@ours.network/fleet 1.2.0-nightly.32 → 1.2.0-nightly.33

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.32",
-  "buildId": "199550205158",
-  "commit": "22c8e5fe504d1ac013dfcce0269a46a9ca6a66b6",
+  "version": "1.2.0-nightly.33",
+  "buildId": "c27262dcfdeb",
+  "commit": "57b2fa27b72ae4f53fbad81e966139474b7a6e03",
   "dirty": true,
-  "builtAt": "2026-10-02T08:03:30.874Z",
+  "builtAt": "2026-10-02T10:40:46.562Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { ensureMinimalSetup } from './minimal-setup.js';
 import { configureWorkspacePort } from './workspace-enrollment.js';
+import { clearPendingTunnelSetup, readPendingTunnelSetup, requiredPortAfterExpiry, savePendingTunnelSetup, setupTunnelPreflight } from './setup-tunnel-preflight.js';
 import { availableWebPort } from './web/available-port.js';
 import QRCode from 'qrcode';
 import { readWorkspacePayload, enrollWorkspace } from './workspace-enrollment.js';
@@ -1534,38 +1535,45 @@ webCommand.command('open').description('securely open or re-pair a browser with
 });
 async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
     try {
-        const payload = readWorkspacePayload(opts.file);
-        if (setupTunnel)
-            await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
-        const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
-        if (!existsSync(new WebAccessStore().path))
-            configureWebAccess({ pairing: true });
-        const manager = new WebServiceManager(), previous = manager.readMetadata();
-        if (previous)
-            await manager.stop();
-        const selectedPort = await availableWebPort(previous?.port ?? 49271);
-        mkdirSync(joinPath(stateRoot(), 'web'), { recursive: true, mode: 0o700 });
-        writeFileSync(joinPath(stateRoot(), 'web', 'port-selection.json'), JSON.stringify({ expiresAt: Date.now() + 60000 }) + '\n', { mode: 0o600 });
-        await manager.install(binPath, selectedPort, opts.configuration, { bind: '127.0.0.1', publicOrigin: result.origin });
-        await manager.restart();
-        const waitForControl = async () => {
-            const controlDeadline = Date.now() + 20000;
-            while (!existsSync(webControlPath())) {
-                if (Date.now() >= controlDeadline)
-                    throw Error('Fleet backend did not become ready within 20 seconds. Run ours-fleet web status; on Linux inspect journalctl --user -u ours-fleet-web.service -n 25 --no-pager. Resolve the startup error before running ours-fleet link-device');
-                await new Promise(resolve => setTimeout(resolve, 200));
+        if (setupTunnel && opts.check && opts.resume)
+            throw Error('Use either --check or --resume');
+        if (setupTunnel && (opts.check || opts.resume) && (opts.file || opts.migrateAppOrigin))
+            throw Error('--check and --resume take no payload file or migration flag');
+        if (setupTunnel && opts.check) {
+            await setupTunnelPreflight();
+            process.stdout.write('Tunnel setup prerequisites are available.\n');
+            return;
+        }
+        let pending;
+        if (setupTunnel && opts.resume) {
+            pending = readPendingTunnelSetup();
+            if (opts.configuration && resolvePath(opts.configuration) !== pending.configuration)
+                throw Error(`This setup started with configuration ${pending.configuration}; resume it without --configuration`);
+            await setupTunnelPreflight();
+        }
+        else {
+            if (!opts.file)
+                throw Error('setup-tunnel requires --file <path> (or --resume to finish an interrupted setup)');
+            const payload = readWorkspacePayload(opts.file);
+            if (setupTunnel) {
+                await setupTunnelPreflight();
+                await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
             }
-        };
-        await waitForControl();
-        const bound = JSON.parse(readFileSync(joinPath(stateRoot(), 'web', 'workspace-port.json'), 'utf8'));
-        if (!Number.isInteger(bound.port) || bound.port < 1 || bound.port > 65535)
-            throw Error('Invalid workspace listener port');
-        if (bound.port !== selectedPort) {
-            await manager.retainBoundPort(binPath, bound.port, opts.configuration, { bind: '127.0.0.1', publicOrigin: result.origin });
-            await waitForControl();
+            const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
+            pending = { appOrigin: payload.appOrigin, origin: result.origin, hostWorkspaceId: result.hostWorkspaceId, rootCid: result.rootCid, challenge: payload.challenge, configuration: resolvePath(opts.configuration ?? defaultConfigPath()) };
+            // The proof is one-time: keep what the remaining steps need so they can be finished without a new command.
+            if (setupTunnel)
+                savePendingTunnelSetup(pending);
+        }
+        try {
+            await finishWorkspaceService(pending, opts.resume ? pending.configuration : opts.configuration, setupTunnel);
         }
-        await configureWorkspacePort(payload, result.hostWorkspaceId, result.rootCid, bound.port);
