@ours.network/fleet 1.2.0-nightly.9 → 2.0.0

package/dist/agent-ours/file-rpc.js

@@ -1,5 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { MAX_CHUNK_BYTES } from './wire.js';
+/** Bridge refusals of a current-chat file that are safe to relay verbatim. */
+const CHAT_FILE_REFUSAL = /^(INVALID_CHAT_FILE_PATH|CHAT_FILE_[A-Z_]{1,40}|FILE_EXCEEDS_20_MIB)$/;
 /** Call-scoped callbacks carry no daemon credentials or upload receipts. */
 export class FileCallbacks {
     wire;
@@ -16,7 +18,7 @@ export class FileCallbacks {
         this.pending.delete(frame.id);
         clearTimeout(p.timer);
         if (frame.error)
-            p.reject(Error('AGENT_FILE_OPERATION_FAILED'));
+            p.reject(Error(typeof frame.error === 'string' && CHAT_FILE_REFUSAL.test(frame.error) ? frame.error : 'AGENT_FILE_OPERATION_FAILED'));
         else
             p.resolve(frame.value);
     }
@@ -59,14 +61,26 @@ export class FileCallbacks {
         return (await this.rpc(String(extra.requestId), 'probe', { path }, extra.signal)) === true;
     }
     async read(path, extra) {
+        return this.openRead(path, extra);
+    }
+    /** Current-chat source: integrity-checked by the bridge, with its real path. */
+    async readChatFile(path, extra) {
+        return this.openRead(path, extra, true);
+    }
+    async openRead(path, extra, chat = false) {
         const call = String(extra.requestId), handle = randomUUID();
-        const meta = await this.rpc(call, 'read-open', { path, handle }, extra.signal);
+        const meta = await this.rpc(call, chat ? 'export-open' : 'read-open', { path, handle }, extra.signal);
         if (!meta ||
             typeof meta.filename !== 'string' ||
             !Number.isSafeInteger(meta.size) ||
-            meta.size < 0)
+            meta.size < 0 ||
+            (chat && typeof meta.path !== 'string'))
             throw Error('INVALID_FILE_METADATA');
+        let closed = false;
         const close = async () => {
+            if (closed)
+                return;
+            closed = true;
             await this.rpc(call, 'close', { handle }, new AbortController().signal).catch(() => { });
         };
         const body = new ReadableStream({
@@ -91,7 +105,7 @@ export class FileCallbacks {
             },
             cancel: close,
         });
-        return { filename: meta.filename, size: meta.size, body, close };
+        return { filename: meta.filename, size: meta.size, body, close, ...(chat ? { path: meta.path } : {}) };
     }
     async write(path, body, extra) {
         const call = String(extra.requestId), handle = randomUUID();

package/dist/agent-ours/harness.js

@@ -13,6 +13,7 @@ export function managedChildEnvironment(input) {
 }
 /** Replace ours only; retain the user's ordinary harness configuration and plugins. */
 export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
+    const child = managedChildEnvironment({ ...process.env, ...env });
     const bridge = fileURLToPath(new URL('./bridge.js', import.meta.url));
     const server = {
         name: 'ours',
@@ -20,21 +21,28 @@ export function prepareManagedHarness(role, stateDir, cwd, descriptor, env) {
         args: [bridge],
         env: [{ name: 'FLEET_OURS_BRIDGE_DESCRIPTOR', value: descriptor }],
     };
+    // Portable allow covers bound identity messaging, not all tools on the server.
+    const tools = role.harness === 'codex' && role.permissions?.approval === 'allow'
+        ? Object.fromEntries([
+            'current_identity', 'get_messages', 'list_history', 'list_contacts', 'send_message',
+        ].map(name => [name, { approval_mode: 'approve' }]))
+        : undefined;
     const native = {
         mcp_servers: {
             ours: {
                 command: process.execPath,
                 args: [bridge],
                 env: { FLEET_OURS_BRIDGE_DESCRIPTOR: descriptor },
+                ...(tools ? { tools } : {}),
             },
         },
         plugins: { 'ours@ours-codex-marketplace': { enabled: false } },
     };
-    const child = managedChildEnvironment({ ...process.env, ...env });
     if (role.harness === 'codex') {
         const config = child.CODEX_CONFIG ? JSON.parse(child.CODEX_CONFIG) : {};
         child.CODEX_CONFIG = JSON.stringify({
             ...config,
+            mcp_servers: { ...config.mcp_servers, ...native.mcp_servers },
             plugins: { ...config.plugins, ...native.plugins },
         });
         // codex-acp otherwise prefers a same-name connector from the user's config.

