@ours.network/fleet 1.2.0-nightly.15 → 1.2.0-nightly.17

package/README.md

@@ -79,7 +79,7 @@ The state dir contract:
 |---|---|---|
 | Node ≥ 22 | runs `ours-fleet` and its maintained adapters | nodejs.org, `apt`, or `brew` |
 | a harness CLI, logged in | the agent itself | e.g. Claude Code (`claude`) or Codex CLI (`codex`) |
-| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `npm i -g @ours.network/cli@2.8.1-nightly.7 @ours.network/daemon@3.8.1-nightly.1 && ours-daemon start` |
+| `ours` CLI + shared daemon | identity + agent-to-agent messaging | `ours-install client --config /absolute/private/profile.json --integrations fleet --fleet-settings /absolute/fleet-settings.json` |
 
 Linux only: `ours-fleet init` enables *linger* so roles run without a login session
 and survive reboots. macOS: launchd agents start **at login** (no linger
@@ -1348,8 +1348,9 @@ The command override is exact: Fleet does not append `--profile`, `--search`, or
 
 One-off/permanent spawn selects a Brain that owns model, reasoning, native permission,
 sandbox, profile, launcher, search, monitor consent, native config, and additional roots.
-Use `env.OURS_PORT`/`env.OURS_CONFIG` for a
-role-specific ours daemon, or configure the host default in `~/.ours/config.json`.
+All roles use the shared gateway profile `~/.ours-client/profile.json`.
+`OURS_CONFIG` selects an alternate whole profile. Legacy port/token/state-dir
+overrides are rejected. See the [gateway setup guide](https://github.com/adapt-toolkit/ours-network/blob/prerelease/packages/installer/GATEWAY_SETUP.md).
 
 ## Agent isolation
 

package/dist/agent-ours/service.js

@@ -267,8 +267,10 @@ export async function preparePermanentAssignment(role) {
         endpoint: profile.endpoint,
         expectedInstanceId: profile.expectedInstanceId,
         credentialPath: profile.credentialPath,
-        sessionMode: 'local',
-        requiredCapabilities: ['local-pid-v1', 'root-first-identities-v1'],
+        sessionMode: 'external',
+        leaseToken: randomUUID(),
+        requiredCapabilities: ['external-sessions-v1', 'root-first-identities-v1'],
+        env: {},
     });
     try {
         const rows = await client.listIdentities(), row = rows.find((r) => r.name === role.identity);
@@ -295,7 +297,12 @@ export async function preparePermanentAssignment(role) {
         return 'verified';
     }
     finally {
-        await client.close();
+        try {
+            await client.releaseLease();
+        }
+        finally {
+            await client.close();
+        }
     }
 }
 export function readRoomReadiness(roomCid, name) {

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.15",
-  "buildId": "4b6a9eb4bc62",
-  "commit": "078d193069b7e8f3a4192a44ea26cf82496cbc66",
+  "version": "1.2.0-nightly.17",
+  "buildId": "165e9b4f7cc7",
+  "commit": "e720586890943d424840f0f9b96d0ac5051d8a6c",
   "dirty": true,
-  "builtAt": "2026-09-25T18:13:36.098Z",
+  "builtAt": "2026-09-26T21:55:24.104Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/client-profile.d.ts

@@ -1,18 +1,6 @@
-export interface ExplicitClientProfile {
-    readonly endpoint: string;
-    readonly expectedInstanceId: string;
-    readonly credentialPath: string;
-    readonly configPath: string;
-    readonly serverUrl?: string;
-}
-export declare class ClientProfileError extends Error {
-    constructor(message: string);
-}
-export declare function clientConfigPath(env: NodeJS.ProcessEnv): string;
-/**
- * Read Fleet's selected host-client profile without opening its credential.
- * A legacy daemon config remains legacy only when none of the profile fields is
- * present. Explicit and managed selections fail closed on invalid input.
- */
-export declare function readClientProfile(env: NodeJS.ProcessEnv): ExplicitClientProfile | undefined;
+import { clientProfilePath, readGatewayClientProfile } from '@ours.network/sdk/client';
+export { ClientProfileError } from '@ours.network/sdk/client';
+export type ExplicitClientProfile = ReturnType<typeof readGatewayClientProfile>;
+export declare const clientConfigPath: typeof clientProfilePath;
+export declare const readClientProfile: typeof readGatewayClientProfile;
 export declare function clientProfileKey(profile: ExplicitClientProfile): string;

