-            if (JSON.stringify(existing.argv) !== JSON.stringify(redactFleetArgv(argv)))
+            if (JSON.stringify(existing.argv) !== JSON.stringify(existing.erased ? redactFleetArgv(argv).map(erasedArg) : redactFleetArgv(argv)))
                 throw new Error('fleet command request ID was reused with different argv');
             return structuredClone(existing);
         }
@@ -329,6 +342,8 @@ export class FleetCommandAuditStore {
         return structuredClone(attempt);
     }
     finish(correlationId, caller, outcome) {
+        this.attempts = redactErasedContent(this.attempts);
+        outcome = redactErasedContent({ outcome }).outcome;
         const attempt = this.owned(correlationId, caller);
         if (!attempt.outcome)
             attempt.outcome = { ...outcome, completedAt: this.deps.now().toISOString(), delivery: 'sending' };
@@ -360,7 +375,8 @@ export class FleetCommandAuditStore {
         return attempt;
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, attempts: this.attempts })}\n`, 0o600);
+        this.attempts = redactErasedContent(this.attempts);
+        writePrivacyFilteredLedger(this.path, { version: 1, attempts: this.attempts });
     }
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

package/dist/harness/agent-session.d.ts

@@ -30,6 +30,10 @@ export interface AgentSessionStartOptions {
     cwd: string;
     stateDir: string;
     mode: 'fresh' | 'resume';
+    /** Durable task context must never silently fall back to a fresh session. */
+    requireResume?: boolean;
+    /** Hold recovered never-started prompts until AgentSession.activateRecoveredPrompts(). */
+    deferRecoveredPrompts?: boolean;
     permissions: CommonPermissions;
     permissionMode: {
         fleetMode: FleetPermissionMode;

package/dist/harness/claude-code-session.js

@@ -24,7 +24,7 @@ export class ClaudeCodeAgentSessionAdapter {
         return this.transport({
             name: role.name, harness: role.harness,
             argv: launch.argv, cwd: options.cwd, env: launch.env,
-            stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+            stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, deferRecoveredPrompts: options.deferRecoveredPrompts, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
             mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
             inheritEnvironment: options.managedOurs ? false : undefined,

package/dist/harness/claude-code.js

@@ -6,7 +6,8 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { bundledAcpAgent } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
+import { hostClaude } from './claude-runtime.js';
 import { ClaudeCodeAgentSessionAdapter } from './claude-code-session.js';
 const OPTION_KEYS = [
     'plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode', 'effort',
@@ -283,6 +284,13 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             };
             if (!memPalace)
                 env.MEMPALACE_DISABLED = 'true';
+            // The bundled adapter runs the Claude Code shipped with its SDK unless told otherwise. A host
+            // Claude Code at least as new as that copy is the one the person updates, so sessions run it.
+            if (!customAcpCommand(role)) {
+                const host = hostClaude(resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').manifestPath, { ...process.env, ...role.env }, dirs.runCwd);
+                if (host)
+                    env.CLAUDE_CODE_EXECUTABLE = host.path;
+            }
             // Per-role harness runtime home. Created before sandbox entry so the
             // bind has something to mount; harmless for un-isolated roles.
             // Only a role that declares `isolation:` gets a sandbox, and only a
@@ -377,16 +385,18 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm an in-session Monitor. When such a line appears, run ' +
                 '**get_messages** to drain the mail.',
-            launchNote: name => `You were launched with \`--remote-control ${name}\`. Confirm you are running.`,
-            restartPrompt: (id, worklog, role) => `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
-                (role?.monitor?.mode === 'fleet'
-                    ? 'then continue from '
-                    : `then ${armMonitor(id)}, then continue from `) +
-                `${worklog}. Do not re-run whatever crashed you.` +
-                (role?.monitor?.mode === 'fleet'
-                    ? ' Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
-                        'do NOT arm an in-session Monitor.'
-                    : ''),
+            launchNote: name => `You were launched as Fleet role \`${name}\` under a Claude session. Announce console readiness before task details.`,
+            restartPrompt: (id, worklog, role) => role?.monitor?.mode === 'fleet'
+                ? `Session restarted. The supervisor has verified assigned identity "${id}"; ` +
+                    'accept that readiness and continue without rebinding or profile reconciliation. ' +
+                    'Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
+                    'do NOT arm an in-session Monitor. ' +
+                    'Announce console readiness first without tools, then end that readiness turn. ' +
+                    `For a separate continuation task, read ${worklog} once for continuity if it records previous work; ` +
+                    'do not read it again later in this session. ' +
+                    'Do not re-run whatever crashed you.'
+                : `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
+                    `then ${armMonitor(id)}, then continue from ${worklog}. Do not re-run whatever crashed you.`,
         },
         exitPolicy: { cleanExitIsFresh: true, fastFailSecs: 20 },
     };

package/dist/harness/claude-runtime.d.ts

@@ -0,0 +1,12 @@
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export declare function bundledClaudeVersion(adapterManifest: string): string | undefined;
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export declare function hostClaude(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;

package/dist/harness/claude-runtime.js

@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { codexVersionAtLeast, executableOnPath } from './codex-runtime.js';
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedClaudeVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export function bundledClaudeVersion(adapterManifest) {
+    try {
+        const sdk = dirname(createRequire(adapterManifest).resolve('@anthropic-ai/claude-agent-sdk'));
+        const version = JSON.parse(readFileSync(join(sdk, 'package.json'), 'utf8')).claudeCodeVersion;
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export function hostClaude(adapterManifest, env, cwd = process.cwd(), version = installedClaudeVersion) {
+    if (env.CLAUDE_CODE_EXECUTABLE !== undefined || !adapterManifest)
+        return undefined;
+    const bundled = bundledClaudeVersion(adapterManifest);
+    if (!bundled)
+        return undefined;
+    let path;
+    try {
+        path = executableOnPath('claude', env, cwd);
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}