package/dist/agent-ours/mcp-endpoint.d.ts

@@ -1,6 +1,12 @@
+import type { FileDeliveryInput, DeliveredFile } from '../file-delivery/types.js';
+import type { ToolRequestExtra } from '@ours.network/mcp/dist/types/mcp/tool.js';
+import { type Server } from 'node:net';
 import type { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
 import type { OursClient } from '@ours.network/sdk/client';
+import { FileCallbacks } from './file-rpc.js';
 import type { AgentOursRuntime } from './runtime.js';
+import { type ReminderToolBackend } from '../reminders/tools.js';
+import { type TaskToolBinding } from '../rooms-tasks/task-tools.js';
 export interface EndpointOptions {
     socket: string;
     capability: string;
@@ -9,7 +15,23 @@ export interface EndpointOptions {
     client: OursClient;
     identities: ApplicationIdentityStore;
     remoteDaemonFiles: boolean;
+    currentChatFile?: (input: FileDeliveryInput, extra: ToolRequestExtra, files: FileCallbacks) => Promise<DeliveredFile>;
+    /** Fleet self-reminders, bound later by the runner; tools refuse until then. */
+    reminders?: () => ReminderToolBackend | undefined;
+    /** Task Progress / To review tools for the task this agent was launched for. */
+    task?: () => TaskToolBinding | undefined;
 }
+/**
+ * Listen on the bridge socket. A close unlinks it, but a predecessor that ended
+ * abruptly leaves the file behind, and every later start of the same generation
+ * then fails with EADDRINUSE until the role is held down. Only a provably dead
+ * socket is removed, once, and only if the path still names that same file;
+ * a live listener, a symlink, any other file, an inconclusive probe or a path
+ * replaced since the probe still fails as before. `afterProbe` is a test seam.
+ */
+export declare function listenOnBridgeSocket(server: Server, path: string, hooks?: {
+    afterProbe?: () => Promise<void>;
+}): Promise<void>;
 export declare function startMcpEndpoint(options: EndpointOptions): Promise<{
     close(): Promise<void>;
 }>;

