@ours.network/fleet 1.2.0-nightly.9 → 2.0.1

package/dist/fleet-command-audit.js

@@ -1,7 +1,7 @@
+import { erasedArg, redactErasedContent, writePrivacyFilteredLedger } from './erased-resources.js';
 import { existsSync, readFileSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { Buffer } from 'node:buffer';
-import { replaceFileAtomically } from './atomic-file.js';
 import { isSensitiveConfigKey } from './sensitive-config.js';
 import { mandatoryConfigurationFits } from './lifecycle-summary.js';
 import { MARKDOWN_MAX_BYTES, MARKDOWN_MAX_CODE_POINTS, markdownCode, markdownProse, } from './rooms-tasks/markdown.js';
@@ -26,6 +26,10 @@ export function lifecycleEventDigestBasis(value) {
     const resourceKind = value.kind === 'lifecycle_failure' ? value.resource : value.kind;
     return `${resourceKind}\0${value.id}\0${value.eventId}`;
 }
+let verifiedCaller;
+/** The managed agent the supervisor authenticated for this CLI process (fleet_audit_begin) and its state directory. */
+export function setVerifiedFleetCaller(caller, stateDir) { verifiedCaller = { caller, stateDir }; }
+export function verifiedFleetCaller() { return verifiedCaller; }
 let collection;
 export function beginFleetAuditCollection() { collection = { resourceIds: {}, presentations: [] }; }
 let lifecycleCheckpoint;
@@ -91,7 +95,7 @@ export function recordFleetAuditPresentation(value) {
                 : value.kind === 'lifecycle_failure'
                     ? { label: fleetPresentationLabel(value.label) }
                     : {};
-        const presentation = structuredClone({ ...value, ...labels, eventId: basis });
+        const presentation = redactErasedContent(structuredClone({ ...value, ...labels, eventId: basis }));
         const digest = lifecycleEventDigestBasis(presentation);
         if (!collection.presentations.some(existing => lifecycleEventDigestBasis(existing) === digest))
             collection.presentations.push(presentation);
@@ -120,7 +124,8 @@ const AGENT_SURFACES = {
     ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
-        'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
+        'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish',
+        'progress', 'review-package']),
     room: new Set(['create', 'list', 'show', 'open', 'members', 'delete', 'close']),
 };
 export const fleetProxyCommandInventory = Object.freeze(Object.fromEntries(Object.entries(AGENT_SURFACES).map(([surface, commands]) => [surface, [...commands]])));
@@ -135,7 +140,8 @@ export const fleetProxyTopLevelInventory = Object.freeze({
     ], denied: [...DENIED],
     hidden: ['_run', '_run-temp', '_run-temp-worker', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
 });
-const globalValueOptions = new Set(['-c', '--configuration']);
+// `--managed-configuration <file>` is the pinned managed entry form (src/managed-cli.ts).
+const globalValueOptions = new Set(['-c', '--configuration', '--managed-configuration']);
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
 export function classifyFleetArgv(argv) {
     let command = '';
@@ -186,12 +192,19 @@ export function classifyFleetArgv(argv) {
     return { command, route: 'supervisor-proxy/public', decision: 'allow' };
