@ours.network/fleet 1.2.0-nightly.25 → 1.2.0-nightly.26

package/dist/account-origin.d.ts

@@ -0,0 +1,2 @@
+export declare const accountOrigins: readonly ["https://app.ours.network", "https://app.ours-tunnel.com"];
+export declare function validateAccountOrigin(value: unknown): string;

package/dist/account-origin.js

@@ -0,0 +1,6 @@
+export const accountOrigins = ['https://app.ours.network', 'https://app.ours-tunnel.com'];
+export function validateAccountOrigin(value) {
+    if (typeof value !== 'string' || !accountOrigins.some(origin => origin === value))
+        throw Error('Unsupported account origin');
+    return value;
+}

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.25",
-  "buildId": "a567036edf8d",
-  "commit": "59ceeac2bb5c52f0861fe19d3c20e5e884d37c6c",
+  "version": "1.2.0-nightly.26",
+  "buildId": "7b8a6a05d7bf",
+  "commit": "99c715eed295baa8fff6bff9f42f868d1f7246f5",
   "dirty": true,
-  "builtAt": "2026-09-30T20:02:41.728Z",
+  "builtAt": "2026-10-01T06:37:30.669Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/cli.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import QRCode from 'qrcode';
+import { readWorkspacePayload, enrollWorkspace } from './workspace-enrollment.js';
 import { waitForRoleDaemon } from './startup-readiness.js';
 import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
@@ -39,7 +41,7 @@ import { controlRequest, controlSocketPath, followControl, livenessNote, } from
 import { SessionControlError } from './session/types.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { startWebConsole } from './web/runtime.js';
-import { requestWebControl } from './web/control.js';
+import { requestWebControl, webControlPath } from './web/control.js';
 import { WebServiceManager } from './web/service.js';
 import { WebAccessStore, passwordAccess, validatePublicOrigin } from './web/access.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
@@ -1527,6 +1529,46 @@ webCommand.command('open').description('securely open or re-pair a browser with
         die(e);
     }
 });
+cOpt(program.command('workspace-enroll').description('enroll this host using a private account setup file'))
+    .requiredOption('--file <path>', 'owned private payload file')
+    .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
+    .action(async (opts) => {
+    try {
+        const result = await enrollWorkspace(readWorkspacePayload(opts.file), opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin });
+        if (!existsSync(new WebAccessStore().path))
+            configureWebAccess({ pairing: true });
+        const manager = new WebServiceManager();
+        await manager.install(binPath, 49271, opts.configuration, { bind: '127.0.0.1', publicOrigin: result.origin });
+        await manager.restart();
+        const controlDeadline = Date.now() + 20000;
+        while (!existsSync(webControlPath())) {
+            if (Date.now() >= controlDeadline)
+                throw Error('Workspace console is still starting; run ours-fleet link-device when ready');
+            await new Promise(resolve => setTimeout(resolve, 200));
+        }
+        const link = await requestWebControl('link-device');
+        const code = Buffer.from(JSON.stringify(link)).toString('base64url');
+        process.stdout.write('Root proof submitted; account setup is ready only after tunnel health and binding verification.\nPrivate single-use device code:\n');
+        process.stdout.write(await QRCode.toString(code, { type: 'terminal', small: true }));
+        process.stdout.write('\n' + code + '\n');
+    }
+    catch (error) {
+        die(error);
+    }
+});
+program.command('link-device').description('create a single-use workspace device connection code (expires in five minutes)')
+    .action(async () => {
+    try {
+        const link = await requestWebControl('link-device');
+        process.stdout.write('Private connection code; share only with the intended device.\n');
+        const code = Buffer.from(JSON.stringify(link)).toString('base64url');
+        process.stdout.write(await QRCode.toString(code, { type: 'terminal', small: true }));
+        process.stdout.write('\n' + code + '\n');
+    }
+    catch (e) {
+        die(e);
+    }
+});
 webCommand.command('revoke-all').description('revoke all trusted browsers and active web sessions')
     .action(async () => {
     try {

package/dist/rooms-tasks/live-readiness.js

@@ -27,7 +27,7 @@ export async function taskLiveReadiness(task, room, cowork, deps = {}) {
     if (!remote || remote.room_id !== room.room_id || remote.identity_cid !== room.room_identity_cid
         || remote.state !== 'active')
         return degraded('room_identity_or_state_mismatch');
-    if (room.owner_seat_cid && remote.seats.filter(seat => seat.identity_cid === room.owner_seat_cid && seat.seat_state === 'active').length !== 1)
+    if (room.owner_seat_cid && remote.seats.filter(seat => seat.identity_cid.toLowerCase() === room.owner_seat_cid.toLowerCase() && seat.seat_state === 'active').length !== 1)
         return degraded('owner_seat_missing');
     for (const seat of room.member_seats) {
         const member = seat.role_name;
@@ -80,6 +80,6 @@ export async function taskLiveReadiness(task, room, cowork, deps = {}) {
     const memberCids = new Set(room.member_seats.map(seat => seat.identity_cid));
     const memberRoles = new Set(room.member_seats.map(seat => seat.cowork_role));
     if (remote.seats.some(seat => seat.seat_state === 'active' && memberRoles.has(seat.role)
-        && !memberCids.has(seat.identity_cid) && seat.identity_cid !== room.owner_seat_cid))
+        && !memberCids.has(seat.identity_cid) && seat.identity_cid.toLowerCase() !== room.owner_seat_cid?.toLowerCase()))
         return degraded('untracked_member_seats');
 }

package/dist/rooms-tasks/provision.js

@@ -619,7 +619,7 @@ export async function reconcileExistingTaskMembers(input) {
                 || remote.state !== 'active')
                 throw new Error('Cowork room is not the exact active room');
             assertCoworkRoomPolicy(remote, storedRoomLaunchPolicy(current.room_policy).anonymous);
-            if (current.owner_seat_cid && !remote.seats.some(seat => seat.identity_cid === current.owner_seat_cid && seat.seat_state === 'active'))
+            if (current.owner_seat_cid && !remote.seats.some(seat => seat.identity_cid.toLowerCase() === current.owner_seat_cid.toLowerCase() && seat.seat_state === 'active'))
                 throw new Error('expected Owner seat is not active');
             const seats = [];
             for (const seat of current.member_seats) {

