@ours.network/fleet 1.2.0-nightly.1 → 1.2.0-nightly.10

package/dist/doctor.js

@@ -1,4 +1,5 @@
-import { userInfo } from 'node:os';
+import { join } from 'node:path';
+import { userInfo, homedir } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { realExec } from './exec.js';
@@ -272,21 +273,39 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
+    let managedSelection = false;
     try {
-        const client = await attachDaemon({
-            env: process.env,
+        // Mark explicit selection before validation so a damaged managed profile does
+        // not produce advice to start an unrelated local daemon.
+        managedSelection = process.env.OURS_CONFIG !== undefined
+            || existsSync(join(process.env.HOME || homedir(), '.ours-client', 'profile.json'));
+        const selected = readClientProfile(process.env);
+        managedSelection = selected !== undefined;
+        const client = await attachDaemon(selected ? {
+            endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
+            credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-            clientPid: process.pid,
+        } : {
+            env: process.env, leaseToken: `ours-fleet-doctor-${process.pid}`, clientPid: process.pid,
         });
-        const info = await client.version();
-        if (info.name !== 'ours' || typeof info.version !== 'string')
-            throw new Error('the selected endpoint did not return a valid ours daemon identity');
-        checks.push({ name: 'ours daemon', ok: true, detail: `running (${info.version})` });
+        let daemonVersion;
+        try {
+            const info = await client.version();
+            if (info.name !== 'ours' || typeof info.version !== 'string')
+                throw new Error('the selected endpoint did not return a valid ours daemon identity');
+            daemonVersion = info.version;
+        }
+        finally {
+            await client.close();
+        }
+        checks.push({ name: 'ours daemon', ok: true, detail: `running (${daemonVersion})` });
     }
     catch (error) {
         checks.push({
             name: 'ours daemon', ok: false,
-            detail: `not reachable through the SDK — start it with: ours daemon start `
+            detail: (managedSelection
+                ? 'selected client profile failed — check its endpoint, instance and issued credential '
+                : 'not reachable through the SDK — start it with: ours-daemon start ')
                 + `[${error?.message ?? String(error)}]`,
         });
     }
@@ -478,7 +497,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         catch (e) {
             const target = selected?.endpoint ?? `:${endpoint.port}`;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours daemon start) [${e?.message ?? e}]`;
+                `(start it: ours-daemon start) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/fleet-command-audit.js

@@ -117,6 +117,7 @@ export function consumeFleetAuditCollection() {
 const SAFE_READ = new Set(['docs', 'version', 'config', 'ls', 'peek', 'logs', 'status', 'doctor']);
 const AGENT_SURFACES = {
     spawn: new Set(['<none>']),
+    ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
         'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
@@ -132,7 +133,7 @@ export const fleetProxyTopLevelInventory = Object.freeze({
         'up', 'down', 'restart', 'force-restart', 'attach', 'send', 'loops', 'owner-channel',
         'watchdog-run', 'watchdog-report', 'rm', 'init', 'web',
     ], denied: [...DENIED],
-    hidden: ['_run', '_run-temp', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
+    hidden: ['_run', '_run-temp', '_run-temp-worker', '_run-watchdog', '_run-watchdogs'], aliases: ['man'],
 });
 const globalValueOptions = new Set(['-c', '--configuration']);
 /** Classify before Commander parsing. Unknown and internal paths fail closed. */
@@ -189,7 +190,7 @@ const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
     '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
-    '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
+    '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
 ]);
 function redactUrl(value) {

package/dist/harness/agent-session.d.ts

@@ -1,3 +1,4 @@
+import type { ManagedHarnessOurs } from '../agent-ours/harness.js';
 import type { CommonPermissions, FleetPermissionMode, ResolvedRole } from '../config.js';
 import type { AgentSession } from '../session/types.js';
 import type { Launch, SessionPrep } from './types.js';
@@ -22,6 +23,7 @@ export interface AgentSessionConfigSelection {
     value: string;
 }
 export interface AgentSessionStartOptions {
+    managedOurs?: ManagedHarnessOurs;
     role: ResolvedRole;
     prep: SessionPrep;
     launch: PreparedAgentSessionLaunch;

