agl 40.5.0 → 40.6.0

package/dist_ts_interfaces/workercallers.d.ts

@@ -4,6 +4,8 @@ export declare const workerCallerLaunchGenerationEnvironmentVariable = "AGL_MCP_
 export interface IFleetWorkerCallerLaunchBase {
     launchId: string;
     projectId: string;
+    /** The fleet worker the launch identifies, `${projectId}:${name}`: a worker holds one current launch. */
+    workerId: string;
 }
 /**
  * The Codex app-server connection that created the worker's thread: a controller connection profile, or the fleet's
@@ -28,12 +30,18 @@ export interface IFleetClaudeProcess {
     pid: number;
     startTicks: string;
 }
-export type TFleetWorkerCallerBinding = IFleetWorkerCallerLaunchBase & {
+export type TFleetWorkerCallerBinding = Omit<IFleetWorkerCallerLaunchBase, 'workerId'> & {
     nativeSessionId: string;
     expectedBindingRevision: number;
-} & ({
+} & (
+/**
+ * A Claude launch binds to its background job and to the job's current process; a job whose process already exited
+ * binds without one, and the next process of the same job proves itself when its bridge enrolls.
+ */
+{
     harnessId: 'claude';
-    claudeProcess: IFleetClaudeProcess;
+    claudeJobId: string;
+    claudeProcess?: IFleetClaudeProcess;
 } | {
     harnessId: 'codex';
 });
@@ -58,11 +66,42 @@ export interface IFleetWorkerCallerHooks {
         ticketSessionId: string;
     }>;
     getWorkerCallerStatus(launchId: string): IWorkerCallerReadiness;
-    revokeWorkerCaller(request: {
+    /**
+     * Revokes one launch, or the current launch of a worker, also one the controller kept from before a restart. Every
+     * reason but `generation_change` revokes it for good: its kept binding is deleted with it.
+     */
+    revokeWorkerCaller(request: ({
         launchId: string;
+    } | {
+        workerId: string;
+    }) & {
         reason: 'failure' | 'stop' | 'replacement' | 'generation_change' | 'cancelled';
     }): Promise<void>;
 }
+/** The background job a Claude worker's launch is bound to, as the controller asks the fleet about it. */
+export interface IWorkerClaudeJobRequest {
+    workerId: string;
+    projectId: string;
+    nativeSessionId: string;
+    jobId: string;
+}
+/**
+ * What a fresh Claude inventory shows of that job: `running` in one process, `settled` without a process, `ended` for
+ * this worker (the worker is gone or archived, continues in another session, or the session continues as another job),
+ * or `unproven` when the registry or the inventory could not be read or did not list the session once.
+ */
+export type TWorkerClaudeJobObservation = {
+    state: 'running';
+    process: IFleetClaudeProcess;
+} | {
+    state: 'settled';
+} | {
+    state: 'ended';
+    reason: string;
+} | {
+    state: 'unproven';
+    reason: string;
+};
 export interface IWorkerCallerSubject {
     kind: 'worker_launch';
     launchId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agl",
-  "version": "40.5.0",
+  "version": "40.6.0",
   "controllerUpgradeManagementVersion": 2,
   "private": false,
   "description": "Agent Gateway Layer for OpenCode, FlexHarness, and Codex sessions",

package/readme.md

@@ -194,7 +194,7 @@ Codex renews the login of the account it runs on, and a login has one renewer, s
 
 **New Claude terminals** above the list says what new Claude terminals of AGL run on, and switches it: Claude Code's own configuration (which AGL Configuration's **Inference** section can route through the proxy's Claude accounts), or ChatGPT models through the AGL proxy, which routes them across its ChatGPT accounts and moves a conversation to another account when one runs out (the `claudeTerminals` controller setting, `controller.settings.update { claudeTerminals: 'claude_code' | 'chatgpt' }`). Terminals already created keep what they were created with. No account row chooses Claude Code any more. See [Claude chats on ChatGPT models](#claude-chats-on-chatgpt-models).
 