package/dist/web/auth.d.ts

@@ -1,3 +1,4 @@
+import { WorkspaceDeviceStore } from './workspace-devices.js';
 import type { FastifyRequest } from 'fastify';
 import type { WebSocket } from 'ws';
 import { TrustedDeviceStore, type TrustedDeviceIssue } from './device-store.js';
@@ -26,6 +27,8 @@ export declare class WebAuth {
     private readonly now;
     private readonly devices;
     private readonly access;
+    private readonly workspaceDevices?;
+    readonly appOrigin: string;
     private _bootstrapSecret;
     private bootstrapExpiresAt;
     private bootstrapUsed;
@@ -35,7 +38,7 @@ export declare class WebAuth {
     private readonly rates;
     private readonly transports;
     private readonly sockets;
-    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig);
+    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig, workspaceDevices?: WorkspaceDeviceStore | undefined, appOrigin?: string);
     get bootstrapSecret(): string;
     get origin(): string;
     get host(): string;
@@ -66,6 +69,26 @@ export declare class WebAuth {
     bindTransport(sessionId: string, close: () => void): () => void;
     clearSessions(): void;
     revokeAllTrustedDevices(): number;
+    workspaceIdentity(): {
+        workspaceId: string;
+    };
+    workspaceEnrollment(issuer?: string | null): {
+        enrollment: string;
+        workspaceId: string;
+        expiresAt: number;
+    };
+    enrollWorkspace(request: FastifyRequest, input: {
+        enrollment: string;
+        workspaceId: string;
+        label: string;
+    }): {
+        token: string;
+        device: import("./workspace-devices.js").WorkspaceDevice;
+        workspaceId: string;
+    };
+    listWorkspaceDevices(): import("./workspace-devices.js").WorkspaceDevice[];
+    revokeWorkspaceDevice(id: string): void;
+    private requireWorkspaceDevices;
     shutdown(): void;
     private createSession;
     private removeSession;