-        rmSync(joinPath(stateRoot(), 'web', 'port-selection.json'), { force: true });
+        catch (error) {
+            if (!setupTunnel)
+                throw error;
+            throw Error(`${error instanceof Error ? error.message : String(error)}\nThis host is already bound to the workspace; do not request a new command. Fix the problem above, then run: ours-fleet setup-tunnel --resume`);
+        }
+        clearPendingTunnelSetup();
         if (setupTunnel) {
             process.stdout.write('Tunnel setup submitted. Check verified binding and tunnel health in the App, then run ours-fleet link-device and paste its private code. Configure Fleet agents and models in the App after linking.\n');
             return;
@@ -1580,13 +1588,62 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
         die(error);
     }
 }
+/** Everything after the root proof: supervised web service, its bound port, and the tunnel target. Safe to repeat. */
+async function finishWorkspaceService(pending, configuration, record) {
+    if (!existsSync(new WebAccessStore().path))
+        configureWebAccess({ pairing: true });
+    // Once the challenge has expired the account can no longer retarget the tunnel. Decide before touching a running service.
+    const expired = pending.challenge.expiresAt <= Date.now();
+    const requiredPort = expired ? requiredPortAfterExpiry(pending) : undefined;
+    const manager = new WebServiceManager(), previous = manager.readMetadata();
+    if (previous)
+        await manager.stop();
+    const selectedPort = await availableWebPort(requiredPort ?? previous?.port ?? 49271);
+    mkdirSync(joinPath(stateRoot(), 'web'), { recursive: true, mode: 0o700 });
+    writeFileSync(joinPath(stateRoot(), 'web', 'port-selection.json'), JSON.stringify({ expiresAt: Date.now() + 60000 }) + '\n', { mode: 0o600 });
+    const notes = await manager.install(binPath, selectedPort, configuration, { bind: '127.0.0.1', publicOrigin: pending.origin });
+    await manager.restart();
+    // Without linger the user service, and with it the tunnel, stops at logout and does not start at boot.
+    for (const note of notes)
+        if (note.startsWith('warning:'))
+            process.stderr.write(`${note}\nUntil then the tunnel stops when you log out of this host.\n`);
+    const waitForControl = async () => {
+        const controlDeadline = Date.now() + 20000;
+        while (!existsSync(webControlPath())) {
+            if (Date.now() >= controlDeadline)
+                throw Error('Fleet backend did not become ready within 20 seconds. Run ours-fleet web status; on Linux inspect journalctl --user -u ours-fleet-web.service -n 25 --no-pager. Resolve the startup error before running ours-fleet link-device');
+            await new Promise(resolve => setTimeout(resolve, 200));
+        }
+    };
+    await waitForControl();
+    const bound = JSON.parse(readFileSync(joinPath(stateRoot(), 'web', 'workspace-port.json'), 'utf8'));
+    if (!Number.isInteger(bound.port) || bound.port < 1 || bound.port > 65535)
+        throw Error('Invalid workspace listener port');
+    if (bound.port !== selectedPort) {
+        await manager.retainBoundPort(binPath, bound.port, configuration, { bind: '127.0.0.1', publicOrigin: pending.origin });
+        await waitForControl();
+    }
+    if (requiredPort === undefined) {
+        // Record the request first: if its answer is lost, a later resume must not assume the default target.
+        if (record) {
+            pending = { ...pending, requestedPorts: [...(pending.requestedPorts ?? []), bound.port] };
+            savePendingTunnelSetup(pending);
+        }
+        await configureWorkspacePort(pending, pending.hostWorkspaceId, pending.rootCid, bound.port);
+    }
+    else if (bound.port !== requiredPort)
+        throw Error(`The setup window has expired and the tunnel points at port ${requiredPort}, but this host could only bind port ${bound.port}. Free port ${requiredPort} on this host`);
+    rmSync(joinPath(stateRoot(), 'web', 'port-selection.json'), { force: true });
+}
 cOpt(program.command('workspace-enroll').description('enroll this host using a private account setup file'))
     .requiredOption('--file <path>', 'owned private payload file')
     .option('--preserve-profile', 'retain the existing human profile without creating or rewriting it')
     .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
     .action(async (opts) => workspaceEnrollmentCommand(opts));
 cOpt(program.command('setup-tunnel').description('connect an installed host using scoped expiring App credentials; preserves identities and agent configuration'))
-    .requiredOption('--file <path>', 'owned private App payload file (chmod 600)')
+    .option('--file <path>', 'owned private App payload file (chmod 600)')
+    .option('--check', 'only verify host prerequisites; changes nothing and needs no payload')
+    .option('--resume', 'finish a setup that stopped after this host was bound; needs no new payload')
     .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
     .action(async (opts) => workspaceEnrollmentCommand(opts, true));
 program.command('link-device').description('create a single-use workspace device connection code (expires in five minutes)')