package/dist/harness/claude-code-session.js

@@ -1,3 +1,4 @@
+import { managedClaudeMeta } from '../agent-ours/harness.js';
 import { AcpSession } from '../session/acp.js';
 import { acpAdapterState, } from './acp-session-transport.js';
 /** Explicit Claude Code implementation of Fleet's shared agent-session factory. */
@@ -25,8 +26,9 @@ export class ClaudeCodeAgentSessionAdapter {
             argv: launch.argv, cwd: options.cwd, env: launch.env,
             stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
-            mcpServers: this.strategy.mcpServers(role),
-            sessionMeta: this.strategy.sessionMeta(role, prep),
+            mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
+            inheritEnvironment: options.managedOurs ? false : undefined,
+            sessionMeta: options.managedOurs ? managedClaudeMeta(this.strategy.sessionMeta(role, prep)) : this.strategy.sessionMeta(role, prep),
             configSelections: this.strategy.sessionConfigSelections(role),
             permissionMode: options.permissionMode,
             permissionMetadataSource: acpAdapterState(launch.adapterState).permissionMetadataSource,

package/dist/harness/codex-session.js

@@ -23,6 +23,12 @@ export class CodexAgentSessionAdapter {
     }
     start(options) {
         const { role, prep, launch } = options;
+        const original = this.strategy.nativeConfig(role) ?? {};
+        const managed = options.managedOurs?.native;
+        const config = managed ? { ...original, ...managed,
+            mcp_servers: { ...(original.mcp_servers ?? {}), ...(managed.mcp_servers ?? {}) },
+            plugins: { ...(original.plugins ?? {}), ...(managed.plugins ?? {}) },
+        } : original;
         if (role.session === 'codex-app-server')
             return this.nativeTransport({
                 name: role.name, argv: launch.argv, cwd: options.cwd, env: launch.env,
@@ -31,7 +37,7 @@ export class CodexAgentSessionAdapter {
                 model: role.model, effort: role.effort,
                 approvalPolicy: this.strategy.approvalPolicy(role),
                 sandbox: this.strategy.sandbox(role),
-                config: this.strategy.nativeConfig(role),
+                config,
                 addDirs: this.strategy.addDirs(role),
                 log: options.log,
             });
@@ -40,7 +46,8 @@ export class CodexAgentSessionAdapter {
             argv: launch.argv, cwd: options.cwd, env: launch.env,
             stateDir: options.stateDir, mode: options.mode, permissions: options.permissions,
             modeId: this.strategy.permissionModeId(role),
-            mcpServers: this.strategy.mcpServers(role),
+            mcpServers: options.managedOurs ? [...(this.strategy.mcpServers(role) ?? []).filter(s => s.name !== 'ours'), options.managedOurs.server] : this.strategy.mcpServers(role),
+            inheritEnvironment: options.managedOurs ? false : undefined,
             sessionMeta: this.strategy.sessionMeta(role, prep),
             configSelections: this.strategy.sessionConfigSelections(role),
             permissionMode: options.permissionMode,

package/dist/harness/codex.d.ts

@@ -6,8 +6,9 @@ import type { AcpSessionTransport } from './acp-session-transport.js';
 import type { CodexAppServerSessionTransport } from './codex-session.js';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export declare function codexCapabilities(approval: string, sandbox: string): UnattendedCapability[];
 /** Defense in depth for callers which launch a role after validation was bypassed. */