package/dist/web/auth.js

@@ -14,6 +14,8 @@ export class WebAuth {
     now;
     devices;
     access;
+    workspaceDevices;
+    appOrigin;
     _bootstrapSecret = token(32);
     bootstrapExpiresAt = Date.now() + 5 * 60_000;
     bootstrapUsed = false;
@@ -23,12 +25,14 @@ export class WebAuth {
     rates = new Map();
     transports = new Map();
     sockets = new Map();
-    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }) {
+    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }, workspaceDevices, appOrigin = 'https://app.ours.network') {
         this._origin = _origin;
         this._host = _host;
         this.now = now;
         this.devices = devices;
         this.access = access;
+        this.workspaceDevices = workspaceDevices;
+        this.appOrigin = appOrigin;
     }
     get bootstrapSecret() { return this._bootstrapSecret; }
     get origin() { return this._origin; }
@@ -56,12 +60,17 @@ export class WebAuth {
         const origins = this.allowedOrigins.size ? this.allowedOrigins : new Set([this.origin]);
         if (!host || !hosts.has(host))
             throw new FleetError('forbidden', `This address is not configured for the fleet console. Open ${this.origin} or set --public-origin.`);
-        if (requireOrigin && (!request.headers.origin || !origins.has(request.headers.origin)))
+        if (this.workspaceDevices && String(request.headers.authorization ?? '').startsWith('Bearer ') && request.headers.origin && request.headers.origin !== this.appOrigin && !origins.has(request.headers.origin))
+            throw new FleetError('forbidden', 'workspace request Origin does not match configured account origin');
+        const workspaceRequest = Boolean(this.workspaceDevices) && request.headers.origin === this.appOrigin
+            && (String(request.headers.authorization ?? '').startsWith('Bearer ') || (request.url ?? '').split('?')[0] === '/api/v1/devices/enroll' || request.method === 'OPTIONS');
+        if (requireOrigin && !workspaceRequest && (!request.headers.origin || !origins.has(request.headers.origin)))
             throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
         const fetchSite = request.headers['sec-fetch-site'];
         const pageNavigation = allowPageNavigation && !requireOrigin && request.method === 'GET'
-            && request.headers['sec-fetch-mode'] === 'navigate' && request.headers['sec-fetch-dest'] === 'document';
-        if (!pageNavigation && fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
+            && request.headers['sec-fetch-mode'] === 'navigate'
+            && (request.headers['sec-fetch-dest'] === 'document' || (Boolean(this.workspaceDevices) && request.headers['sec-fetch-dest'] === 'iframe' && new URL(request.url || '/', this.origin).searchParams.get('workspace-frame') === '1'));
+        if (!workspaceRequest && !pageNavigation && fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
             throw new FleetError('forbidden', 'cross-site request rejected');
     }
     exchange(request) {
@@ -103,7 +112,23 @@ export class WebAuth {
         return { session: this.createSession(device.id), device };
     }
     authenticate(request, mutation = false) {
+        const authorization = String(request.headers.authorization ?? '');
+        if (authorization.startsWith('Bearer ')) {
+            this.validateBoundary(request, mutation);
+            if (!this.workspaceDevices)
+                throw new FleetError('unauthorized', 'workspace bearer credential is invalid');
+            const device = this.requireWorkspaceDevices().authenticate(authorization.slice(7));
+            const id = `workspace:${device.id}`;
+            const session = { id, csrf: '', createdAt: device.createdAt, lastSeenAt: this.now(), absoluteExpiresAt: device.expiresAt };
+            this.sessions.set(id, session);
+            this.sessionDevices.set(id, id);
+            if (mutation)
+                this.consumeRate(`mutation:${id}`, 120, 60000);
+            return session;
+        }
         this.validateBoundary(request, mutation);
+        if (request.headers.origin === this.appOrigin && !this.allowedOrigins.has(this.appOrigin))
+            throw new FleetError('unauthorized', 'workspace bearer credential required');
         const id = parseCookies(request.headers.cookie ?? '').ofs_session;
         const session = id ? this.sessions.get(id) : undefined;
         const now = this.now();
@@ -124,7 +149,9 @@ export class WebAuth {
     logout(request) {
         const session = this.authenticate(request, true);
         const deviceId = this.sessionDevices.get(session.id);
-        if (deviceId && deviceId !== 'unprotected')
+        if (session.id.startsWith('workspace:'))
+            this.workspaceDevices?.revoke(session.id.slice(10));
+        else if (deviceId && deviceId !== 'unprotected')
             this.devices.revokeId(deviceId);
         this.removeSession(session.id);
     }
@@ -146,7 +173,7 @@ export class WebAuth {
             || ticket.roleId !== roleId)
             throw new FleetError('unauthorized', 'WebSocket ticket is invalid, expired, or already used');
         const session = this.sessions.get(ticket.sessionId);
-        if (!session)
+        if (!session || (session.id.startsWith('workspace:') && !this.workspaceDevices?.valid(session.id.slice(10))))
             throw new FleetError('unauthorized', 'browser session expired');
         return session;
     }
@@ -157,7 +184,10 @@ export class WebAuth {
             this.sockets.set(sessionId, sockets);
         }
         sockets.add(socket);
-        socket.once('close', () => sockets?.delete(socket));
+        const expiry = setInterval(() => { const session = this.sessions.get(sessionId); if (!session || session.absoluteExpiresAt <= this.now() || (sessionId.startsWith('workspace:') && !this.workspaceDevices?.valid(sessionId.slice(10))))
+            this.removeSession(sessionId); }, 1000);
+        expiry.unref();
+        socket.once('close', () => { clearInterval(expiry); sockets?.delete(socket); });
     }
     /** Raw service streams share the same logout/revocation boundary as native sockets. */
     bindTransport(sessionId, close) {
@@ -167,7 +197,10 @@ export class WebAuth {
             this.transports.set(sessionId, transports);
         }
         transports.add(close);
-        return () => { transports.delete(close); if (!transports.size)
+        const expiry = setInterval(() => { const session = this.sessions.get(sessionId); if (!session || session.absoluteExpiresAt <= this.now() || (sessionId.startsWith('workspace:') && !this.workspaceDevices?.valid(sessionId.slice(10))))
+            this.removeSession(sessionId); }, 1000);
+        expiry.unref();
+        return () => { clearInterval(expiry); transports.delete(close); if (!transports.size)
             this.transports.delete(sessionId); };
     }
     clearSessions() {
@@ -185,10 +218,29 @@ export class WebAuth {
     }
     revokeAllTrustedDevices() {
         const count = this.devices.revokeAll();
+        for (const device of this.workspaceDevices?.list() ?? [])
+            this.workspaceDevices?.revoke(device.id);
         this.clearSessions();
         return count;
     }
-    shutdown() { this.clearSessions(); }
+    workspaceIdentity() { return { workspaceId: this.requireWorkspaceDevices().workspaceId }; }
+    workspaceEnrollment(issuer = null) { return this.requireWorkspaceDevices().mint(issuer?.startsWith('workspace:') ? issuer.slice(10) : null); }
+    enrollWorkspace(request, input) {
+        this.validateBoundary(request, true);
+        this.consumeRate('workspace-enrollment', 30, 60000);
+        return this.requireWorkspaceDevices().enroll(input.enrollment, input.workspaceId, input.label);
+    }
+    listWorkspaceDevices() { return this.requireWorkspaceDevices().list(); }
+    revokeWorkspaceDevice(id) {
+        this.requireWorkspaceDevices().revoke(id);
+        this.removeSession(`workspace:${id}`);
+    }
+    requireWorkspaceDevices() {
+        if (!this.workspaceDevices)
+            throw new FleetError('capability_unavailable', 'workspace device access is not configured');
+        return this.workspaceDevices;
+    }
+    shutdown() { this.clearSessions(); this.workspaceDevices?.close(); }
     createSession(deviceId) {
         const now = this.now();
         const session = {

package/dist/web/control.d.ts

@@ -1,4 +1,4 @@
-export type WebControlCommand = 'open' | 'revoke-all';
+export type WebControlCommand = 'open' | 'revoke-all' | 'link-device';
 export declare const webControlPath: (dir?: string) => string;
 export interface WebControlServer {
     path: string;
@@ -7,8 +7,9 @@ export interface WebControlServer {
 export declare function startWebControlServer(options: {
     dir?: string;
     onOpen(): void | Promise<void>;
+    onLinkDevice?(): Record<string, unknown> | Promise<Record<string, unknown>>;
     onRevokeAll(): void | Promise<void>;
     now?: () => number;
     rateLimit?: number;
 }): Promise<WebControlServer>;
-export declare function requestWebControl(command: WebControlCommand, path?: string, timeoutMs?: number): Promise<void>;
+export declare function requestWebControl(command: WebControlCommand, path?: string, timeoutMs?: number): Promise<Record<string, unknown> | void>;