-**Add Claude account** starts a Claude sign-in in the accounts service: it makes a private Claude Code home for it and names the command that signs Claude Code in there. The sign-in waits above the list with that command, **Open in a terminal**, which closes Settings and runs the command in a new terminal of the project in view, and **Cancel sign-in**. Once Claude Code signed in, the service takes the login over -- it is the login's only renewer from then on -- and the new account appears in the list; the screen says how the sign-in ended. **Add Codex's current sign-in** adds the account Codex on this host is already signed in to, once (the `codex_native` source of the service's import inventory): the service manages Codex's sign-in from then on and can switch it, and Codex keeps renewing its own login. The service restarts Codex's app-server to prove the sign-in. It is offered until the service manages Codex's sign-in on this host.
+**Add Claude account** starts a Claude sign-in in the accounts service: it makes a private Claude Code home for it and names the command that signs Claude Code in there. The sign-in waits above the list with that command, **Open in a terminal**, which closes Settings and runs the command in a new terminal of the project in view, and **Cancel sign-in**. Once Claude Code signed in, the service takes the login over -- it is the login's only renewer from then on -- and the new account appears in the list; the screen says how the sign-in ended. The service takes the login only while no Claude Code process may still write to the sign-in home: one running on it, or one it could not inspect that started after the sign-in did (a process that started earlier cannot name the home; one whose working directory was deleted is still matched by the home and credential store it names by absolute path). Until then the sign-in says that Claude Code signed in and names those processes by pid; one still held after fifteen minutes ends without adding the login and names them again. **Add Codex's current sign-in** adds the account Codex on this host is already signed in to, once (the `codex_native` source of the service's import inventory): the service manages Codex's sign-in from then on and can switch it, and Codex keeps renewing its own login. The service restarts Codex's app-server to prove the sign-in. It is offered until the service manages Codex's sign-in on this host.
 
 **Claude Code on this host**, below **New Claude terminals**, says what Claude Code's own home on this host holds (`controller.accounts.claude.host.get`, the service's `claude.host` read) and offers the one action it calls for, each confirmed with what it does first. Claude Code is not switched between accounts: once AGL Configuration routes it through the AGL proxy, its own sign-in is handed to AGL with **Hand to AGL** (`controller.accounts.claude.release { operationId, accountId, loginId, endNativeSessions }`, naming the account and sign-in the read named) -- the sign-in an earlier AGL adopted moves into the service's custody, and a sign-in of an account the service already renews is signed out of Claude Code's files, which keep everything else. Before Claude Code is routed the hand-over waits and **Open Inference settings** opens AGL Configuration on its Inference section. A Claude Code process that started before the routing may still use the sign-in: the screen names it by pid and start, and **Hand to AGL and end their sign-in** hands it over anyway, after saying those processes fail at their next request until restarted. A Claude Code process on a release whose credential handling AGL has not verified (2.1.280 to 2.1.282, 2.1.288, the one AGL's own Claude chats run through the Agent SDK, and 2.1.306 are; a newer release, a remote agent's build such as `2.1.295-8b2928c330c4` or another Agent SDK's build is not yet) blocks the hand-over, also when its sign-in would be ended: the screen names each such process by pid, start and release, to be closed or restarted on a verified release first. A process counts as running on the home when its credential store is there, also when `CLAUDE_SECURESTORAGE_CONFIG_DIR` puts it there from another configuration directory; one configured on the home whose store is elsewhere blocks the hand-over too. A sign-in an earlier AGL adopted that can no longer be handed over -- the service holds it after a hand-over or switch it could not settle, or Claude Code's files now hold another account, none, or no readable one -- is **Repair**ed instead (`controller.accounts.claude.repair { operationId }`): the service forgets it, leaves Claude Code's files as they are, and the adopted account needs a new sign-in unless a renewal the held hand-over kept is confirmed by the provider. The browser names each hand-over and repair by an operation id of its own, so one whose answer is lost is read again by it: a hand-over with `controller.accounts.claude.release.get`, a repair by sending it again with the same id, which the service answers with the repair it committed; both are recorded in AGL's audit trail (`accounts.claude.release`, `accounts.claude.repair`). While Claude Code renews an adopted sign-in in its routed home, its usage is not read, and its row says so.
 