package/dist/harness/codex.js

@@ -25,12 +25,13 @@ const CODEX_PROXY_REAL_PATH_ENV = 'OURS_FLEET_REAL_CODEX_PATH';
 const CODEX_PROXY_MANIFEST_ENV = 'OURS_FLEET_CODEX_ACP_MANIFEST';
 /**
  * What an unattended role can actually do under Codex's native settings.
- * `on-request` and `untrusted` stop to ask, and with no console attached that
- * request is refused rather than answered — so the role can only read.
+ * `on-request` and `untrusted` can ask even for startup file reads (for example,
+ * shell reads or files outside the sandbox). Without a controller the request
+ * waits or is denied according to policy. Neither guarantees `read-state`.
  */
 export function codexCapabilities(approval, sandbox) {
     if (approval !== 'never')
-        return ['read-state'];
+        return [];
     const caps = ['read-state', 'messaging', 'monitor', 'status-commands'];
     if (sandbox !== 'read-only')
         caps.push('write-state', 'workspace-edit');

package/dist/harness/hermes-session.js

@@ -53,6 +53,12 @@ export class HermesAgentSessionAdapter {
         // composition; no second ambient merge may reintroduce provider secrets.
         const env = hermesChildEnvironment(role, preparedHome(prep), launch.env, launch.env);
         delete env.OURS_AUTOSTART;
+        if (options.managedOurs) {
+            for (const key of Object.keys(env))
+                if (key.startsWith('OURS_') && !key.startsWith('OURS_FLEET_'))
+                    delete env[key];
+            Object.assign(env, { FLEET_OURS_MANAGED: '1' });
+        }
         await this.checks.preflight?.(options, env);
         const nativeProvider = await this.checks.expectedProvider(role, prep);
         if (typeof nativeProvider !== 'string' || !nativeProvider.trim())
@@ -68,7 +74,7 @@ export class HermesAgentSessionAdapter {
             permissions: options.permissions, modeId, requireMode: true,
             permissionMode: { fleetMode: options.permissionMode.fleetMode, nativeMode: modeId },
             permissionTimeoutMs: 50_000,
-            mcpServers: hermesMcpServers(role, env),
+            mcpServers: options.managedOurs ? [...hermesMcpServers(role, env).filter(s => s.name !== 'ours'), options.managedOurs.server] : hermesMcpServers(role, env),
             scrubObsoleteOursAutostart: true,
             validateStartupResponse: async (initialized, created) => {
                 await this.checks.validateArtifact(initialized);

package/dist/owner-channel/channel.d.ts

@@ -14,6 +14,8 @@ export interface OwnerChannelOptions {
     harness: string;
     config: OwnerChannelConfig;
     session: AgentSession;
+    /** Ordinary owner input must not cancel the initial briefing turn. */
+    startupPending?: () => boolean;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;
@@ -269,6 +271,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
+    private ownerPromptPolicy;
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the

package/dist/owner-channel/channel.js

@@ -1123,6 +1123,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');
@@ -1136,8 +1143,7 @@ export class OwnerChannel {
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
             const queued = await queueSessionPrompt(this.options.session, this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
@@ -1263,8 +1269,7 @@ export class OwnerChannel {
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
             queued = await queueSessionPrompt(this.options.session, this.ownerPrompt(sender, text, wireId), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId, displayText: text },
             });
         }
@@ -1309,6 +1314,14 @@ export class OwnerChannel {
         this.completionTasks.add(task);
         return true;
     }
+    ownerPromptPolicy() {
+        if (this.options.startupPending?.())
+            return { interrupt: false, steer: true };
+        return {
+            interrupt: this.options.config.interrupt,
+            ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+        };
+    }
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the
@@ -1762,6 +1775,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');

package/dist/rooms-tasks/archived-absence.d.ts

@@ -0,0 +1,8 @@
+import type { ArchivedMemberAbsence, RoomMemberSeat } from './types.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export declare function verifyArchivedAbsence(proof: ArchivedMemberAbsence): Promise<void>;
+/** After the verified archive has been consumed by explicit workspace deletion,
+ * still fence replacement live state and a recreated daemon identity on every retry.
+ */
+export declare function verifyArchivedMemberStillAbsent(proof: ArchivedMemberAbsence): Promise<void>;
+export declare function proveArchivedAbsence(seat: RoomMemberSeat): Promise<ArchivedMemberAbsence>;

