@ours.network/fleet 1.2.0-nightly.33 → 1.2.0-nightly.34

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.33",
-  "buildId": "c27262dcfdeb",
-  "commit": "57b2fa27b72ae4f53fbad81e966139474b7a6e03",
+  "version": "1.2.0-nightly.34",
+  "buildId": "1d0ffc344d7e",
+  "commit": "b17e975b8f21b865f6690fc7299851447b53fdad",
   "dirty": true,
-  "builtAt": "2026-10-02T10:40:46.562Z",
+  "builtAt": "2026-10-02T12:17:07.327Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/web/auth.d.ts

@@ -52,6 +52,8 @@ export declare class WebAuth {
     }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request: Pick<FastifyRequest, 'headers'>): string | undefined;
     validateBoundary(request: FastifyRequest, requireOrigin: boolean, allowPageNavigation?: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;

package/dist/web/auth.js

@@ -54,6 +54,10 @@ export class WebAuth {
         this.bootstrapUsed = false;
         return this._bootstrapSecret;
     }
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request) {
+        return this.workspaceDevices && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
+    }
     validateBoundary(request, requireOrigin, allowPageNavigation = false) {
         const host = request.headers.host;
         const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);

package/dist/web/prefix-gateway.js

@@ -72,14 +72,31 @@ export function createPrefixGateway(options) {
         timer.unref();
         return () => { clearInterval(timer); unbind(); };
     };
+    // The account App calls workspace services directly from its own origin with a device
+    // credential. Only that exact configured origin is answered; the reply grants nothing by
+    // itself, every request is still authenticated below.
+    const accountCors = (req) => {
+        const origin = auth?.accountOrigin(req);
+        return origin ? { 'access-control-allow-origin': origin, vary: 'Origin',
+            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag' } : {};
+    };
     const server = createServer((req, res) => {
+        const cors = accountCors(req);
         let route;
         try {
+            if (req.method === 'OPTIONS' && cors.vary && req.headers['access-control-request-method'] && select(req).service) {
+                auth.validateBoundary({ headers: req.headers, method: req.method, url: req.url }, false);
+                res.writeHead(204, { ...cors, 'cache-control': 'no-store', 'access-control-max-age': '600',
+                    'access-control-allow-methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
+                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration' });
+                res.end();
+                return;
+            }
             route = prepare(req);
         }
         catch (error) {
             const code = error.code;
-            res.writeHead(code === 'unauthorized' ? 401 : 403, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            res.writeHead(code === 'unauthorized' ? 401 : 403, { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end(JSON.stringify({ error: { code: code ?? 'forbidden', message: error.message } }));
             return;
         }
@@ -92,8 +109,13 @@ export function createPrefixGateway(options) {
             method: req.method, path: route.path, headers: route.headers,
         }, response => {
             const headers = headersFor(response);
-            if (route.service)
+            if (route.service) {
                 delete headers['set-cookie'];
+                for (const key of Object.keys(headers))
+                    if (key.startsWith('access-control-'))
+                        delete headers[key];
+                Object.assign(headers, cors);
+            }
             res.writeHead(response.statusCode ?? 502, headers);
             response.on('error', () => res.destroy());
             response.on('aborted', () => res.destroy());
@@ -104,7 +126,7 @@ export function createPrefixGateway(options) {
         });
         upstream.on('error', () => {
             if (!res.headersSent)
-                res.writeHead(502, { 'content-type': 'application/json' });
+                res.writeHead(502, { ...(route.service ? cors : {}), 'content-type': 'application/json' });
             res.end(JSON.stringify({ error: { code: 'upstream_unavailable', message: 'Service is unavailable' } }));
         });
         const untrack = track(req, route.session, () => { upstream.destroy(); res.destroy(); });

package/dist/web/runtime.js

@@ -10,7 +10,7 @@ import { spawn } from 'node:child_process';
 import { FleetNotificationProducer } from '../notifications/fleet-producer.js';
 import { producerConfig } from '../notifications/outbox.js';
 import { SubscriptionService } from '../subscriptions/service.js';
-import { existsSync, realpathSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, realpathSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from '../config.js';
 import { RoleRepository } from '../application/role-repository.js';
@@ -24,7 +24,8 @@ import { FleetError } from '../application/errors.js';
 import { controlRequest, controlSocketPath } from '../session/control.js';
 import { pickBackend } from '../supervisor/index.js';
 import { realExec } from '../exec.js';
-import { home, stateRoot, agentsRoot, tmpRoot } from '../paths.js';
+import { home, stateRoot, agentsRoot, tmpRoot, logsRoot } from '../paths.js';
+import { executeInitAnswers, publishSetup } from '../init-wizard.js';
 import { AuditSink } from './audit.js';
 import { FleetEventBus } from './events.js';
 import { buildWebServer } from './server.js';
@@ -190,6 +191,17 @@ export async function startWebConsole(options) {
             layoutBindings: new LayoutBindingGrants(new RoomLayoutService(options.configPath).supervisor()),
             presetProvenance: new PresetProvenance(options.configPath),
             topology: readTopology, topologyDrafts, topologyPromote,
+            // Same boundary as `ours-fleet init --settings`: existing files are preserved, missing defaults are added.
+            onboardingSetup: async (answers) => {
+                await executeInitAnswers(answers, configuration.path, {
+                    async hostSetup() {
+                        for (const directory of [agentsRoot(), tmpRoot(), logsRoot()])
+                            mkdirSync(directory, { recursive: true });
+                        await pickBackend().init(options.binPath);
+                    },
+                    publish: publishSetup,
+                });
+            },
             subscriptions: new SubscriptionService({
                 agents: async () => (await query.list(true)).map(({ role, status }) => ({
                     roleId: role.id, stateDir: repository.stateDir(role), running: status.supervisor.liveness === 'running',