package/dist/setup-tunnel-preflight.d.ts

@@ -0,0 +1,32 @@
+import { type Exec } from './exec.js';
+import type { WorkspacePayload } from './workspace-enrollment.js';
+/**
+ * Check what the steps after the one-time root proof depend on, before that
+ * proof is sent: a failure afterwards cannot be retried with a fresh command.
+ */
+export declare function setupTunnelPreflight({ exec, platform, node }?: {
+    exec?: Exec;
+    platform?: NodeJS.Platform;
+    node?: string;
+}): Promise<void>;
+/** What the steps after the proof need, kept so they can be finished without a new command. */
+export interface PendingTunnelSetup {
+    appOrigin: string;
+    origin: string;
+    hostWorkspaceId: string;
+    rootCid: string;
+    challenge: WorkspacePayload['challenge'];
+    /** Fleet configuration the setup started with; a resume must use the same one. */
+    configuration: string;
+    /** Every port sent to the account as the tunnel target. No answer was confirmed while this record exists, so the remote target is any of these or the default. */
+    requestedPorts?: number[];
+}
+export declare function savePendingTunnelSetup(pending: PendingTunnelSetup): void;
+export declare function clearPendingTunnelSetup(): void;
+export declare function readPendingTunnelSetup(): PendingTunnelSetup;
+export declare const DEFAULT_TUNNEL_PORT = 49271;
+/**
+ * The port the web service must bind when the account can no longer retarget
+ * the tunnel. Unknown when a different port was requested and never confirmed.
+ */
+export declare function requiredPortAfterExpiry(pending: PendingTunnelSetup): number;