package/dist/client-profile.js

@@ -1,130 +1,7 @@
-import { normalizeDaemonEndpoint } from '@ours.network/sdk/client';
-import { lstatSync, readFileSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { isAbsolute, join } from 'node:path';
-const PROFILE_FIELDS = ['endpoint', 'expectedInstanceId', 'credentialPath'];
-const LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-const LEGACY_CONFIG_FIELDS = ['apiToken', 'stateDir', 'port'];
-const LEGACY_ENV_FIELDS = ['OURS_API_TOKEN', 'OURS_STATE_DIR', 'OURS_PORT', 'OURS_DAEMON_ID'];
-export class ClientProfileError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ClientProfileError';
-    }
-}
-export function clientConfigPath(env) {
-    if (env.OURS_CONFIG !== undefined)
-        return env.OURS_CONFIG;
-    const managedPath = join(env.HOME || homedir(), '.ours-client', 'profile.json');
-    try {
-        lstatSync(managedPath);
-        return managedPath;
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw invalid(managedPath, 'could not be read');
-        return join(homedir(), '.ours', 'config.json');
-    }
-}
-function invalid(path, detail) {
-    return new ClientProfileError(`ours client profile ${JSON.stringify(path)} ${detail}`);
-}
-/**
- * Read Fleet's selected host-client profile without opening its credential.
- * A legacy daemon config remains legacy only when none of the profile fields is
- * present. Explicit and managed selections fail closed on invalid input.
- */
-export function readClientProfile(env) {
-    const configPath = clientConfigPath(env);
-    const managed = configPath === join(env.HOME || homedir(), '.ours-client', 'profile.json');
-    const named = env.OURS_CONFIG !== undefined || managed;
-    let text;
-    try {
-        text = readFileSync(configPath, 'utf8');
-    }
-    catch {
-        if (named)
-            throw invalid(configPath, 'could not be read');
-        return undefined;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        if (named)
-            throw invalid(configPath, 'is not valid JSON');
-        return undefined;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        if (named)
-            throw invalid(configPath, 'must contain a JSON object');
-        return undefined;
-    }
-    const row = parsed;
-    if (!PROFILE_FIELDS.some(field => Object.prototype.hasOwnProperty.call(row, field))) {
-        if (managed)
-            throw invalid(configPath, 'must contain a complete client profile');
-        return undefined;
-    }
-    let metadata;
-    try {
-        metadata = statSync(configPath);
-    }
-    catch {
-        throw invalid(configPath, 'could not be inspected');
-    }
-    if (!metadata.isFile())
-        throw invalid(configPath, 'must be a regular file');
-    const getuid = process.getuid;
-    if (getuid && metadata.uid !== getuid())
-        throw invalid(configPath, 'must be owned by this user');
-    if ((metadata.mode & 0o077) !== 0)
-        throw invalid(configPath, 'must not be accessible by group or other users');
-    for (const field of PROFILE_FIELDS)
-        if (typeof row[field] !== 'string' || !row[field].trim())
-            throw invalid(configPath, `has an invalid or missing ${field}`);
-    for (const field of LEGACY_CONFIG_FIELDS)
-        if (Object.prototype.hasOwnProperty.call(row, field))
-            throw invalid(configPath, `cannot combine ${field} with explicit profile selection`);
-    for (const field of LEGACY_ENV_FIELDS)
-        if (env[field]?.trim())
-            throw invalid(configPath, `cannot combine ${field} with explicit profile selection`);
-    const endpoint = row.endpoint.trim();
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        throw invalid(configPath, 'has an invalid endpoint');
-    }
-    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password
-        || url.search || url.hash)
-        throw invalid(configPath, 'endpoint must be an HTTP or HTTPS base URL');
-    const expectedInstanceId = row.expectedInstanceId.trim();
-    if (!LOWERCASE_UUID.test(expectedInstanceId))
-        throw invalid(configPath, 'expectedInstanceId must be a lowercase UUID');
-    const credentialPath = row.credentialPath.trim();
-    if (!isAbsolute(credentialPath))
-        throw invalid(configPath, 'credentialPath must be absolute');
-    let serverUrl;
-    if (Object.hasOwn(row, 'serverUrl')) {
-        if (typeof row.serverUrl !== 'string' || /[\s\\?#]/.test(row.serverUrl))
-            throw invalid(configPath, 'serverUrl must be a safe HTTP or HTTPS base URL');
-        try {
-            serverUrl = normalizeDaemonEndpoint(row.serverUrl);
-        }
-        catch {
-            throw invalid(configPath, 'serverUrl must be a safe HTTP or HTTPS base URL');
-        }
-        if (normalizeDaemonEndpoint(endpoint) !== serverUrl + '/daemon')
-            throw invalid(configPath, 'endpoint must select serverUrl/daemon');
-    }
-    return Object.freeze({
-        ...(serverUrl === undefined ? {} : { serverUrl }),
-        endpoint: normalizeDaemonEndpoint(endpoint), expectedInstanceId, credentialPath, configPath,
-    });
-}
+import { clientProfilePath, readGatewayClientProfile } from '@ours.network/sdk/client';
+export { ClientProfileError } from '@ours.network/sdk/client';
+export const clientConfigPath = clientProfilePath;
+export const readClientProfile = readGatewayClientProfile;
 export function clientProfileKey(profile) {
     return `${profile.endpoint}#${profile.expectedInstanceId}`;
 }

package/dist/creation.js

@@ -213,10 +213,10 @@ export async function ensureIdentity(name, profile, provisioner, log = () => { }
 export function daemonIdentityProvisioner(env = process.env, attachClient = attachOursClient, options = {}) {
     const connect = (leaseToken) => {
         const profile = readClientProfile(env);
-        return attachClient(profile ? {
+        return attachClient({
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken, env: {},
-        } : { env, leaseToken, clientPid: process.pid });
+        });
     };
     const provisioner = {
         async exists(name) {

package/dist/daemon-recovery.d.ts

@@ -34,14 +34,7 @@ interface GenerationProbeDeps {
     canonicalize?(path: string): string;
     attachClient?(options: AttachOursClientOptions): Pick<OursClient, 'version' | 'identities' | 'close'> | Promise<Pick<OursClient, 'version' | 'identities' | 'close'>>;
 }
-/**
- * Corroborate the loopback daemon's unauthenticated `/info`, its credentialed
- * identity-index readiness route, and its local boot-generation record. The
- * index enforces auth when the daemon visibility requires it; open visibility
- * deliberately does not. No source is sufficient
- * alone: `/info` has no boot id, the identity index has no generation, and a
- * stale `ready` file can outlive the process that wrote it.
- */
+/** Read generation and readiness through the selected gateway. Server paths are opaque. */
 export declare function probeDaemonGeneration(fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: GenerationProbeDeps): Promise<DaemonGenerationProbe>;
 export declare class DaemonGenerationObserver {
     private current?;

