@ours.network/fleet 1.2.0-nightly.32 → 1.2.0-nightly.34

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.32",
-  "buildId": "199550205158",
-  "commit": "22c8e5fe504d1ac013dfcce0269a46a9ca6a66b6",
+  "version": "1.2.0-nightly.34",
+  "buildId": "1d0ffc344d7e",
+  "commit": "b17e975b8f21b865f6690fc7299851447b53fdad",
   "dirty": true,
-  "builtAt": "2026-10-02T08:03:30.874Z",
+  "builtAt": "2026-10-02T12:17:07.327Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { ensureMinimalSetup } from './minimal-setup.js';
 import { configureWorkspacePort } from './workspace-enrollment.js';
+import { clearPendingTunnelSetup, readPendingTunnelSetup, requiredPortAfterExpiry, savePendingTunnelSetup, setupTunnelPreflight } from './setup-tunnel-preflight.js';
 import { availableWebPort } from './web/available-port.js';
 import QRCode from 'qrcode';
 import { readWorkspacePayload, enrollWorkspace } from './workspace-enrollment.js';
@@ -1534,38 +1535,45 @@ webCommand.command('open').description('securely open or re-pair a browser with
 });
 async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
     try {
-        const payload = readWorkspacePayload(opts.file);
-        if (setupTunnel)
-            await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
-        const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
-        if (!existsSync(new WebAccessStore().path))
-            configureWebAccess({ pairing: true });
-        const manager = new WebServiceManager(), previous = manager.readMetadata();
-        if (previous)
-            await manager.stop();
-        const selectedPort = await availableWebPort(previous?.port ?? 49271);
-        mkdirSync(joinPath(stateRoot(), 'web'), { recursive: true, mode: 0o700 });
-        writeFileSync(joinPath(stateRoot(), 'web', 'port-selection.json'), JSON.stringify({ expiresAt: Date.now() + 60000 }) + '\n', { mode: 0o600 });
-        await manager.install(binPath, selectedPort, opts.configuration, { bind: '127.0.0.1', publicOrigin: result.origin });
-        await manager.restart();
-        const waitForControl = async () => {
-            const controlDeadline = Date.now() + 20000;
-            while (!existsSync(webControlPath())) {
-                if (Date.now() >= controlDeadline)
-                    throw Error('Fleet backend did not become ready within 20 seconds. Run ours-fleet web status; on Linux inspect journalctl --user -u ours-fleet-web.service -n 25 --no-pager. Resolve the startup error before running ours-fleet link-device');
-                await new Promise(resolve => setTimeout(resolve, 200));
+        if (setupTunnel && opts.check && opts.resume)
+            throw Error('Use either --check or --resume');
+        if (setupTunnel && (opts.check || opts.resume) && (opts.file || opts.migrateAppOrigin))
+            throw Error('--check and --resume take no payload file or migration flag');
+        if (setupTunnel && opts.check) {
+            await setupTunnelPreflight();
+            process.stdout.write('Tunnel setup prerequisites are available.\n');
+            return;
+        }
+        let pending;
+        if (setupTunnel && opts.resume) {
+            pending = readPendingTunnelSetup();
+            if (opts.configuration && resolvePath(opts.configuration) !== pending.configuration)
+                throw Error(`This setup started with configuration ${pending.configuration}; resume it without --configuration`);
+            await setupTunnelPreflight();
+        }
+        else {
+            if (!opts.file)
+                throw Error('setup-tunnel requires --file <path> (or --resume to finish an interrupted setup)');
+            const payload = readWorkspacePayload(opts.file);
+            if (setupTunnel) {
+                await setupTunnelPreflight();
+                await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
             }
-        };
-        await waitForControl();
-        const bound = JSON.parse(readFileSync(joinPath(stateRoot(), 'web', 'workspace-port.json'), 'utf8'));
-        if (!Number.isInteger(bound.port) || bound.port < 1 || bound.port > 65535)
-            throw Error('Invalid workspace listener port');
-        if (bound.port !== selectedPort) {
-            await manager.retainBoundPort(binPath, bound.port, opts.configuration, { bind: '127.0.0.1', publicOrigin: result.origin });
-            await waitForControl();
+            const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
+            pending = { appOrigin: payload.appOrigin, origin: result.origin, hostWorkspaceId: result.hostWorkspaceId, rootCid: result.rootCid, challenge: payload.challenge, configuration: resolvePath(opts.configuration ?? defaultConfigPath()) };
+            // The proof is one-time: keep what the remaining steps need so they can be finished without a new command.
+            if (setupTunnel)
+                savePendingTunnelSetup(pending);
+        }
+        try {
+            await finishWorkspaceService(pending, opts.resume ? pending.configuration : opts.configuration, setupTunnel);
         }
-        await configureWorkspacePort(payload, result.hostWorkspaceId, result.rootCid, bound.port);