 }
 const marker = (value) => value === '' ? '[REDACTED:empty]' : '[REDACTED:value]';
+/**
+ * The pinned configuration of a managed entry (src/managed-cli.ts) is recorded
+ * as a fingerprint, not as its path: diagnostics must tell which configuration a
+ * row ran under without the ledger holding the path itself.
+ */
+export const managedPinMarker = (configuration) => `[PIN:${createHash('sha256').update(configuration).digest('hex').slice(0, 16)}]`;
 const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
-    '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
+    '--configuration', '-c', '--managed-configuration', '--public-invite', '--public-invite-file', '--invite-file',
     '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
+    '--text-file', '--markdown', '--markdown-file', '--attach',
 ]);
 function redactUrl(value) {
     try {
@@ -249,6 +262,11 @@ export function redactFleetArgv(argv) {
             result[index] = `${equal[1]}=${marker(equal[2])}`;
             continue;
         }
+        if (index === 0 && arg === '--managed-configuration' && result.length > 1) {
+            result[1] = managedPinMarker(result[1]);
+            index++;
+            continue;
+        }
         if (sensitiveValueFlags.has(arg) && index + 1 < result.length) {
             result[index + 1] = marker(result[index + 1]);
             index++;
@@ -305,11 +323,12 @@ export class FleetCommandAuditStore {
         if (recovered)
             this.persist();
     }
-    list() { return this.attempts.map(item => structuredClone(item)); }
+    list() { return redactErasedContent(this.attempts).map(item => structuredClone(item)); }
     begin(requestId, caller, argv) {
+        this.attempts = redactErasedContent(this.attempts);
         const existing = this.attempts.find(item => item.caller === caller && item.requestId === requestId);
         if (existing) {
-            if (JSON.stringify(existing.argv) !== JSON.stringify(redactFleetArgv(argv)))
+            if (JSON.stringify(existing.argv) !== JSON.stringify(existing.erased ? redactFleetArgv(argv).map(erasedArg) : redactFleetArgv(argv)))
                 throw new Error('fleet command request ID was reused with different argv');
             return structuredClone(existing);
         }
@@ -329,6 +348,8 @@ export class FleetCommandAuditStore {
         return structuredClone(attempt);
     }
     finish(correlationId, caller, outcome) {
+        this.attempts = redactErasedContent(this.attempts);
+        outcome = redactErasedContent({ outcome }).outcome;
         const attempt = this.owned(correlationId, caller);
         if (!attempt.outcome)
             attempt.outcome = { ...outcome, completedAt: this.deps.now().toISOString(), delivery: 'sending' };
@@ -360,7 +381,8 @@ export class FleetCommandAuditStore {
         return attempt;
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, attempts: this.attempts })}\n`, 0o600);
+        this.attempts = redactErasedContent(this.attempts);
+        writePrivacyFilteredLedger(this.path, { version: 1, attempts: this.attempts });
     }
 }
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;

