@ours.network/fleet 1.2.0-nightly.8 → 1.2.0-nightly.81

package/dist/erased-resources.js

@@ -0,0 +1,87 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot } from './paths.js';
+const registryPath = () => join(stateRoot(), 'erased-resources.json');
+const lockPath = () => join(stateRoot(), 'locks', 'audit-erasure');
+const ledgerNames = ['.fleet-command-audit.json', '.owner-channel-command-audit.json', '.owner-channel-lifecycle-outbox.json'];
+export const erasedArg = (value) => `[erased:${createHash('sha256').update(value).digest('hex')}]`;
+function registry() {
+    if (!existsSync(registryPath()))
+        return new Set();
+    const value = JSON.parse(readFileSync(registryPath(), 'utf8'));
+    if (!Array.isArray(value) || value.some(v => typeof v !== 'string'))
+        throw new Error('Invalid erasure registry');
+    return new Set(value);
+}
+/** Preserve delivery/deduplication metadata while removing owned presentation content. */
+function redact(value, erased) {
+    if (Array.isArray(value))
+        return value.map(item => redact(item, erased));
+    if (!value || typeof value !== 'object')
+        return value;
+    const next = { ...value };
+    const kind = value.kind === 'lifecycle_failure' ? value.resource?.toLowerCase() : value.kind === 'agent_started' ? 'agent' : value.kind;
+    if (typeof value.id === 'string' && erased.has(`${kind}:${value.id}`)) {
+        for (const key of ['title', 'reason', 'roomName', 'label', 'template', 'configuration', 'model', 'permissions'])
+            delete next[key];
+        if (kind === 'task')
+            next.agents = [];
+        if (kind === 'room') {
+            delete next.name;
+            next.participants = [];
+        }
+        if (kind === 'agent') {
+            next.name = 'erased';
+            next.brain = '[erased]';
+            next.role = '[erased]';
+            next.inherited = [];
+        }
+    }
+    if (typeof value.roomId === 'string' && erased.has(`room:${value.roomId}`)) {
+        delete next.roomName;
+        if (kind === 'task')
+            next.agents = [];
+    }
+    const resources = value.outcome?.resourceIds;
+    const ownsAttempt = resources && Object.entries(resources).some(([key, id]) => erased.has(`${key}:${id}`));
+    const ownsPresentation = value.outcome?.presentations?.some((p) => erased.has(`${p.kind === 'agent_started' ? 'agent' : p.kind}:${p.id}`));
+    if ((ownsAttempt || ownsPresentation) && Array.isArray(value.argv) && !value.erased) {
+        next.argv = value.argv.map(erasedArg);
+        next.erased = true;
+    }
+    for (const key of Object.keys(next))
+        if (typeof next[key] === 'object')
+            next[key] = redact(next[key], erased);
+    return next;
+}
+export function redactErasedContent(value) { return redact(value, registry()); }
+/** Every cooperative writer filters stale in-memory snapshots under the same lock as erasure. */
+export function writePrivacyFilteredLedger(path, value) {
+    withSynchronousFileLock(lockPath(), () => replaceFileAtomically(path, JSON.stringify(redact(value, registry())) + '\n'));
+}
+/** Content-free resource IDs persist to prevent active writers resurrecting erased labels. */
+export function eraseResourcePresentations(resources) {
+    withSynchronousFileLock(lockPath(), () => {
+        const erased = registry();
+        for (const resource of resources)
+            erased.add(`${resource.kind}:${resource.id}`);
+        replaceFileAtomically(registryPath(), JSON.stringify([...erased]));
+        for (const root of [join(stateRoot(), 'agents'), join(stateRoot(), 'tmp'), join(stateRoot(), 'recovery', 'temporary')]) {
+            if (!existsSync(root))
+                continue;
+            for (const entry of readdirSync(root, { withFileTypes: true })) {
+                if (!entry.isDirectory() || entry.isSymbolicLink())
+                    continue;
+                for (const name of ledgerNames) {
+                    const path = join(root, entry.name, name);
+                    if (!existsSync(path) || !lstatSync(path).isFile() || lstatSync(path).isSymbolicLink())
+                        continue;
+                    const old = JSON.parse(readFileSync(path, 'utf8'));
+                    replaceFileAtomically(path, JSON.stringify(redact(old, erased)) + '\n');
+                }
+            }
+        }
+    });
+}

