@ours.network/fleet 1.2.0-nightly.1 → 1.2.0-nightly.3

package/README.md

@@ -80,7 +80,7 @@ The state dir contract:
 |---|---|---|
 | Node ≥ 22 | runs `ours-fleet` and its maintained adapters | nodejs.org, `apt`, or `brew` |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli && ours daemon start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli@2.8.1-nightly.7 @ours.network/daemon@3.8.1-nightly.1 && ours-daemon start` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -1653,7 +1653,7 @@ After building Fleet with the selected SDK and CLI artifacts installed, run
 `npm run test:v1-recovery` in an isolated Docker container with external networking
 disabled. The existing test covers retry and terminal failure cases using a
 temporary daemon and no authenticated AI harness. By default both daemon and
-token-update commands use `node_modules/@ours.network/cli/dist/cli.js`;
+token-update commands use `node_modules/@ours.network/daemon/dist/cli.js`;
 `FLEET_DAEMON_CLI` and `FLEET_TOKEN_CLI` can select explicitly prepared CLI entries.
 These package checks do not replace native Fleet/harness or platform acceptance.
 
@@ -1678,3 +1678,22 @@ under identical input names and versions, plus a missing-vendor negative check):
 ```sh
 node scripts/check-build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz
 ```
+
+### Remote clients over HTTPS
+
+A client may select an `https://` origin backed by a TLS reverse proxy. Keep the
+daemon listener private and configure the proxy separately with a certificate
+trusted by the client and matching the hostname. Node uses its normal trust
+store; a private CA may be supplied through `NODE_EXTRA_CA_CERTS` before starting
+the client. Certificate verification must remain enabled.
+
+The existing issued client credential works over either transport; changing the
+URL scheme does not require a new credential. Keep the server's master on the
+server. Forward `x-ours-api-token` and the `x-ours-*` session headers unchanged,
+and support streamed request/response bodies and long polling. Client requests
+refuse redirects, including HTTPS-to-HTTP redirects: configure the final HTTPS
+origin directly. UUID/capability checks still precede credential-bearing calls.
+
+This adds client HTTPS support, not an HTTPS daemon listener, certificate
+provisioning or automatic reverse-proxy configuration. Existing local HTTP and
+SSH-tunnel profiles continue to work.

package/dist/agent-recovery-gate.js

@@ -118,7 +118,7 @@ export async function recoverAgentIdentity(session, identity) {
     const unsubscribe = session.subscribeConversation(event => events.push(event));
     try {
         const queued = await session.queuePrompt([
-            '[fleet-recovery] The shared ours daemon restarted.',
+            '[fleet-recovery] The shared ours-daemon restarted.',
             `Call ours choose_identity with name ${JSON.stringify(identity)} and force false.`,
             'Then call current_identity, then get_messages. Complete all three in that order.',
             'Do not create/delete identities, force-bind, interrupt, or restart any service/session.',

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.1",
-  "buildId": "1e4449b7d64e",
-  "commit": "79fb01a75d39a721491c789b857f892c7c9d000f",
+  "version": "1.2.0-nightly.3",
+  "buildId": "2a8eea26f2b1",
+  "commit": "892adea95e96f4b2a2e4adf850fe409fe1705eda",
   "dirty": true,
-  "builtAt": "2026-09-18T12:07:17.159Z",
+  "builtAt": "2026-09-21T09:07:12.483Z",
   "capabilities": [
     "monitor.interrupt.after_tool"
   ]

package/dist/client-profile.js

@@ -97,9 +97,9 @@ export function readClientProfile(env) {
     catch {
         throw invalid(configPath, 'has an invalid endpoint');
     }
-    if (url.protocol !== 'http:' || url.username || url.password || url.pathname !== '/'
+    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password || url.pathname !== '/'
         || url.search || url.hash)
-        throw invalid(configPath, 'endpoint must be a local HTTP origin');
+        throw invalid(configPath, 'endpoint must be an HTTP or HTTPS origin');
     const expectedInstanceId = row.expectedInstanceId.trim();
     if (!LOWERCASE_UUID.test(expectedInstanceId))
         throw invalid(configPath, 'expectedInstanceId must be a lowercase UUID');

package/dist/doctor.js

@@ -286,7 +286,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     catch (error) {
         checks.push({
             name: 'ours daemon', ok: false,
-            detail: `not reachable through the SDK — start it with: ours daemon start `
+            detail: `not reachable through the SDK — start it with: ours-daemon start `
                 + `[${error?.message ?? String(error)}]`,
         });
     }
@@ -478,7 +478,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         catch (e) {
             const target = selected?.endpoint ?? `:${endpoint.port}`;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours daemon start) [${e?.message ?? e}]`;
+                `(start it: ours-daemon start) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.1",
+  "version": "1.2.0-nightly.3",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -41,8 +41,8 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "2.8.1-nightly.1",
-    "@ours.network/sdk": "3.8.1-nightly.3",
+    "@ours.network/cli": "2.8.1-nightly.7",
+    "@ours.network/sdk": "3.8.1-nightly.9",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "react": "^19.1.1",
@@ -63,6 +63,7 @@
     "@types/ws": "^8.18.1",
     "typescript": "^5.5.0",
     "vite": "^7.0.6",
-    "vitest": "^2.0.0"
+    "vitest": "^2.0.0",
+    "@ours.network/daemon": "3.8.1-nightly.1"
   }
 }