package/dist/harness/agent-session.d.ts

@@ -30,6 +30,10 @@ export interface AgentSessionStartOptions {
     cwd: string;
     stateDir: string;
     mode: 'fresh' | 'resume';
+    /** Durable task context must never silently fall back to a fresh session. */
+    requireResume?: boolean;
+    /** Hold recovered never-started prompts until AgentSession.activateRecoveredPrompts(). */
+    deferRecoveredPrompts?: boolean;
     permissions: CommonPermissions;
     permissionMode: {
         fleetMode: FleetPermissionMode;

package/dist/harness/claude-code-session.js

@@ -24,7 +24,7 @@ export class ClaudeCodeAgentSessionAdapter {
         return this.transport({
             name: role.name, harness: role.harness,
             argv: launch.argv, cwd: options.cwd, env: launch.env,
-            stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+            stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, deferRecoveredPrompts: options.deferRecoveredPrompts, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
             mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
             inheritEnvironment: options.managedOurs ? false : undefined,

package/dist/harness/claude-code.js

@@ -6,7 +6,8 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { replaceFileAtomically, withFileLock } from '../atomic-file.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
-import { bundledAcpAgent } from './acp-agent.js';
+import { bundledAcpAgent, resolveBundledAcpAgent } from './acp-agent.js';
+import { hostClaude } from './claude-runtime.js';
 import { ClaudeCodeAgentSessionAdapter } from './claude-code-session.js';
 const OPTION_KEYS = [
     'plugins', 'mem_palace', 'mem_palace_midsession_autosave', 'permission_mode', 'effort',
@@ -283,6 +284,13 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             };
             if (!memPalace)
                 env.MEMPALACE_DISABLED = 'true';
+            // The bundled adapter runs the Claude Code shipped with its SDK unless told otherwise. A host
+            // Claude Code at least as new as that copy is the one the person updates, so sessions run it.
+            if (!customAcpCommand(role)) {
+                const host = hostClaude(resolveBundledAcpAgent('@agentclientprotocol/claude-agent-acp', 'claude-agent-acp', 'claude-agent-acp').manifestPath, { ...process.env, ...role.env }, dirs.runCwd);
+                if (host)
+                    env.CLAUDE_CODE_EXECUTABLE = host.path;
+            }
             // Per-role harness runtime home. Created before sandbox entry so the
             // bind has something to mount; harmless for un-isolated roles.
             // Only a role that declares `isolation:` gets a sandbox, and only a
@@ -377,16 +385,18 @@ export function makeClaudeCodeAdapter(exec = realExec, transport) {
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm an in-session Monitor. When such a line appears, run ' +
                 '**get_messages** to drain the mail.',
-            launchNote: name => `You were launched with \`--remote-control ${name}\`. Confirm you are running.`,
-            restartPrompt: (id, worklog, role) => `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
-                (role?.monitor?.mode === 'fleet'
-                    ? 'then continue from '
-                    : `then ${armMonitor(id)}, then continue from `) +
-                `${worklog}. Do not re-run whatever crashed you.` +
-                (role?.monitor?.mode === 'fleet'
-                    ? ' Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
-                        'do NOT arm an in-session Monitor.'
-                    : ''),
+            launchNote: name => `You were launched as Fleet role \`${name}\` under a Claude session. Announce console readiness before task details.`,
+            restartPrompt: (id, worklog, role) => role?.monitor?.mode === 'fleet'
+                ? `Session restarted. The supervisor has verified assigned identity "${id}"; ` +
+                    'accept that readiness and continue without rebinding or profile reconciliation. ' +
+                    'Your mail wakes arrive as `[fleet-monitor]` console lines from the supervisor — ' +
+                    'do NOT arm an in-session Monitor. ' +
+                    'Announce console readiness first without tools, then end that readiness turn. ' +
+                    `For a separate continuation task, read ${worklog} once for continuity if it records previous work; ` +
+                    'do not read it again later in this session. ' +
+                    'Do not re-run whatever crashed you.'
+                : `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
+                    `then ${armMonitor(id)}, then continue from ${worklog}. Do not re-run whatever crashed you.`,
         },
         exitPolicy: { cleanExitIsFresh: true, fastFailSecs: 20 },
     };

package/dist/harness/claude-runtime.d.ts

@@ -0,0 +1,12 @@
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export declare function bundledClaudeVersion(adapterManifest: string): string | undefined;
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export declare function hostClaude(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;

package/dist/harness/claude-runtime.js

@@ -0,0 +1,43 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { codexVersionAtLeast, executableOnPath } from './codex-runtime.js';
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedClaudeVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/** The Claude Code version shipped inside the adapter's own SDK dependency. */
+export function bundledClaudeVersion(adapterManifest) {
+    try {
+        const sdk = dirname(createRequire(adapterManifest).resolve('@anthropic-ai/claude-agent-sdk'));
+        const version = JSON.parse(readFileSync(join(sdk, 'package.json'), 'utf8')).claudeCodeVersion;
+        return typeof version === 'string' ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The host's own Claude Code, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Claude Code, and a newer one knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit
+ * CLAUDE_CODE_EXECUTABLE, in the role or the service environment, always decides instead.
+ */
+export function hostClaude(adapterManifest, env, cwd = process.cwd(), version = installedClaudeVersion) {
+    if (env.CLAUDE_CODE_EXECUTABLE !== undefined || !adapterManifest)
+        return undefined;
+    const bundled = bundledClaudeVersion(adapterManifest);
+    if (!bundled)
+        return undefined;
+    let path;
+    try {
+        path = executableOnPath('claude', env, cwd);
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}