package/dist/rooms-tasks/archived-absence.js

@@ -0,0 +1,48 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { agentDir } from '../paths.js';
+import { tempArchiveForLaunch, tempArchiveForCreationAction, tempSupervisorLiveness } from '../temp-lifecycle.js';
+import { assertMemberIdentityAbsent } from './close.js';
+/** Revalidate live facts; a persisted timestamp is never cleanup authority. */
+export async function verifyArchivedAbsence(proof) {
+    const absent = () => {
+        if (existsSync(agentDir(proof.name, true)))
+            throw new Error('Archived member has replacement live state');
+    };
+    absent();
+    const archive = tempArchiveForLaunch(proof.name, proof.launch_id);
+    const action = tempArchiveForCreationAction(proof.name, proof.action_id);
+    if (!archive || archive !== proof.archive_path || action?.path !== archive
+        || action.launchId !== proof.launch_id
+        || readFileSync(join(archive, '.identity'), 'utf8').trim() !== proof.name)
+        throw new Error('Archived member absence ownership proof mismatch');
+    if (await tempSupervisorLiveness(archive) !== 'stopped')
+        throw new Error('Archived member supervisor absence is not proven');
+    await verifyArchivedMemberStillAbsent(proof);
+}
+/** After the verified archive has been consumed by explicit workspace deletion,
+ * still fence replacement live state and a recreated daemon identity on every retry.
+ */
+export async function verifyArchivedMemberStillAbsent(proof) {
+    const absent = () => {
+        if (existsSync(agentDir(proof.name, true)))
+            throw new Error('Archived member has replacement live state');
+    };
+    absent();
+    await assertMemberIdentityAbsent({
+        role_name: proof.name, slot: 'archived', cowork_role: 'archived', seat_state: 'removed',
+    });
+    absent();
+}
+export async function proveArchivedAbsence(seat) {
+    if (seat.identity_cid || seat.retirement?.phase !== 'identity_absent'
+        || !seat.launch?.launch_id || !seat.launch.action_id
+        || seat.launch.launch_id !== seat.retirement.launch_id || !seat.retirement.archive_path)
+        throw new Error('Missing exact archived member absence evidence');
+    const proof = {
+        name: seat.role_name, launch_id: seat.launch.launch_id, action_id: seat.launch.action_id,
+        archive_path: seat.retirement.archive_path, checked_at: new Date().toISOString(),
+    };
+    await verifyArchivedAbsence(proof);
+    return proof;
+}

package/dist/rooms-tasks/cli.js

@@ -1152,7 +1152,7 @@ export function registerTaskCommands(parent, cOpt) {
                 const app = taskRoomService(opts.configuration);
                 for (;;) {
                     const before = app.taskProvisioningOutcome(id);
-                    if (before.kind !== 'in_progress') {
+                    if (before.kind !== 'in_progress' || before.next_action) {
                         await presentDetachedProvisioningOutcome(before);
                         return;
                     }

package/dist/rooms-tasks/close.d.ts

@@ -2,6 +2,8 @@ import { withFileLock } from '../atomic-file.js';
 import { type TempLifecycleDeps } from '../temp-lifecycle.js';
 import { type CoworkAdapter } from './cowork-adapter.js';
 import type { RoomMemberSeat, RoomOrchestrationRecord } from './types.js';
+export declare const CLOSE_LOCK_STALE_MS: number;
+export declare function roomCloseLockPath(roomId: string): string;
 export interface RoomCloseDeps {
     inspectMember?(seat: RoomMemberSeat): Promise<{
         launchId: string;
@@ -19,6 +21,7 @@ export declare function waitForLivenessAbsent(role: string, launchId: string, li
 /** Report whether any daemon identity — under any name — carries this exact CID. */
 export declare function identityCidPresent(cid: string): Promise<boolean>;
 export declare function removeExactMemberIdentity(seat: RoomMemberSeat): Promise<void>;
+export declare function assertMemberIdentityAbsent(seat: RoomMemberSeat): Promise<void>;
 /** One forward-only room close saga shared by every Fleet entry point. */
 export declare function acceptManagedRoomClose(roomId: string): Promise<RoomOrchestrationRecord>;
 export declare function recordManagedRoomCloseError(roomId: string, error: string, recoveryHint: string): Promise<RoomOrchestrationRecord>;