@@ -328,6 +328,8 @@ agl proxy run codex --model <catalog-model> -- exec 'Explain this repository'
 agl proxy run claude --                       # Claude Code on Claude accounts
 agl proxy run claude --provider openai --model <catalog-model> --
 agl proxy run opencode --model <catalog-model> -- run 'Explain this repository'
+agl proxy confined run -- docker run --rm --user "$(id -u):$(id -g)" -i <image> claude -p   # Claude Code in a container
+agl proxy confined end <run id>
 ```
 
 Every client -- `codex`, `claude`, `opencode`, or a name of your own -- has one credential. The proxy keeps it
@@ -434,7 +436,8 @@ pool and keeps its credential. `agl proxy run claude` uses Claude accounts unles
 ChatGPT models behind Claude Code; `run codex` and `run opencode` use ChatGPT accounts.
 
 The listener binds only `127.0.0.1` and requires the exact host and port, no browser Origin, and
-`Authorization: Bearer <credential>` (or `x-api-key`).
+`Authorization: Bearer <credential>` (or `x-api-key`). Claude Code in a container reaches the proxy through a second
+listener, a Unix socket that serves confined runs alone (see [Confined containers](#confined-containers)).
 
 - A ChatGPT pool serves `/openai/v1/responses` and `/openai/v1/models` (the pooled Codex catalog in Codex's
   own shape when Codex names its `client_version`), and `/anthropic/v1/messages` and `/anthropic/v1/models`
@@ -701,6 +704,65 @@ proxy's binding with it, and the sessions it served move at their next request.
 pool, 16 requests in flight per session, 256 per client credential, 512 in all, 32 MiB per request and 8 MiB
 per inspected response event (or non-streaming JSON response).
 
+#### Confined containers
+
+`agl proxy confined run` runs Claude Code in a Docker container that reaches AGL through one route only: the proxy's
+confined listener, a Unix socket alone in a directory of its own (`agl-proxy-confined/proxy.sock` beside the proxy's
+control socket; `agl proxy status` names it). The listener serves the Claude pool's three endpoints Claude Code uses --
+`GET /anthropic/v1/models`, `POST /anthropic/v1/messages` and `POST /anthropic/v1/messages/count_tokens` -- exactly as
+the loopback listener serves a Claude client, and refuses every other path, method and pool with 404 before anything is
+read or routed; nothing else of AGL is reachable through it. It accepts confined runs' credentials alone: a request
+without a credential, with one the proxy does not know, or with a credential of the loopback listener (any client's or
+lease's) is refused with 401, and a confined run's credential is refused on the loopback listener alike.
+
+```sh
+agl proxy confined run -- docker run --rm --user "$(id -u):$(id -g)" -i <image> \
+  claude -p --model claude-opus-5-5 --output-format json < prompt.txt
+agl proxy status                  # names the confined listener and lists the runs by id
+agl proxy confined end <run id>   # ends a run's credential at once
+```
+
+Before the container starts, the command asks the proxy for the run's credential: one for this run alone, a lease of
+the Claude pool (the Claude accounts first, then the Anthropic API keys) whose sessions are those of the client
+`confined`, so its requests are placed, moved and counted (token usage under `confined`) like any other Claude
+client's. Right after `docker run` it adds the listener's directory as a read-only mount at `/run/agl-proxy` and what
+Claude Code inside needs to reach it, each variable passed by name so the credential appears on no command line:
+
+- `ANTHROPIC_UNIX_SOCKET=/run/agl-proxy/proxy.sock`: Claude Code sends its API requests through the socket, as plain
+  HTTP, so no relay runs in the container (Claude Code's own setting, which `claude ssh` uses; verified with Claude Code
+  2.1.288, the release of AGL's Agent SDK);
+- `ANTHROPIC_BASE_URL=http://localhost/anthropic`: the path Claude Code puts on its requests; the host is not used;
+- `ANTHROPIC_AUTH_TOKEN`: the run's credential;
+- `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` and `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, as `agl proxy run
+  claude` sets them.
+
+It prints the run's id on standard error (`AGL proxy confined run <id>: …`), passes its standard input and output
+through, and exits with the container's status. The container never receives an account token, the control socket or
+any other part of the AGL home: the mount holds the socket alone, and the variables that would give Claude Code another
+login or route (`CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_API_KEY`, …) are removed from the environment `docker` runs with,
+so a `-e NAME` of one of them passes nothing. What the launcher names itself after `docker run` is its own: it must not
+set the variables above. The command takes `docker run` and `docker container run` only, with the image and its
+command after the options.
+
+The socket and its directory are the proxy user's alone (0600 and 0700), so the container's processes connect as that
+user: `--user` with its uid and gid under a Docker daemon that runs as root, or the container's own root under rootless
+Docker, which maps it to that user; another uid, or a container whose user namespace maps it elsewhere, cannot connect.