-        rmSync(joinPath(stateRoot(), 'web', 'port-selection.json'), { force: true });
+        catch (error) {
+            if (!setupTunnel)
+                throw error;
+            throw Error(`${error instanceof Error ? error.message : String(error)}\nThis host is already bound to the workspace; do not request a new command. Fix the problem above, then run: ours-fleet setup-tunnel --resume`);
+        }
+        clearPendingTunnelSetup();
         if (setupTunnel) {
             process.stdout.write('Tunnel setup submitted. Check verified binding and tunnel health in the App, then run ours-fleet link-device and paste its private code. Configure Fleet agents and models in the App after linking.\n');
             return;
@@ -1580,13 +1588,62 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
         die(error);
     }
 }
+/** Everything after the root proof: supervised web service, its bound port, and the tunnel target. Safe to repeat. */
+async function finishWorkspaceService(pending, configuration, record) {
+    if (!existsSync(new WebAccessStore().path))
+        configureWebAccess({ pairing: true });
+    // Once the challenge has expired the account can no longer retarget the tunnel. Decide before touching a running service.
+    const expired = pending.challenge.expiresAt <= Date.now();
+    const requiredPort = expired ? requiredPortAfterExpiry(pending) : undefined;
+    const manager = new WebServiceManager(), previous = manager.readMetadata();
+    if (previous)
+        await manager.stop();
+    const selectedPort = await availableWebPort(requiredPort ?? previous?.port ?? 49271);
+    mkdirSync(joinPath(stateRoot(), 'web'), { recursive: true, mode: 0o700 });
+    writeFileSync(joinPath(stateRoot(), 'web', 'port-selection.json'), JSON.stringify({ expiresAt: Date.now() + 60000 }) + '\n', { mode: 0o600 });
+    const notes = await manager.install(binPath, selectedPort, configuration, { bind: '127.0.0.1', publicOrigin: pending.origin });
+    await manager.restart();
+    // Without linger the user service, and with it the tunnel, stops at logout and does not start at boot.
+    for (const note of notes)
+        if (note.startsWith('warning:'))
+            process.stderr.write(`${note}\nUntil then the tunnel stops when you log out of this host.\n`);
+    const waitForControl = async () => {
+        const controlDeadline = Date.now() + 20000;
+        while (!existsSync(webControlPath())) {
+            if (Date.now() >= controlDeadline)
+                throw Error('Fleet backend did not become ready within 20 seconds. Run ours-fleet web status; on Linux inspect journalctl --user -u ours-fleet-web.service -n 25 --no-pager. Resolve the startup error before running ours-fleet link-device');
+            await new Promise(resolve => setTimeout(resolve, 200));
+        }
+    };
+    await waitForControl();
+    const bound = JSON.parse(readFileSync(joinPath(stateRoot(), 'web', 'workspace-port.json'), 'utf8'));
+    if (!Number.isInteger(bound.port) || bound.port < 1 || bound.port > 65535)
+        throw Error('Invalid workspace listener port');
+    if (bound.port !== selectedPort) {
+        await manager.retainBoundPort(binPath, bound.port, configuration, { bind: '127.0.0.1', publicOrigin: pending.origin });
+        await waitForControl();
+    }
+    if (requiredPort === undefined) {
+        // Record the request first: if its answer is lost, a later resume must not assume the default target.
+        if (record) {
+            pending = { ...pending, requestedPorts: [...(pending.requestedPorts ?? []), bound.port] };
+            savePendingTunnelSetup(pending);
+        }
+        await configureWorkspacePort(pending, pending.hostWorkspaceId, pending.rootCid, bound.port);
+    }
+    else if (bound.port !== requiredPort)
+        throw Error(`The setup window has expired and the tunnel points at port ${requiredPort}, but this host could only bind port ${bound.port}. Free port ${requiredPort} on this host`);
+    rmSync(joinPath(stateRoot(), 'web', 'port-selection.json'), { force: true });
+}
 cOpt(program.command('workspace-enroll').description('enroll this host using a private account setup file'))
     .requiredOption('--file <path>', 'owned private payload file')
     .option('--preserve-profile', 'retain the existing human profile without creating or rewriting it')
     .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
     .action(async (opts) => workspaceEnrollmentCommand(opts));
 cOpt(program.command('setup-tunnel').description('connect an installed host using scoped expiring App credentials; preserves identities and agent configuration'))
-    .requiredOption('--file <path>', 'owned private App payload file (chmod 600)')
+    .option('--file <path>', 'owned private App payload file (chmod 600)')
+    .option('--check', 'only verify host prerequisites; changes nothing and needs no payload')
+    .option('--resume', 'finish a setup that stopped after this host was bound; needs no new payload')
     .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
     .action(async (opts) => workspaceEnrollmentCommand(opts, true));
 program.command('link-device').description('create a single-use workspace device connection code (expires in five minutes)')