package/dist/agent-ours/mcp-endpoint.js

@@ -1,11 +1,85 @@
-import { createServer } from 'node:net';
-import { chmod, unlink } from 'node:fs/promises';
+import * as managedMcp from '@ours.network/mcp/server';
+import { connect, createServer } from 'node:net';
+import { chmod, lstat, unlink } from 'node:fs/promises';
 import { timingSafeEqual } from 'node:crypto';
 import { createManagedOursMcpServer } from '@ours.network/mcp/server';
 import { JSONRPCMessageSchema } from '@modelcontextprotocol/sdk/types.js';
 import { FileCallbacks } from './file-rpc.js';
 import { Wire } from './wire.js';
+import { registerReminderTools } from '../reminders/tools.js';
+import { registerTaskTools } from '../rooms-tasks/task-tools.js';
+const ORPHAN_PROBE_TIMEOUT_MS = 1_000;
+function listenOnce(server, path) {
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(path, () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+}
+const sameFile = (a, b) => a.dev === b.dev && a.ino === b.ino && a.ctimeNs === b.ctimeNs && a.birthtimeNs === b.birthtimeNs;
+/**
+ * The identity of a socket file, never a symlink or other file, that refuses
+ * connections; undefined when it is not provably dead.
+ */
+async function orphanSocket(path) {
+    let found;
+    try {
+        found = await lstat(path, { bigint: true });
+    }
+    catch {
+        return undefined;
+    }
+    if (!found.isSocket())
+        return undefined;
+    const dead = await new Promise(resolve => {
+        const probe = connect(path);
+        const done = (orphan) => { clearTimeout(timer); probe.destroy(); resolve(orphan); };
+        const timer = setTimeout(() => done(false), ORPHAN_PROBE_TIMEOUT_MS);
+        probe.once('connect', () => done(false));
+        probe.once('error', error => done(error.code === 'ECONNREFUSED'));
+    });
+    return dead ? { dev: found.dev, ino: found.ino, ctimeNs: found.ctimeNs, birthtimeNs: found.birthtimeNs } : undefined;
+}
+/**
+ * Listen on the bridge socket. A close unlinks it, but a predecessor that ended
+ * abruptly leaves the file behind, and every later start of the same generation
+ * then fails with EADDRINUSE until the role is held down. Only a provably dead
+ * socket is removed, once, and only if the path still names that same file;
+ * a live listener, a symlink, any other file, an inconclusive probe or a path
+ * replaced since the probe still fails as before. `afterProbe` is a test seam.
+ */
+export async function listenOnBridgeSocket(server, path, hooks = {}) {
+    let original;
+    try {
+        return await listenOnce(server, path);
+    }
+    catch (error) {
+        original = error;
+        if (error.code !== 'EADDRINUSE')
+            throw error;
+    }
+    const orphan = await orphanSocket(path);
+    if (!orphan)
+        throw original;
+    await hooks.afterProbe?.();
+    let now;
+    try {
+        now = await lstat(path, { bigint: true });
+    }
+    catch {
+        throw original;
+    }
+    if (!now.isSocket() || !sameFile(now, orphan))
+        throw original;
+    await unlink(path);
+    await listenOnce(server, path);
+}
 export async function startMcpEndpoint(options) {
+    // Every managed Agent offers current-chat delivery, so a package without the contract is a broken install, not a quiet downgrade.
+    if (options.currentChatFile && managedMcp.MANAGED_FILE_DELIVERY_VERSION !== 1)
+        throw Error('INCOMPATIBLE_MANAGED_FILE_DELIVERY: installed @ours.network/mcp lacks MANAGED_FILE_DELIVERY_VERSION 1; reinstall Fleet with its pinned @ours.network/mcp');
     const sockets = new Set();
     const server = createServer((socket) => {
         if (sockets.size >= 4) {
@@ -31,26 +105,34 @@ export async function startMcpEndpoint(options) {
             },
             close: async () => wire.close(),
         };
+        // One admission path for every tool on this connection: the same
+        // authentication, in-flight bound and managed-runtime fence.
+        const admit = async () => {
+            if (!authenticated || inFlight >= 32)
+                throw Error('MCP_ADMISSION_LIMIT');
+            inFlight++;
+            try {
+                const release = await options.runtime.admit();
+                return () => {
+                    inFlight--;
+                    release();
+                };
+            }
+            catch (error) {
+                inFlight--;
+                throw error;
+            }
+        };
         const mcp = createManagedOursMcpServer(options.client, 'managed-v1', options.identities, {
             remoteDaemonFiles: options.remoteDaemonFiles,
+            ...(options.currentChatFile ? { currentChatFile: (input, extra) => options.currentChatFile(input, extra, files) } : {}),
             fileContext: files,
-            admit: async () => {
-                if (!authenticated || inFlight >= 32)
-                    throw Error('MCP_ADMISSION_LIMIT');
-                inFlight++;
-                try {
-                    const release = await options.runtime.admit();
-                    return () => {
-                        inFlight--;
-                        release();
-                    };
-                }
-                catch (error) {
-                    inFlight--;
-                    throw error;
-                }
-            },
+            admit,
         });
+        if (options.reminders)
+            registerReminderTools(mcp, options.reminders, admit);
+        if (options.task)
+            registerTaskTools(mcp, options.task, admit);
         wire.onClose = () => {
             clearTimeout(deadline);
             sockets.delete(wire);
@@ -89,13 +171,7 @@ export async function startMcpEndpoint(options) {
             transport.onmessage?.(message);
         };
     });
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(options.socket, () => {
-            server.removeListener('error', reject);
-            resolve();
-        });
-    });
+    await listenOnBridgeSocket(server, options.socket);
     await chmod(options.socket, 0o600);
     return {
         close: async () => {

