@ours.network/fleet 1.2.0-nightly.29 → 1.2.0-nightly.30

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.29",
-  "buildId": "cc1740d5df7b",
-  "commit": "e4737a56d25b0244222bd94b25c299825b8f916f",
+  "version": "1.2.0-nightly.30",
+  "buildId": "a2babf441212",
+  "commit": "3cd486a81e62d5bd2c345c0d73cb443aee02dee1",
   "dirty": true,
-  "builtAt": "2026-10-01T10:23:02.435Z",
+  "builtAt": "2026-10-01T21:40:11.246Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/cli.js

@@ -1544,7 +1544,7 @@ cOpt(program.command('workspace-enroll').description('enroll this host using a p
         const controlDeadline = Date.now() + 20000;
         while (!existsSync(webControlPath())) {
             if (Date.now() >= controlDeadline)
-                throw Error('Workspace console is still starting; run ours-fleet link-device when ready');
+                throw Error('Fleet backend did not become ready within 20 seconds. Run ours-fleet web status; on Linux inspect journalctl --user -u ours-fleet-web.service -n 25 --no-pager. Resolve the startup error before running ours-fleet link-device');
             await new Promise(resolve => setTimeout(resolve, 200));
         }
         const link = await requestWebControl('link-device');

package/dist/web/service.d.ts

@@ -1,6 +1,7 @@
 import { type Exec } from '../exec.js';
 export declare const WEB_SYSTEMD_UNIT = "ours-fleet-web.service";
 export declare const WEB_LAUNCHD_LABEL = "network.ours.fleet.web";
+type ServiceEnvironment = Partial<Record<'OURS_CONFIG' | 'OURS_FLEET_HOME' | 'PATH', string>>;
 interface ServiceMetadata {
     version: 3;
     platform: 'linux' | 'darwin';
@@ -10,6 +11,7 @@ interface ServiceMetadata {
     configuration?: string;
     bind?: string;
     publicOrigin?: string;
+    environment?: ServiceEnvironment;
 }
 export interface WebServiceOptions {
     platform?: NodeJS.Platform;
@@ -18,6 +20,7 @@ export interface WebServiceOptions {
     stateDir?: string;
     uid?: number;
     runtimeExecutable?: string;
+    environment?: NodeJS.ProcessEnv;
 }
 export declare class WebServiceManager {
     private readonly platform;
@@ -26,6 +29,7 @@ export declare class WebServiceManager {
     private readonly stateDir;
     private readonly uid;
     private readonly runtimeExecutable;
+    private readonly environment;
     constructor(options?: WebServiceOptions);
     get metadataPath(): string;
     get definitionPath(): string;
@@ -45,9 +49,9 @@ export declare class WebServiceManager {
 export declare function systemdUnit(runtime: string, script: string, port: number, configuration?: string, web?: {
     bind?: string;
     publicOrigin?: string;
-}): string;
+}, environment?: ServiceEnvironment): string;
 export declare function launchdPlist(runtime: string, script: string, port: number, configuration?: string, web?: {
     bind?: string;
     publicOrigin?: string;
-}): string;
+}, environment?: ServiceEnvironment): string;
 export {};

