@ours.network/fleet 1.2.0-nightly.30 → 1.2.0-nightly.32

package/dist/web-app/sw.js

@@ -0,0 +1,221 @@
+// build.mjs replaces this stamp on every release so browsers always see
+// different service-worker bytes.
+// This worker deliberately caches no application shell: keeping an old HTML
+// document and hashed JS chunks in Cache Storage can strand an installed PWA
+// on a blank screen during a deployment.
+const SW_BUILD = '21b1610c125e41982803ecc8c389c169dd1252c4';
+function workerBase() {
+  try { return new URL(self.registration.scope).pathname; } catch { return '/'; }
+}
+function inWorkerScope(url, origin) {
+  try { const parsed = new URL(url); return parsed.origin === origin && parsed.pathname.startsWith(workerBase()); } catch { return false; }
+}
+const FOREGROUND_HEARTBEAT_FRESH_MS = 30_000;
+let lastVisibility = null;
+let lastIOSStandalone = false;
+
+// WindowClient.visibilityState is not authoritative on mobile PWAs. Suppress
+// only when a page-owned heartbeat is fresh and explicitly visible. Installed
+// iOS always shows because its service worker can be torn down between events.
+function shouldSuppressNotification(clientList, visibility, now, freshMs, iosStandalone) {
+  if (!clientList || clientList.length === 0 || iosStandalone) return false;
+  const current = visibility === undefined ? lastVisibility : visibility;
+  const time = now === undefined ? Date.now() : now;
+  const fresh = freshMs === undefined ? FOREGROUND_HEARTBEAT_FRESH_MS : freshMs;
+  return !!current && time - current.ts <= fresh && current.state === 'visible';
+}
+
+function queryClientsVisible(clientList, timeoutMs) {
+  if (!clientList || clientList.length === 0) return Promise.resolve(false);
+  const timeout = typeof timeoutMs === 'number' ? timeoutMs : 400;
+  return new Promise((resolve) => {
+    let replies = 0;
+    let visible = false;
+    let iosStandalone = false;
+    let settled = false;
+    const ports = [];
+    let timer;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      for (const port of ports) { try { port.close(); } catch { /* closed */ } }
+      resolve(visible && !iosStandalone);
+    };
+    const replied = (data) => {
+      replies++;
+      if (data?.iosStandalone === true) iosStandalone = true;
+      if (data?.state === 'visible') visible = true;
+      if (replies >= clientList.length) finish();
+    };
+    for (const client of clientList) {
+      try {
+        const channel = new MessageChannel();
+        ports.push(channel.port1);
+        channel.port1.onmessage = (event) => replied(event.data);
+        client.postMessage({ type: 'ours-visibility-query' }, [channel.port2]);
+      } catch {
+        replied(null);
+      }
+    }
+    timer = setTimeout(finish, timeout);
+  });
+}
+
+function safeNotificationUrl(value, origin) {
+  if (typeof value !== 'string' || !value.startsWith('/') || value.startsWith('//')) return workerBase() + 'chats';
+  try {
+    const parsed = new URL(value, origin);
+    if (parsed.origin !== origin || !parsed.pathname.startsWith('/')) return workerBase() + 'chats';
+    const base = workerBase();
+    const pathname = base !== '/' && parsed.pathname.startsWith('/chats') ? base + parsed.pathname.slice(1) : parsed.pathname;
+    if (!pathname.startsWith(base)) return base + 'chats';
+    return pathname + parsed.search + parsed.hash;
+  } catch {
+    return workerBase() + 'chats';
+  }
+}
+
+function selectClickTarget(clientList, origin, targetUrl) {
+  const safe = (clientList || []).filter((client) => {
+    return inWorkerScope(client.url, origin);
+  });
+  if (targetUrl) {
+    const target = new URL(targetUrl, origin).href;
+    const exact = safe.find((client) => client.url === target);
+    if (exact) return exact;
+  }
+  return safe.find((client) => client.focused) || safe[0] || null;
+}
+
+function selectForegroundClient(clientList, origin) {
+  const safe = (clientList || []).filter((client) => {
+    return inWorkerScope(client.url, origin);
+  });
+  return safe.find((client) => client.visibilityState === 'visible') || safe[0] || null;
+}
+
+function safeText(value, fallback, max) {
+  return typeof value === 'string' && value.trim() ? value.slice(0, max) : fallback;
+}
+
+// Activate immediately, claim existing windows, and purge every legacy
+// app-shell cache. HTML and hashed bundles then
+// always come from the server's current immutable release.