package/dist/daemon-recovery.js

@@ -1,8 +1,7 @@
-import { readFileSync, realpathSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { attachOursClient, } from '@ours.network/sdk/client';
-import { readDaemonConfig, resolveEndpoint } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { replaceFileAtomically } from './atomic-file.js';
 export const DAEMON_RECOVERY_MAX_ATTEMPTS = 6;
@@ -39,129 +38,25 @@ function startupProgress(value) {
         return undefined;
     return row;
 }
-function canonical(path, deps) {
-    const absolute = resolve(path);
-    return deps.canonicalize?.(absolute) ?? realpathSync.native(absolute);
-}
-/**
- * Corroborate the loopback daemon's unauthenticated `/info`, its credentialed
- * identity-index readiness route, and its local boot-generation record. The
- * index enforces auth when the daemon visibility requires it; open visibility
- * deliberately does not. No source is sufficient
- * alone: `/info` has no boot id, the identity index has no generation, and a
- * stale `ready` file can outlive the process that wrote it.
- */
+/** Read generation and readiness through the selected gateway. Server paths are opaque. */
 export async function probeDaemonGeneration(fetch, env, deps = {}) {
-    const profile = readClientProfile(env);
-    if (profile || env.OURS_DAEMON_ID)
-        return probeSelectedDaemon(env, deps, profile);
-    const endpoint = resolveEndpoint(env);
-    let response;
-    try {
-        response = await fetch(`${endpoint.origin}/info`, { headers: endpoint.headers });
-    }
-    catch {
-        return { state: 'unavailable', reason: 'DAEMON_INFO_UNREACHABLE' };
-    }
-    if (!response.ok)
-        return {
-            state: 'unavailable',
-            reason: response.status === 401 ? 'DAEMON_INFO_UNAUTHORIZED' : 'DAEMON_INFO_HTTP_ERROR',
-        };
-    let info;
-    try {
-        const value = await response.json();
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            throw new Error('shape');
-        info = value;
-    }
-    catch {
-        return { state: 'unavailable', reason: 'DAEMON_INFO_INVALID' };
-    }
-    if (info.name !== 'ours' || !positiveInteger(info.pid)
-        || typeof info.stateDir !== 'string' || info.stateDir.length === 0)
-        return { state: 'unavailable', reason: 'DAEMON_INFO_INVALID' };
-    let reportedStateDir;
-    let expectedStateDir;
-    try {
-        reportedStateDir = canonical(info.stateDir, deps);
-        expectedStateDir = canonical(endpoint.stateDir, deps);
-    }
-    catch {
-        return { state: 'unavailable', reason: 'DAEMON_STATE_DIR_UNAVAILABLE' };
-    }
-    if (reportedStateDir !== expectedStateDir)
-        return { state: 'unavailable', reason: 'DAEMON_STATE_DIR_MISMATCH' };
-    // `/identities` is the daemon's credential-capable readiness route. A
-    // valid-but-empty index is a documented intermediate startup state, never
-    // proof of readiness.
-    let identitiesResponse;
-    try {
-        identitiesResponse = await fetch(`${endpoint.origin}/identities`, { headers: endpoint.headers });
-    }
-    catch {
-        return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_UNREACHABLE' };
-    }
-    if (!identitiesResponse.ok)
-        return {
-            state: 'unavailable',
-            reason: identitiesResponse.status === 401
-                ? 'DAEMON_IDENTITIES_UNAUTHORIZED' : 'DAEMON_IDENTITIES_HTTP_ERROR',
-        };
-    try {
-        const body = await identitiesResponse.json();
-        if (!body || typeof body !== 'object' || Array.isArray(body)
-            || !Array.isArray(body.identities))
-            return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_INVALID' };
-        if (body.identities.length === 0)
-            return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_NOT_READY' };
-    }
-    catch {
-        return { state: 'unavailable', reason: 'DAEMON_IDENTITIES_INVALID' };
-    }
-    let progress;
     try {
-        const text = deps.readText?.(join(reportedStateDir, 'startup-progress.json'))
-            ?? readFileSync(join(reportedStateDir, 'startup-progress.json'), 'utf8');
-        progress = startupProgress(JSON.parse(text));
+        return await probeSelectedDaemon(deps, readClientProfile(env));
     }
     catch {
-        return { state: 'unavailable', reason: 'DAEMON_PROGRESS_UNAVAILABLE' };
+        return { state: 'unavailable', reason: 'CLIENT_GATEWAY_PROFILE_INVALID' };
     }
-    if (!progress)
-        return { state: 'unavailable', reason: 'DAEMON_PROGRESS_INVALID' };
-    if (progress.phase !== 'ready')
-        return { state: 'unavailable', reason: 'DAEMON_PROGRESS_NOT_READY' };
-    if (progress.pid !== info.pid)
-        return { state: 'unavailable', reason: 'DAEMON_GENERATION_MISMATCH' };
-    return {
-        state: 'ready',
-        generation: {
-            // Keep bootId opaque. Its current writer uses `${pid}-${startedAt}`, but
-            // equality—not its formatting—is the generation contract Fleet needs.
-            bootId: progress.bootId,
-            pid: progress.pid,
-            startedAt: progress.startedAt,
-            stateDir: reportedStateDir,
-        },
-    };
 }
 /** Container selection uses public SDK reads; daemon paths/PIDs remain opaque metadata. */
-async function probeSelectedDaemon(env, deps, profile) {
+async function probeSelectedDaemon(deps, profile) {
     // Defer credential-file access to SDK selection, which checks the configured
     // daemon identity/capability before it reads or sends the credential.
-    const endpoint = profile ? undefined : resolveEndpoint(env, false);
-    const token = profile ? undefined : env.OURS_API_TOKEN?.trim() || readDaemonConfig(env).apiToken;
     let client;
     try {
-        const options = profile ? {
+        const options = {
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath,
             sessionMode: 'external', leaseToken: randomUUID(), env: {},
-        } : {
-            endpoint: endpoint.origin, expectedInstanceId: env.OURS_DAEMON_ID,
-            sessionMode: 'external', leaseToken: randomUUID(),
-            ...(token ? { token } : { credentialPath: join(endpoint.stateDir, 'daemon-token') }),
         };
         client = await (deps.attachClient?.(options) ?? attachOursClient(options));
         const info = await client.version({ startup: true });
@@ -189,7 +84,7 @@ async function probeSelectedDaemon(env, deps, profile) {
         return { state: 'unavailable', reason: 'DAEMON_SELECTED_PROBE_UNAVAILABLE' };
     }
     finally {
-        await client?.close();
+        await client?.close().catch(() => undefined);
     }
 }
 export class DaemonGenerationObserver {

package/dist/doctor.d.ts

@@ -3,7 +3,7 @@ import { type Exec } from './exec.js';
 import type { YamlMode } from './config-yaml.js';
 import { type FetchLike } from './monitor.js';
 import type { PrereqReport } from './harness/types.js';
-type DoctorDaemonClient = Pick<OursClient, 'version' | 'close'>;
+type DoctorDaemonClient = Pick<OursClient, 'version' | 'close'> & Partial<Pick<OursClient, 'identities'>>;
 type AttachDoctorDaemon = (options: AttachOursClientOptions) => Promise<DoctorDaemonClient>;
 /** Host-level + per-harness prerequisite report with actionable messages. */
 export declare function doctor(opts?: {