package/dist/agent-ours/runtime.d.ts

@@ -1,3 +1,4 @@
+import type { AgentHistoryQuery } from './correspondence.js';
 import type { OursClient } from '@ours.network/sdk/client';
 import { RuntimeJournal, type RuntimeState } from './state.js';
 export interface AssignedIdentity {
@@ -9,7 +10,9 @@ export interface AssignedIdentity {
     action: string;
     expectedCid?: string;
     allowCreate: boolean;
-    bio: string;
+    /** Omitted fields preserve an existing identity's custom profile. */
+    bio?: string;
+    persona?: string;
 }
 export interface RoomAdmission {
     id: string;
@@ -47,6 +50,11 @@ export declare class AgentOursRuntime {
     prepare(room?: RoomAdmission, timeoutMs?: number): Promise<void>;
     /** Admission covers SDK calls, response rendering and agent filesystem callbacks. */
     admit(): Promise<() => void>;
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    joinAdditionalRoom(invite: string, expectedRoomCid: string): Promise<void>;
+    readContacts(): Promise<unknown>;
+    readHistory(request: AgentHistoryQuery): Promise<unknown>;
     startHarness<T>(start: () => Promise<T>): Promise<T>;
     suspend(): Promise<void>;
     terminal(): Promise<void>;

package/dist/agent-ours/runtime.js

@@ -62,6 +62,7 @@ export class AgentOursRuntime {
             actual.isRoot)
             throw Error('IDENTITY_PROOF_MISMATCH');
         this.deps.assertFence();
+        return actual;
     }
     async prepare(room, timeoutMs = 30_000) {
         if (['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED', 'QUIESCING'].includes(this.state.phase))
@@ -92,7 +93,7 @@ export class AgentOursRuntime {
                 this.transition('RECOVERING');
                 const args = {
                     name: this.state.name,
-                    bio: this.assignment.bio,
+                    bio: this.assignment.bio ?? '',
                     exposeLocal: false,
                     localAutoAccept: true,
                 };
@@ -104,7 +105,18 @@ export class AgentOursRuntime {
                 this.transition('OWNED', { cid: created.info.cid });
             }
         }
-        await this.verify();
+        const profile = await this.verify();
+        // The supervisor owns profile setup, just like identity binding. Apply only
+        // explicitly configured fields, under the verified owner, before publishing
+        // readiness or admitting the harness. Repeating a prepare is idempotent.
+        if (this.assignment.bio !== undefined && profile.bio !== this.assignment.bio) {
+            this.deps.assertFence();
+            await this.deps.client.setBio({ bio: this.assignment.bio });
+        }
+        if (this.assignment.persona !== undefined && profile.persona !== this.assignment.persona) {
+            this.deps.assertFence();
+            await this.deps.client.setPersona({ persona: this.assignment.persona });
+        }
         if (!room && (this.state.room || this.state.admissionIntent))
             throw Error('ROOM_DESCRIPTOR_REQUIRED');
         if (room) {
@@ -201,6 +213,42 @@ export class AgentOursRuntime {
             throw error;
         }
     }
+    /** Trusted supervisor-only admission for a later room; keeps the live harness
+     * and original startup assignment. Not exposed as an agent lifecycle tool. */
+    async joinAdditionalRoom(invite, expectedRoomCid) {
+        const release = await this.admit();
+        try {
+            const contact = await this.deps.client.addContact({ invite });
+            if (contact.cid !== expectedRoomCid)
+                throw Error('ADDITIONAL_ROOM_CID_MISMATCH');
+            await this.verify();
+        }
+        finally {
+            release();
+        }
+    }
+    async readContacts() {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listContacts();
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
+    async readHistory(request) {
+        const release = await this.admit();
+        try {
+            const data = await this.deps.client.listHistory(request);
+            await this.verify();
+            return { identity: { name: this.state.name, cid: this.state.cid, generation: this.state.generation }, ...data };
+        }
+        finally {
+            release();
+        }
+    }
     async startHarness(start) {
         if (!this.accepting || this.state.phase !== 'READY')
             throw Error('RUNTIME_NOT_READY');