package/dist/harness/codex-app-server-proxy.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+type JsonObject = Record<string, unknown>;
 interface TerminalRecoveryOptions {
     sendToCodex(line: string): void;
     emitToClient(line: string): void;
@@ -39,6 +40,8 @@ export declare class CodexTerminalRecovery {
     private finishTurn;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean): string;
+export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean, managedOursTools?: JsonObject): string;
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export declare function managedCodexToolPolicy(env: NodeJS.ProcessEnv): JsonObject | undefined;
 export declare function runCodexAppServerProxy(): void;
 export {};

package/dist/harness/codex-app-server-proxy.js

@@ -300,9 +300,9 @@ function sandboxMode(policy) {
  * Fleet keeps the preset's sandbox policy, but restores the independently
  * configured approval policy on the request Codex actually executes.
  */
-function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
+function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp, managedOursTools) {
     if (Array.isArray(value))
-        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp));
+        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     if (!isObject(value) || !isObject(value.params))
         return value;
     if (value.method === 'turn/start') {
@@ -318,17 +318,52 @@ function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
             params: { ...value.params, config: { ...config, mcp_servers: {} } },
         };
     }
+    if (managedOursTools
+        && (value.method === 'thread/start' || value.method === 'thread/resume')) {
+        const config = isObject(value.params.config) ? value.params.config : {};
+        const servers = isObject(config.mcp_servers) ? config.mcp_servers : {};
+        const ours = servers.ours;
+        // Policy cannot create or re-enable a connector that ACP did not inject.
+        if (!isObject(ours) || ours.enabled === false)
+            return value;
+        const tools = isObject(ours.tools) ? { ...ours.tools } : {};
+        for (const [name, policy] of Object.entries(managedOursTools)) {
+            if (isObject(policy))
+                tools[name] = {
+                    ...(isObject(tools[name]) ? tools[name] : {}), ...policy,
+                };
+        }
+        return { ...value, params: { ...value.params, config: { ...config,
+                    mcp_servers: { ...servers, ours: { ...ours, tools } },
+                } } };
+    }
     return value;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false) {
+export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false, managedOursTools) {
     try {
-        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp));
+        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     }
     catch {
         return line;
     }
 }
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export function managedCodexToolPolicy(env) {
+    if (env.FLEET_OURS_MANAGED !== '1')
+        return undefined;
+    try {
+        const config = JSON.parse(env.CODEX_CONFIG ?? '{}');
+        const servers = isObject(config) ? config.mcp_servers : undefined;
+        const ours = isObject(servers) ? servers.ours : undefined;
+        return isObject(ours) && ours.enabled !== false && isObject(ours.tools)
+            ? ours.tools : undefined;
+    }
+    catch {
+        // Invalid config never grants tool approval. ACP owns config diagnostics.
+        return undefined;
+    }
+}
 function requiredChoice(name, allowed) {
     const value = process.env[name];
     if (value && allowed.has(value))
@@ -355,6 +390,7 @@ export function runCodexAppServerProxy() {
     const approval = requiredChoice(APPROVAL_ENV, APPROVAL_POLICIES);
     const expectedSandbox = requiredChoice(SANDBOX_ENV, SANDBOX_MODES);
     const disableInheritedMcp = process.env[DISABLE_INHERITED_MCP_ENV] === '1';
+    const managedOursTools = managedCodexToolPolicy(process.env);
     const launch = realCodexLaunch();
     const env = { ...process.env };
     delete env.CODEX_PATH;
@@ -450,7 +486,7 @@ export function runCodexAppServerProxy() {
     input.on('line', line => {
         if (finished)
             return;
-        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp);
+        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
         writeToChild(rewritten);
     });

package/dist/harness/codex-reasoning.d.ts

@@ -0,0 +1,5 @@
+/** Efforts supported by Fleet's Codex Brain contract. Keep native eligibility in sync. */
+export declare const CODEX_REASONING_EFFORTS: readonly ["low", "medium", "high", "xhigh", "max", "ultra"];
+export declare function isCodexReasoningEffort(value: unknown): value is string;
+/** Only inspected model tuning may bypass the managed CLI native-config guard. */
+export declare function isManagedCliCodexConfig(config: unknown): boolean;

package/dist/harness/codex-reasoning.js

@@ -0,0 +1,12 @@
+/** Efforts supported by Fleet's Codex Brain contract. Keep native eligibility in sync. */
+export const CODEX_REASONING_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
+export function isCodexReasoningEffort(value) {
+    return typeof value === 'string' && CODEX_REASONING_EFFORTS.includes(value);
+}
+/** Only inspected model tuning may bypass the managed CLI native-config guard. */
+export function isManagedCliCodexConfig(config) {
+    if (config == null)
+        return true;
+    return typeof config === 'object' && !Array.isArray(config)
+        && Object.entries(config).every(([key, value]) => key === 'model_reasoning_effort' && isCodexReasoningEffort(value));
+}

package/dist/harness/codex-runtime.d.ts

@@ -4,8 +4,18 @@ export declare const VERIFIED_CODEX_ACP_VERSIONS: Set<string>;
 export declare function executableOnPath(command: string, env: NodeJS.ProcessEnv, cwd?: string): string;
 /** Match the npm Codex wrapper's platform-package/vendor selection. */
 export declare function codexExecutable(entry: string): string;
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export declare function hostCodex(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;
 export interface CodexRuntime {
-    source: 'CODEX_PATH' | 'bundled';
+    source: 'CODEX_PATH' | 'host' | 'bundled';
     entry: string;
     executable: string;
     version: string;