package/dist/doctor.js

@@ -1,5 +1,4 @@
-import { join } from 'node:path';
-import { userInfo, homedir } from 'node:os';
+import { userInfo } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
 import { realExec } from './exec.js';
@@ -11,7 +10,6 @@ import { agentDir, deriveXdgRuntimeDir } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
-import { authResolutionHint, resolveEndpoint, } from './monitor.js';
 import { readClientProfile } from './client-profile.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { controlSocketPath } from './session/control.js';
@@ -37,25 +35,21 @@ function resolveMonitorProfiles(roles) {
     const profiles = [];
     for (const role of roles.filter(r => r.monitor?.mode === 'fleet')) {
         const env = { ...process.env, ...(role.env ?? {}) };
-        const client = readClientProfile(env);
-        if (client) {
-            const existing = profiles.find(p => p.client?.endpoint === client.endpoint
-                && p.client.expectedInstanceId === client.expectedInstanceId
-                && p.client.credentialPath === client.credentialPath);
-            if (existing)
-                existing.roles.push(role.name);
-            else
-                profiles.push({ client, roles: [role.name] });
+        let client;
+        try {
+            client = readClientProfile(env);
+        }
+        catch (error) {
+            profiles.push({ roles: [role.name], error: error instanceof Error ? error.message : 'Invalid gateway profile' });
             continue;
         }
-        const endpoint = resolveEndpoint(env);
-        const token = endpoint.headers['x-ours-api-token'];
-        const existing = profiles.find(p => p.endpoint?.origin === endpoint.origin
-            && p.endpoint.headers['x-ours-api-token'] === token);
+        const existing = profiles.find(p => p.client?.endpoint === client.endpoint
+            && p.client.expectedInstanceId === client.expectedInstanceId
+            && p.client.credentialPath === client.credentialPath);
         if (existing)
             existing.roles.push(role.name);
         else
-            profiles.push({ endpoint, roles: [role.name] });
+            profiles.push({ client, roles: [role.name] });
     }
     return profiles;
 }
@@ -156,7 +150,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // ── Rooms/tasks checks ────────────────────────────────────────
     if (loaded.ok && loaded.rooms) {
         const rooms = loaded.rooms;
-        // Cowork socket reachability
+        // Cowork gateway reachability
         const coworkConfig = rooms.cowork?.config;
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -165,14 +159,14 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
             checks.push({
                 name: 'cowork', ok: reachable,
                 detail: reachable
-                    ? 'management socket reachable'
-                    : `management socket unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
+                    ? 'gateway management reachable'
+                    : `gateway management unreachable${coworkConfig ? ` (config: ${coworkConfig})` : ''}`,
             });
         }
         catch (e) {
             checks.push({
                 name: 'cowork', ok: false,
-                detail: `management socket error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
+                detail: `gateway management error${coworkConfig ? ` (config: ${coworkConfig})` : ''}: ${e?.message ?? e}`,
             });
         }
         // Owner CID shape
@@ -219,17 +213,6 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                     : `template '${defaultTemplate}' not found`,
             });
         }
-        // Shared-daemon selection coherence
-        if (rooms.cowork?.config) {
-            const { existsSync: exists } = await import('node:fs');
-            const configOk = exists(rooms.cowork.config);
-            checks.push({
-                name: 'rooms: cowork config', ok: configOk,
-                detail: configOk
-                    ? `cowork config at ${rooms.cowork.config}`
-                    : `cowork config not found: ${rooms.cowork.config}`,
-            });
-        }
         // Hard room-management capability check
         try {
             const { createCoworkAdapter } = await import('./rooms-tasks/cowork-adapter.js');
@@ -273,20 +256,17 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
         }
         catch { /* state dir may not exist yet */ }
     }
-    let managedSelection = false;
+    let managedSelection = true;
     try {
         // Mark explicit selection before validation so a damaged managed profile does
         // not produce advice to start an unrelated local daemon.
-        managedSelection = process.env.OURS_CONFIG !== undefined
-            || existsSync(join(process.env.HOME || homedir(), '.ours-client', 'profile.json'));
+        managedSelection = true;
         const selected = readClientProfile(process.env);
         managedSelection = selected !== undefined;
-        const client = await attachDaemon(selected ? {
+        const client = await attachDaemon({
             endpoint: selected.endpoint, expectedInstanceId: selected.expectedInstanceId,
             credentialPath: selected.credentialPath, env: {}, sessionMode: 'external',
             leaseToken: `ours-fleet-doctor-${process.pid}`,
-        } : {
-            env: process.env, leaseToken: `ours-fleet-doctor-${process.pid}`, clientPid: process.pid,
         });
         let daemonVersion;
         try {
@@ -448,14 +428,18 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
     // shared-mode misconfig (401) surfaces here rather than as a silent deaf monitor.
     const monitorProfiles = resolveMonitorProfiles(roles);
     for (const profile of monitorProfiles) {
-        const { endpoint, client: selected } = profile;
+        const selected = profile.client;
         const checkName = monitorProfiles.length === 1
             ? 'monitor: daemon API'
             : `monitor: daemon API (${profile.roles.join(', ')})`;
-        let ok = false, detail;
+        let ok = false, detail = 'gateway profile unavailable';
+        if (profile.error) {
+            checks.push({ name: checkName, ok: false, detail: profile.error });
+            continue;
+        }
         try {
             if (selected) {
-                const daemon = await attachOursClient({
+                const daemon = await attachDaemon({
                     endpoint: selected.endpoint,
                     expectedInstanceId: selected.expectedInstanceId,
                     credentialPath: selected.credentialPath,
@@ -464,7 +448,7 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 });
                 try {
                     const [info, identities] = await Promise.all([
-                        daemon.version(), daemon.identities(),
+                        daemon.version(), daemon.identities?.(),
                     ]);
                     if (info.name !== 'ours' || !Array.isArray(identities))
                         throw new Error('selected daemon metadata is invalid');
@@ -477,27 +461,11 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 checks.push({ name: checkName, ok, detail });
                 continue;
             }
-            const live = await fetchImpl(`${endpoint.origin}/state-dir`, {});
-            if (!live.ok) {
-                detail = `daemon on :${endpoint.port} answered /state-dir with HTTP ${live.status} — not the ours daemon?`;
-            }
-            else {
-                const auth = await fetchImpl(`${endpoint.origin}/identities`, { headers: endpoint.headers });
-                if (auth.status === 401)
-                    detail = `reachable on :${endpoint.port} but the API token was rejected (401) — ` +
-                        authResolutionHint(endpoint);
-                else if (!auth.ok)
-                    detail = `reachable on :${endpoint.port} but /identities returned HTTP ${auth.status}`;
-                else {
-                    ok = true;
-                    detail = `reachable on :${endpoint.port}, authorized — supervisor wake stream available`;
-                }
-            }
         }
         catch (e) {
-            const target = selected?.endpoint ?? `:${endpoint.port}`;
+            const target = selected.endpoint;
             detail = `unreachable on ${target} — monitored roles run degraded until it is up ` +
-                `(start it: ours-daemon start) [${e?.message ?? e}]`;
+                `(check the configured gateway and issued credential) [${e?.message ?? e}]`;
         }
         checks.push({ name: checkName, ok, detail });
     }

package/dist/monitor.d.ts

@@ -88,33 +88,6 @@ export interface MonitorDeps {
  * turns they trigger keep dying.
  */
 export type StatusCause = 'connectivity' | 'delivery' | 'modal' | 'offline' | 'turns-failing' | 'safe-boundary' | 'auth';
-/** Best-effort daemon config (issue #17): the fields the MCP client reads. */
-interface DaemonConfig {
-    apiToken?: string;
-    port?: number;
-    stateDir?: string;
-}
-/**
- * Read the daemon config the way the MCP client does — best-effort. Any missing,
- * malformed, or unreadable config yields `{}` so token resolution falls through
- * (issue #17). Only the well-typed fields we consume are surfaced.
- */
-export declare function readDaemonConfig(env: NodeJS.ProcessEnv): DaemonConfig;
-/**
- * Resolve the daemon API token exactly like the MCP client (issue #17), a 3-step
- * chain: `OURS_API_TOKEN` (trimmed) → config `apiToken` (trimmed) → the 0600 owner
- * token at `<stateDir>/daemon-token`. Never generates a token; a failed read of
- * any source (missing/unreadable) silently falls through to the next.
- */
-export declare function resolveApiToken(env: NodeJS.ProcessEnv, file?: DaemonConfig): string | undefined;
-export interface DaemonEndpoint {
-    origin: string;
-    port: number;
-    configPath: string;
-    stateDir: string;
-    url(name: string): string;
-    headers: Record<string, string>;
-}
 export type IdentityPresence = {
     state: 'present';
     temporary: boolean;
@@ -125,16 +98,12 @@ export type IdentityPresence = {
     state: 'unknown';
     detail: string;
 };
-/** Resolve the daemon endpoint + auth header from env → config → defaults. */
-export declare function resolveEndpoint(env: NodeJS.ProcessEnv, includeToken?: boolean): DaemonEndpoint;
 /**
  * Ask the daemon's authoritative identity index. The notifications endpoint is
  * intentionally unsuitable for lifecycle: it serves an empty 200 page for a
  * valid but missing identity, which made a closed temp identity look healthy.
  */
 export declare function probeIdentityPresence(name: string, fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: IdentityProbeDeps): Promise<IdentityPresence>;
-/** Actionable, secret-free description of every token source for this profile. */
-export declare function authResolutionHint(ep: DaemonEndpoint): string;
 /** Keep only the events whose type the role asked to wake on. */
 export declare function filterEvents(events: NotifyEvent[], wakeSources: string[]): NotifyEvent[];
 /**
@@ -196,8 +165,7 @@ export declare class Monitor {
     private readonly identity;
     private readonly cfg;
     private readonly deps;
-    private readonly ep?;
-    private readonly profile?;
+    private readonly profile;
     private readonly profileKey;
     private readonly monitorLeaseToken;
     private profileClientPromise?;
@@ -263,4 +231,3 @@ export declare class Monitor {
     private writeStatus;
 }
 export declare function createMonitor(o: MonitorOpts): Monitor;
-export {};