package/dist/harness/codex-app-server-proxy.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+type JsonObject = Record<string, unknown>;
 interface TerminalRecoveryOptions {
     sendToCodex(line: string): void;
     emitToClient(line: string): void;
@@ -39,6 +40,8 @@ export declare class CodexTerminalRecovery {
     private finishTurn;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean): string;
+export declare function rewriteCodexAppServerRequest(line: string, approval: string, expectedSandbox: string, disableInheritedMcp?: boolean, managedOursTools?: JsonObject): string;
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export declare function managedCodexToolPolicy(env: NodeJS.ProcessEnv): JsonObject | undefined;
 export declare function runCodexAppServerProxy(): void;
 export {};

package/dist/harness/codex-app-server-proxy.js

@@ -300,9 +300,9 @@ function sandboxMode(policy) {
  * Fleet keeps the preset's sandbox policy, but restores the independently
  * configured approval policy on the request Codex actually executes.
  */
-function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
+function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp, managedOursTools) {
     if (Array.isArray(value))
-        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp));
+        return value.map(candidate => rewriteMessage(candidate, approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     if (!isObject(value) || !isObject(value.params))
         return value;
     if (value.method === 'turn/start') {
@@ -318,17 +318,52 @@ function rewriteMessage(value, approval, expectedSandbox, disableInheritedMcp) {
             params: { ...value.params, config: { ...config, mcp_servers: {} } },
         };
     }
+    if (managedOursTools
+        && (value.method === 'thread/start' || value.method === 'thread/resume')) {
+        const config = isObject(value.params.config) ? value.params.config : {};
+        const servers = isObject(config.mcp_servers) ? config.mcp_servers : {};
+        const ours = servers.ours;
+        // Policy cannot create or re-enable a connector that ACP did not inject.
+        if (!isObject(ours) || ours.enabled === false)
+            return value;
+        const tools = isObject(ours.tools) ? { ...ours.tools } : {};
+        for (const [name, policy] of Object.entries(managedOursTools)) {
+            if (isObject(policy))
+                tools[name] = {
+                    ...(isObject(tools[name]) ? tools[name] : {}), ...policy,
+                };
+        }
+        return { ...value, params: { ...value.params, config: { ...config,
+                    mcp_servers: { ...servers, ours: { ...ours, tools } },
+                } } };
+    }
     return value;
 }
 /** Transform one app-server NDJSON request; malformed input passes through. */
-export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false) {
+export function rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp = false, managedOursTools) {
     try {
-        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp));
+        return JSON.stringify(rewriteMessage(JSON.parse(line), approval, expectedSandbox, disableInheritedMcp, managedOursTools));
     }
     catch {
         return line;
     }
 }
+/** ACP only carries transport fields; read policy from Fleet's complete config. */
+export function managedCodexToolPolicy(env) {
+    if (env.FLEET_OURS_MANAGED !== '1')
+        return undefined;
+    try {
+        const config = JSON.parse(env.CODEX_CONFIG ?? '{}');
+        const servers = isObject(config) ? config.mcp_servers : undefined;
+        const ours = isObject(servers) ? servers.ours : undefined;
+        return isObject(ours) && ours.enabled !== false && isObject(ours.tools)
+            ? ours.tools : undefined;
+    }
+    catch {
+        // Invalid config never grants tool approval. ACP owns config diagnostics.
+        return undefined;
+    }
+}
 function requiredChoice(name, allowed) {
     const value = process.env[name];
     if (value && allowed.has(value))
@@ -355,6 +390,7 @@ export function runCodexAppServerProxy() {
     const approval = requiredChoice(APPROVAL_ENV, APPROVAL_POLICIES);
     const expectedSandbox = requiredChoice(SANDBOX_ENV, SANDBOX_MODES);
     const disableInheritedMcp = process.env[DISABLE_INHERITED_MCP_ENV] === '1';
+    const managedOursTools = managedCodexToolPolicy(process.env);
     const launch = realCodexLaunch();
     const env = { ...process.env };
     delete env.CODEX_PATH;
@@ -450,7 +486,7 @@ export function runCodexAppServerProxy() {
     input.on('line', line => {
         if (finished)
             return;
-        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp);
+        const rewritten = rewriteCodexAppServerRequest(line, approval, expectedSandbox, disableInheritedMcp, managedOursTools);
         recovery.observeClientLine(rewritten);
         writeToChild(rewritten);
     });