package/dist/web/control.js

@@ -35,13 +35,16 @@ export async function startWebControlServer(options) {
                     if (used > rateLimit)
                         throw new FleetError('rate_limited', 'local web control rate limit exceeded');
                     const parsed = JSON.parse(body.slice(0, body.indexOf('\n')));
-                    if (parsed.command === 'open')
+                    let result;
+                    if (parsed.command === 'link-device' && options.onLinkDevice)
+                        result = await options.onLinkDevice();
+                    else if (parsed.command === 'open')
                         await options.onOpen();
                     else if (parsed.command === 'revoke-all')
                         await options.onRevokeAll();
                     else
                         throw new FleetError('invalid_request', 'unknown local web control command');
-                    socket.end(JSON.stringify({ ok: true }) + '\n');
+                    socket.end(JSON.stringify({ ok: true, result }) + '\n');
                 }
                 catch (error) {
                     const code = error instanceof FleetError ? error.code : 'internal';
@@ -66,7 +69,7 @@ export async function startWebControlServer(options) {
     };
 }
 export async function requestWebControl(command, path = webControlPath(), timeoutMs = 5_000) {
-    await new Promise((resolve, reject) => {
+    return await new Promise((resolve, reject) => {
         const socket = createConnection(path);
         let response = '';
         let settled = false;
@@ -74,7 +77,7 @@ export async function requestWebControl(command, path = webControlPath(), timeou
             socket.destroy();
             reject(new FleetError('timeout', 'local web control request timed out'));
         }, timeoutMs);
-        const finish = (error) => {
+        const finish = (error, result) => {
             if (settled)
                 return;
             settled = true;
@@ -82,7 +85,7 @@ export async function requestWebControl(command, path = webControlPath(), timeou
             if (error)
                 reject(error);
             else
-                resolve();
+                resolve(result);
         };
         socket.once('connect', () => socket.write(JSON.stringify({ command }) + '\n'));
         socket.on('data', chunk => { response += chunk.toString('utf8'); });
@@ -92,7 +95,7 @@ export async function requestWebControl(command, path = webControlPath(), timeou
                 const parsed = JSON.parse(response);
                 if (!parsed.ok)
                     throw new FleetError(parsed.error?.code === 'rate_limited' ? 'rate_limited' : 'rejected', parsed.error?.message ?? 'local web control request was rejected');
-                finish();
+                finish(undefined, parsed.result);
             }
             catch (error) {
                 finish(error);

package/dist/web/prefix-gateway.d.ts

@@ -4,6 +4,7 @@ import type { WebAuth } from './auth.js';
 export interface ServiceTarget {
     prefix: string;
     origin: string;
+    upstreamPrefix?: string;
     /** Server-side service credentials; never taken from browser headers. */
     headers?: Record<string, string>;
     /** Dedicated credential-authenticated services reject direct browser context. */

package/dist/web/prefix-gateway.js

@@ -12,6 +12,8 @@ export function createPrefixGateway(options) {
         if (!/^\/[a-z][a-z0-9-]*$/.test(target.prefix) || target.prefix === '/fleet')
             throw new Error('invalid service prefix');
         const origin = new URL(target.origin);
+        if (target.upstreamPrefix && !/^\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]*$/.test(target.upstreamPrefix))
+            throw new Error('invalid upstream service prefix');
         if (!['http:', 'https:'].includes(origin.protocol) || origin.pathname !== '/' || origin.search || origin.hash || origin.username || origin.password)
             throw new Error('service target must be an HTTP origin');
         return { ...target, origin: origin.origin };
@@ -26,11 +28,11 @@ export function createPrefixGateway(options) {
         const service = services.find(x => path === x.prefix || path.startsWith(x.prefix + '/'));
         const fleet = path === '/fleet/api' || path.startsWith('/fleet/api/');
         return { service, page: !service && !fleet && !path.startsWith('/api/'), origin: service?.origin ?? options.fleetOrigin,
-            path: service ? (raw.slice(service.prefix.length) || '/').replace(/^\?/, '/?') : fleet ? raw.slice('/fleet'.length) : raw };
+            path: service ? (service.upstreamPrefix || '') + (raw.slice(service.prefix.length) || '/').replace(/^\?/, '/?') : fleet ? raw.slice('/fleet'.length) : raw };
     };
     const prepare = (req, upgrade = false) => {
         const route = select(req);
-        const request = { headers: req.headers, method: req.method };
+        const request = { headers: req.headers, method: req.method, url: route.path };
         if (!auth && (req.headers.origin || req.headers['sec-fetch-site'] || !route.service))
             throw new Error('machine-client listener rejects browser requests');
         auth?.validateBoundary(request, upgrade, route.page);
@@ -44,11 +46,11 @@ export function createPrefixGateway(options) {
             if (auth)
                 for (const name of ['cookie', 'authorization', 'x-csrf-token', 'x-ours-api-token'])
                     delete headers[name];
-            Object.assign(headers, route.service.headers);
             if (route.service.stripBrowserContext) {
                 for (const name of ['origin', 'sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest', 'sec-fetch-user'])
                     delete headers[name];
             }
+            Object.assign(headers, route.service.headers);
             headers.host = new URL(route.origin).host;
         }
         if (upgrade) {