package/dist/monitor.js

@@ -1,6 +1,5 @@
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
-import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { attachOursClient } from '@ours.network/sdk/client';
 import { clientProfileKey, readClientProfile, } from './client-profile.js';
@@ -42,124 +41,28 @@ const TURN_OBSERVE_INTERVAL_MS = 1_500;
 const DEFAULT_TURN_FAIL_THRESHOLD = 3; // fallback when the resolved config omits it
 class AuthError extends Error {
 }
-/** Path to the daemon config the MCP client uses: OURS_CONFIG ?? real ~/.ours/config.json. */
-const daemonConfigPath = (env) => env.OURS_CONFIG ?? join(homedir(), '.ours', 'config.json');
-/** Preserve the daemon's legacy env integer semantics: parseInt, invalid → absent. */
-function envInt(env, name) {
-    const raw = env[name];
-    if (raw === undefined)
-        return undefined;
-    const n = parseInt(raw, 10);
-    return Number.isNaN(n) ? undefined : n;
-}
-/**
- * Read the daemon config the way the MCP client does — best-effort. Any missing,
- * malformed, or unreadable config yields `{}` so token resolution falls through
- * (issue #17). Only the well-typed fields we consume are surfaced.
- */
-export function readDaemonConfig(env) {
-    try {
-        const p = JSON.parse(readFileSync(daemonConfigPath(env), 'utf8'));
-        const o = {};
-        if (typeof p.apiToken === 'string' && p.apiToken.trim())
-            o.apiToken = p.apiToken.trim();
-        if (typeof p.port === 'number' && Number.isFinite(p.port))
-            o.port = p.port;
-        if (typeof p.stateDir === 'string')
-            o.stateDir = p.stateDir;
-        return o;
-    }
-    catch {
-        return {};
-    }
-}
-/**
- * Resolve the daemon API token exactly like the MCP client (issue #17), a 3-step
- * chain: `OURS_API_TOKEN` (trimmed) → config `apiToken` (trimmed) → the 0600 owner
- * token at `<stateDir>/daemon-token`. Never generates a token; a failed read of
- * any source (missing/unreadable) silently falls through to the next.
- */
-export function resolveApiToken(env, file = readDaemonConfig(env)) {
-    const e = env.OURS_API_TOKEN?.trim();
-    if (e)
-        return e;
-    if (file.apiToken)
-        return file.apiToken;
-    const sd = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
-    try {
-        const t = readFileSync(join(sd, 'daemon-token'), 'utf8').trim();
-        if (t)
-            return t;
-    }
-    catch { /* missing/unreadable (e.g. cross-user 0600) → fall through */ }
-    return undefined;
-}
-/** Resolve the daemon endpoint + auth header from env → config → defaults. */
-export function resolveEndpoint(env, includeToken = true) {
-    const file = readDaemonConfig(env);
-    const port = envInt(env, 'OURS_PORT') ?? file.port ?? DEFAULT_PORT;
-    const configPath = daemonConfigPath(env);
-    const stateDir = env.OURS_STATE_DIR ?? file.stateDir ?? join(homedir(), '.ours');
-    const token = includeToken ? resolveApiToken(env, file) : undefined;
-    const origin = `http://127.0.0.1:${port}`;
-    return {
-        origin,
-        port,
-        configPath,
-        stateDir,
-        url: (name) => `${origin}/identities/${encodeURIComponent(name)}/notifications`,
-        headers: token ? { 'x-ours-api-token': token } : {},
-    };
-}
 /**
  * Ask the daemon's authoritative identity index. The notifications endpoint is
  * intentionally unsuitable for lifecycle: it serves an empty 200 page for a
  * valid but missing identity, which made a closed temp identity look healthy.
  */
 export async function probeIdentityPresence(name, fetch, env, deps = {}) {
-    const profile = readClientProfile(env);
-    if (profile) {
-        let client;
-        try {
-            client = await (deps.attachClient?.({
-                endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
-                credentialPath: profile.credentialPath,
-                sessionMode: 'external', leaseToken: randomUUID(), env: {},
-            }) ?? attachOursClient({
-                endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
-                credentialPath: profile.credentialPath,
-                sessionMode: 'external', leaseToken: randomUUID(), env: {},
-            }));
-            return classifyIdentityPresence(name, await client.identities());
-        }
-        catch {
-            return { state: 'unknown', detail: 'selected identity index is unavailable' };
-        }
-        finally {
-            await client?.close().catch(() => undefined);
-        }
-    }
-    const ep = resolveEndpoint(env);
-    let response;
+    let client;
     try {
-        response = await fetch(`${ep.origin}/identities`, { headers: ep.headers });
-    }
-    catch (error) {
-        return { state: 'unknown', detail: `identity index unreachable (${msg(error)})` };
-    }
-    if (!response.ok)
-        return {
-            state: 'unknown',
-            detail: response.status === 401
-                ? `daemon rejected the API token (401) — ${authResolutionHint(ep)}`
-                : `identity index returned HTTP ${response.status}`,
+        const profile = readClientProfile(env);
+        const options = {
+            endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
+            credentialPath: profile.credentialPath,
+            sessionMode: 'external', leaseToken: randomUUID(), env: {},
         };
-    try {
-        const body = await response.json();
-        return classifyIdentityPresence(name, body.identities);
+        client = await (deps.attachClient?.(options) ?? attachOursClient(options));
+        return classifyIdentityPresence(name, await client.identities());
     }
-    catch (error) {
-        return { state: 'unknown', detail: `identity index response is unreadable (${msg(error)})` };
+    catch {
+        return { state: 'unknown', detail: 'gateway identity index unavailable; check the shared client profile and issued credential' };
+    }
+    finally {
+        await client?.close().catch(() => undefined);
     }
 }
 function classifyIdentityPresence(name, identities) {
@@ -186,12 +89,6 @@ function classifyIdentityPresence(name, identities) {
             stale: found.stale === true,
         };
 }
-/** Actionable, secret-free description of every token source for this profile. */
-export function authResolutionHint(ep) {
-    const tokenPath = join(ep.stateDir, 'daemon-token');
-    return `set OURS_API_TOKEN, set apiToken in ${JSON.stringify(ep.configPath)}, or ensure ` +
-        `${JSON.stringify(tokenPath)} is readable by the fleet supervisor`;
-}
 /** Keep only the events whose type the role asked to wake on. */
 export function filterEvents(events, wakeSources) {
     const set = new Set(wakeSources);
@@ -414,7 +311,6 @@ export class Monitor {
     identity;
     cfg;
     deps;
-    ep;
     profile;
     profileKey;
     monitorLeaseToken = `ours-fleet-monitor-${process.pid}-${randomUUID()}`;
@@ -441,8 +337,7 @@ export class Monitor {
         this.cfg = o.cfg;
         this.deps = o.deps;
         this.profile = readClientProfile(o.deps.env);
-        this.ep = this.profile ? undefined : resolveEndpoint(o.deps.env);
-        this.profileKey = this.profile ? clientProfileKey(this.profile) : this.ep.origin;
+        this.profileKey = clientProfileKey(this.profile);
         this.statusPath = join(o.agentDir, '.monitor-status');
         this.cursorPath = join(o.agentDir, '.notify-cursor');
         this.statePath = join(o.agentDir, '.monitor-state.json');
@@ -470,14 +365,8 @@ export class Monitor {
         }
         catch (e) {
             if (e instanceof AuthError) {
-                if (this.profile) {
-                    this.cursor = null;
-                    this.degrade('auth', e.message);
-                }
-                else {
-                    this.fatal = true;
-                    this.degrade('auth', e.message, 'failed');
-                }
+                this.cursor = null;
+                this.degrade('auth', e.message);
             }
             else {
                 this.cursor = null;
@@ -510,11 +399,6 @@ export class Monitor {
                 catch (e) {
                     if (this.stopped)
                         return;
-                    if (e instanceof AuthError && !this.profile) {
-                        this.fatal = true;
-                        this.degrade('auth', e.message, 'failed');
-                        return;
-                    }
                     backoff = Math.min(backoff + BACKOFF_STEP_MS, BACKOFF_MAX_MS);
                     if (e instanceof AuthError)
                         this.degrade('auth', e.message);
@@ -630,23 +514,19 @@ export class Monitor {
         this.currentAbort = ctrl;
         let timedOut = false;
         const timer = this.deps.timers.set(() => { timedOut = true; ctrl.abort(); }, timeoutMs);
-        let resp;
         try {
-            if (this.profile) {
-                const client = await this.profileClient();
-                const page = await client.readNotificationPage(this.identity, {
-                    since: since === 'tip' ? 'tip' : Number.parseInt(since, 10),
-                    signal: ctrl.signal,
-                    requestTimeoutMs: timeoutMs,
-                });
-                return { cursor: page.cursor, events: page.events };
-            }
-            resp = await this.deps.fetch(`${this.ep.url(this.identity)}?since=${since}`, { headers: this.ep.headers, signal: ctrl.signal });
+            const client = await this.profileClient();
+            const page = await client.readNotificationPage(this.identity, {
+                since: since === 'tip' ? 'tip' : Number.parseInt(since, 10),
+                signal: ctrl.signal,
+                requestTimeoutMs: timeoutMs,
+            });
+            return { cursor: page.cursor, events: page.events };
         }
         catch (error) {
             if (timedOut && timeoutKind === 'stall')
                 throw new Error(`notification stream stalled for ${Math.round(timeoutMs / 1000)}s`);
-            if (this.profile && /(?:HTTP\s*401|unauthori[sz]ed|API token)/i.test(msg(error)))
+            if (/(?:HTTP\s*401|unauthori[sz]ed|API token)/i.test(msg(error)))
                 throw new AuthError(`daemon rejected the API token (401) — verify the credential file `
                     + `${JSON.stringify(this.profile.credentialPath)} selected by `
                     + `${JSON.stringify(this.profile.configPath)}`);
@@ -656,15 +536,8 @@ export class Monitor {
             this.deps.timers.clear(timer);
             this.currentAbort = null;
         }
-        if (resp.status === 401)
-            throw new AuthError(`daemon rejected the API token (401) — ${authResolutionHint(this.ep)}`);
-        if (!resp.ok)
-            throw new Error(`daemon returned HTTP ${resp.status}`);
-        return resp.json();
     }
     profileClient() {
-        if (!this.profile)
-            throw new Error('explicit client profile is not selected');
         if (!this.profileClientPromise) {
             const { endpoint, expectedInstanceId, credentialPath } = this.profile;
             const options = {