package/dist/setup-tunnel-preflight.d.ts

@@ -0,0 +1,32 @@
+import { type Exec } from './exec.js';
+import type { WorkspacePayload } from './workspace-enrollment.js';
+/**
+ * Check what the steps after the one-time root proof depend on, before that
+ * proof is sent: a failure afterwards cannot be retried with a fresh command.
+ */
+export declare function setupTunnelPreflight({ exec, platform, node }?: {
+    exec?: Exec;
+    platform?: NodeJS.Platform;
+    node?: string;
+}): Promise<void>;
+/** What the steps after the proof need, kept so they can be finished without a new command. */
+export interface PendingTunnelSetup {
+    appOrigin: string;
+    origin: string;
+    hostWorkspaceId: string;
+    rootCid: string;
+    challenge: WorkspacePayload['challenge'];
+    /** Fleet configuration the setup started with; a resume must use the same one. */
+    configuration: string;
+    /** Every port sent to the account as the tunnel target. No answer was confirmed while this record exists, so the remote target is any of these or the default. */
+    requestedPorts?: number[];
+}
+export declare function savePendingTunnelSetup(pending: PendingTunnelSetup): void;
+export declare function clearPendingTunnelSetup(): void;
+export declare function readPendingTunnelSetup(): PendingTunnelSetup;
+export declare const DEFAULT_TUNNEL_PORT = 49271;
+/**
+ * The port the web service must bind when the account can no longer retarget
+ * the tunnel. Unknown when a different port was requested and never confirmed.
+ */
+export declare function requiredPortAfterExpiry(pending: PendingTunnelSetup): number;