package/dist/web/runtime.js

@@ -1,10 +1,15 @@
+import { validateAccountOrigin } from '../account-origin.js';
+import { startWorkspaceTunnel } from './workspace-tunnel.js';
+import { createPrefixGateway } from './prefix-gateway.js';
+import { readClientProfile } from '../client-profile.js';
+import { readPrivateFile } from '@ours.network/sdk/connector';
 import { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
 import { RoomLayoutService } from '../rooms-tasks/layout-service.js';
 import { spawn } from 'node:child_process';
 import { FleetNotificationProducer } from '../notifications/fleet-producer.js';
 import { producerConfig } from '../notifications/outbox.js';
 import { SubscriptionService } from '../subscriptions/service.js';
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, realpathSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from '../config.js';
 import { RoleRepository } from '../application/role-repository.js';
@@ -30,6 +35,7 @@ import { RoomLayoutDefinitions } from '../application/room-layout-definitions.js
 import { PresetProvenance } from '../application/preset-provenance.js';
 import { doctor } from '../doctor.js';
 import { acquireWebServerLock } from './lock.js';
+import { WorkspaceDeviceStore } from './workspace-devices.js';
 import { TrustedDeviceStore } from './device-store.js';
 import { WebAuth } from './auth.js';
 import { startWebControlServer } from './control.js';
@@ -62,12 +68,23 @@ export async function startWebConsole(options) {
     const lock = acquireWebServerLock(webDir);
     const bind = options.bind ?? '127.0.0.1';
     const publicOrigin = options.publicOrigin ? validatePublicOrigin(options.publicOrigin) : undefined;
+    const workspaceGateway = Boolean(publicOrigin && existsSync(resolve(stateRoot(), 'workspace', 'binding.json')));
     if (!isLoopback(bind) && !publicOrigin) {
         lock.release();
         throw new FleetError('forbidden', 'a non-loopback bind requires an explicit --public-origin');
     }
     const access = options.access ?? new WebAccessStore(webDir).read();
-    const auth = new WebAuth(publicOrigin?.origin ?? `http://127.0.0.1:${requestedPort}`, publicOrigin?.host ?? `127.0.0.1:${requestedPort}`, Date.now, new TrustedDeviceStore(webDir), access);
+    const bindingFile = resolve(stateRoot(), 'workspace', 'binding.json');
+    let appOrigin = 'https://app.ours.network';
+    try {
+        if (existsSync(bindingFile))
+            appOrigin = validateAccountOrigin(JSON.parse(readFileSync(bindingFile, 'utf8')).appOrigin ?? appOrigin);
+    }
+    catch (error) {
+        lock.release();
+        throw error;
+    }
+    const auth = new WebAuth(publicOrigin?.origin ?? `http://127.0.0.1:${requestedPort}`, publicOrigin?.host ?? `127.0.0.1:${requestedPort}`, Date.now, new TrustedDeviceStore(webDir), access, new WorkspaceDeviceStore(webDir), appOrigin);
     const backend = pickBackend();
     const repository = new RoleRepository({
         configPath: options.configPath,
@@ -199,7 +216,7 @@ export async function startWebConsole(options) {
     }
     let address;
     try {
-        address = await server.app.listen({ host: bind, port: requestedPort });
+        address = await server.app.listen({ host: workspaceGateway ? '127.0.0.1' : bind, port: workspaceGateway ? 0 : requestedPort });
     }
     catch (error) {
         await server.close();
@@ -210,11 +227,26 @@ export async function startWebConsole(options) {
     const localHost = `127.0.0.1:${actual.port}`;
     const browserOrigin = publicOrigin?.origin ?? `http://${localHost}`;
     const browserHost = publicOrigin?.host ?? localHost;
+    let gateway;
+    if (workspaceGateway)
+        try {
+            const profile = readClientProfile(), provider = new URL(profile.serverUrl), credential = readPrivateFile(profile.credentialPath, 4096).toString('utf8').trim();
+            const basePath = provider.pathname.replace(/\/$/, '');
+            const services = ['daemon', 'cowork', 'messenger'].map(name => ({ prefix: '/' + name, origin: provider.origin, upstreamPrefix: basePath + '/' + name, stripBrowserContext: true, headers: { 'X-Ours-Api-Token': credential, ...(name === 'messenger' ? { Origin: provider.origin, 'X-Ours-Messenger-CSRF': '1' } : name === 'cowork' ? { Origin: provider.origin } : {}) } }));
+            gateway = createPrefixGateway({ auth: server.auth, fleetOrigin: address, services });
+            await new Promise((resolve, reject) => { gateway.server.once('error', reject); gateway.server.listen(requestedPort, bind, () => { gateway.server.off('error', reject); resolve(); }); });
+        }
+        catch (error) {
+            await gateway?.close().catch(() => { });
+            await server.close();
+            lock.release();
+            throw error;
+        }
     server.auth.setBoundary(browserOrigin, browserHost, publicOrigin ? {
         // nginx's safe default uses the loopback upstream as Host. The declared
         // browser Origin remains mandatory for auth/mutations and WebSocket hello,
         // so operators do not need a fragile Host-rewrite incantation.
-        hosts: [localHost, `localhost:${actual.port}`],
+        hosts: [localHost, `localhost:${actual.port}`, ...(workspaceGateway ? [`127.0.0.1:${requestedPort}`, `localhost:${requestedPort}`] : [])],
     } : {
         hosts: [`localhost:${actual.port}`], origins: [`http://localhost:${actual.port}`],
     });
@@ -228,10 +260,12 @@ export async function startWebConsole(options) {
                         ? `${browserOrigin}/#bootstrap=${server.auth.mintBootstrap()}` : `${browserOrigin}/`;
                     openBrowser(url);
                 },
+                onLinkDevice() { return { version: 1, origin: browserOrigin, ...server.auth.workspaceEnrollment() }; },
                 onRevokeAll() { server.auth.revokeAllTrustedDevices(); },
             });
     }
     catch (error) {
+        await gateway?.close();
         await server.close();
         lock.release();
         throw error;
@@ -239,13 +273,30 @@ export async function startWebConsole(options) {
     if (options.open !== false)
         openBrowser(access.mode === 'pairing'
             ? `${browserOrigin}/#bootstrap=${server.auth.bootstrapSecret}` : `${browserOrigin}/`);
+    let stopTunnel;
+    try {
+        stopTunnel = startWorkspaceTunnel(browserOrigin);
+    }
+    catch (error) {
+        try {
+            await control?.close();
+            await gateway?.close();
+            await server.close();
+        }
+        finally {
+            lock.release();
+        }
+        throw error;
+    }
     const notifications = notificationConfig ? new FleetNotificationProducer([agentsRoot(), tmpRoot()], resolve(webDir, 'notification-outboxes'), notificationConfig, options.log) : undefined;
     return {
         ...server, address: browserOrigin,
         async close() {
             try {
+                await stopTunnel();
                 await notifications?.close();
                 await control?.close();
+                await gateway?.close();
                 await server.close();
             }
             finally {