+self.addEventListener('install', () => {
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    await self.clients.claim();
+    try {
+      const keys = await caches.keys();
+      await Promise.all(keys.map(async (key) => {
+        const cache = await caches.open(key);
+        for (const request of await cache.keys()) {
+          const url = new URL(request.url), base = workerBase(), path = url.pathname.slice(base.length);
+          if (url.origin === self.location.origin && url.pathname.startsWith(base) &&
+            (path === '' || path === 'index.html' || path === 'fleet-index.html' || path === 'fleet' || path.startsWith('fleet/') || path.startsWith('assets/')))
+            await cache.delete(request);
+        }
+      }));
+    } catch { /* Cache API may be unavailable; nothing to purge. */ }
+    try {
+      const windows = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+      for (const client of windows.filter(client => inWorkerScope(client.url, self.location.origin))) client.postMessage({ type: 'ours-sw-activated', build: SW_BUILD });
+    } catch { /* no clients */ }
+  })());
+});
+
+self.addEventListener('message', (event) => {
+  const data = event.data;
+  if (data?.type === 'SKIP_WAITING') {
+    self.skipWaiting();
+    return;
+  }
+  if (data?.type === 'ours-visibility' && (data.state === 'visible' || data.state === 'hidden')) {
+    lastVisibility = { state: data.state, ts: typeof data.ts === 'number' ? data.ts : Date.now() };
+    lastIOSStandalone = data.iosStandalone === true;
+    return;
+  }
+  if (data?.type === 'ours-clear-notifications') {
+    event.waitUntil((async () => {
+      const notifications = await self.registration.getNotifications();
+      for (const notification of notifications) notification.close();
+      if ('clearAppBadge' in self.navigator) await self.navigator.clearAppBadge().catch(() => {});
+    })());
+  }
+});
+
+self.addEventListener('push', (event) => {
+  let payload = {};
+  try { payload = event.data ? event.data.json() : {}; } catch { payload = {}; }
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) payload = {};
+  const title = safeText(payload.title, 'ours messenger', 160);
+  const body = safeText(payload.body, 'Open messenger to view the update.', 512);
+  const url = safeNotificationUrl(payload.url, self.location.origin);
+  const tag = payload.kind === 'notification' && typeof payload.notification_id === 'string' ? `ours-${payload.notification_id.slice(0, 256)}` : typeof payload.wire_id === 'string' && payload.wire_id
+    ? `ours-${payload.wire_id.slice(0, 256)}` : undefined;
+  event.waitUntil(self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(async (clientList) => {
+    if (payload.kind === 'notification') for (const client of clientList) client.postMessage({ type: 'ours-push-inbox-changed' });
+    const suppress = shouldSuppressNotification(clientList, undefined, undefined, undefined, lastIOSStandalone)
+      || await queryClientsVisible(clientList);
+    if (suppress) {
+      selectForegroundClient(clientList, self.location.origin)?.postMessage({
+        type: 'ours-push-foreground', kind: payload.kind,
+        contact_id: payload.contact_id, wire_id: payload.wire_id,
+      });
+      return;
+    }
+    await self.registration.showNotification(title, {
+      body, icon: workerBase() + 'icons/icon-192.png', badge: workerBase() + 'icons/icon-192.png', tag, data: { url },
+    });
+    if ('setAppBadge' in self.navigator) {
+      const notifications = await self.registration.getNotifications();
+      await self.navigator.setAppBadge(notifications.length).catch(() => {});
+    }
+  }));
+});
+
+self.addEventListener('pushsubscriptionchange', (event) => {
+  event.waitUntil(self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then((clientList) => {
+    for (const client of clientList) client.postMessage({ type: 'ours-push-repair-required' });
+  }));
+});
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const url = safeNotificationUrl(event.notification.data?.url, self.location.origin);
+  event.waitUntil(self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(async (clientList) => {
+    const target = selectClickTarget(clientList, self.location.origin, url);
+    if (target) {
+      const desired = new URL(url, self.location.origin).href;
+      if (target.url !== desired && 'navigate' in target) await target.navigate(desired);
+      return target.focus();
+    }
+    return self.clients.openWindow(url);
+  }));
+});
+
+// Credentials are never cached or persisted; separate tunnel origins cannot share them.