package/dist/agent-ours/service.d.ts

@@ -1,12 +1,35 @@
+import type { AgentSession } from '../session/types.js';
+import type { ReminderToolBackend } from '../reminders/tools.js';
+import { ArtifactStore } from '../file-delivery/store.js';
 import type { ResolvedRole } from '../config.js';
 import { AgentOursRuntime } from './runtime.js';
+import { startMcpEndpoint } from './mcp-endpoint.js';
+import type { TaskToolBinding } from '../rooms-tasks/task-tools.js';
 export declare const privateRuntimeRoot: () => string;
 export interface ManagedAgentService {
     runtime: AgentOursRuntime;
     descriptor: string;
     privatePaths: string[];
+    setFileDelivery?(sender: AgentSession['sendFileToChat']): void;
+    /** Bind (or unbind) this agent's self-reminders behind its own MCP tools. */
+    setReminders?(backend: ReminderToolBackend | undefined): void;
     close(terminal: boolean): Promise<void>;
 }
+/**
+ * `send_file` without a contact, offered to every managed Agent with no Agent
+ * setting and no export directory. A backend without a tracked ACP turn gets a
+ * precise refusal instead of a missing tool.
+ */
+export declare function currentChatFileHandler(options: {
+    role: Pick<ResolvedRole, 'harness' | 'session' | 'permissions'>;
+    cwd: string;
+    store: Pick<ArtifactStore, 'copy'>;
+    sender: () => AgentSession['sendFileToChat'];
+    /** Fleet's own credentials and stored attachments are never chat content. */
+    privateState: string[];
+}): NonNullable<Parameters<typeof startMcpEndpoint>[0]['currentChatFile']>;
+/** Task membership comes from supervisor launch records, re-read per call so a restart cannot leave it stale. */
+export declare function taskToolBinding(role: ResolvedRole, stateDir: string, cid: string | undefined): TaskToolBinding | undefined;
 /** Only trusted launch orchestration may write this descriptor, never the child. */
 export declare function storeRoomSecret(role: ResolvedRole): void;
 export declare function storeTemporaryLaunch(role: ResolvedRole, action: string): void;
@@ -20,4 +43,7 @@ export declare function readRoomReadiness(roomCid: string, name: string): {
     generation: number;
 } | undefined;
 /** Explicit logical-instance termination, independent of harness/bridge transport. */
-export declare function releaseManagedAgent(role: ResolvedRole): Promise<void>;
+export declare function releaseManagedAgent(role: ResolvedRole, expected?: {
+    cid: string;
+    action: string;
+}): Promise<void>;