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import { type InitAnswers } from '../init-wizard.js';
 import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
 import type { FleetQueryService } from '../application/fleet-query-service.js';
@@ -41,6 +42,8 @@ export interface WebServices {
     presetProvenance?: PresetProvenance;
     oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
     subscriptions?: SubscriptionService;
+    /** First-time setup from the packaged presets; the account App supplies only the model choices. */
+    onboardingSetup?(answers: InitAnswers): Promise<void>;
 }
 export interface WebServer {
     app: FastifyInstance;

package/dist/web/server.js

@@ -22,6 +22,7 @@ import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { TaskStateError } from '../rooms-tasks/task-state.js';
 import { isProvider } from '../subscriptions/store.js';
+const ONBOARDING_WORK = ['coordination', 'development', 'review'];
 const statusFor = (code) => ({
     role_not_found: 404, resource_not_found: 404, unauthorized: 401, forbidden: 403, conflict: 409,
     idempotency_conflict: 409, stale_state: 409, rate_limited: 429,
@@ -165,7 +166,57 @@ export async function buildWebServer(services, boundary, options = {}) {
             }
         }));
         const catalog = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8')));
-        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator' };
+        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
+    });
+    // First-time setup is what creates the persistent coordinator. A configuration that loads and
+    // has it is set up, whatever its brains are called; its models are then changed by editing it.
+    const onboardingConfigured = () => {
+        if (!services.configuration)
+            return false;
+        try {
+            return Boolean(services.configuration.read(false).model.agents.FleetCoordinator);
+        }
+        catch {
+            return false;
+        }
+    };
+    let onboardingSetupQueue = Promise.resolve();
+    app.post('/api/v1/onboarding/setup', async (request) => {
+        auth.authenticate(request, true);
+        if (!services.configuration || !services.onboardingSetup)
+            throw new FleetError('capability_unavailable', 'first-time Fleet setup is unavailable');
+        const requested = request.body?.models;
+        const supported = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8'))).models;
+        const models = {};
+        for (const work of ONBOARDING_WORK) {
+            const matches = supported.filter(model => model.harness === requested?.[work]?.harness && model.model === requested?.[work]?.model);
+            if (matches.length !== 1)
+                throw new FleetError('invalid_request', `choose a supported model for ${work}`);
+            models[work] = matches[0];
+        }
+        const chosen = Object.values(models);
+        const subscriptions = [...new Set(chosen.map(model => model.harness === 'codex' ? 'codex' : 'claude'))];
+        const oneModel = new Set(chosen.map(model => `${model.harness}\0${model.model}`)).size === 1;
+        const configuration = services.configuration, setup = services.onboardingSetup;
+        // One setup at a time: the first-time check and the publication it guards must not interleave.
+        const run = onboardingSetupQueue.then(async () => {
+            if (onboardingConfigured())
+                throw new FleetError('conflict', 'Fleet is already set up; change its models in the configuration');
+            try {
+                await setup({ subscriptions, assignmentStrategy: oneModel ? 'one-model' : 'per-job', models, reasoning: 'balanced' });
+            }
+            catch (error) {
+                throw new FleetError('backend_failure', `Fleet setup did not complete: ${error.message}`);
+            }
+            // Setup preserves files it finds, so confirm the published models are the ones this request chose.
+            const brains = configuration.read(true).model.brains ?? {};
+            for (const work of ONBOARDING_WORK)
+                if (brains[work]?.harness !== models[work].harness || brains[work]?.model !== models[work].model)
+                    throw new FleetError('conflict', 'Fleet was set up with different models; review its configuration');
+            return { configured: true };
+        });
+        onboardingSetupQueue = run.catch(() => { });
+        return run;
     });
     app.get('/api/v1/creation-capabilities', async (request) => {
         auth.authenticate(request);

package/dist/web-app/version.json

@@ -1 +1 @@
-{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T10:38:31.229Z"}
+{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T12:14:07.133Z"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.33",
+  "version": "1.2.0-nightly.34",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",