+const workspaceCredentials = new Map();
+self.addEventListener('message', event => {
+  if (event.data?.type !== 'ours.workspace.credential' || !event.source?.id) return;
+  const sourceUrl=new URL(event.source.url);
+  if(sourceUrl.origin!==self.location.origin || sourceUrl.searchParams.get('workspace-frame')!=='1')return;
+  if (typeof event.data.token === 'string' && event.data.token) workspaceCredentials.set(event.source.id,event.data.token);
+  else workspaceCredentials.delete(event.source.id);
+  event.ports[0]?.postMessage({ready:true});
+  event.waitUntil(self.clients.matchAll({type:'window',includeUncontrolled:true}).then(clients=>{const live=new Set(clients.map(client=>client.id));for(const id of workspaceCredentials.keys())if(!live.has(id))workspaceCredentials.delete(id);}));
+});
+self.addEventListener('fetch', event => {
+  const url = new URL(event.request.url);
+  if (url.origin !== self.location.origin || !url.pathname.startsWith('/messenger/api/media/')) return;
+  const token = workspaceCredentials.get(event.clientId);
+  if (!token) return;
+  const headers = new Headers(event.request.headers);headers.set('Authorization','Bearer '+token);
+  // Native media requests use no-cors, whose header guard strips Authorization.
+  // The URL was checked above, so a same-origin worker request can carry it.
+  event.respondWith(fetch(new Request(event.request,{headers,mode:'same-origin',cache:'no-store',credentials:'omit'})));
+});

package/dist/web-app/version.json

@@ -0,0 +1 @@
+{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T08:00:39.873Z"}

package/dist/web-app/workspace-install.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Personalised payload is read from stdin and never logged or passed in argv.
+set -euo pipefail
+umask 077
+set +x
+case "${1:-}" in ''|--check) ;; *) echo 'Unsupported bootstrap option' >&2; exit 2;; esac
+check_only=${1:-}
+if [[ $check_only != --check ]]; then
+  IFS= read -r payload
+  [[ ${#payload} -le 32768 && $payload =~ ^[A-Za-z0-9_-]+$ ]] || { echo 'Invalid workspace payload' >&2; exit 1; }
+fi
+missing=()
+for binary in node npm curl cloudflared; do
+  command -v "$binary" >/dev/null || missing+=("$binary")
+done
+if [[ ${#missing[@]} != 0 ]]; then
+  printf 'Missing prerequisites: %s. Install these manually or ask your agent, then retry.\n' "${missing[*]}" >&2
+  exit 1
+fi
+node -e 'if(Number(process.versions.node.split(".")[0])<22){console.error("Node.js 22 or newer is required. Install it manually or ask your agent, then retry.");process.exit(1)}'
+cloudflared --version >/dev/null
+if [[ -z ${OURS_CONFIG:-} && ! -e "$HOME/.ours-client/profile.json" && ! -e "$HOME/.ours-network/workspace/installation.json" ]]; then
+  if ! command -v docker >/dev/null; then
+    echo 'Missing fresh-server prerequisites: docker. Install Docker and Docker Compose 2.35 or newer, configure access for your normal user, then retry.' >&2
+    exit 1
+  fi
+  if ! docker info --format '{{.ServerVersion}}' >/dev/null 2>&1; then
+    echo 'Docker is not reachable as your normal user. Start Docker and configure user access, then retry without running this installer as root.' >&2
+    exit 1
+  fi
+  if ! docker compose version --short >/dev/null 2>&1; then
+    echo 'Docker Compose plugin is missing. Install Docker Compose 2.35 or newer, then retry.' >&2
+    exit 1
+  fi
+fi
+# Install only Ours packages in an isolated user prefix. Host prerequisites and
+# existing host CLI installations are never installed or upgraded by this script.
+export NPM_CONFIG_PREFIX="$HOME/.local/share/ours-bootstrap/tools"
+export PATH="$NPM_CONFIG_PREFIX/bin:$HOME/.local/bin:$PATH"
+echo 'Preparing Ours tools…'
+npm install --global --no-audit --no-fund @ours.network/install@1.2.1-nightly.23 @ours.network/fleet@1.2.0-nightly.31
+# Starter configuration only: the browser checks installed/authenticated harnesses
+# and asks for actual model choices before any FleetCoordinator is started.