package/dist/web/server.js

@@ -1,3 +1,7 @@
+import { readFileSync } from 'node:fs';
+import { packagedPresetRoot } from '../preset-bootstrap.js';
+import { validateCatalog } from '../init-wizard.js';
+import { getAdapter } from '../harness/registry.js';
 import { storeAgentAttachment, attachmentPrompt, MAX_ATTACHMENT_BODY, readAgentAttachment, prepareAttachmentPresentation, presentAttachmentEvent } from './agent-attachments.js';
 import { readChatIdle } from '../temp-idle.js';
 import { agentDir } from '../paths.js';
@@ -39,12 +43,21 @@ export async function buildWebServer(services, boundary, options = {}) {
         reply.header('X-Content-Type-Options', 'nosniff');
         reply.header('Referrer-Policy', 'no-referrer');
         reply.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=(), payment=()');
-        reply.header('X-Frame-Options', 'DENY');
+        // Only the configured account launcher may embed workspace pages.
         reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; frame-src 'self' blob:; ` +
             `connect-src 'self' ${auth.secureCookies ? 'wss' : 'ws'}://${auth.host}; object-src 'none'; base-uri 'none'; ` +
-            `frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'`);
+            `frame-ancestors 'self' ${auth.appOrigin}; form-action 'self'; manifest-src 'self'; worker-src 'self'`);
         if (request.url.startsWith('/api/'))
             reply.header('Cache-Control', 'no-store');
+        if (request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
+            reply.header('Access-Control-Allow-Origin', auth.appOrigin).header('Vary', 'Origin');
+            reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
+            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key');
+            if (request.method === 'OPTIONS') {
+                auth.validateBoundary(request, false);
+                return reply.code(204).send();
+            }
+        }
         try {
             auth.validateBoundary(request, false, !request.url.startsWith('/api/'));
         }
@@ -117,6 +130,20 @@ export async function buildWebServer(services, boundary, options = {}) {
         const session = auth.authenticate(request);
         return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
     });
+    app.get('/api/v1/workspace/identity', async () => auth.workspaceIdentity());
+    app.post('/api/v1/devices/enroll', async (request, reply) => {
+        reply.header('Cache-Control', 'no-store');
+        const input = request.body;
+        if (!input)
+            throw new FleetError('invalid_request', 'device enrollment body required');
+        return auth.enrollWorkspace(request, input);
+    });
+    app.post('/api/v1/devices/link', async (request) => {
+        const session = auth.authenticate(request, true);
+        return { version: 1, origin: auth.origin, ...auth.workspaceEnrollment(session.id) };
+    });
+    app.get('/api/v1/devices', async (request) => { auth.authenticate(request); return { devices: auth.listWorkspaceDevices() }; });
+    app.delete('/api/v1/devices/:id', async (request) => { auth.authenticate(request, true); auth.revokeWorkspaceDevice(request.params.id); return { revoked: true }; });
     app.get('/api/v1/meta', async (request) => {
         auth.authenticate(request);
         return {
@@ -127,6 +154,19 @@ export async function buildWebServer(services, boundary, options = {}) {
             auditDegraded: audit.degraded,
         };
     });
+    app.get('/api/v1/onboarding', async (request) => {
+        auth.authenticate(request);
+        const harnesses = await Promise.all(['codex', 'claude-code'].map(async (harness) => {
+            try {
+                return { harness, ...await getAdapter(harness).checkPrereqs() };
+            }
+            catch {
+                return { harness, ok: false, checks: [{ name: 'availability', ok: false, detail: 'Harness checks unavailable' }] };
+            }
+        }));
+        const catalog = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8')));
+        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator' };
+    });
     app.get('/api/v1/creation-capabilities', async (request) => {
         auth.authenticate(request);
         return services.creation.capabilities();

package/dist/web/workspace-devices.d.ts

@@ -0,0 +1,29 @@
+export interface WorkspaceDevice {
+    id: string;
+    label: string;
+    createdAt: number;
+    lastUsedAt: number;
+    expiresAt: number;
+    revokedAt: number | null;
+}
+export declare class WorkspaceDeviceStore {
+    private readonly now;
+    private readonly db;
+    readonly workspaceId: string;
+    constructor(dir?: string, now?: () => number);
+    mint(issuer?: string | null): {
+        enrollment: string;
+        workspaceId: string;
+        expiresAt: number;
+    };
+    enroll(enrollment: string, workspaceId: string, label: string): {
+        token: string;
+        device: WorkspaceDevice;
+        workspaceId: string;
+    };
+    authenticate(token: string): WorkspaceDevice;
+    valid(id: string): boolean;
+    list(): WorkspaceDevice[];
+    revoke(id: string): void;
+    close(): void;
+}