package/dist/setup-tunnel-preflight.js

@@ -0,0 +1,58 @@
+import { existsSync, lstatSync, readFileSync, rmSync } from 'node:fs';
+import { userInfo } from 'node:os';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+import { realExec } from './exec.js';
+import { stateRoot } from './paths.js';
+const UNCHANGED = 'Nothing was changed and this host was not bound.';
+/**
+ * Check what the steps after the one-time root proof depend on, before that
+ * proof is sent: a failure afterwards cannot be retried with a fresh command.
+ */
+export async function setupTunnelPreflight({ exec = realExec, platform = process.platform, node = process.versions.node } = {}) {
+    const [major, minor] = node.split('.').map(Number);
+    if (major < 22 || (major === 22 && minor < 13))
+        throw Error(`Tunnel setup requires Node.js 22.13 or newer; this is ${node}. Update Node.js, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (platform === 'linux') {
+        const manager = await exec('systemctl', ['--user', 'show-environment'], { timeout: 10_000 });
+        if (manager.code !== 0)
+            throw Error(`The user service manager is not reachable from this shell (${manager.stderr.trim().split('\n')[0] || `systemctl --user exited ${manager.code}`}). `
+                + `Log in directly as ${userInfo().username} (not through su or sudo), or run: sudo loginctl enable-linger ${userInfo().username} && export XDG_RUNTIME_DIR=/run/user/${process.getuid?.()} `
+                + `Then run a fresh tunnel setup command. ${UNCHANGED}`);
+    }
+    const help = await exec('cloudflared', ['tunnel', 'run', '--help'], { timeout: 10_000 });
+    if (help.code === 127)
+        throw Error(`cloudflared is not installed or not on PATH. Install it, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (help.code !== 0 || !`${help.stdout}\n${help.stderr}`.includes('--token-file'))
+        throw Error(`This cloudflared is too old for tunnel setup (no --token-file support). Update cloudflared, then run a fresh tunnel setup command. ${UNCHANGED}`);
+}
+const pendingPath = () => join(stateRoot(), 'workspace', 'pending-setup.json');
+export function savePendingTunnelSetup(pending) {
+    replaceFileAtomically(pendingPath(), JSON.stringify(pending) + '\n', 0o600);
+}
+export function clearPendingTunnelSetup() { rmSync(pendingPath(), { force: true }); }
+export function readPendingTunnelSetup() {
+    const path = pendingPath();
+    if (!existsSync(path))
+        throw Error('No unfinished tunnel setup on this host. Run the tunnel setup command from the App.');
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+        throw Error('Unfinished tunnel setup record must be an owned private file');
+    const pending = JSON.parse(readFileSync(path, 'utf8'));
+    if (typeof pending?.appOrigin !== 'string' || typeof pending.origin !== 'string' || typeof pending.hostWorkspaceId !== 'string'
+        || typeof pending.rootCid !== 'string' || !pending.challenge || !Number.isSafeInteger(pending.challenge.expiresAt) || typeof pending.configuration !== 'string'
+        || (pending.requestedPorts !== undefined && (!Array.isArray(pending.requestedPorts) || !pending.requestedPorts.every(Number.isInteger))))
+        throw Error('Unfinished tunnel setup record is invalid');
+    return pending;
+}
+export const DEFAULT_TUNNEL_PORT = 49_271;
+/**
+ * The port the web service must bind when the account can no longer retarget
+ * the tunnel. Unknown when a different port was requested and never confirmed.
+ */
+export function requiredPortAfterExpiry(pending) {
+    const other = [...new Set(pending.requestedPorts ?? [])].filter(port => port !== DEFAULT_TUNNEL_PORT);
+    if (!other.length)
+        return DEFAULT_TUNNEL_PORT;
+    throw Error(`The setup window has expired and it is unknown whether the tunnel points at port ${[...other, DEFAULT_TUNNEL_PORT].join(' or ')}: the account's answer to a port request was not received. This setup cannot be finished automatically`);
+}

package/dist/web/auth.d.ts

@@ -52,6 +52,8 @@ export declare class WebAuth {
     }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request: Pick<FastifyRequest, 'headers'>): string | undefined;
     validateBoundary(request: FastifyRequest, requireOrigin: boolean, allowPageNavigation?: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;

package/dist/web/auth.js

@@ -54,6 +54,10 @@ export class WebAuth {
         this.bootstrapUsed = false;
         return this._bootstrapSecret;
     }
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request) {
+        return this.workspaceDevices && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
+    }
     validateBoundary(request, requireOrigin, allowPageNavigation = false) {
         const host = request.headers.host;
         const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);