+fleet_settings="$HOME/.local/share/ours-bootstrap/fleet-init.json"
+mkdir -p "$HOME/.local/share/ours-bootstrap"
+node --input-type=module - "$fleet_settings" <<'OURS_FLEET_SETTINGS'
+import {readFileSync,writeFileSync} from 'node:fs';
+import {join} from 'node:path';
+import {pathToFileURL} from 'node:url';
+const root=join(process.env.NPM_CONFIG_PREFIX,'lib/node_modules/@ours.network/fleet');
+const catalog=JSON.parse(readFileSync(join(root,'presets/brain-catalog.json'),'utf8'));
+const model=catalog.models.find(value=>value.harness==='codex' && value.session==='acp' && value.model==='gpt-6.1-sol');
+if(!model)throw Error('Published Fleet starter model is missing');
+const path=process.argv[2];
+writeFileSync(path,JSON.stringify({subscriptions:['codex'],assignmentStrategy:'one-model',models:{development:model,review:model,coordination:model},reasoning:'balanced'}),{mode:0o600});
+const {readInitSettings}=await import(pathToFileURL(join(root,'dist/init-wizard.js')));
+readInitSettings(path);
+OURS_FLEET_SETTINGS
+cloudflared --version
+ours-fleet workspace-enroll --help >/dev/null
+ours-install --help >/dev/null
+mkdir -p "$HOME/.local/bin"
+# Offer host commands on fresh hosts without replacing an existing CLI.
+offer_host_commands() {
+  for binary in ours-install ours-fleet ours; do
+    if [[ -x "$NPM_CONFIG_PREFIX/bin/$binary" && ! -e "$HOME/.local/bin/$binary" && ! -L "$HOME/.local/bin/$binary" ]] && ! PATH="${PATH#*:}" command -v "$binary" >/dev/null 2>&1; then
+      ln -s "$NPM_CONFIG_PREFIX/bin/$binary" "$HOME/.local/bin/$binary"
+    fi
+  done
+}
+offer_host_commands
+# Server setup acquires the verified ours client later. Expose it even when a
+# subsequent enrollment step fails, without replacing an existing host command.
+trap 'offer_host_commands' EXIT
+# Use the published installer's own profile validation and recorded-engine preflight.
+# Its disposable capability project runs before redeeming the personal command.
+installation_kind=$(node --input-type=module <<'OURS_HOST_CHECK'
+import {join} from 'node:path';
+import {existsSync} from 'node:fs';
+import {pathToFileURL} from 'node:url';
+const root=join(process.env.NPM_CONFIG_PREFIX,'lib/node_modules/@ours.network/install');
+const {realEffects}=await import(pathToFileURL(join(root,'lib/effects.mjs')));
+const {validateInstallation}=await import(pathToFileURL(join(root,'lib/plan.mjs')));
+const effects=realEffects({out:()=>{},write:()=>{}});
+const managed=effects.readManagedClientProfile();
+if(process.env.OURS_CONFIG || managed){
+  if(process.env.OURS_CONFIG && !effects.readProfile(process.env.OURS_CONFIG))throw Error('Existing OURS_CONFIG must select a complete gateway client profile');
+  process.stdout.write('existing');
+}else{
+  const state=join(effects.home,'.ours-network','workspace');
+  const pending=existsSync(join(effects.home,'.ours-client','workspace-setup-pending.json'));
+  if(existsSync(join(process.env.OURS_FLEET_HOME || effects.home,'fleet.yaml')) && !pending)throw Error('Existing Fleet configuration needs its gateway client profile; no new root was created');
+  const retained=effects.readJson(join(state,'installation.json'));
+  if(retained && !pending)throw Error('Existing server needs its gateway client profile; no new root was created');
+  // Never construct a new installation over a partial retry. The actual wrapper
+  // validates the private pending marker/account before any provisioning.