package/dist/file-delivery/reader.d.ts

@@ -0,0 +1,15 @@
+import { type FileHandle } from 'node:fs/promises';
+export declare const MAX_FILE_BYTES: number;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export declare function openDirectory(path: string): Promise<FileHandle>;
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export declare function chatFilePath(cwd: string, input: string): string;
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export declare function openChatFile(cwd: string, input: string): Promise<{
+    file: FileHandle;
+    path: string;
+}>;

package/dist/file-delivery/reader.js

@@ -0,0 +1,63 @@
+import { constants } from 'node:fs';
+import { open, readlink } from 'node:fs/promises';
+import { isAbsolute, resolve } from 'node:path';
+export const MAX_FILE_BYTES = 20 * 1024 * 1024;
+const FLAGS = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+/** Pin every component; neither trusted root ancestors nor agent components follow symlinks. */
+export async function openDirectory(path) {
+    if (process.platform !== 'linux' || !isAbsolute(path) || path !== resolve(path))
+        throw Error('FILE_DELIVERY_REQUIRES_LINUX_ROOT');
+    let dir = await open('/', FLAGS | constants.O_DIRECTORY);
+    try {
+        for (const part of path.split('/').filter(Boolean)) {
+            const next = await open(`/proc/self/fd/${dir.fd}/${part}`, FLAGS | constants.O_DIRECTORY);
+            await dir.close();
+            dir = next;
+        }
+        return dir;
+    }
+    catch (error) {
+        await dir.close();
+        throw error;
+    }
+}
+/** The agent's provided path, resolved from its working directory; no export subtree. */
+export function chatFilePath(cwd, input) {
+    if (typeof input !== 'string' || !input || input.length > 4096 || /[\x00-\x1f]/.test(input))
+        throw Error('INVALID_CHAT_FILE_PATH');
+    return resolve(cwd, input);
+}
+/**
+ * Runs in the harness bridge, never in the supervisor's OS context. Ancestor
+ * symlinks resolve normally; the named file itself must be one regular,
+ * singly-linked file within the size limit. `path` is the opened file's real path.
+ */
+export async function openChatFile(cwd, input) {
+    if (process.platform !== 'linux')
+        throw Error('CHAT_FILE_REQUIRES_LINUX');
+    let file;
+    try {
+        file = await open(chatFilePath(cwd, input), FLAGS);
+    }
+    catch (error) {
+        const code = error.code;
+        if (error instanceof Error && error.message === 'INVALID_CHAT_FILE_PATH')
+            throw error;
+        throw Error(code === 'ELOOP' ? 'CHAT_FILE_IS_SYMLINK' : code === 'ENOENT' || code === 'ENOTDIR' ? 'CHAT_FILE_NOT_FOUND'
+            : code === 'EACCES' || code === 'EPERM' ? 'CHAT_FILE_NOT_READABLE' : 'CHAT_FILE_OPEN_FAILED');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile())
+            throw Error('CHAT_FILE_NOT_REGULAR');
+        if (stat.nlink !== 1)
+            throw Error('CHAT_FILE_HARDLINKED');
+        if (stat.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        return { file, path: await readlink(`/proc/self/fd/${file.fd}`) };
+    }
+    catch (error) {
+        await file.close();
+        throw error;
+    }
+}

package/dist/file-delivery/store.d.ts

@@ -0,0 +1,15 @@
+import type { DeliveredFile, FileDeliveryBinding } from './types.js';
+export declare function artifactDirectory(stateDir: string): string;
+export declare class ArtifactStore {
+    private readonly stateDir;
+    constructor(stateDir: string);
+    copy(source: {
+        size: number;
+        body: ReadableStream<Uint8Array>;
+        close(): Promise<void>;
+    }, name: string, mimeType: string, binding: FileDeliveryBinding, signal: AbortSignal): Promise<DeliveredFile>;
+}
+export declare function readDeliveredFile(stateDir: string, id: string): Promise<{
+    record: DeliveredFile;
+    bytes: Buffer;
+}>;