+Root in a container of a rootful daemon connects as well while it keeps Docker's default capabilities, since
+`CAP_DAC_OVERRIDE` passes the socket's mode (with `--cap-drop ALL` it is refused): the mode keeps the host's other users
+out, and only the containers a run started have the mount at all. The directory, not the socket file, is mounted, so a
+proxy restart, which replaces the socket, does not cut the container off.
+
+The credential lives as long as the command. When the container exits the command ends it, and the proxy refuses it
+from then on and forgets it. Like a lease it survives a restart of the proxy, which keeps only its SHA-256 digest and
+serves it again at once while the command takes it back. `agl proxy confined end <run id>` ends it at once: requests in
+flight end, the next one is refused, and the command stops the container (`docker run` passes its SIGTERM on) and exits
+with the reason; it does the same when the proxy does not hand the credential back after a restart.
+
+Downgrade: an earlier proxy refuses to start while its store keeps a confined run's credential, which its check of the
+kept leases does not know. Let every confined run end before downgrading; if an earlier proxy's start already failed,
+start this release once with no confined run going and wait out the 60-second reclaim window, which ends the kept
+credential, then downgrade.
+
 ## Native Codex Harness
 
 Choose **New → Chat session** and pick the Codex harness to use Codex inside AGL. Native threads support text and reasoning streaming, tool activity, the Codex model and reasoning-effort catalog, command and file approvals, ordinary user-input questions, interruption, history pagination, rename, archive, and deletion. AGL Ask/Yolo controls apply to the exact pending native approval request; approvals never outlive its server request.
@@ -1737,11 +1799,12 @@ superseded origins refuse preparation.
 - Revoke on failure, stop, replacement, cancellation or controller-generation change.
   Revocation fences new admissions immediately, removes credentials, and waits for already
   admitted ticket requests. Native-ID uniqueness and binding revision checks fence races.
-  Controller restart invalidates every old handle; existing native workers remain
-  unidentified until fleet performs an authorized controlled resume/relaunch with a fresh
-  overlay. Hooks do not automatically terminate or adopt outside sessions. Revoked launch IDs
-  stay recorded so they are never prepared again; the oldest give way once 65,536 launches
-  are recorded.
+  Controller restart invalidates every credential. A Claude launch's binding to its job
+  outlives it (below); a Codex launch does not, and its worker is bound again at its next
+  steer. Every reason but a controller-generation change revokes a launch for good and
+  deletes its kept binding. Hooks do not automatically terminate or adopt outside sessions.
+  Revoked launch IDs stay recorded so they are never prepared again; the oldest give way
+  once 65,536 launches are recorded.
 
 Fleet workers use these hooks themselves, so a worker's MCP ticket writes are admitted as
 that worker, not as the driver or anonymously:
@@ -1753,16 +1816,40 @@ that worker, not as the driver or anonymously:
   the worker id), passed as `--mcp-config <file> -- <prompt>`. Claude Code saves that path and reads it
   again at every wake, so the fleet rewrites it before each one; the launch ID and
   generation reach only the `agl` MCP server's environment, never the Claude process's.
-  Once the agents listing shows the job's process, the fleet binds the launch to it. A start,
-  wake or relaunch that fails at any step revokes its launch. Stop revokes the launch and archive removes the overlay. A start fails closed before Claude
-  runs when the Configuration master has no `agl` MCP server.
+  Once the agents listing shows the job's process, the fleet binds the launch to the job and
+  that process; a job that already settled after a quick turn is bound without a process. A
+  start, wake or relaunch that fails at any step revokes its launch. Stop revokes the launch
+  and archive also removes the overlay. A start fails closed before Claude runs when the
+  Configuration master has no `agl` MCP server.
 - Fleet Codex workers prepare the launch on the fleet's own connection before
   `thread/start` and bind it before the first `turn/start`. Before steering a thread whose
   launch is unbound, from an earlier connection or from before a controller restart, the
   fleet loads the thread and binds a fresh launch; a refusal fails the steer undispatched.
-- Launches live in memory. After a controller restart a Claude worker stays unidentified
-  until its next fleet start, steer or resume, and a Codex worker is bound again at its next
-  steer.
+- A Claude launch belongs to its background job, not to one process. Claude Code retires an
+  idle job's process and starts a new one for the same job when someone writes to it in
+  Claude Code; that process reads the same overlay. The controller keeps each Claude
+  launch's binding in its store (`agl_worker_caller_bindings`, one record per worker:
+  digests of the launch ID and generation, the job and session IDs, the binding revision, the