package/dist/web/prefix-gateway.js

@@ -72,14 +72,31 @@ export function createPrefixGateway(options) {
         timer.unref();
         return () => { clearInterval(timer); unbind(); };
     };
+    // The account App calls workspace services directly from its own origin with a device
+    // credential. Only that exact configured origin is answered; the reply grants nothing by
+    // itself, every request is still authenticated below.
+    const accountCors = (req) => {
+        const origin = auth?.accountOrigin(req);
+        return origin ? { 'access-control-allow-origin': origin, vary: 'Origin',
+            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag' } : {};
+    };
     const server = createServer((req, res) => {
+        const cors = accountCors(req);
         let route;
         try {
+            if (req.method === 'OPTIONS' && cors.vary && req.headers['access-control-request-method'] && select(req).service) {
+                auth.validateBoundary({ headers: req.headers, method: req.method, url: req.url }, false);
+                res.writeHead(204, { ...cors, 'cache-control': 'no-store', 'access-control-max-age': '600',
+                    'access-control-allow-methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
+                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration' });
+                res.end();
+                return;
+            }
             route = prepare(req);
         }
         catch (error) {
             const code = error.code;
-            res.writeHead(code === 'unauthorized' ? 401 : 403, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            res.writeHead(code === 'unauthorized' ? 401 : 403, { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end(JSON.stringify({ error: { code: code ?? 'forbidden', message: error.message } }));
             return;
         }
@@ -92,8 +109,13 @@ export function createPrefixGateway(options) {
             method: req.method, path: route.path, headers: route.headers,
         }, response => {
             const headers = headersFor(response);
-            if (route.service)
+            if (route.service) {
                 delete headers['set-cookie'];
+                for (const key of Object.keys(headers))
+                    if (key.startsWith('access-control-'))
+                        delete headers[key];
+                Object.assign(headers, cors);
+            }
             res.writeHead(response.statusCode ?? 502, headers);
             response.on('error', () => res.destroy());
             response.on('aborted', () => res.destroy());
@@ -104,7 +126,7 @@ export function createPrefixGateway(options) {
         });
         upstream.on('error', () => {
             if (!res.headersSent)
-                res.writeHead(502, { 'content-type': 'application/json' });
+                res.writeHead(502, { ...(route.service ? cors : {}), 'content-type': 'application/json' });
             res.end(JSON.stringify({ error: { code: 'upstream_unavailable', message: 'Service is unavailable' } }));
         });
         const untrack = track(req, route.session, () => { upstream.destroy(); res.destroy(); });

package/dist/web/runtime.js

@@ -10,7 +10,7 @@ import { spawn } from 'node:child_process';
 import { FleetNotificationProducer } from '../notifications/fleet-producer.js';
 import { producerConfig } from '../notifications/outbox.js';
 import { SubscriptionService } from '../subscriptions/service.js';
-import { existsSync, realpathSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, realpathSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from '../config.js';
 import { RoleRepository } from '../application/role-repository.js';
@@ -24,7 +24,8 @@ import { FleetError } from '../application/errors.js';
 import { controlRequest, controlSocketPath } from '../session/control.js';
 import { pickBackend } from '../supervisor/index.js';
 import { realExec } from '../exec.js';
-import { home, stateRoot, agentsRoot, tmpRoot } from '../paths.js';
+import { home, stateRoot, agentsRoot, tmpRoot, logsRoot } from '../paths.js';
+import { executeInitAnswers, publishSetup } from '../init-wizard.js';
 import { AuditSink } from './audit.js';
 import { FleetEventBus } from './events.js';
 import { buildWebServer } from './server.js';
@@ -190,6 +191,17 @@ export async function startWebConsole(options) {
             layoutBindings: new LayoutBindingGrants(new RoomLayoutService(options.configPath).supervisor()),
             presetProvenance: new PresetProvenance(options.configPath),
             topology: readTopology, topologyDrafts, topologyPromote,
+            // Same boundary as `ours-fleet init --settings`: existing files are preserved, missing defaults are added.
+            onboardingSetup: async (answers) => {
+                await executeInitAnswers(answers, configuration.path, {
+                    async hostSetup() {
+                        for (const directory of [agentsRoot(), tmpRoot(), logsRoot()])
+                            mkdirSync(directory, { recursive: true });
+                        await pickBackend().init(options.binPath);
+                    },
+                    publish: publishSetup,
+                });
+            },
             subscriptions: new SubscriptionService({
                 agents: async () => (await query.list(true)).map(({ role, status }) => ({
                     roleId: role.id, stateDir: repository.stateDir(role), running: status.supervisor.liveness === 'running',

