@ours.network/fleet 1.1.0-nightly.27 → 1.1.0-nightly.28

package/dist/application/task-room-service.d.ts

@@ -22,7 +22,7 @@ export interface TaskSettlementPlan {
     settlementRequired: boolean;
 }
 export type TaskRecoveryIssue = {
-    code: 'terminal_pending' | 'waiting_cowork' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'waiting_seats' | 'provisioning_resumed';
+    code: 'terminal_pending' | 'waiting_cowork' | 'waiting_owner_authorization' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'waiting_seats' | 'provisioning_resumed';
 } | {
     code: 'member_failed';
     stepIndex: number;

package/dist/application/task-room-service.js

@@ -16,6 +16,7 @@ import { withFileLock } from '../atomic-file.js';
 import { launchFleetWorker } from '../rooms-tasks/external-worker.js';
 import { storedRoomLaunchPolicy, TASK_CANCELLABLE_STATES, TASK_TERMINAL_STATES } from '../rooms-tasks/types.js';
 import { deriveTaskRoomName } from '../rooms-tasks/task-room-name.js';
+const OWNER_ROOM_COMMANDS = ['list-members', 'remove-member'];
 function recordCanonicalRoomCreated(room) {
     recordFleetAuditPresentation({ kind: 'room', operation: 'create',
         eventId: `room-created:${room.created_at}`, id: room.room_id,
@@ -235,15 +236,17 @@ export class TaskRoomApplicationService {
         const ready = task.state === 'active' && room?.state === 'active'
             && active === expected && launched === expected;
         const blocker = task.outcome?.summary ?? task.blocked?.reason ?? room?.saga.error;
-        const nextAction = room?.provisioning_detail === 'waiting_owner_invite'
-            ? 'Rotate rooms.owner.public_invite, then await the same task.'
-            : room?.provisioning_detail === 'owner_cid_mismatch'
-                ? 'Verify rooms.owner.expected_cid, rotate the Owner invite, then await the same task.'
-                : room?.provisioning_detail === 'waiting_cowork'
-                    ? 'Restore ours-cowork, then await the same task.'
-                    : failed
-                        ? `Correct the blocker, then run ours-fleet task recover ${task.task_id}.`
-                        : undefined;
+        const nextAction = room?.provisioning_detail === 'waiting_owner_authorization'
+            ? 'Restore ours-cowork, then await the same task to retry Owner command authorization.'
+            : room?.provisioning_detail === 'waiting_owner_invite'
+                ? 'Rotate rooms.owner.public_invite, then await the same task.'
+                : room?.provisioning_detail === 'owner_cid_mismatch'
+                    ? 'Verify rooms.owner.expected_cid, rotate the Owner invite, then await the same task.'
+                    : room?.provisioning_detail === 'waiting_cowork'
+                        ? 'Restore ours-cowork, then await the same task.'
+                        : failed
+                            ? `Correct the blocker, then run ours-fleet task recover ${task.task_id}.`
+                            : undefined;
         return {
             kind: failed ? 'failed' : ready ? 'ready' : 'in_progress', task, room,
             handle: { command: `ours-fleet task await ${task.task_id}`, task_id: task.task_id },
@@ -462,7 +465,9 @@ export class TaskRoomApplicationService {
                 return { kind: 'provisioning_resume_failed', task, room, issues };
             }
         }
-        if (room.provisioning_detail === 'waiting_owner_invite'
+        if (room.saga.phase === 'attach_owner'
+            || room.provisioning_detail === 'waiting_owner_authorization'
+            || room.provisioning_detail === 'waiting_owner_invite'
             || room.provisioning_detail === 'owner_cid_mismatch') {
             try {
                 await this.recoverRoom({ actor: input.actor, roomId: room.room_id });
@@ -484,6 +489,8 @@ export class TaskRoomApplicationService {
             };
         if (room.provisioning_detail === 'waiting_cowork')
             issues.push({ code: 'waiting_cowork' });
+        if (room.provisioning_detail === 'waiting_owner_authorization')
+            issues.push({ code: 'waiting_owner_authorization' });