package/dist/setup-tunnel-preflight.js

@@ -0,0 +1,58 @@
+import { existsSync, lstatSync, readFileSync, rmSync } from 'node:fs';
+import { userInfo } from 'node:os';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+import { realExec } from './exec.js';
+import { stateRoot } from './paths.js';
+const UNCHANGED = 'Nothing was changed and this host was not bound.';
+/**
+ * Check what the steps after the one-time root proof depend on, before that
+ * proof is sent: a failure afterwards cannot be retried with a fresh command.
+ */
+export async function setupTunnelPreflight({ exec = realExec, platform = process.platform, node = process.versions.node } = {}) {
+    const [major, minor] = node.split('.').map(Number);
+    if (major < 22 || (major === 22 && minor < 13))
+        throw Error(`Tunnel setup requires Node.js 22.13 or newer; this is ${node}. Update Node.js, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (platform === 'linux') {
+        const manager = await exec('systemctl', ['--user', 'show-environment'], { timeout: 10_000 });
+        if (manager.code !== 0)
+            throw Error(`The user service manager is not reachable from this shell (${manager.stderr.trim().split('\n')[0] || `systemctl --user exited ${manager.code}`}). `
+                + `Log in directly as ${userInfo().username} (not through su or sudo), or run: sudo loginctl enable-linger ${userInfo().username} && export XDG_RUNTIME_DIR=/run/user/${process.getuid?.()} `
+                + `Then run a fresh tunnel setup command. ${UNCHANGED}`);
+    }
+    const help = await exec('cloudflared', ['tunnel', 'run', '--help'], { timeout: 10_000 });
+    if (help.code === 127)
+        throw Error(`cloudflared is not installed or not on PATH. Install it, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (help.code !== 0 || !`${help.stdout}\n${help.stderr}`.includes('--token-file'))
+        throw Error(`This cloudflared is too old for tunnel setup (no --token-file support). Update cloudflared, then run a fresh tunnel setup command. ${UNCHANGED}`);
+}
+const pendingPath = () => join(stateRoot(), 'workspace', 'pending-setup.json');
+export function savePendingTunnelSetup(pending) {
+    replaceFileAtomically(pendingPath(), JSON.stringify(pending) + '\n', 0o600);
+}
+export function clearPendingTunnelSetup() { rmSync(pendingPath(), { force: true }); }
+export function readPendingTunnelSetup() {
+    const path = pendingPath();
+    if (!existsSync(path))
+        throw Error('No unfinished tunnel setup on this host. Run the tunnel setup command from the App.');
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+        throw Error('Unfinished tunnel setup record must be an owned private file');
+    const pending = JSON.parse(readFileSync(path, 'utf8'));
+    if (typeof pending?.appOrigin !== 'string' || typeof pending.origin !== 'string' || typeof pending.hostWorkspaceId !== 'string'
+        || typeof pending.rootCid !== 'string' || !pending.challenge || !Number.isSafeInteger(pending.challenge.expiresAt) || typeof pending.configuration !== 'string'
+        || (pending.requestedPorts !== undefined && (!Array.isArray(pending.requestedPorts) || !pending.requestedPorts.every(Number.isInteger))))
+        throw Error('Unfinished tunnel setup record is invalid');
+    return pending;
+}
+export const DEFAULT_TUNNEL_PORT = 49_271;
+/**
+ * The port the web service must bind when the account can no longer retarget
+ * the tunnel. Unknown when a different port was requested and never confirmed.
+ */
+export function requiredPortAfterExpiry(pending) {
+    const other = [...new Set(pending.requestedPorts ?? [])].filter(port => port !== DEFAULT_TUNNEL_PORT);
+    if (!other.length)
+        return DEFAULT_TUNNEL_PORT;
+    throw Error(`The setup window has expired and it is unknown whether the tunnel points at port ${[...other, DEFAULT_TUNNEL_PORT].join(' or ')}: the account's answer to a port request was not received. This setup cannot be finished automatically`);
+}

package/dist/web-app/version.json

@@ -1 +1 @@
-{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T08:00:39.873Z"}
+{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T10:38:31.229Z"}

package/dist/workspace-enrollment.d.ts

@@ -25,4 +25,4 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
     rootCid: any;
 }>;
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
-export declare function configureWorkspacePort(payload: WorkspacePayload, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
+export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;

package/dist/workspace-enrollment.js

@@ -33,7 +33,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     if (!base.pathname.endsWith('/messenger/'))
         throw Error('Workspace setup requires the supported gateway client profile');
     const secret = readFileSync(profile.credentialPath, 'utf8').trim();
-    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(15000), redirect: 'error' }); if (!response.ok) {
+    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
         await response.body?.cancel();
         throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
     } return response.json(); };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.32",
+  "version": "1.2.0-nightly.33",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",