package/dist/rooms-tasks/close.js

@@ -1,16 +1,19 @@
+import { deleteWorkspace, assertWorkspaceDeletable } from './workspace.js';
+import { collectWorkspaceArchives } from './workspace-artifacts.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { withFileLock } from '../atomic-file.js';
 import { agentDir, stateRoot } from '../paths.js';
-import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, } from '../temp-lifecycle.js';
+import { readClientProfile } from '../client-profile.js';
+import { readTempSupervisor, secureStoppedTempArchive, stopTempSupervisor, tempSupervisorLiveness, tempArchiveForLaunch, tempArchiveForCreationAction, } from '../temp-lifecycle.js';
 import { CoworkProtocolError } from './cowork-adapter.js';
 import { advanceMemberRetirement, advanceRoomClose, beginRoomClose, closeRoom, deleteRoomRecord, getRoomRecord, listRoomRecords, setRoomCloseError, } from './room-state.js';
-const CLOSE_LOCK_STALE_MS = 5 * 60_000;
+export const CLOSE_LOCK_STALE_MS = 5 * 60_000;
 const STOP_POLLS = 50;
 const STOP_POLL_MS = 100;
-function roomCloseLockPath(roomId) {
+export function roomCloseLockPath(roomId) {
     return join(stateRoot(), 'locks', 'room-close', encodeURIComponent(roomId));
 }
 function errorText(error) {
@@ -54,16 +57,28 @@ export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {})
     throw new Error(`temporary role '${role}' did not reach proven stopped liveness`);
 }
 async function withIdentityClient(work) {
-    const client = await attachOursClient({
+    const profile = readClientProfile(process.env);
+    const leaseToken = `ours-fleet-room-close-${process.pid}-${randomUUID()}`;
+    const client = await attachOursClient(profile ? {
+        endpoint: profile.endpoint,
+        expectedInstanceId: profile.expectedInstanceId,
+        credentialPath: profile.credentialPath,
+        sessionMode: 'external', env: {}, leaseToken,
+    } : {
         env: process.env,
-        leaseToken: `ours-fleet-room-close-${process.pid}-${randomUUID()}`,
+        leaseToken,
         clientPid: process.pid,
     });
     try {
         return await work(client);
     }
     finally {
-        await client.releaseLease().catch(() => { });
+        try {
+            await client.releaseLease().catch(() => { });
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 function listedIdentity(rows, name) {
@@ -106,11 +121,57 @@ export async function removeExactMemberIdentity(seat) {
         }
     });
 }
+export async function assertMemberIdentityAbsent(seat) {
+    await withIdentityClient(async (client) => {
+        const rows = await client.listIdentities();
+        if (rows.some(row => row.name === seat.role_name ||
+            (seat.identity_cid && 'cid' in row && row.cid.toLowerCase() === seat.identity_cid.toLowerCase()))) {
+            throw new Error(`room member '${seat.role_name}' identity absence is not proven; refusing retirement`);
+        }
+    });
+}
 async function retireMember(roomId, seat, deps) {
     let room = getRoomRecord(roomId);
     let current = room.member_seats.find(candidate => candidate.role_name === seat.role_name);
     let retirement = current.retirement;
+    if (retirement?.phase === 'identity_absent') {
+        if (current.launch?.launch_id && current.launch.launch_id !== retirement.launch_id) {
+            if (existsSync(agentDir(current.role_name, true)))
+                throw new Error(`room member '${current.role_name}' has a replacement launch after retirement; retire that exact temporary role before retrying`);
+            await assertMemberIdentityAbsent(current);
+        }
+        return;
+    }
     if (!retirement) {
+        if (!existsSync(agentDir(current.role_name, true)) && current.launch?.launch_id && current.launch.action_id) {
+            const archived = tempArchiveForLaunch(current.role_name, current.launch.launch_id);
+            const created = tempArchiveForCreationAction(current.role_name, current.launch.action_id);
+            if (archived && created?.path === archived && created.launchId === current.launch.launch_id) {
+                if (readFileSync(join(archived, '.identity'), 'utf8').trim() !== current.role_name)
+                    throw new Error(`room member '${current.role_name}' archive identity mismatch`);
+                if (await tempSupervisorLiveness(archived) !== 'stopped')
+                    throw new Error(`room member '${current.role_name}' archived supervisor is not proven stopped`);