         if (room.provisioning_detail === 'waiting_owner_invite')
             issues.push({ code: 'waiting_owner_invite' });
         if (room.provisioning_detail === 'owner_cid_mismatch')
@@ -631,14 +638,27 @@ export class TaskRoomApplicationService {
                 throw new Error(error);
             }
         }
+        if (orchestration?.owner_seat_cid) {
+            const ownerCid = orchestration.owner_seat_cid.toLowerCase();
+            const ownerSeat = room.seats.find(seat => seat.identity_cid.toLowerCase() === ownerCid && seat.seat_state !== 'removed');
+            if (ownerSeat)
+                await adapter.setRoleCommands(input.roomId, {
+                    role: ownerSeat.role, commands: [...OWNER_ROOM_COMMANDS],
+                });
+        }
         if (orchestration && !orchestration.owner_seat_cid
-            && (orchestration.provisioning_detail === 'waiting_owner_invite'
+            && (orchestration.saga.phase === 'attach_owner'
+                || orchestration.provisioning_detail === 'waiting_owner_authorization'
+                || orchestration.provisioning_detail === 'waiting_owner_invite'
                 || orchestration.provisioning_detail === 'owner_cid_mismatch')) {
             const expected = cfg.rooms.owner.expected_cid.toLowerCase();
             const existing = (await adapter.getSeats(input.roomId))
                 .find(seat => seat.identity_cid.toLowerCase() === expected && seat.seat_state !== 'removed');
             if (!existing && !cfg.ownerInvite)
                 throw new ConfigError('rooms.owner: configure public_invite or public_invite_file before recovery');
+            await adapter.setRoleCommands(input.roomId, {
+                role: existing?.role ?? cfg.rooms.owner.role, commands: [...OWNER_ROOM_COMMANDS],
+            });
             let acceptedCid = existing?.identity_cid;
             if (!acceptedCid)
                 acceptedCid = (await adapter.acceptInvite(input.roomId, cfg.ownerInvite, {
@@ -654,6 +674,8 @@ export class TaskRoomApplicationService {
             issues.push('Recovery guidance is recorded; inspect role logs for diagnostics.');
         if (orchestration?.provisioning_detail === 'waiting_cowork')
             issues.push('Check ours-cowork service status');
+        if (orchestration?.provisioning_detail === 'waiting_owner_authorization')
+            issues.push('Restore Cowork availability, then re-run recover');
         if (orchestration?.provisioning_detail === 'waiting_owner_invite')
             issues.push('Rotate rooms.owner.public_invite in config, then re-run recover');
         if (orchestration?.provisioning_detail === 'waiting_seats')
@@ -951,8 +973,17 @@ export class TaskRoomApplicationService {
         await checkpointFleetAuditPresentations();
         room = advanceSaga(room.room_id, 'create_room', 1);
         if (attachOwner) {
+            room = advanceSaga(room.room_id, 'attach_owner', 2);
+            try {
+                await cowork.setRoleCommands(room.room_id, {
+                    role: rooms.owner.role, commands: [...OWNER_ROOM_COMMANDS],
+                });
+            }
+            catch (error) {
+                setSagaError(room.room_id, error instanceof Error ? error.message : String(error), 'Restore Cowork availability, then run room recover to configure Owner command authorization.', 'waiting_owner_authorization');
+                throw error;
+            }
             try {
-                room = advanceSaga(room.room_id, 'attach_owner', 2);
                 const accepted = await cowork.acceptInvite(room.room_id, cfg.ownerInvite, {
                     role: rooms.owner.role, expected_cid: rooms.owner.expected_cid,
                 });

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.1.0-nightly.27",
-  "buildId": "188ee458bb22",
-  "commit": "0ace1644c06e5c637efccced7b39bdfa03260cf6",
+  "version": "1.1.0-nightly.28",
+  "buildId": "761c569df66f",
+  "commit": "c03ee4d380feb9e12fcc503785f3d81203026c2a",
   "dirty": true,
-  "builtAt": "2026-09-03T18:06:33.704Z",
+  "builtAt": "2026-09-04T14:31:02.540Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/owner-channel/channel.js