package/dist/file-delivery/store.js

@@ -0,0 +1,124 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, mkdirSync, readFileSync, readdirSync, lstatSync, openSync, fstatSync, closeSync, renameSync, writeFileSync } from 'node:fs';
+import { open, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { openDirectory, MAX_FILE_BYTES } from './reader.js';
+export function artifactDirectory(stateDir) {
+    const incarnation = readFileSync(join(stateDir, '.session-id'), 'utf8').trim();
+    if (!/^[a-f0-9-]{36}$/.test(incarnation))
+        throw Error('INVALID_ROLE_INCARNATION');
+    const key = createHash('sha256').update(JSON.stringify([stateDir, incarnation])).digest('hex');
+    return join(stateRoot(), 'private-file-delivery', key);
+}
+function privateDirectory(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077)
+        throw Error('INVALID_ARTIFACT_DIRECTORY');
+}
+export class ArtifactStore {
+    stateDir;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+    }
+    async copy(source, name, mimeType, binding, signal) {
+        if (!Number.isSafeInteger(source.size) || source.size < 0 || source.size > MAX_FILE_BYTES)
+            throw Error('FILE_EXCEEDS_20_MIB');
+        const path = artifactDirectory(this.stateDir);
+        privateDirectory(join(stateRoot(), 'private-file-delivery'));
+        privateDirectory(path);
+        const root = await openDirectory(path);
+        const id = randomUUID(), base = `/proc/self/fd/${root.fd}/`, partial = base + id + '.part';
+        let file;
+        const reader = source.body.getReader();
+        try {
+            // Orphans count toward the same bounded quota. They are never republished.
+            const entries = readdirSync(base).filter(p => /\.(data|part)$/.test(p));
+            const bytes = entries.reduce((sum, p) => sum + lstatSync(base + p).size, 0);
+            if (entries.length >= 100 || bytes + source.size > 200 * 1024 * 1024)
+                throw Error('ARTIFACT_QUOTA_EXCEEDED');
+            file = await open(partial, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            const hash = createHash('sha256');
+            let size = 0;
+            for (;;) {
+                signal.throwIfAborted();
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                size += chunk.value.length;
+                if (size > source.size || size > MAX_FILE_BYTES)
+                    throw Error('SOURCE_SIZE_CHANGED');
+                hash.update(chunk.value);
+                let offset = 0;
+                while (offset < chunk.value.length) {
+                    const { bytesWritten } = await file.write(chunk.value, offset, chunk.value.length - offset);
+                    if (!bytesWritten)
+                        throw Error('SHORT_ARTIFACT_WRITE');
+                    offset += bytesWritten;
+                }
+            }
+            if (size !== source.size)
+                throw Error('SOURCE_SIZE_CHANGED');
+            signal.throwIfAborted();
+            await file.chmod(0o400);
+            await file.sync();
+            await file.close();
+            file = undefined;
+            const record = { id, name, mimeType, size, sha256: hash.digest('hex'), ...binding };
+            renameSync(partial, base + id + '.data');
+            writeFileSync(base + id + '.json', JSON.stringify(record), { flag: 'wx', mode: 0o400, flush: true });
+            // No pending-send record or recovery: a later failure leaves only unreferenced stored bytes.
+            await root.sync();
+            // The newly created incarnation directory and store root must also survive
+            // a crash before a durable conversation event can reference this file.
+            for (const parent of [join(stateRoot(), 'private-file-delivery'), stateRoot()]) {
+                const handle = await openDirectory(parent);
+                try {
+                    await handle.sync();
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            return record;
+        }
+        finally {
+            await file?.close();
+            await reader.cancel().catch(() => { });
+            await source.close();
+            await unlink(partial).catch(() => { });
+            await root.close();
+        }
+    }
+}
+export async function readDeliveredFile(stateDir, id) {
+    if (!/^[a-f0-9-]{36}$/.test(id))
+        throw Error('ARTIFACT_NOT_FOUND');
+    const root = await openDirectory(artifactDirectory(stateDir));
+    const read = (suffix, max) => {
+        const fd = openSync(`/proc/self/fd/${root.fd}/${id}.${suffix}`, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+                throw Error('INVALID_STORED_ARTIFACT');
+            const bytes = readFileSync(fd);
+            if (bytes.length > max)
+                throw Error('ARTIFACT_TOO_LARGE');
+            return bytes;
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    try {
+        const record = JSON.parse(read('json', 4096).toString());
+        const bytes = read('data', MAX_FILE_BYTES);
+        if (record.id !== id || record.size !== bytes.length || record.sha256 !== createHash('sha256').update(bytes).digest('hex') || typeof record.name !== 'string')
+            throw Error('ARTIFACT_INTEGRITY_FAILED');
+        return { record, bytes };
+    }
+    finally {
+        await root.close();
+    }
+}

package/dist/file-delivery/types.d.ts

@@ -0,0 +1,19 @@
+export interface FileDeliveryBinding {
+    sessionGeneration: string;
+    acpSessionId: string;
+    turnId: string;
+}
+export interface DeliveredFile extends FileDeliveryBinding {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+}
+export interface FileDeliveryInput {
+    path: string;
+    filename?: string;
+    mime?: string;
+}
+export type CopyChatFile = (binding: FileDeliveryBinding) => Promise<DeliveredFile>;
+export type SendChatFile = (input: FileDeliveryInput, signal: AbortSignal, copy: CopyChatFile) => Promise<DeliveredFile>;

package/dist/file-delivery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/fleet-command-audit.d.ts