package/dist/owner-channel/ours-client.js

@@ -1,7 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { extname, join } from 'node:path';
-import { readDaemonConfig, resolveEndpoint } from '../monitor.js';
+import { extname } from 'node:path';
 import { readClientProfile } from '../client-profile.js';
 import { OursError, attachOursClient, } from '@ours.network/sdk/client';
 /** Any failure of a daemon operation. Never carries a message body or a token. */
@@ -131,24 +130,10 @@ export class OursSdkClient {
             return;
         const environment = { ...process.env, ...this.env };
         const profile = readClientProfile(environment);
-        // Reuse existing connection configuration. Identity selection checks the
-        // daemon capability before reading the client's protected token delivery file.
-        const endpoint = !profile && environment.OURS_DAEMON_ID
-            ? resolveEndpoint(environment, false) : undefined;
-        const token = endpoint ? environment.OURS_API_TOKEN?.trim() || readDaemonConfig(environment).apiToken : undefined;
-        const options = profile ? {
+        const options = {
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath,
             sessionMode: 'external', leaseToken: this.leaseToken, env: {},
-        } : endpoint ? {
-            endpoint: endpoint.origin, expectedInstanceId: environment.OURS_DAEMON_ID,
-            sessionMode: 'external', leaseToken: this.leaseToken,
-            ...(token ? { token } : { credentialPath: join(endpoint.stateDir, 'daemon-token') }),
-        } : {
-            env: environment,
-            leaseToken: this.leaseToken,
-            clientPid: process.pid,
-            fetch: notificationDeadlineFetch(this.deps.fetch ?? globalThis.fetch, this.deps.notificationRequestDeadlineMs ?? NOTIFICATION_REQUEST_DEADLINE_MS),
         };
         this.client = await (this.deps.attachClient?.(options) ?? attachOursClient(options));
         this.terminalReleasePending = true;

package/dist/rooms-tasks/close.js

@@ -77,15 +77,11 @@ export async function waitForLivenessAbsent(role, launchId, lifecycleDeps = {})
 async function withIdentityClient(work) {
     const profile = readClientProfile(process.env);
     const leaseToken = `ours-fleet-room-close-${process.pid}-${randomUUID()}`;
-    const client = await attachOursClient(profile ? {
+    const client = await attachOursClient({
         endpoint: profile.endpoint,
         expectedInstanceId: profile.expectedInstanceId,
         credentialPath: profile.credentialPath,
         sessionMode: 'external', env: {}, leaseToken,
-    } : {
-        env: process.env,
-        leaseToken,
-        clientPid: process.pid,
     });
     try {
         return await work(client);