@@ -1648,12 +1648,13 @@ export class OwnerChannel {
         }
         const { task, room, issues } = begin.result;
         const hints = issues.map(issue => issue.code === 'waiting_cowork' ? 'Cowork socket unreachable'
-            : issue.code === 'waiting_owner_invite' ? 'Owner invite missing or invalid'
-                : issue.code === 'owner_cid_mismatch' ? 'Owner CID mismatch'
-                    : issue.code === 'member_failed' ? `Member failed at step ${issue.stepIndex}`
-                        : issue.code === 'resume_failed' ? `Resume failed: ${issue.error}`
-                            : issue.code === 'provisioning_resumed' ? 'Provisioning resumed successfully'
-                                : issue.code);
+            : issue.code === 'waiting_owner_authorization' ? 'Owner command authorization is not configured'
+                : issue.code === 'waiting_owner_invite' ? 'Owner invite missing or invalid'
+                    : issue.code === 'owner_cid_mismatch' ? 'Owner CID mismatch'
+                        : issue.code === 'member_failed' ? `Member failed at step ${issue.stepIndex}`
+                            : issue.code === 'resume_failed' ? `Resume failed: ${issue.error}`
+                                : issue.code === 'provisioning_resumed' ? 'Provisioning resumed successfully'
+                                    : issue.code);
         await this.send(sender.id, renderMarkdownResult({
             icon: '🛟', title: 'Task recovery',
             fields: [{ label: 'Task', value: task.task_id, kind: 'code' },

package/dist/rooms-tasks/cli.js

@@ -1196,6 +1196,8 @@ export function registerTaskCommands(parent, cOpt) {
                     return 'Cowork management socket unreachable — check ours-cowork service';
                 if (issue.code === 'waiting_owner_invite')
                     return 'Owner invite invalid or expired — rotate rooms.owner.public_invite in config';
+                if (issue.code === 'waiting_owner_authorization')
+                    return 'Owner command authorization is not configured — restore ours-cowork and retry';
                 if (issue.code === 'owner_cid_mismatch')
                     return 'Owner CID mismatch — verify rooms.owner.expected_cid matches Messenger identity';
                 if (issue.code === 'member_failed')

package/dist/rooms-tasks/cowork-adapter.d.ts

@@ -73,6 +73,10 @@ export interface CoworkAdapter {
         role: string;
         text: string;
     }): Promise<CoworkRoleBriefingInfo>;
+    setRoleCommands(roomId: string, opts: {
+        role: string;
+        commands: Array<'list-members' | 'remove-member'>;
+    }): Promise<void>;
     getHistory(roomId: string, opts?: {
         after?: number;
         limit?: number;

package/dist/rooms-tasks/cowork-adapter.js

@@ -390,6 +390,13 @@ export function createCoworkAdapter(options = {}) {
                 throw new CoworkProtocolError('room.participants', 'result must be an array');
             return result.map((seat) => projectSeat(seat, 'room.participants'));
         },
+        async setRoleCommands(roomId, opts) {
+            const result = await call('room.command.role.set', {
+                room_id: roomId, role: opts.role, commands: opts.commands,
+            });
+            if (!Array.isArray(result))
+                throw new CoworkProtocolError('room.command.role.set', 'result must be an array');
+        },
         async recoverRoom(roomId) {
             // Cowork performs packet/state reconciliation during daemon recovery.
             // Its `room.recover` RPC is specifically invite-receipt recovery, so a

package/dist/rooms-tasks/types.d.ts

@@ -133,7 +133,7 @@ export interface SagaCursor {
     error?: string;
     recovery_hint?: string;
 }
-export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'uncertain';
+export type ProvisioningDetail = 'waiting_cowork' | 'waiting_owner_authorization' | 'waiting_owner_invite' | 'owner_cid_mismatch' | 'member_failed' | 'waiting_seats' | 'uncertain';
 export interface RoomRoleBriefingDefinition {
     role: string;
     text: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.1.0-nightly.27",
+  "version": "1.1.0-nightly.28",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",