+  proved process's PID, start and snapshot digest, and the approved bridge command; never a
+  credential). When a bridge enrolls under another process than the bound one, or after a
+  controller restart, the fleet reads a fresh Claude inventory (one read at a time) and the
+  launch is bound to the bridge's process only when the inventory lists the worker's session,
+  once, as the same background job in exactly that process, the process runs the approved
+  Claude Code executable, and the bridge is its direct child running the recorded command
+  over its own connection. A launch a restarted controller restores is proved the same way
+  before its first write, also when its process still runs. Every other process stays
+  unverified, and a refused bridge is not proved again at every call: for the life of that
+  process image, or for five seconds when the job showed no process yet, the inventory could
+  not be read, or the inventory still named another process for the job (Claude Code may just
+  have replaced it).
+  When the inventory shows the worker's session as another job, or the fleet no longer binds
+  the worker to it (archived, moved to another session), the launch is revoked for good.
+  An upgrade moves every bridge in place onto the new build (`process.execve`: the same PID and
+  start, a new image from the new install's path), and the image it became is proved afresh:
+  its command is the one recorded with the launch or the one the restarted controller resolves
+  itself from its configured `agl` MCP entry, never one the bridge names, and a new command is
+  kept with the binding's next revision. Each reason an enrollment stays unverified is written once to the controller log,
+  naming the worker and its session, never the launch ID or a credential.
 
 The bridge exchanges credentials only through the private controller endpoint after Linux
 direct-loopback socket-inode ownership, approved executable/argv and current native
@@ -2860,6 +2947,8 @@ Backend isolation is mandatory. Proxy mode binds the controller to all interface
 - Permission auto-accept is an explicit server policy, never an assumption based on an open browser.
 - Questions are never auto-answered.
 - Unknown, malformed, concurrent, or unverifiable lifecycle state fails closed.
+- The inference proxy's confined listener is a Unix socket of the proxy's user alone; it accepts only confined runs'
+  credentials and serves them only the Claude pool's three Claude Code endpoints.
 
 The global **auto-accept permissions (yolo)** setting replies once to pending permissions across registered projects and writes those replies to the audit log. Each conversation also has a run-local Ask/Yolo switch. For an active managed OpenCode root, that switch covers its currently active direct children under the same exact family authority. For an active managed Flex root, it covers admitted descendants through their exact active parent-run authority chain; a relationship alone grants nothing. Terminal children are never auto-accepted. Disabling either policy seals new automatic replies and drains already admitted replies before returning. Neither mode creates persistent broad provider grants.
 
@@ -2910,7 +2999,7 @@ A run that fails keeps its evidence before its root goes: when a test of the fil
 The suite guards, end to end: opening every harness's conversation across page reloads without a harness child being replaced, recovering the Flex child after `SIGKILL` within 15 seconds, rejoining the shared Codex daemon on its own after that daemon restarts (the conversation opens and answers again within one rejoin backoff step, without **Reconnect**), starting the controller again (as the same and as the next build) with a browser resource attached to a Codex, Flex and OpenCode chat, listing a project's resources right after a browser is attached to each new chat and after a restart, the Flex model list carrying the account's current catalog, a Flex conversation answering, and opening and answering again after a restart, in a project whose id begins with `-` or `_` (the file creates projects until one does), and an `agl mcp` bridge answering tool calls from the same process after the controller moves to the next build. It is the test step of `gitzone release` (`release.preflight` in `.smartconfig.json`) and takes about eight minutes.
 
 
-Host prerequisites: Linux, Chrome (`google-chrome`, `chromium` or `chromium-browser`), `openssl`, `ss` (iproute2, to name the process behind a refused connection) and `codex` 0.156.0 or newer on `PATH`. Set `AGL_E2E_PACKAGE_ROOT` to another installed and built checkout, for example an earlier release, to run a scenario against it and prove it fails there:
+Host prerequisites: Linux, Chrome (`google-chrome`, `chromium` or `chromium-browser`), `openssl`, `ss` (iproute2, to name the process behind a refused connection) and `codex` 0.156.0 or newer on `PATH`. `e2e.proxyconfined` also runs a Docker container (a daemon this user may use and the `ubuntu:24.04` image already on the host, which the case never pulls) and skips with the missing prerequisite named without them. Set `AGL_E2E_PACKAGE_ROOT` to another installed and built checkout, for example an earlier release, to run a scenario against it and prove it fails there:
 