package/dist/web/service.js

@@ -15,6 +15,7 @@ export class WebServiceManager {
     stateDir;
     uid;
     runtimeExecutable;
+    environment;
     constructor(options = {}) {
         const platform = options.platform ?? process.platform;
         if (platform !== 'linux' && platform !== 'darwin')
@@ -25,6 +26,7 @@ export class WebServiceManager {
         this.stateDir = options.stateDir ?? join(stateRoot(), 'web');
         this.uid = options.uid ?? process.getuid?.() ?? 501;
         this.runtimeExecutable = options.runtimeExecutable ?? process.execPath;
+        this.environment = serviceEnvironment(options.environment ?? process.env);
     }
     get metadataPath() { return join(this.stateDir, 'service.json'); }
     get definitionPath() {
@@ -42,13 +44,14 @@ export class WebServiceManager {
         const config = configuration ? resolve(configuration) : undefined;
         const metadata = {
             version: VERSION, platform: this.platform, runtime, script: resolvedScript, port,
+            environment: this.environment,
             ...(config ? { configuration: config } : {}),
             ...(web.bind ? { bind: web.bind } : {}),
             ...(web.publicOrigin ? { publicOrigin: web.publicOrigin } : {}),
         };
         replaceFileAtomically(this.definitionPath, this.platform === 'linux'
-            ? systemdUnit(runtime, resolvedScript, port, config, web)
-            : launchdPlist(runtime, resolvedScript, port, config, web), 0o600);
+            ? systemdUnit(runtime, resolvedScript, port, config, web, this.environment)
+            : launchdPlist(runtime, resolvedScript, port, config, web, this.environment), 0o600);
         replaceFileAtomically(this.metadataPath, JSON.stringify(metadata, null, 2) + '\n', 0o600);
         if (this.platform === 'linux') {
             await this.must('systemctl', ['--user', 'daemon-reload']);
@@ -159,19 +162,20 @@ function validatePort(port) {
 function systemdQuote(value) {
     return `"${value.replace(/[%\\"]/g, char => char === '%' ? '%%' : `\\${char}`)}"`;
 }
-export function systemdUnit(runtime, script, port, configuration, web = {}) {
+export function systemdUnit(runtime, script, port, configuration, web = {}, environment = {}) {
     const config = configuration ? ` --configuration ${systemdQuote(configuration)}` : '';
     const access = `${web.bind ? ` --bind ${systemdQuote(web.bind)}` : ''}`
         + `${web.publicOrigin ? ` --public-origin ${systemdQuote(web.publicOrigin)}` : ''}`;
     return `[Unit]\nDescription=ours-fleet localhost web console\nAfter=default.target\n\n`
         + `[Service]\nType=simple\nExecStart=${systemdQuote(runtime)} ${systemdQuote(script)} web serve --port ${port} --no-open${config}${access}\n`
+        + Object.entries(serviceEnvironment(environment)).map(([key, value]) => `Environment=${systemdQuote(`${key}=${value}`)}\n`).join('')
         + `Restart=on-failure\nRestartSec=5\nTimeoutStopSec=15\n\n`
         + `[Install]\nWantedBy=default.target\n`;
 }
 const xml = (value) => value.replace(/[&<>"']/g, char => ({
     '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;',
 }[char]));
-export function launchdPlist(runtime, script, port, configuration, web = {}) {
+export function launchdPlist(runtime, script, port, configuration, web = {}, environment = {}) {
     const config = configuration
         ? `<string>--configuration</string><string>${xml(configuration)}</string>` : '';
     const access = `${web.bind ? `<string>--bind</string><string>${xml(web.bind)}</string>` : ''}`
@@ -181,6 +185,20 @@ export function launchdPlist(runtime, script, port, configuration, web = {}) {
         + `<plist version="1.0"><dict>\n<key>Label</key><string>${WEB_LAUNCHD_LABEL}</string>\n`
         + `<key>ProgramArguments</key><array><string>${xml(runtime)}</string><string>${xml(script)}</string><string>web</string>`
         + `<string>serve</string><string>--port</string><string>${port}</string><string>--no-open</string>${config}${access}</array>\n`
+        + `<key>EnvironmentVariables</key><dict>${Object.entries(serviceEnvironment(environment)).map(([key, value]) => `<key>${key}</key><string>${xml(value)}</string>`).join('')}</dict>\n`
         + `<key>RunAtLoad</key><true/><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n`
         + `<key>ProcessType</key><string>Background</string>\n</dict></plist>\n`;
 }
+// Retain only profile/tool paths, never inherited credentials or arbitrary environment.
+function serviceEnvironment(source) {
+    const result = {};
+    for (const key of ['OURS_CONFIG', 'OURS_FLEET_HOME', 'PATH']) {
+        const value = source[key];
+        if (!value)
+            continue;
+        if (/[\r\n\0]/.test(value))
+            throw new FleetError('invalid_request', `invalid service path setting: ${key}`);
+        result[key] = key === 'PATH' ? value : resolve(value);
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.29",
+  "version": "1.2.0-nightly.30",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",