package/dist/rooms-tasks/config.js

@@ -54,7 +54,9 @@ export function validateRoomsConfig(raw, vars, path) {
         if (!isPlainObject(raw.cowork))
             throw new RoomsTasksConfigError(path, 'rooms.cowork: must be a mapping');
         rejectUnknown(raw.cowork, RCK, path, 'rooms.cowork');
-        cowork = { config: raw.cowork.config };
+        if (raw.cowork.config !== undefined)
+            throw new RoomsTasksConfigError(path, 'rooms.cowork.config is no longer supported; remove it and configure ~/.ours-client/profile.json for all services');
+        cowork = {};
     }
     if (!isPlainObject(raw.owner))
         throw new RoomsTasksConfigError(path, 'rooms.owner: required and must be a mapping');

package/dist/rooms-tasks/cowork-adapter.d.ts

@@ -1,8 +1,8 @@
 /**
- * Typed client for the ours-cowork v1 private management-socket protocol.
+ * Typed client for the ours-cowork v1 gateway management protocol.
  *
  * Cowork owns room state. Fleet only invokes the versioned JSON RPC exposed
- * by Cowork's Unix socket and projects the response into orchestration data.
+ * through the shared HTTP gateway and projects the response into orchestration data.
  */
 import type { Socket } from 'node:net';
 import type { RoomHistoryEvidence } from './types.js';
@@ -108,6 +108,4 @@ export interface CoworkAdapterOptions {
     home?: string;
     connect?: (path: string) => Socket;
 }
-/** Resolve the same config/state inputs as ours-cowork and return its Unix socket. */
-export declare function resolveCoworkSocketPath(options?: CoworkAdapterOptions): string;
 export declare function createCoworkAdapter(options?: CoworkAdapterOptions): CoworkAdapter;

package/dist/rooms-tasks/cowork-adapter.js

@@ -1,20 +1,14 @@
 /**
- * Typed client for the ours-cowork v1 private management-socket protocol.
+ * Typed client for the ours-cowork v1 gateway management protocol.
  *
  * Cowork owns room state. Fleet only invokes the versioned JSON RPC exposed
- * by Cowork's Unix socket and projects the response into orchestration data.
+ * through the shared HTTP gateway and projects the response into orchestration data.
  */
-import { existsSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { createConnection } from 'node:net';
 import { readClientProfile } from '../client-profile.js';
 import { coworkHttpCall } from './cowork-http.js';
-const RPC_VERSION = 1;
 const DEFAULT_TIMEOUT_MS = 30_000;
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
 export class CoworkUnavailableError extends Error {
-    constructor(message = 'Cowork management socket is not reachable', options) {
+    constructor(message = 'Cowork gateway management is not reachable', options) {
         super(message, options);
         this.name = 'CoworkUnavailableError';
     }
@@ -171,121 +165,13 @@ function projectHistoryRecord(value) {
     }
     return undefined;
 }
-/** Resolve the same config/state inputs as ours-cowork and return its Unix socket. */
-export function resolveCoworkSocketPath(options = {}) {
-    if (options.socketPath)
-        return resolve(options.socketPath);
-    const env = options.env ?? process.env;
-    const home = options.home ?? homedir();
-    const configuredPath = options.configPath ?? env.OURS_COWORK_CONFIG;
-    const configPath = resolve(configuredPath ?? join(home, '.ours-cowork', 'config.json'));
-    let stateDir = resolve(home, '.ours-cowork');
-    if (existsSync(configPath)) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(configPath, 'utf8'));
-        }
-        catch (error) {
-            throw new CoworkProtocolError('config', `malformed config at ${configPath}`, 'invalid_config', { cause: error });
-        }
-        const config = object(parsed, 'config', 'config');
-        if (config.version !== 1 || typeof config.stateDir !== 'string' || !config.stateDir)
-            throw new CoworkProtocolError('config', `invalid Cowork v1 config at ${configPath}`, 'invalid_config');
-        stateDir = resolve(config.stateDir);
-    }
-    else if (configuredPath !== undefined) {
-        throw new CoworkProtocolError('config', `configured Cowork config does not exist: ${configPath}`, 'invalid_config');
-    }
-    if (env.OURS_COWORK_STATE_DIR)
-        stateDir = resolve(env.OURS_COWORK_STATE_DIR);
-    return join(stateDir, 'management.sock');
-}
-function rpcCall(socketPath, method, params, timeoutMs, connect) {
-    const id = `${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-    const request = `${JSON.stringify({ version: RPC_VERSION, id, method, params })}\n`;
-    return new Promise((resolveCall, rejectCall) => {
-        const socket = connect(socketPath);
-        let bytes = '';
-        let size = 0;
-        let settled = false;
-        let connected = false;
-        const finishError = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            socket.destroy();
-            rejectCall(error);
-        };
-        const timer = setTimeout(() => finishError(new CoworkUnavailableError(connected ? 'Cowork did not answer the management socket' : 'Cowork management socket is not reachable')), timeoutMs);
-        socket.setEncoding('utf8');
-        socket.once('connect', () => {
-            connected = true;
-            socket.write(request);
-        });
-        socket.on('data', (chunk) => {
-            if (settled)
-                return;
-            const text = typeof chunk === 'string' ? chunk : chunk.toString('utf8');
-            size += Buffer.byteLength(text);
-            if (size > MAX_RESPONSE_BYTES) {
-                finishError(new CoworkProtocolError(method, 'response exceeded 4 MiB'));
-                return;
-            }
-            bytes += text;
-            const newline = bytes.indexOf('\n');
-            if (newline < 0)
-                return;
-            if (bytes.slice(newline + 1).trim() !== '') {
-                finishError(new CoworkProtocolError(method, 'daemon returned more than one response'));
-                return;
-            }
-            let response;
-            try {
-                response = object(JSON.parse(bytes.slice(0, newline)), method, 'RPC response');
-            }
-            catch (error) {
-                finishError(error instanceof CoworkProtocolError
-                    ? error : new CoworkProtocolError(method, 'daemon returned malformed JSON', 'protocol_error', { cause: error }));
-                return;
-            }
-            if (response.version !== RPC_VERSION || response.id !== id
-                || (Object.hasOwn(response, 'error') === Object.hasOwn(response, 'result'))) {
-                finishError(new CoworkProtocolError(method, 'daemon returned an invalid RPC response'));
-                return;
-            }
-            settled = true;
-            clearTimeout(timer);
-            socket.destroy();
-            if (Object.hasOwn(response, 'error')) {
-                const error = object(response.error, method, 'RPC error');
-                rejectCall(new CoworkProtocolError(method, typeof error.message === 'string' ? error.message : 'unknown RPC error', typeof error.code === 'string' ? error.code : 'rpc_error'));
-            }
-            else {
-                resolveCall(response.result);
-            }
-        });
-        socket.once('end', () => {
-            if (!settled)
-                finishError(new CoworkProtocolError(method, 'daemon closed without a complete response'));
-        });
-        socket.once('error', (error) => {
-            if (!settled)
-                finishError(new CoworkUnavailableError(error.code === 'EACCES' || error.code === 'EPERM'
-                    ? 'Cowork management socket access denied' : 'Cowork management socket is not reachable', { cause: error }));
-        });
-    });
-}
 export function createCoworkAdapter(options = {}) {
     const env = options.env ?? process.env;
-    const explicitLocal = options.socketPath !== undefined || options.configPath !== undefined
-        || env.OURS_COWORK_CONFIG !== undefined || !!env.OURS_COWORK_STATE_DIR;
-    const profile = explicitLocal ? undefined : readClientProfile({ ...env, HOME: options.home ?? env.HOME });
-    const remote = profile?.serverUrl ? profile : undefined;
-    const socketPath = remote ? undefined : resolveCoworkSocketPath(options);
+    if (options.socketPath !== undefined || options.configPath !== undefined)
+        throw new CoworkProtocolError('config', 'Local Cowork selectors are unsupported; configure the shared gateway client profile', 'invalid_config');
+    const profile = readClientProfile({ ...env, HOME: options.home ?? env.HOME });
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const connect = options.connect ?? ((path) => createConnection(path));
-    const call = (method, params) => remote ? coworkHttpCall(remote, method, params, timeoutMs) : rpcCall(socketPath, method, params, timeoutMs, connect);
+    const call = (method, params) => coworkHttpCall(profile, method, params, timeoutMs);
     return {
         async available() {
             try {