@@ -80,6 +80,12 @@ export type FleetAuditPresentation = {
 export declare const FLEET_LIFECYCLE_EVENT_KINDS: readonly ["agent_started", "task", "room", "lifecycle_failure"];
 /** Stable semantic dedupe basis: resource kind + stable resource ID + transition/action ID. */
 export declare function lifecycleEventDigestBasis(value: FleetAuditPresentation): string;
+/** The managed agent the supervisor authenticated for this CLI process (fleet_audit_begin) and its state directory. */
+export declare function setVerifiedFleetCaller(caller: string, stateDir: string): void;
+export declare function verifiedFleetCaller(): {
+    caller: string;
+    stateDir: string;
+} | undefined;
 export declare function beginFleetAuditCollection(): void;
 export declare function setFleetAuditLifecycleCheckpoint(checkpoint: ((presentations: FleetAuditPresentation[]) => Promise<void>) | undefined): void;
 /**
@@ -113,6 +119,7 @@ export interface FleetCommandClassification {
     decision: FleetCommandDecision;
 }
 export interface FleetAuditAttempt {
+    erased?: boolean;
     version: 1;
     correlationId: string;
     requestId: string;
@@ -144,6 +151,12 @@ export declare const fleetProxyTopLevelInventory: Readonly<{
 }>;
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export declare function classifyFleetArgv(argv: readonly string[]): FleetCommandClassification;
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export declare const managedPinMarker: (configuration: string) => string;
 /** Faithful ordered argv with deterministic structural redaction. */
 export declare function redactFleetArgv(argv: readonly string[]): string[];
 /** Durable write-once attempt ledger; contains redacted argv only. */