 ```sh
 AGL_E2E_PACKAGE_ROOT=/path/to/agl-32.15.1 pnpm exec tsrepo test test/e2e/e2e.conversations.node.ts --verbose --timeout 900

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: 'agl',
-  version: '40.5.0',
+  version: '40.6.0',
   description: 'Agent Gateway Layer for OpenCode, FlexHarness, and Codex sessions'
 }

package/ts/aglapi/aglapisurface.document.ts

@@ -3783,7 +3783,7 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
           },
           "protocolVersion": {
             "type": "number",
-            "const": 44
+            "const": 45
           },
           "upgradeManagementVersion": {
             "type": "number"
@@ -3905,7 +3905,7 @@ export const AGL_API_SURFACE: plugins.flexTypedRequest.IFlexTypedRequestSurface
         ],
         "additionalProperties": false
       },
-      "declaration": "interface IControllerStatus {\n  packageName: string;\n  packageVersion: string;\n  protocolVersion: 44;\n  upgradeManagementVersion: number;\n  controllerPid: number;\n  processGroupId: number;\n  processFingerprint: string;\n  processMode: TControllerProcessMode;\n  lifecycleState: TControllerLifecycleState;\n  startedAt: number;\n  setupRequired: boolean;\n  /** Present when the controller runs as the systemd user unit (`agl service install`); absent for a detached or foreground one. */\n  serviceUnit?: \"agl-controller.service\";\n  /** The TLS mode of the runtime configuration the controller runs with; absent until it is resolved. */\n  tlsMode?: TControllerTlsMode;\n  upgrade?: IControllerUpgradeStatus;\n  /** AGL's inference proxy, by state only; details need a signed-in owner (`controller.proxy.status.get`). */\n  proxy?: { state: TControllerProxyState };\n  harnesses: Array<{\n    harnessId: TControllerSessionHarnessId;\n    pid?: number;\n    state: TControllerHarnessLifecycleState;\n    healthy: boolean;\n    version?: string;\n    supportsLocalAttachments?: boolean;\n    connectionMode?: 'local' | 'shared' | 'remote';\n    diagnostic?: IControllerCodexDiagnostic;\n    /** Codex only: automatic reconnection of this entry's profile to the local shared app-server. */\n    rejoin?: IControllerCodexRejoinStatus;\n    /**\n     * Codex only, on the controller status: every connected or required profile. The entry's\n     * `healthy` is then true only when each of them is, apart from a profile on an account Codex\n     * cannot run on now, listed `stopped` with an `account_unavailable` diagnostic that says why;\n     * its other members describe the default profile.\n     */\n    profiles?: IControllerCodexProfileStatus[];\n  }>;\n}"