package/dist/web/workspace-devices.js

@@ -0,0 +1,84 @@
+import { createRequire } from 'node:module';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdirSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { FleetError } from '../application/errors.js';
+const opaque = () => randomBytes(32).toString('base64url');
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+export class WorkspaceDeviceStore {
+    now;
+    db;
+    workspaceId;
+    constructor(dir = join(stateRoot(), 'web'), now = Date.now) {
+        this.now = now;
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        chmodSync(dir, 0o700);
+        const path = join(dir, 'workspace-devices.db');
+        this.db = new DatabaseSync(path);
+        chmodSync(path, 0o600);
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;
+      CREATE TABLE IF NOT EXISTS metadata(key TEXT PRIMARY KEY,value TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS devices(id TEXT PRIMARY KEY,hash TEXT NOT NULL,label TEXT NOT NULL,createdAt INTEGER NOT NULL,lastUsedAt INTEGER NOT NULL,expiresAt INTEGER NOT NULL,revokedAt INTEGER);
+      CREATE TABLE IF NOT EXISTS enrollments(hash TEXT PRIMARY KEY,expiresAt INTEGER NOT NULL,issuer TEXT);`);
+        this.db.prepare('INSERT OR IGNORE INTO metadata VALUES(?,?)').run('workspaceId', opaque());
+        this.workspaceId = String(this.db.prepare('SELECT value FROM metadata WHERE key=?').get('workspaceId').value);
+    }
+    mint(issuer = null) {
+        const now = this.now(), enrollment = opaque(), expiresAt = now + 5 * 60000;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            this.db.prepare('DELETE FROM enrollments WHERE expiresAt<=?').run(now);
+            const count = Number(this.db.prepare('SELECT count(*) AS n FROM enrollments').get().n);
+            if (count >= 32)
+                throw new FleetError('rate_limited', 'too many pending device links');
+            this.db.prepare('INSERT INTO enrollments VALUES(?,?,?)').run(hash(enrollment), expiresAt, issuer);
+            this.db.exec('COMMIT');
+            return { enrollment, workspaceId: this.workspaceId, expiresAt };
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    enroll(enrollment, workspaceId, label) {
+        if (workspaceId !== this.workspaceId || typeof enrollment !== 'string' || !/^[\w-]{43}$/.test(enrollment))
+            throw new FleetError('unauthorized', 'invalid device enrollment');
+        if (typeof label !== 'string' || !label.trim() || label.length > 100 || /[\x00-\x1f\x7f]/.test(label))
+            throw new FleetError('invalid_request', 'device name must contain 1–100 printable characters');
+        const now = this.now(), id = opaque(), token = `${id}.${opaque()}`;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const code = this.db.prepare('DELETE FROM enrollments WHERE hash=? AND expiresAt>? RETURNING issuer').get(hash(enrollment), now);
+            if (!code)
+                throw new FleetError('unauthorized', 'device enrollment is expired or already used');
+            if (code.issuer && !this.db.prepare('SELECT id FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(code.issuer, now))
+                throw new FleetError('unauthorized', 'issuing device has been revoked');
+            const count = Number(this.db.prepare('SELECT count(*) AS n FROM devices WHERE revokedAt IS NULL AND expiresAt>?').get(now).n);
+            if (count >= 128)
+                throw new FleetError('rate_limited', 'authorized device limit reached');
+            const device = { id, label: label.trim(), createdAt: now, lastUsedAt: now, expiresAt: now + 90 * 86400000, revokedAt: null };
+            this.db.prepare('INSERT INTO devices VALUES(?,?,?,?,?,?,NULL)').run(id, hash(token), device.label, now, now, device.expiresAt);
+            this.db.exec('COMMIT');
+            return { token, device, workspaceId };
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    authenticate(token) {
+        const id = typeof token === 'string' ? token.split('.')[0] : '', now = this.now();
+        const row = this.db.prepare('SELECT * FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(id, now);
+        const supplied = Buffer.from(hash(token || '')), expected = Buffer.from(String(row?.hash || '0'.repeat(64)));
+        if (!row || !timingSafeEqual(supplied, expected))
+            throw new FleetError('unauthorized', 'workspace device is missing, expired, or revoked');
+        this.db.prepare('UPDATE devices SET lastUsedAt=? WHERE id=?').run(now, id);
+        return { id, label: String(row.label), createdAt: Number(row.createdAt), lastUsedAt: now, expiresAt: Number(row.expiresAt), revokedAt: null };
+    }
+    valid(id) { return Boolean(this.db.prepare('SELECT id FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(id, this.now())); }
+    list() { return this.db.prepare('SELECT id,label,createdAt,lastUsedAt,expiresAt,revokedAt FROM devices ORDER BY createdAt DESC LIMIT 256').all().map(row => ({ id: String(row.id), label: String(row.label), createdAt: Number(row.createdAt), lastUsedAt: Number(row.lastUsedAt), expiresAt: Number(row.expiresAt), revokedAt: row.revokedAt === null ? null : Number(row.revokedAt) })); }
+    revoke(id) { this.db.prepare('UPDATE devices SET revokedAt=? WHERE id=? AND revokedAt IS NULL').run(this.now(), id); this.db.prepare('DELETE FROM enrollments WHERE issuer=?').run(id); }
+    close() { this.db.close(); }
+}

package/dist/web/workspace-tunnel.d.ts

@@ -0,0 +1 @@
+export declare function startWorkspaceTunnel(origin: string): () => Promise<void>;

package/dist/web/workspace-tunnel.js

@@ -0,0 +1,32 @@
+import { spawn } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+export function startWorkspaceTunnel(origin) {
+    const dir = join(stateRoot(), 'workspace'), file = join(dir, 'tunnel.json');
+    if (!existsSync(file))
+        return async () => { };
+    const config = JSON.parse(readFileSync(file, 'utf8'));
+    if (config.origin !== origin)
+        throw Error('Workspace tunnel requires its configured public origin');
+    const tokenFile = join(dir, 'connector');
+    if (config.tokenFile !== tokenFile)
+        throw Error('Unexpected connector credential path');
+    const stat = lstatSync(tokenFile);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.())
+        throw Error('Connector credential must be an owned private file');
+    let stopped = false, child, timer, backoff = 1000;
+    const launch = () => {
+        if (stopped)
+            return;
+        child = spawn('cloudflared', ['tunnel', '--no-autoupdate', 'run', '--token-file', tokenFile], { stdio: 'ignore' });
+        let scheduled = false;
+        const retry = () => { if (scheduled || stopped)
+            return; scheduled = true; timer = setTimeout(launch, backoff); backoff = Math.min(30000, backoff * 2); };
+        child.once('error', retry);
+        child.once('exit', retry);
+    };
+    launch();
+    return async () => { stopped = true; clearTimeout(timer); const current = child; if (!current || current.exitCode !== null)
+        return; await new Promise(resolve => { const timeout = setTimeout(() => { current.kill('SIGKILL'); resolve(); }, 5000); current.once('exit', () => { clearTimeout(timeout); resolve(); }); current.kill('SIGTERM'); }); };
+}

package/dist/workspace-enrollment.d.ts

@@ -0,0 +1,24 @@
+export interface WorkspacePayload {
+    version: 1;
+    appOrigin: string;
+    hostname: string;
+    rootName: string;
+    name: string;
+    surname: string;
+    connectorToken: string;
+    invitation: string;
+    serverCid: string;
+    challenge: {
+        nonce: string;
+        workspaceId: string;
+        accountId: string;
+        expiresAt: number;
+    };
+}
+export declare function readWorkspacePayload(file: string): WorkspacePayload;
+export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
+    migrateAppOrigin?: boolean;
+}): Promise<{
+    origin: string;
+    hostWorkspaceId: string;
+}>;