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import { type InitAnswers } from '../init-wizard.js';
 import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
 import type { FleetQueryService } from '../application/fleet-query-service.js';
@@ -41,6 +42,8 @@ export interface WebServices {
     presetProvenance?: PresetProvenance;
     oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
     subscriptions?: SubscriptionService;
+    /** First-time setup from the packaged presets; the account App supplies only the model choices. */
+    onboardingSetup?(answers: InitAnswers): Promise<void>;
 }
 export interface WebServer {
     app: FastifyInstance;

package/dist/web/server.js

@@ -22,6 +22,7 @@ import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { TaskStateError } from '../rooms-tasks/task-state.js';
 import { isProvider } from '../subscriptions/store.js';
+const ONBOARDING_WORK = ['coordination', 'development', 'review'];
 const statusFor = (code) => ({
     role_not_found: 404, resource_not_found: 404, unauthorized: 401, forbidden: 403, conflict: 409,
     idempotency_conflict: 409, stale_state: 409, rate_limited: 429,
@@ -165,7 +166,57 @@ export async function buildWebServer(services, boundary, options = {}) {
             }
         }));
         const catalog = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8')));
-        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator' };
+        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
+    });
+    // First-time setup is what creates the persistent coordinator. A configuration that loads and
+    // has it is set up, whatever its brains are called; its models are then changed by editing it.
+    const onboardingConfigured = () => {
+        if (!services.configuration)
+            return false;
+        try {
+            return Boolean(services.configuration.read(false).model.agents.FleetCoordinator);
+        }
+        catch {
+            return false;
+        }
+    };
+    let onboardingSetupQueue = Promise.resolve();
+    app.post('/api/v1/onboarding/setup', async (request) => {
+        auth.authenticate(request, true);
+        if (!services.configuration || !services.onboardingSetup)
+            throw new FleetError('capability_unavailable', 'first-time Fleet setup is unavailable');
+        const requested = request.body?.models;
+        const supported = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8'))).models;
+        const models = {};
+        for (const work of ONBOARDING_WORK) {
+            const matches = supported.filter(model => model.harness === requested?.[work]?.harness && model.model === requested?.[work]?.model);
+            if (matches.length !== 1)
+                throw new FleetError('invalid_request', `choose a supported model for ${work}`);
+            models[work] = matches[0];
+        }
+        const chosen = Object.values(models);
+        const subscriptions = [...new Set(chosen.map(model => model.harness === 'codex' ? 'codex' : 'claude'))];
+        const oneModel = new Set(chosen.map(model => `${model.harness}\0${model.model}`)).size === 1;
+        const configuration = services.configuration, setup = services.onboardingSetup;
+        // One setup at a time: the first-time check and the publication it guards must not interleave.
+        const run = onboardingSetupQueue.then(async () => {
+            if (onboardingConfigured())
+                throw new FleetError('conflict', 'Fleet is already set up; change its models in the configuration');
+            try {
+                await setup({ subscriptions, assignmentStrategy: oneModel ? 'one-model' : 'per-job', models, reasoning: 'balanced' });
+            }
+            catch (error) {
+                throw new FleetError('backend_failure', `Fleet setup did not complete: ${error.message}`);
+            }
+            // Setup preserves files it finds, so confirm the published models are the ones this request chose.
+            const brains = configuration.read(true).model.brains ?? {};
+            for (const work of ONBOARDING_WORK)
+                if (brains[work]?.harness !== models[work].harness || brains[work]?.model !== models[work].model)
+                    throw new FleetError('conflict', 'Fleet was set up with different models; review its configuration');
+            return { configured: true };
+        });
+        onboardingSetupQueue = run.catch(() => { });
+        return run;
     });
     app.get('/api/v1/creation-capabilities', async (request) => {
         auth.authenticate(request);

package/dist/web-app/version.json

@@ -1 +1 @@
-{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T08:00:39.873Z"}
+{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T12:14:07.133Z"}

package/dist/workspace-enrollment.d.ts

@@ -25,4 +25,4 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
     rootCid: any;
 }>;
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
-export declare function configureWorkspacePort(payload: WorkspacePayload, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
+export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;

package/dist/workspace-enrollment.js

@@ -33,7 +33,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     if (!base.pathname.endsWith('/messenger/'))
         throw Error('Workspace setup requires the supported gateway client profile');
     const secret = readFileSync(profile.credentialPath, 'utf8').trim();
-    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(15000), redirect: 'error' }); if (!response.ok) {
+    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
         await response.body?.cancel();
         throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
     } return response.json(); };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.32",
+  "version": "1.2.0-nightly.34",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",