package/dist/fleet-command-audit.js

@@ -1,7 +1,7 @@
+import { erasedArg, redactErasedContent, writePrivacyFilteredLedger } from './erased-resources.js';
 import { existsSync, readFileSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { replaceFileAtomically } from './atomic-file.js';
 import { isSensitiveConfigKey } from './sensitive-config.js';
 import { mandatoryConfigurationFits } from './lifecycle-summary.js';
 import { MARKDOWN_MAX_BYTES, MARKDOWN_MAX_CODE_POINTS, markdownCode, markdownProse, } from './rooms-tasks/markdown.js';
@@ -26,6 +26,10 @@ export function lifecycleEventDigestBasis(value) {
     const resourceKind = value.kind === 'lifecycle_failure' ? value.resource : value.kind;
     return `${resourceKind}\0${value.id}\0${value.eventId}`;
 }
+let verifiedCaller;
+/** The managed agent the supervisor authenticated for this CLI process (fleet_audit_begin) and its state directory. */
+export function setVerifiedFleetCaller(caller, stateDir) { verifiedCaller = { caller, stateDir }; }
+export function verifiedFleetCaller() { return verifiedCaller; }
 let collection;
 export function beginFleetAuditCollection() { collection = { resourceIds: {}, presentations: [] }; }
 let lifecycleCheckpoint;
@@ -91,7 +95,7 @@ export function recordFleetAuditPresentation(value) {
                 : value.kind === 'lifecycle_failure'
                     ? { label: fleetPresentationLabel(value.label) }
                     : {};
-        const presentation = structuredClone({ ...value, ...labels, eventId: basis });
+        const presentation = redactErasedContent(structuredClone({ ...value, ...labels, eventId: basis }));
         const digest = lifecycleEventDigestBasis(presentation);
         if (!collection.presentations.some(existing => lifecycleEventDigestBasis(existing) === digest))
             collection.presentations.push(presentation);
@@ -120,7 +124,8 @@ const AGENT_SURFACES = {
     ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
-        'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
+        'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish',
+        'progress', 'review-package']),
     room: new Set(['create', 'list', 'show', 'open', 'members', 'delete', 'close']),
 };
 export const fleetProxyCommandInventory = Object.freeze(Object.fromEntries(Object.entries(AGENT_SURFACES).map(([surface, commands]) => [surface, [...commands]])));
@@ -135,7 +140,8 @@ export const fleetProxyTopLevelInventory = Object.freeze({
     ], denied: [...DENIED],
     hidden: ['_run', '_run-temp', '_run-temp-worker', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
 });
-const globalValueOptions = new Set(['-c', '--configuration']);
+// `--managed-configuration <file>` is the pinned managed entry form (src/managed-cli.ts).
+const globalValueOptions = new Set(['-c', '--configuration', '--managed-configuration']);
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export function classifyFleetArgv(argv) {
     let command = '';
@@ -186,12 +192,19 @@ export function classifyFleetArgv(argv) {
     return { command, route: 'supervisor-proxy/public', decision: 'allow' };
 }
 const marker = (value) => value === '' ? '[REDACTED:empty]' : '[REDACTED:value]';
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export const managedPinMarker = (configuration) => `[PIN:${createHash('sha256').update(configuration).digest('hex').slice(0, 16)}]`;
 const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
-    '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
+    '--configuration', '-c', '--managed-configuration', '--public-invite', '--public-invite-file', '--invite-file',
     '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
+    '--text-file', '--markdown', '--markdown-file', '--attach',
 ]);
 function redactUrl(value) {
     try {
@@ -249,6 +262,11 @@ export function redactFleetArgv(argv) {
             result[index] = `${equal[1]}=${marker(equal[2])}`;
             continue;
         }
+        if (index === 0 && arg === '--managed-configuration' && result.length > 1) {
+            result[1] = managedPinMarker(result[1]);
+            index++;
+            continue;
+        }
         if (sensitiveValueFlags.has(arg) && index + 1 < result.length) {
             result[index + 1] = marker(result[index + 1]);
             index++;
@@ -305,11 +323,12 @@ export class FleetCommandAuditStore {
         if (recovered)
             this.persist();
     }
-    list() { return this.attempts.map(item => structuredClone(item)); }
+    list() { return redactErasedContent(this.attempts).map(item => structuredClone(item)); }
     begin(requestId, caller, argv) {
+        this.attempts = redactErasedContent(this.attempts);
         const existing = this.attempts.find(item => item.caller === caller && item.requestId === requestId);
         if (existing) {
-            if (JSON.stringify(existing.argv) !== JSON.stringify(redactFleetArgv(argv)))
+            if (JSON.stringify(existing.argv) !== JSON.stringify(existing.erased ? redactFleetArgv(argv).map(erasedArg) : redactFleetArgv(argv)))
                 throw new Error('fleet command request ID was reused with different argv');
             return structuredClone(existing);
         }
@@ -329,6 +348,8 @@ export class FleetCommandAuditStore {
         return structuredClone(attempt);
     }
     finish(correlationId, caller, outcome) {
+        this.attempts = redactErasedContent(this.attempts);
+        outcome = redactErasedContent({ outcome }).outcome;
         const attempt = this.owned(correlationId, caller);
         if (!attempt.outcome)
             attempt.outcome = { ...outcome, completedAt: this.deps.now().toISOString(), delivery: 'sending' };
@@ -360,7 +381,8 @@ export class FleetCommandAuditStore {
         return attempt;
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, attempts: this.attempts })}\n`, 0o600);
+        this.attempts = redactErasedContent(this.attempts);
+        writePrivacyFilteredLedger(this.path, { version: 1, attempts: this.attempts });
     }
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

package/dist/harness/agent-session.d.ts

@@ -30,6 +30,10 @@ export interface AgentSessionStartOptions {
     cwd: string;
     stateDir: string;
     mode: 'fresh' | 'resume';
+    /** Durable task context must never silently fall back to a fresh session. */
+    requireResume?: boolean;
+    /** Hold recovered never-started prompts until AgentSession.activateRecoveredPrompts(). */
+    deferRecoveredPrompts?: boolean;
     permissions: CommonPermissions;
     permissionMode: {
         fleetMode: FleetPermissionMode;

package/dist/harness/claude-code-session.js

@@ -24,7 +24,7 @@ export class ClaudeCodeAgentSessionAdapter {
         return this.transport({
             name: role.name, harness: role.harness,
             argv: launch.argv, cwd: options.cwd, env: launch.env,
-            stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+            stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, deferRecoveredPrompts: options.deferRecoveredPrompts, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
             mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
             inheritEnvironment: options.managedOurs ? false : undefined,