package/dist/harness/codex-reasoning.d.ts

@@ -0,0 +1,5 @@
+/** Efforts supported by Fleet's Codex Brain contract. Keep native eligibility in sync. */
+export declare const CODEX_REASONING_EFFORTS: readonly ["low", "medium", "high", "xhigh", "max", "ultra"];
+export declare function isCodexReasoningEffort(value: unknown): value is string;
+/** Only inspected model tuning may bypass the managed CLI native-config guard. */
+export declare function isManagedCliCodexConfig(config: unknown): boolean;

package/dist/harness/codex-reasoning.js

@@ -0,0 +1,12 @@
+/** Efforts supported by Fleet's Codex Brain contract. Keep native eligibility in sync. */
+export const CODEX_REASONING_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
+export function isCodexReasoningEffort(value) {
+    return typeof value === 'string' && CODEX_REASONING_EFFORTS.includes(value);
+}
+/** Only inspected model tuning may bypass the managed CLI native-config guard. */
+export function isManagedCliCodexConfig(config) {
+    if (config == null)
+        return true;
+    return typeof config === 'object' && !Array.isArray(config)
+        && Object.entries(config).every(([key, value]) => key === 'model_reasoning_effort' && isCodexReasoningEffort(value));
+}

package/dist/harness/codex-runtime.d.ts

@@ -4,8 +4,18 @@ export declare const VERIFIED_CODEX_ACP_VERSIONS: Set<string>;
 export declare function executableOnPath(command: string, env: NodeJS.ProcessEnv, cwd?: string): string;
 /** Match the npm Codex wrapper's platform-package/vendor selection. */
 export declare function codexExecutable(entry: string): string;
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export declare function hostCodex(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;
 export interface CodexRuntime {
-    source: 'CODEX_PATH' | 'bundled';
+    source: 'CODEX_PATH' | 'host' | 'bundled';
     entry: string;
     executable: string;
     version: string;

package/dist/harness/codex-runtime.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
-import { accessSync, constants, existsSync, realpathSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { accessSync, constants, existsSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, join, isAbsolute, resolve, delimiter } from 'node:path';
 import { realExec } from '../exec.js';
 export const VERIFIED_CODEX_ACP_VERSIONS = new Set(['1.1.7', '1.10.0']);
@@ -46,18 +47,44 @@ export function codexExecutable(entry) {
     }
     throw new Error(`Codex platform binary missing under ${vendor}; reinstall Fleet with optional dependencies`);
 }
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedCodexVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export function hostCodex(adapterManifest, env, cwd = process.cwd(), version = installedCodexVersion) {
+    if (env.CODEX_PATH !== undefined || !adapterManifest)
+        return undefined;
+    let path, bundled;
+    try {
+        path = executableOnPath('codex', env, cwd);
+        bundled = JSON.parse(readFileSync(createRequire(adapterManifest).resolve('@openai/codex/package.json'), 'utf8')).version;
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && typeof bundled === 'string' && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}
 export async function probeCodexRuntime(adapter, env, exec = realExec, cwd = process.cwd()) {
-    const configured = env.CODEX_PATH;
+    const host = hostCodex(adapter.manifestPath, env, cwd);
+    const configured = env.CODEX_PATH || host?.path;
     if (!configured && !adapter.manifestPath)
         throw new Error('ACP runtime is unknown for a PATH/custom adapter; set CODEX_PATH to an absolute executable or use the bundled adapter');
     const entry = configured ? executableOnPath(configured, env, cwd)
         : createRequire(adapter.manifestPath).resolve('@openai/codex/bin/codex.js');
     const executable = codexExecutable(entry);
     const result = await exec(!configured ? process.execPath : entry, !configured ? [entry, '--version'] : ['--version'], { env, timeout: 5_000 });
-    const version = result.stdout.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+    const version = versionOf(result.stdout);
     if (result.code !== 0 || !version)
         throw new Error(`Cannot read Codex version from ${entry}; check CODEX_PATH and executable permissions`);
-    return { source: configured ? 'CODEX_PATH' : 'bundled', entry, executable, version };
+    return { source: host ? 'host' : configured ? 'CODEX_PATH' : 'bundled', entry, executable, version };
 }
 export function codexVersionAtLeast(version, minimum) {
     const actual = version.split('.').map(Number);