package/dist/workspace-enrollment.js

@@ -0,0 +1,109 @@
+import { validateAccountOrigin } from './account-origin.js';
+import { lstatSync, readFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { readClientProfile } from './client-profile.js';
+import { stateRoot, defaultConfigPath } from './paths.js';
+import { replaceFileAtomically } from './atomic-file.js';
+import { loadConfig, splitRootFor } from './config.js';
+import { stringify } from 'yaml';
+import { WebAccessStore } from './web/access.js';
+import { WorkspaceDeviceStore } from './web/workspace-devices.js';
+export function readWorkspacePayload(file) {
+    const path = resolve(file), stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0 || stat.size > 32768)
+        throw Error('Setup payload requires an owned private regular file (chmod 600)');
+    let p;
+    try {
+        p = JSON.parse(Buffer.from(readFileSync(path, 'utf8').trim(), 'base64url').toString());
+    }
+    catch {
+        throw Error('Invalid workspace payload');
+    }
+    if (p.version !== 1 || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || p.challenge.expiresAt <= Date.now() || p.challenge.expiresAt > Date.now() + 16 * 60000)
+        throw Error('Workspace payload is invalid or expired');
+    for (const k of ['connectorToken', 'invitation', 'name', 'surname'])
+        if (typeof p[k] !== 'string' || !p[k] || p[k].length > 8192 || /[\x00-\x1f\x7f]/.test(p[k]))
+            throw Error('Invalid workspace payload');
+    return p;
+}
+export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+    const profile = readClientProfile();
+    const base = new URL(profile.endpoint);
+    base.pathname = base.pathname.replace(/\/daemon\/?$/, '/messenger/');
+    if (!base.pathname.endsWith('/messenger/'))
+        throw Error('Workspace setup requires the supported gateway client profile');
+    const secret = readFileSync(profile.credentialPath, 'utf8').trim();
+    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(15000), redirect: 'error' }); if (!response.ok) {
+        await response.body?.cancel();
+        throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
+    } return response.json(); };
+    if (new WebAccessStore().read().mode === 'none')
+        throw Error('Workspace enrollment requires protected web access; enable pairing or password before setup');
+    const dir = join(stateRoot(), 'workspace');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const appOrigin = validateAccountOrigin(payload.appOrigin);
+    const previousFile = join(dir, 'binding.json');
+    let migrating = false;
+    if (existsSync(previousFile)) {
+        const previous = JSON.parse(readFileSync(previousFile, 'utf8'));
+        if (previous.workspaceId !== payload.challenge.workspaceId)
+            throw Error('This host is already associated with another workspace');
+        const priorOrigin = validateAccountOrigin(previous.appOrigin ?? 'https://app.ours.network');
+        migrating = priorOrigin !== appOrigin;
+        if (migrating && !options.migrateAppOrigin)
+            throw Error('Account origin change requires explicit --migrate-app-origin and a fresh setup payload');
+        if (migrating && previous.serverCid && previous.serverCid.toUpperCase() !== payload.serverCid.toUpperCase())
+            throw Error('Account origin migration must retain the enrollment server identity');
+    }
+    const loaded = loadConfig(configuration);
+    if (loaded.rooms?.defaults?.attach_owner === false)
+        throw Error('Existing rooms.defaults.attach_owner is disabled; enable automatic Human Owner admission before workspace setup');
+    if (loaded.rooms && !loaded.rooms.owner.public_invite_file)
+        throw Error('Existing room owner configuration must be reviewed before workspace enrollment');
+    const identity = await request('workspace/enrollment-identity');
+    if (!/^[a-f0-9]{64}$/i.test(identity.cid))
+        throw Error('Bound Messenger identity unavailable');
+    if (loaded.rooms && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
+        throw Error('Retained room owner CID conflicts with the Human root');
+    const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
+    if (existsSync(inviteFile)) {
+        const stat = lstatSync(inviteFile);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.nlink !== 1 || (stat.mode & 0o077) !== 0)
+            throw Error('Retained Owner invitation file must be owned and private');
+    }
+    const devices = new WorkspaceDeviceStore();
+    const hostWorkspaceId = devices.workspaceId;
+    devices.close();
+    const result = await request('workspace/enroll', { ...payload, hostWorkspaceId });
+    if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
+        throw Error('Malformed workspace enrollment response');
+    if (loaded.rooms && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+        throw Error('Retained room owner CID conflicts with the Human root');
+    if (migrating) {
+        const deadline = Date.now() + 15000;
+        while (true) {
+            const response = await fetch(appOrigin + '/account-api/workspace-proof', { method: 'POST', headers: { Origin: appOrigin, 'Content-Type': 'application/json' }, credentials: 'omit', redirect: 'error', signal: AbortSignal.timeout(5000), body: JSON.stringify({ ...payload.challenge, hostWorkspaceId, rootCid: result.rootCid }) });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw Error('Account origin migration proof was rejected; local trust unchanged');
+            }
+            const receipt = await response.json();
+            if (receipt.verified === true)
+                break;
+            if (Date.now() >= deadline)
+                throw Error('Account origin migration proof is not confirmed; local trust unchanged');
+            await new Promise(resolve => setTimeout(resolve, 500));
+        }
+    }
+    replaceFileAtomically(inviteFile, result.ownerInvite + '\n', 0o600);
+    const split = splitRootFor(configuration);
+    mkdirSync(split, { recursive: true, mode: 0o700 });
+    if (!loaded.rooms)
+        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify({ rooms: { owner: { provider: 'messenger-server', expected_cid: result.rootCid, public_invite_file: inviteFile, role: 'Owner' }, defaults: { attach_owner: true, close_when_task_done: true } } }), 0o600);
+    replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
+    const origin = `https://${payload.hostname}`;
+    replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
+    replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase() }) + '\n', 0o600);
+    loadConfig(configuration);
+    return { origin, hostWorkspaceId };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.25",
+  "version": "1.2.0-nightly.26",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -23,7 +23,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=22.13.0"
   },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
@@ -46,6 +46,7 @@
     "@ours.network/sdk": "3.8.1-nightly.15",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
+    "qrcode": "1.5.4",
     "secure-json-parse": "^4.1.0",
     "ws": "^8.18.3",
     "yaml": "^2.5.0"
@@ -56,7 +57,8 @@
   },
   "devDependencies": {
     "@ours.network/daemon": "3.8.1-nightly.7",
-    "@types/node": "^20.14.0",
+    "@types/node": "^22.20.4",
+    "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",
     "typescript": "^5.5.0",
     "vitest": "^2.0.0"