+                // A terminated launch can archive itself before room retirement begins.
+                // Accept its exact durable provenance only when no identity needs removal.
+                await assertMemberIdentityAbsent(current);
+                const latest = getRoomRecord(roomId)?.member_seats.find(seat => seat.role_name === current.role_name);
+                if (existsSync(agentDir(current.role_name, true))
+                    || latest?.launch?.launch_id !== current.launch.launch_id
+                    || latest?.launch?.action_id !== current.launch.action_id
+                    || latest?.identity_cid !== current.identity_cid)
+                    throw new Error(`room member '${current.role_name}' changed during archived retirement proof`);
+                advanceMemberRetirement(roomId, current.role_name, 'identity_absent', current.launch.launch_id, archived);
+                return;
+            }
+        }
+        if (current.launch?.state === 'failed' && !existsSync(agentDir(current.role_name, true))) {
+            // A failure before applyRole (for example invite-secret validation) has
+            // no supervisor to stop or archive. Settle only proven absence; this
+            // path never removes an identity based on missing local evidence.
+            await assertMemberIdentityAbsent(current);
+            advanceMemberRetirement(roomId, current.role_name, 'identity_absent', 'failed-launch-absent');
+            return;
+        }
         if (current.launch?.state === 'pending' && current.launch.attempt === 0) {
             if (existsSync(agentDir(current.role_name, true))) {
                 throw new Error(`never-launched room member '${current.role_name}' unexpectedly has Fleet temp state`);
@@ -159,8 +220,6 @@ export async function closeManagedRoom(input) {
         try {
             if (room.close?.phase === 'retire_members') {
                 for (const seat of room.member_seats) {
-                    if (seat.retirement?.phase === 'identity_absent')
-                        continue;
                     await retireMember(input.roomId, seat, deps);
                 }
                 room = advanceRoomClose(input.roomId, 'close_cowork');
@@ -180,6 +239,9 @@ export async function closeManagedRoom(input) {
 export async function deleteLegacyClosedRooms(input) {
     const deleted = [];
     for (const room of listRoomRecords({ state: 'closed' })) {
+        // This compatibility sweep is retirement, never explicit workspace deletion.
+        if (room.workspace)
+            continue;
         try {
             await input.cowork.deleteRoom(room.room_id);
         }
@@ -197,13 +259,29 @@ export async function deleteLegacyClosedRooms(input) {
 /** Retire live resources through the existing cursor, then delete retained state. */
 export async function deleteManagedRoom(input) {
     await closeManagedRoom(input);
-    try {
-        await input.cowork.deleteRoom(input.roomId);
-    }
-    catch (error) {
-        setRoomCloseError(input.roomId, errorText(error), `Retry 'ours-fleet room delete ${input.roomId} ${input.roomId}'.`);
-        throw error;
-    }
-    deleteRoomRecord(input.roomId);
-    return { room_id: input.roomId, deleted: true };
+    return withFileLock(roomCloseLockPath(input.roomId), async () => {
+        try {
+            try {
+                await input.cowork.deleteRoom(input.roomId);
+            }
+            catch (error) {
+                // An earlier explicit delete may have removed the remote room before
+                // local filesystem cleanup failed. Never restore it or repeat creation.
+                if (!(error instanceof CoworkProtocolError && error.code === 'not_found'))
+                    throw error;
+            }
+            const retained = getRoomRecord(input.roomId);
+            if (retained?.workspace && !retained.task_id) {
+                assertWorkspaceDeletable(retained.workspace, 'room', input.roomId);
+                collectWorkspaceArchives(retained.workspace);
+                deleteWorkspace(retained.workspace, 'room', input.roomId);
+            }
+            deleteRoomRecord(input.roomId);
+            return { room_id: input.roomId, deleted: true };
+        }
+        catch (error) {
+            setRoomCloseError(input.roomId, errorText(error), `Fix the cleanup error and explicitly retry room delete ${input.roomId} ${input.roomId}.`);
+            throw error;
+        }
+    }, {}, CLOSE_LOCK_STALE_MS);
 }