+  const record=retained ? validateInstallation(retained,state) : {mode:'docker',containerEngine:'docker',project:'ours-account-prerequisite-probe'};
+  try {
+    await effects.serverPreflight(record,'install',{existing:Boolean(retained)});
+  } catch (error) {
+    const message=String(error?.message || 'Host compatibility check failed');
+    if (/systemctl --user is-enabled podman-restart\.service exited \d+: disabled/.test(message)) {
+      console.error('Podman reboot recovery is disabled. Run this as your normal user, then retry:');
+      console.error('  systemctl --user enable podman-restart.service');
+    } else {
+      console.error('Your host is not ready for installation: '+message);
+      console.error('Use the manual setup Help in your account to resolve this prerequisite, then retry.');
+    }
+    console.error('Your personal setup code has not been used.');
+    process.exit(1);
+  }
+  process.stdout.write(retained ? (record.containerEngine==='podman' ? 'retry-podman' : 'retry-docker') : 'fresh');
+}
+OURS_HOST_CHECK
+)
+setup_options=()
+if [[ $installation_kind == fresh || $installation_kind == retry-docker ]]; then setup_options=(--mode docker --container-engine docker); fi
+if [[ $installation_kind == retry-podman ]]; then setup_options=(--mode docker --container-engine podman); fi
+if [[ $check_only == --check ]]; then
+  echo 'BOOTSTRAP_PREREQUISITES_PASS: Node22+, cloudflared, pinned Ours tools and validated fresh Docker or retained existing profile. Workspace installation not executed.'
+  exit 0
+fi
+# Redeem only after prerequisites are available. The capability and response are
+# stdin/body-only, never process arguments, URLs or bootstrap output.
+payload=$(printf '%s\n' "$payload" | node --input-type=module -e '
+import {readFileSync} from "node:fs";
+const stop=message=>{console.error("Ours setup: "+message);process.exit(1);};
+try {
+  const input=readFileSync(0,"utf8").trim();
+  let value;
+  try { value=JSON.parse(Buffer.from(input,"base64url").toString()); } catch { stop("Invalid installation command. Copy a fresh command from your account."); }
+  if(value?.version!==2 || !["https://app.ours.network","https://app.ours-tunnel.com"].includes(value.appOrigin) || !/^[A-Za-z0-9_-]{43}$/.test(value.code) || !Number.isSafeInteger(value.expiresAt))stop("Invalid installation command. Copy a fresh command from your account.");
+  if(value.expiresAt<=Date.now())stop("This installation command has expired. Open this workspace in your account and copy a fresh command. Your existing installation is preserved.");
+  const response=await fetch(value.appOrigin+"/account-api/workspace-install-redeem",{method:"POST",redirect:"error",headers:{"Content-Type":"application/json","Origin":value.appOrigin},body:JSON.stringify({code:value.code}),signal:AbortSignal.timeout(30000)});
+  if(response.status===410)stop("This installation command has expired or was already used. Open this workspace in your account and copy a fresh command. Your existing installation is preserved.");
+  if(response.status===429)stop("Too many setup attempts. Wait a minute, then retry. Your existing installation is preserved.");
+  if(!response.ok)stop("The account service could not prepare your installation. Please try again shortly. Your existing installation is preserved.");
+  let result;
+  try { result=await response.json(); } catch { stop("The account service returned an invalid response. Please try again shortly."); }
+  if(typeof result?.payload!=="string" || !/^[A-Za-z0-9_-]{1,32768}$/.test(result.payload))stop("The account service returned an invalid response. Please try again shortly.");
+  process.stdout.write(result.payload);
+} catch {
+  stop("Could not reach the account service. Check your internet connection and retry. Your existing installation is preserved.");
+}
+')
+echo 'Installing or connecting Ours to your workspace…' 
+printf '%s\n' "$payload" | ours-install --setup-workspace - --fleet-settings "$fleet_settings" ${setup_options[@]+"${setup_options[@]}"}
+unset payload

package/dist/web-app/workspace-tunnel.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Second step only: no installation, role selection or broad provider credentials.