package/dist/harness/codex-session.js

@@ -32,7 +32,7 @@ export class CodexAgentSessionAdapter {
         if (role.session === 'codex-app-server')
             return this.nativeTransport({
                 name: role.name, argv: launch.argv, cwd: options.cwd, env: launch.env,
-                stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+                stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, deferRecoveredPrompts: options.deferRecoveredPrompts, permissions: options.permissions,
                 permissionMode: options.permissionMode,
                 model: role.model, effort: role.effort,
                 approvalPolicy: this.strategy.approvalPolicy(role),
@@ -44,7 +44,7 @@ export class CodexAgentSessionAdapter {
         return this.transport({
             name: role.name, harness: role.harness,
             argv: launch.argv, cwd: options.cwd, env: launch.env,
-            stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
+            stateDir: options.stateDir, mode: options.mode, requireResume: options.requireResume, deferRecoveredPrompts: options.deferRecoveredPrompts, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
             mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
             inheritEnvironment: options.managedOurs ? false : undefined,

package/dist/harness/codex.js

@@ -6,8 +6,9 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
 import { resolveBundledAcpAgent, } from './acp-agent.js';
-import { VERIFIED_CODEX_ACP_VERSIONS, probeCodexRuntime, codexVersionAtLeast } from './codex-runtime.js';
+import { VERIFIED_CODEX_ACP_VERSIONS, probeCodexRuntime, codexVersionAtLeast, hostCodex } from './codex-runtime.js';
 import { CodexAgentSessionAdapter } from './codex-session.js';
+import { CODEX_REASONING_EFFORTS, isCodexReasoningEffort } from './codex-reasoning.js';
 const OPTION_KEYS = [
     'launcher', 'sandbox', 'approval', 'permission_mode', 'search', 'profile', 'config', 'add_dirs',
     'monitor',
@@ -141,6 +142,13 @@ function neutralSandboxMode(role) {
 function isNativeConfigKeyAllowed(key) {
     return NATIVE_CONFIG_ALLOWLIST.has(key);
 }
+/** Brain wins; a validated native effort also needs delivery through ACP's selection API. */
+function reasoningEffort(role) {
+    if (typeof role.effort === 'string')
+        return role.effort;
+    const value = role.harness_options?.config?.model_reasoning_effort;
+    return isCodexReasoningEffort(value) ? value : undefined;
+}
 /** Defense in depth for callers which launch a role after validation was bypassed. */
 export function nativeCodexConfig(role) {
     const options = role.harness_options;
@@ -266,7 +274,9 @@ function codexAcpEnvironment(role, dirs) {
         [CODEX_PROXY_APPROVAL_ENV]: approvalPolicy(role) ?? 'on-request',
         [CODEX_PROXY_SANDBOX_ENV]: acpRuntimeSandbox(role),
         [CODEX_PROXY_MANIFEST_ENV]: resolution.manifestPath,
-        [CODEX_PROXY_REAL_PATH_ENV]: role.env?.CODEX_PATH ?? process.env.CODEX_PATH ?? '',
+        // Same choice as probeCodexRuntime: an explicit CODEX_PATH, else a host Codex at least as new as the bundled one.
+        [CODEX_PROXY_REAL_PATH_ENV]: role.env?.CODEX_PATH ?? process.env.CODEX_PATH
+            ?? hostCodex(resolution.manifestPath, { ...process.env, ...role.env }, dirs.runCwd)?.path ?? '',
     };
 }
 function encodeTomlValue(value) {
@@ -316,10 +326,8 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
         id: 'codex',
         agentSession: new CodexAgentSessionAdapter({
             resolveBrain(brain) {
-                const levels = ['low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
-                if (brain.effort != null
-                    && (typeof brain.effort !== 'string' || !levels.includes(brain.effort)))
-                    throw new Error(`Codex Brain effort must be one of: ${levels.join(', ')}`);
+                if (brain.effort != null && !isCodexReasoningEffort(brain.effort))