+      "declaration": "interface IControllerStatus {\n  packageName: string;\n  packageVersion: string;\n  protocolVersion: 45;\n  upgradeManagementVersion: number;\n  controllerPid: number;\n  processGroupId: number;\n  processFingerprint: string;\n  processMode: TControllerProcessMode;\n  lifecycleState: TControllerLifecycleState;\n  startedAt: number;\n  setupRequired: boolean;\n  /** Present when the controller runs as the systemd user unit (`agl service install`); absent for a detached or foreground one. */\n  serviceUnit?: \"agl-controller.service\";\n  /** The TLS mode of the runtime configuration the controller runs with; absent until it is resolved. */\n  tlsMode?: TControllerTlsMode;\n  upgrade?: IControllerUpgradeStatus;\n  /** AGL's inference proxy, by state only; details need a signed-in owner (`controller.proxy.status.get`). */\n  proxy?: { state: TControllerProxyState };\n  harnesses: Array<{\n    harnessId: TControllerSessionHarnessId;\n    pid?: number;\n    state: TControllerHarnessLifecycleState;\n    healthy: boolean;\n    version?: string;\n    supportsLocalAttachments?: boolean;\n    connectionMode?: 'local' | 'shared' | 'remote';\n    diagnostic?: IControllerCodexDiagnostic;\n    /** Codex only: automatic reconnection of this entry's profile to the local shared app-server. */\n    rejoin?: IControllerCodexRejoinStatus;\n    /**\n     * Codex only, on the controller status: every connected or required profile. The entry's\n     * `healthy` is then true only when each of them is, apart from a profile on an account Codex\n     * cannot run on now, listed `stopped` with an `account_unavailable` diagnostic that says why;\n     * its other members describe the default profile.\n     */\n    profiles?: IControllerCodexProfileStatus[];\n  }>;\n}"
     },
     {
       "name": "IControllerTerminalResource",

package/ts/classes.aglhome.ts

@@ -64,6 +64,11 @@ export interface IAGLHomePaths {
   proxy: string;
   /** The running proxy's private control socket. */
   proxySocket: string;
+  /**
+   * The proxy's confined listener: a Unix socket alone in a private directory of its own, which a confined run mounts
+   * into its container, so the container sees nothing else of AGL. Only confined credentials are accepted on it.
+   */
+  proxyConfinedSocket: string;
   /** The credentials the proxy keeps in files, one per client with delivery `file` (OpenCode's `{file:...}`). */
   proxyCredentials: string;
   /** The credential command a harness routed through the proxy runs; the proxy writes it whenever it starts. */
@@ -211,6 +216,7 @@ export const resolveAGLHomePaths = (
     claudeOnChatGpt: path.join(root, 'claude-gateway'),
     proxy: path.join(root, 'proxy'),
     proxySocket: path.join(sockets, 'agl-proxy.sock'),
+    proxyConfinedSocket: path.join(sockets, 'agl-proxy-confined', 'proxy.sock'),
     proxyCredentials: path.join(root, 'proxy', 'credentials'),
     proxyCredentialHelper: path.join(root, 'proxy', 'credential-helper'),
     migration: path.join(root, 'migration'),