package/dist/rooms-tasks/external-worker.js

@@ -10,7 +10,6 @@ const LIFECYCLE_RETRY_MS = 250;
 export function fleetWorkerEnv(source = process.env) {
     const inheritedKeys = [
         'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_CONFIG',
-        'OURS_PORT', 'OURS_STATE_DIR', 'OURS_API_TOKEN', 'OURS_COWORK_CONFIG',
     ];
     const env = Object.fromEntries(inheritedKeys.flatMap(key => source[key] === undefined ? [] : [[key, source[key]]]));
     const lifecycleStateDir = source[FLEET_WORKER_LIFECYCLE_STATE_DIR_ENV]

package/dist/runner.d.ts

@@ -1,6 +1,6 @@
 import { prepareManagedAgent, releaseManagedAgent } from './agent-ours/service.js';
 import { type ResolvedRole } from './config.js';
-import { type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
+import { probeIdentityPresence, type MonitorHandle, type MonitorOpts, type FetchLike } from './monitor.js';
 import { type DaemonGenerationProbe } from './daemon-recovery.js';
 import { type Exec } from './exec.js';
 import { RoleControlServer } from './session/control.js';
@@ -20,6 +20,7 @@ export interface RunnerDeps {
     log(line: string): void;
     /** HTTP transport for the monitor's daemon long-poll (injectable for tests). */
     fetch: FetchLike;
+    identityProbeDeps?: Parameters<typeof probeIdentityPresence>[3];
     probeGeneration(env: NodeJS.ProcessEnv): Promise<DaemonGenerationProbe>;
     /** Construct the supervisor mail monitor (injectable so tests stub it out). */
     createMonitor(opts: MonitorOpts): MonitorHandle;

package/dist/runner.js

@@ -936,7 +936,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
             if (temp && now >= nextIdentityPollAt) {
                 nextIdentityPollAt = now + TEMP_IDENTITY_POLL_MS;
-                const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env);
+                const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env, deps.identityProbeDeps);
                 if (presence.state === 'present') {
                     identityObserved = true;
                     identityAbsentSince = undefined;

package/dist/supervisor/launchd.js

@@ -1,3 +1,4 @@
+import { clientConfigPath } from '../client-profile.js';
 import { existsSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { home, logsRoot } from '../paths.js';
@@ -22,7 +23,7 @@ const xml = (value) => value
     .replaceAll("'", ''');
 function plist(name, binPath) {
     const log = join(logsRoot(), `${name}.log`);
-    const config = process.env.OURS_CONFIG;
+    const config = clientConfigPath(process.env);
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">

package/dist/supervisor/systemd.js

@@ -1,3 +1,4 @@
+import { clientConfigPath } from '../client-profile.js';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { userInfo } from 'node:os';
@@ -69,30 +70,10 @@ export function makeSystemdBackend(exec = realExec) {
                     dirname(process.execPath),
                     ...(process.env.PATH ?? '').split(delimiter),
                 ].filter(Boolean))].join(delimiter);
-            // Same reason as PATH, for the other thing a lingering unit cannot inherit:
-            // WHICH ours daemon this fleet was set up against.
-            //
-            // ours-fleet resolves its daemon from OURS_CONFIG / OURS_PORT / OURS_STATE_DIR
-            // and otherwise falls back to ~/.ours and port 3050 (src/monitor.ts). A host
-            // set up against a non-default daemon — the installer's multi-daemon profiles
-            // do exactly this — passes that selection to `ours-fleet init` in the
-            // environment, and it died there: nothing persisted it, so every runner
-            // systemd started at boot resolved the default daemon again, and on a host
-            // where only the non-default daemon exists that is a daemon that is not there.
-            //
-            // ONLY OURS_CONFIG is baked, deliberately. It names which daemon, and leaves
-            // that daemon's own config file authoritative for port and state directory, so
-            // a later edit to it still wins. Baking OURS_PORT/OURS_STATE_DIR would freeze
-            // those into a unit file that outranks the config for ever after — the failure
-            // mode @ours.network/cli avoids for the same reason (packages/cli/src/
-            // service.ts: "The port is deliberately NOT baked").
-            //
-            // Absent from init's environment ⇒ no line, and the unit is byte-for-byte what
-            // it has always been. This teaches fleet nothing about installer profiles; it
-            // persists the selection fleet was initialised with.
+            // Persist one profile path, never a URL or service port. Profile updates
+            // are picked up by every fresh process, including lingering user services.
             const unitEnv = ['PATH=' + servicePath];
-            if (process.env.OURS_CONFIG)
-                unitEnv.push('OURS_CONFIG=' + process.env.OURS_CONFIG);
+            unitEnv.push('OURS_CONFIG=' + clientConfigPath(process.env));
             const environmentLines = unitEnv
                 .map(value => `Environment="${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`)
                 .join('\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.15",
+  "version": "1.2.0-nightly.17",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -42,9 +42,9 @@
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "2.8.1-nightly.9",
-    "@ours.network/mcp": "1.2.0-nightly.7",
-    "@ours.network/sdk": "3.8.1-nightly.11",
+    "@ours.network/cli": "2.8.1-nightly.12",
+    "@ours.network/mcp": "1.2.0-nightly.9",
+    "@ours.network/sdk": "3.8.1-nightly.14",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "react": "^19.1.1",
@@ -58,7 +58,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "3.8.1-nightly.3",
+    "@ours.network/daemon": "3.8.1-nightly.6",
     "@playwright/test": "^1.54.1",
     "@types/node": "^20.14.0",
     "@types/react": "^19.1.9",