+                    throw new Error(`Codex Brain effort must be one of: ${CODEX_REASONING_EFFORTS.join(', ')}`);
                 const harnessOptions = { ...(brain.harnessOptions ?? {}) };
                 if (brain.effort)
                     harnessOptions.config = {
@@ -341,8 +349,8 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
             sessionConfigSelections: role => [
                 ...(typeof role.model === 'string'
                     ? [{ configId: 'model', value: role.model }] : []),
-                ...(typeof role.effort === 'string'
-                    ? [{ configId: 'reasoning_effort', value: role.effort }] : []),
+                ...(reasoningEffort(role)
+                    ? [{ configId: 'reasoning_effort', value: reasoningEffort(role) }] : []),
             ],
             permissionModeId: role => acpAgentMode(role),
             mcpServers: () => undefined,
@@ -613,12 +621,16 @@ export function makeCodexAdapter(exec = realExec, transport, nativeTransport) {
             supervisedWakeNote: () => 'Your mail wake-ups are delivered by the fleet supervisor directly into this console as ' +
                 '`[fleet-monitor]` lines — do NOT arm arm_monitor or foreground_monitor. When such a line ' +
                 'appears, call **get_messages**, handle the mail, and reply with send_message.',
-            launchNote: name => `You were launched as the fleet role \`${name}\` under a Codex session. Confirm you are running.`,
+            launchNote: name => `You were launched as the fleet role \`${name}\` under a Codex session. Announce console readiness before task details.`,
             restartPrompt: (id, worklog, configuredRole) => {
                 if (configuredRole?.monitor?.mode === 'fleet')
-                    return `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true); ` +
-                        'your mail wakes are delivered by the fleet supervisor as `[fleet-monitor]` console lines, so do ' +
-                        `NOT arm arm_monitor/foreground_monitor. Continue from ${worklog}. Do not re-run whatever crashed you.`;
+                    return `Session restarted. The supervisor has verified assigned identity "${id}"; ` +
+                        'accept that readiness and continue without rebinding or profile reconciliation. ' +
+                        'Mail wakes arrive as `[fleet-monitor]` lines; do NOT arm arm_monitor/foreground_monitor. ' +
+                        'Announce console readiness first without tools, then end that readiness turn. ' +
+                        `For a separate continuation task, read ${worklog} once for continuity if it records previous work; ` +
+                        'do not read it again later in this session. ' +
+                        'Do not re-run whatever crashed you.';
                 const consented = configuredRole?.harness_options?.monitor === true;
                 return `Session restarted. Re-bind your ours identity now (choose_identity name "${id}" force=true), ` +
                     (consented

package/dist/init-wizard.d.ts

@@ -53,6 +53,8 @@ export declare function validateCatalog(value: BrainCatalog, path?: string): Bra
 export declare function readInitSettings(path: string): InitAnswers;
 export declare function askInitQuestions(prompter: InitPrompter, configuration: string): Promise<InitAnswers | undefined>;
 export declare function formatSetupSummary(answers: InitAnswers, configuration: string): string;
+/** The packaged Brain preset for a catalog model at one effort; the same naming the presets are generated with. */
+export declare function brainPresetId(model: Pick<CatalogModel, 'harness' | 'model'>, effort: string): string;
 /** Build the exact, deterministic default experience without writing to disk. */
 export declare function generateSetup(answers: InitAnswers): GeneratedSetup;
 /** Run the mutation boundary only after the complete questionnaire is accepted. */