package/ts/classes.authstore.ts

@@ -3,6 +3,7 @@ import { DriverModel } from './driver/classes.driverstore.js';
 import { DirectReportModel } from './driver/classes.directreportstore.js';
 import { SessionFeedAcknowledgementModel } from './classes.sessionfeedacknowledgements.js';
 import { HarnessReleaseModel } from './classes.harnessreleases.js';
+import { WorkerCallerBindingModel } from './classes.workercallerbindings.js';
 import { FleetTicketEffectModel } from './fleet/classes.ticketeffects.js';
 import { ControllerCodexOriginMigrationModel } from '../ts_migration/v29_codexorigins.js';
 import { ControllerCodexConnectionStore } from './classes.codexconnectionstore.js';
@@ -781,6 +782,7 @@ const setAuthStoreModelManager = (
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, SessionFeedAcknowledgementModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, FleetTicketEffectModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, HarnessReleaseModel);
+  plugins.nosqldb.setDefaultManagerForDoc(managerArg, WorkerCallerBindingModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketBoardModel);
   plugins.nosqldb.setDefaultManagerForDoc(managerArg, TicketCommentModel);
@@ -1054,6 +1056,8 @@ export class SmartDataAuthStore implements IAuthStore, IAuthStoreSessionIdentity
       await FleetTicketEffectModel.exact.prepare();
       await HarnessReleaseModel.init();
       await HarnessReleaseModel.exact.prepare();
+      await WorkerCallerBindingModel.init();
+      await WorkerCallerBindingModel.exact.prepare();
       await TicketModel.init();
       await TicketBoardModel.init();
       await TicketCommentModel.init();

package/ts/classes.controller.ts

@@ -5,6 +5,7 @@ import { FleetDispatchError } from './fleet/interfaces.workers.js';
 import type { TFleetWorkerAction, TFleetWorkerRequest } from '../ts_interfaces/fleetworkers.js';
 import { ControllerBrowserOperationAuthority } from './classes.browseroperationauthority.js';
 import { ControllerWorkerCallers, type IWorkerCodexCallerOrigin } from './classes.workercallers.js';
+import { WorkerCallerBindingStore } from './classes.workercallerbindings.js';
 import { FleetWorkerLaunches } from './fleet/classes.workerlaunches.js';
 import { workerCallerEnrollmentToolName } from './classes.mcpworkercaller.js';
 import { readWorkerProcessSnapshot, readWorkerUnixSocketOwner, workerSnapshotsEqual, isWorkerCallerProofRefusal, type IWorkerCallerConnection } from './functions.workerprocessproof.js';
@@ -10555,7 +10556,12 @@ export class OpenCodeController {
         readMaster: async () => {
           const resource = await configurationAuthority.getResource();
           return (await configurationAuthority.getMaster({ resourceId: resource.resourceId })).master;
-        }, captureCodexOrigin: launch => this.captureWorkerCodexOrigin(launch) });
+        }, captureCodexOrigin: launch => this.captureWorkerCodexOrigin(launch),
+        // Claude launches keep their bindings, so a fleet worker's bridge proves itself again after this restart and
+        // after Claude Code continued its job in another process; the fleet reads the job's inventory for that proof.
+        bindings: new WorkerCallerBindingStore(),
+        observeClaudeJob: async (request) => this.fleetWorkers
+          ? await this.fleetWorkers.observeCallerJob(request) : { state: 'unproven', reason: 'the fleet is not running yet' } });
       this.workerCallers = workerCallers;
       const mcpControllerHost = new ControllerMcpHost({
         controllerPort: runtimeConfig.controllerPort,
@@ -12955,6 +12961,9 @@ export class OpenCodeController {
       }
     };
 
+    // Fleet jobs prepare, bind and revoke worker launches through the caller hooks: admit none and let the running
+    // ones settle before the hooks go, so a stop or archive meets the fleet's own refusal, never missing hooks.
+    await stopPart(async () => { await this.fleetWorkers?.closeAdmission(); });
     await stopPart(async () => {
       await this.workerCallers?.close();
       this.workerCallers = undefined;