package/dist/agent-ours/service.js

@@ -1,8 +1,13 @@
+import { chatFilePath } from '../file-delivery/reader.js';
+import { ArtifactStore } from '../file-delivery/store.js';
+import { resolve, basename, extname } from 'node:path';
+import { socketPath as privateSocketPath } from '../socket-path.js';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { ApplicationIdentityStore } from '@ours.network/mcp/application-identities';
+import { assertSafeAncestors } from '../rooms-tasks/workspace.js';
 import { readClientProfile } from '../client-profile.js';
 import { stateRoot } from '../paths.js';
 import { createCoworkAdapter } from '../rooms-tasks/cowork-adapter.js';
@@ -10,7 +15,52 @@ import { RuntimeController } from './controller.js';
 import { atomicPrivateWrite, binderKey } from './state.js';
 import { AgentOursRuntime } from './runtime.js';
 import { startMcpEndpoint } from './mcp-endpoint.js';
+import { readTempSupervisorForScan } from '../temp-lifecycle.js';
 export const privateRuntimeRoot = () => join(stateRoot(), 'private-ours');
+/**
+ * `send_file` without a contact, offered to every managed Agent with no Agent
+ * setting and no export directory. A backend without a tracked ACP turn gets a
+ * precise refusal instead of a missing tool.
+ */
+export function currentChatFileHandler(options) {
+    const { role, cwd, store } = options, privateState = options.privateState.map(p => resolve(p));
+    const isPrivate = (path) => privateState.some(p => path === p || path.startsWith(p + '/'));
+    return async (input, extra, files) => {
+        if (role.session !== 'acp' || !['codex', 'claude-code'].includes(role.harness))
+            throw Error(`CURRENT_CHAT_DELIVERY_UNAVAILABLE: sending a file to this chat requires a Codex or Claude ACP session; this Agent runs ${role.harness}/${role.session}. Pass contact to send through Ours instead`);
+        const sender = options.sender();
+        if (!sender)
+            throw Error('CURRENT_CHAT_DELIVERY_UNAVAILABLE: this session has no ACP chat to attach to');
+        if (isPrivate(chatFilePath(cwd, input.path)))
+            throw Error('PRIVATE_STATE_CANNOT_BE_SENT'); // before approval/read
+        const name = input.filename ?? basename(input.path);
+        if (!name || Buffer.byteLength(name) > 240 || /[\/\\\x00-\x1f]/.test(name) || name === '.' || name === '..')
+            throw Error('INVALID_FILENAME');
+        const mime = input.mime ?? { '.txt': 'text/plain', '.md': 'text/markdown', '.pdf': 'application/pdf', '.json': 'application/json', '.html': 'text/html', '.png': 'image/png' }[extname(name).toLowerCase()] ?? 'application/octet-stream';
+        if (mime.length > 200 || !/^[A-Za-z0-9.+-]+\/[A-Za-z0-9.+-]+$/.test(mime))
+            throw Error('INVALID_MIME');
+        return sender(input, extra.signal, async (binding) => {
+            const source = await files.readChatFile(input.path, extra);
+            try {
+                // The bridge reports the opened file's real path, so a symlinked ancestor cannot reach private state.
+                if (isPrivate(source.path))
+                    throw Error('PRIVATE_STATE_CANNOT_BE_SENT');
+                return await store.copy(source, name, mime, binding, extra.signal);
+            }
+            finally {
+                await source.close();
+            }
+        }, role.permissions);
+    };
+}
+/** Task membership comes from supervisor launch records, re-read per call so a restart cannot leave it stale. */
+export function taskToolBinding(role, stateDir, cid) {
+    const owned = readTempSupervisorForScan(stateDir)?.taskOwner?.taskId;
+    const taskId = owned ?? role.roomMemberStartup?.task_id;
+    if (!taskId)
+        return undefined;
+    return { taskId, role: role.name, ...(cid ? { identityCid: cid } : {}), taskOwned: !!owned };
+}
 function roomSecretPath(role) {
     const startup = role.roomMemberStartup;
     return join(privateRuntimeRoot(), 'room-inputs', binderKey(startup.room_identity_cid, JSON.stringify([role.name, startup.invite_id])) + '.json');
@@ -93,6 +143,8 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
     }
     const controller = await RuntimeController.acquire(root, profile.expectedInstanceId, role.identity, instance);
     let closeClient;
+    let fileSender;
+    let reminders;
     let partialEndpoint;
     try {
         let prior = controller.journal.read();
@@ -145,7 +197,8 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
             action: launch?.action ?? prior?.action ?? randomUUID(),
             expectedCid: pin?.cid,
             allowCreate: true,
-            bio: role.bio ?? '',
+            bio: role.bio,
+            persona: role.persona,
         }, {
             client,
             journal: controller.journal,
@@ -207,7 +260,8 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         await identities.add(role.identity);
         const bridgeDir = join(stateDir, '.ours-bridge');
         mkdirSync(bridgeDir, { recursive: true, mode: 0o700 });
-        const capability = randomBytes(32).toString('hex'), socket = join(bridgeDir, `g${generation}.sock`);
+        const capability = randomBytes(32).toString('hex'), socket = privateSocketPath(join(bridgeDir, `g${generation}.sock`));
+        const cwd = role.cwd && existsSync(role.cwd) ? resolve(role.cwd) : resolve(stateDir);
         const endpoint = await startMcpEndpoint({
             socket,
             capability,
@@ -216,6 +270,12 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