package/dist/harness/claude-code.js

@@ -6,7 +6,8 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { bundledAcpAgent } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
+import { hostClaude } from './claude-runtime.js';
 import { ClaudeCodeAgentSessionAdapter } from './claude-code-session.js';
 const OPTION_KEYS = [
     'plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode', 'effort',
@@ -283,6 +284,13 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             };
             if (!memPalace)
                 env.MEMPALACE_DISABLED = 'true';
+            // The bundled adapter runs the Claude Code shipped with its SDK unless told otherwise. A host
+            // Claude Code at least as new as that copy is the one the person updates, so sessions run it.
+            if (!customAcpCommand(role)) {
+                const host = hostClaude(resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').manifestPath, { ...process.env, ...role.env }, dirs.runCwd);
+                if (host)
+                    env.CLAUDE_CODE_EXECUTABLE = host.path;
+            }
             // Per-role harness runtime home. Created before sandbox entry so the
             // bind has something to mount; harmless for un-isolated roles.
             // Only a role that declares `isolation:` gets a sandbox, and only a
@@ -377,16 +385,18 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm an in-session Monitor. When such a line appears, run ' +
                 '**get_messages** to drain the mail.',
-            launchNote: name => `You were launched with \`--remote-control ${name}\`. Confirm you are running.`,
-            restartPrompt: (id, worklog, role) => `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
-                (role?.monitor?.mode === 'fleet'
-                    ? 'then continue from '
-                    : `then ${armMonitor(id)}, then continue from `) +
-                `${worklog}. Do not re-run whatever crashed you.` +
-                (role?.monitor?.mode === 'fleet'
-                    ? ' Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
-                        'do NOT arm an in-session Monitor.'
-                    : ''),
+            launchNote: name => `You were launched as Fleet role \`${name}\` under a Claude session. Announce console readiness before task details.`,
+            restartPrompt: (id, worklog, role) => role?.monitor?.mode === 'fleet'
+                ? `Session restarted. The supervisor has verified assigned identity "${id}"; ` +
+                    'accept that readiness and continue without rebinding or profile reconciliation. ' +
+                    'Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
+                    'do NOT arm an in-session Monitor. ' +
+                    'Announce console readiness first without tools, then end that readiness turn. ' +
+                    `For a separate continuation task, read ${worklog} once for continuity if it records previous work; ` +
+                    'do not read it again later in this session. ' +
+                    'Do not re-run whatever crashed you.'
+                : `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
+                    `then ${armMonitor(id)}, then continue from ${worklog}. Do not re-run whatever crashed you.`,
         },
         exitPolicy: { cleanExitIsFresh: true, fastFailSecs: 20 },
     };

package/dist/harness/claude-runtime.d.ts

@@ -0,0 +1,12 @@
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export declare function bundledClaudeVersion(adapterManifest: string): string | undefined;
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export declare function hostClaude(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;

package/dist/harness/claude-runtime.js

@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { codexVersionAtLeast, executableOnPath } from './codex-runtime.js';
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedClaudeVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export function bundledClaudeVersion(adapterManifest) {
+    try {
+        const sdk = dirname(createRequire(adapterManifest).resolve('@anthropic-ai/claude-agent-sdk'));
+        const version = JSON.parse(readFileSync(join(sdk, 'package.json'), 'utf8')).claudeCodeVersion;
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export function hostClaude(adapterManifest, env, cwd = process.cwd(), version = installedClaudeVersion) {
+    if (env.CLAUDE_CODE_EXECUTABLE !== undefined || !adapterManifest)
+        return undefined;
+    const bundled = bundledClaudeVersion(adapterManifest);
+    if (!bundled)
+        return undefined;
+    let path;
+    try {
+        path = executableOnPath('claude', env, cwd);
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}

package/dist/harness/codex-app-server-proxy.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+type JsonObject = Record<string, unknown>;
 interface TerminalRecoveryOptions {
     sendToCodex(line: string): void;
     emitToClient(line: string): void;
@@ -39,6 +40,8 @@ export declare class CodexTerminalRecovery {
     private finishTurn;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean): string;
+export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean, managedOursTools?: JsonObject): string;
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export declare function managedCodexToolPolicy(env: NodeJS.ProcessEnv): JsonObject | undefined;
 export declare function runCodexAppServerProxy(): void;
 export {};