+set -euo pipefail
+umask 077
+set +x
+IFS= read -r payload
+[[ ${#payload} -le 32768 && $payload =~ ^[A-Za-z0-9_-]+$ ]] || { echo 'Invalid tunnel setup payload' >&2; exit 1; }
+for binary in node ours-fleet cloudflared; do
+  command -v "$binary" >/dev/null || { echo "Missing tunnel setup prerequisite: $binary" >&2; exit 1; }
+done
+node -e 'if(Number(process.versions.node.split(".")[0])<22){console.error("Node.js 22+ is required");process.exit(1)}'
+ours-fleet setup-tunnel --help >/dev/null
+cloudflared --version >/dev/null
+payload=$(printf '%s\n' "$payload" | node --input-type=module -e '
+import {readFileSync} from "node:fs";
+const stop=message=>{console.error("Ours setup: "+message);process.exit(1);};
+try {
+  const input=readFileSync(0,"utf8").trim();
+  let value;
+  try { value=JSON.parse(Buffer.from(input,"base64url").toString()); } catch { stop("Invalid installation command. Copy a fresh command from your account."); }
+  if(value?.version!==2 || !["https://app.ours.network","https://app.ours-tunnel.com"].includes(value.appOrigin) || !/^[A-Za-z0-9_-]{43}$/.test(value.code) || !Number.isSafeInteger(value.expiresAt))stop("Invalid installation command. Copy a fresh command from your account.");
+  if(value.expiresAt<=Date.now())stop("This installation command has expired. Open this workspace in your account and copy a fresh command. Your existing installation is preserved.");
+  const response=await fetch(value.appOrigin+"/account-api/workspace-install-redeem",{method:"POST",redirect:"error",headers:{"Content-Type":"application/json","Origin":value.appOrigin},body:JSON.stringify({code:value.code}),signal:AbortSignal.timeout(30000)});
+  if(response.status===410)stop("This installation command has expired or was already used. Open this workspace in your account and copy a fresh command. Your existing installation is preserved.");
+  if(response.status===429)stop("Too many setup attempts. Wait a minute, then retry. Your existing installation is preserved.");
+  if(!response.ok)stop("The account service could not prepare your installation. Please try again shortly. Your existing installation is preserved.");
+  let result;
+  try { result=await response.json(); } catch { stop("The account service returned an invalid response. Please try again shortly."); }
+  if(typeof result?.payload!=="string" || !/^[A-Za-z0-9_-]{1,32768}$/.test(result.payload))stop("The account service returned an invalid response. Please try again shortly.");
+  process.stdout.write(result.payload);
+} catch {
+  stop("Could not reach the account service. Check your internet connection and retry. Your existing installation is preserved.");
+}
+')
+payload_dir=$(mktemp -d "${TMPDIR:-/tmp}/ours-tunnel-XXXXXXXX")
+trap 'rm -f "$payload_dir/payload"; rmdir "$payload_dir"' EXIT
+printf '%s\n' "$payload" > "$payload_dir/payload"
+unset payload
+ours-fleet setup-tunnel --file "$payload_dir/payload"
+echo 'Next: run ours-fleet link-device and paste its private code into the App.'

package/dist/workspace-enrollment.d.ts

@@ -22,4 +22,7 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
 }): Promise<{
     origin: string;
     hostWorkspaceId: string;
+    rootCid: any;
 }>;
+/** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+export declare function configureWorkspacePort(payload: WorkspacePayload, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;

package/dist/workspace-enrollment.js

@@ -108,5 +108,22 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
     replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase() }) + '\n', 0o600);
     loadConfig(configuration);
-    return { origin, hostWorkspaceId };
+    return { origin, hostWorkspaceId, rootCid: result.rootCid };
+}
+/** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+export async function configureWorkspacePort(payload, hostWorkspaceId, rootCid, port) {
+    const deadline = Date.now() + 15000;
+    while (true) {
+        const response = await fetch(payload.appOrigin + '/account-api/workspace-tunnel-configure', { method: 'POST', headers: { Origin: payload.appOrigin, 'Content-Type': 'application/json' }, credentials: 'omit', redirect: 'error', signal: AbortSignal.timeout(15000), body: JSON.stringify({ ...payload.challenge, hostWorkspaceId, rootCid, port }) });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw Error('Workspace tunnel target configuration failed (HTTP ' + response.status + ')');
+        }
+        const receipt = await response.json();
+        if (receipt.configured === true)
+            return;
+        if (Date.now() >= deadline)
+            throw Error('Signed workspace binding is not confirmed; tunnel target was not changed');
+        await new Promise(resolve => setTimeout(resolve, 500));
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.30",
+  "version": "1.2.0-nightly.32",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -27,7 +27,7 @@
   },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json && node scripts/build-info.mjs",
+    "build": "npm run clean && tsc -p tsconfig.json && node scripts/copy-web.mjs && node scripts/build-info.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "npm run typecheck",
     "test": "vitest run",