package/dist/rooms-tasks/cowork-adapter.d.ts

@@ -58,6 +58,10 @@ export interface CoworkAdapter {
         briefing: string;
         quiet_membership?: boolean;
         anonymous?: boolean;
+        activation_requirements?: Array<{
+            role: string;
+            count: number;
+        }>;
     }): Promise<CoworkRoomCreateResult>;
     acceptInvite(roomId: string, invite: string, opts: {
         role: string;

package/dist/rooms-tasks/cowork-adapter.js

@@ -8,6 +8,8 @@ import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { createConnection } from 'node:net';
+import { readClientProfile } from '../client-profile.js';
+import { coworkHttpCall } from './cowork-http.js';
 const RPC_VERSION = 1;
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
@@ -275,10 +277,15 @@ function rpcCall(socketPath, method, params, timeoutMs, connect) {
     });
 }
 export function createCoworkAdapter(options = {}) {
-    const socketPath = resolveCoworkSocketPath(options);
+    const env = options.env ?? process.env;
+    const explicitLocal = options.socketPath !== undefined || options.configPath !== undefined
+        || env.OURS_COWORK_CONFIG !== undefined || !!env.OURS_COWORK_STATE_DIR;
+    const profile = explicitLocal ? undefined : readClientProfile({ ...env, HOME: options.home ?? env.HOME });
+    const remote = profile?.serverUrl ? profile : undefined;
+    const socketPath = remote ? undefined : resolveCoworkSocketPath(options);
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const connect = options.connect ?? ((path) => createConnection(path));
-    const call = (method, params) => rpcCall(socketPath, method, params, timeoutMs, connect);
+    const call = (method, params) => remote ? coworkHttpCall(remote, method, params, timeoutMs) : rpcCall(socketPath, method, params, timeoutMs, connect);
     return {
         async available() {
             try {
@@ -296,6 +303,7 @@ export function createCoworkAdapter(options = {}) {
                 briefing: opts.briefing,
                 ...(opts.quiet_membership === undefined ? {} : { quiet_membership: opts.quiet_membership }),
                 ...(opts.anonymous === undefined ? {} : { anonymous: opts.anonymous }),
+                ...(opts.activation_requirements === undefined ? {} : { activation_requirements: opts.activation_requirements }),
             }), 'room.create');
             if (!result.identity_cid)
                 throw new CoworkProtocolError('room.create', 'created room did not establish an identity CID');

package/dist/rooms-tasks/cowork-http.d.ts

@@ -0,0 +1,3 @@
+import type { ExplicitClientProfile } from '../client-profile.js';
+/** Same RPC protocol as the local socket; never replay a possibly delivered mutation. */
+export declare function coworkHttpCall(profile: ExplicitClientProfile, method: string, params: Record<string, unknown>, timeoutMs: number): Promise<unknown>;