             client,
             identities,
             remoteDaemonFiles: true,
+            reminders: () => reminders,
+            task: () => taskToolBinding(role, stateDir, runtime.snapshot.cid),
+            currentChatFile: currentChatFileHandler({
+                role, cwd, store: new ArtifactStore(stateDir), sender: () => fileSender,
+                privateState: [privateRuntimeRoot(), join(stateRoot(), 'private-file-delivery'), profile.configPath, profile.credentialPath],
+            }),
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
@@ -223,9 +283,13 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         return {
             runtime,
             descriptor,
-            privatePaths: [root, profile.configPath, profile.credentialPath],
+            privatePaths: [root, profile.configPath, profile.credentialPath, join(stateRoot(), 'private-file-delivery')],
+            setFileDelivery: sender => { fileSender = sender; },
+            setReminders: backend => { reminders = backend; },
             close: async (terminal) => {
                 try {
+                    fileSender = undefined;
+                    reminders = undefined;
                     await endpoint.close();
                     if (terminal)
                         await runtime.terminal();
@@ -267,8 +331,10 @@ export async function preparePermanentAssignment(role) {
         endpoint: profile.endpoint,
         expectedInstanceId: profile.expectedInstanceId,
         credentialPath: profile.credentialPath,
-        sessionMode: 'local',
-        requiredCapabilities: ['local-pid-v1', 'root-first-identities-v1'],
+        sessionMode: 'external',
+        leaseToken: randomUUID(),
+        requiredCapabilities: ['external-sessions-v1', 'root-first-identities-v1'],
+        env: {},
     });
     try {
         const rows = await client.listIdentities(), row = rows.find((r) => r.name === role.identity);
@@ -295,7 +361,12 @@ export async function preparePermanentAssignment(role) {
         return 'verified';
     }
     finally {
-        await client.close();
+        try {
+            await client.releaseLease();
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 export function readRoomReadiness(roomCid, name) {
@@ -309,24 +380,47 @@ export function readRoomReadiness(roomCid, name) {
     }
 }
 /** Explicit logical-instance termination, independent of harness/bridge transport. */
-export async function releaseManagedAgent(role) {
+export async function releaseManagedAgent(role, expected) {
     const profile = readClientProfile({ ...process.env, ...role.env });
     if (!profile)
         throw Error('MANAGED_OURS_REQUIRES_EXPLICIT_DAEMON_PROFILE');
     const root = privateRuntimeRoot(), dir = join(root, binderKey(profile.expectedInstanceId, role.identity));
-    if (!existsSync(join(dir, 'instance.json')))
+    if (!existsSync(join(dir, 'instance.json'))) {
+        if (expected)
+            throw Error('MEMBER_RUNTIME_RETIREMENT_MISSING');
         return;
-    const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+    }
+    const read = (file) => {
+        const path = join(dir, file);
+        if (expected) {
+            assertSafeAncestors(dir);
+            const stat = lstatSync(path);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256 * 1024)
+                throw Error('MEMBER_RUNTIME_UNSAFE_PROOF');
+        }
+        return JSON.parse(readFileSync(path, 'utf8'));
+    };
+    const instance = read('instance.json');
+    if (expected) {
+        read('state.json');
+        read('owner.json');
+    }
     if (instance.role !== role.name)
         throw Error('IDENTITY_ASSIGNED_TO_OTHER_ROLE');
     const controller = await RuntimeController.acquire(root, profile.expectedInstanceId, role.identity, instance.instance);
     try {
         const state = controller.journal.read();
-        if (!state || state.phase === 'RELEASED')
+        if (expected && (!state || state.name !== role.identity || state.daemon !== profile.expectedInstanceId
+            || state.instance !== instance.instance || state.lifetime !== 'temporary' || instance.temporary !== true
+            || state.cid !== expected.cid || state.action !== expected.action))
+            throw Error('MEMBER_RUNTIME_RETIREMENT_MISMATCH');
+        if (!state)
             return;
-        const owner = JSON.parse(readFileSync(join(dir, 'owner.json'), 'utf8'));
-        if (owner.instance !== state.instance)
+        const owner = read('owner.json');
+        if (owner.instance !== state.instance || typeof owner.token !== 'string' || !owner.token)
             throw Error('OWNER_RECORD_MISMATCH');
+        if (state.phase === 'RELEASED')
+            return;
         const client = await attachOursClient({
             endpoint: profile.endpoint,
             expectedInstanceId: profile.expectedInstanceId,

package/dist/application/codex-models.d.ts

@@ -0,0 +1,15 @@
+import { type OfferedModels } from '../subscriptions/cli.js';
+export interface CodexModelDiscoveryDeps {
+    /** The Codex executable ACP sessions will run, and its version. */
+    runtime(): Promise<{
+        executable: string;
+        version: string;
+    }>;
+    ask(executable: string, env: NodeJS.ProcessEnv): Promise<OfferedModels>;
+    now(): number;
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export declare function createCodexModelDiscovery(overrides?: Partial<CodexModelDiscoveryDeps>): () => Promise<OfferedModels>;