@ours.network/fleet 1.2.0-nightly.33 → 1.2.0-nightly.35

package/dist/application/codex-models.d.ts

@@ -0,0 +1,15 @@
+import { type OfferedModels } from '../subscriptions/cli.js';
+export interface CodexModelDiscoveryDeps {
+    /** The Codex executable ACP sessions will run, and its version. */
+    runtime(): Promise<{
+        executable: string;
+        version: string;
+    }>;
+    ask(executable: string, env: NodeJS.ProcessEnv): Promise<OfferedModels>;
+    now(): number;
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export declare function createCodexModelDiscovery(overrides?: Partial<CodexModelDiscoveryDeps>): () => Promise<OfferedModels>;

package/dist/application/codex-models.js

@@ -0,0 +1,56 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveBundledAcpAgent } from '../harness/acp-agent.js';
+import { probeCodexRuntime } from '../harness/codex-runtime.js';
+import { codexOfferedModels, profileEnv } from '../subscriptions/cli.js';
+import { profileHome, readSubscriptionState } from '../subscriptions/store.js';
+const KNOWN_FOR_MS = 5 * 60_000;
+const UNKNOWN_FOR_MS = 10_000;
+/** When the profile's sign-in last changed; a new sign-in must not reuse another account's answer. */
+function signInStamp(home) {
+    try {
+        return statSync(join(home, 'auth.json')).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export function createCodexModelDiscovery(overrides = {}) {
+    const deps = {
+        runtime: () => probeCodexRuntime(resolveBundledAcpAgent('@agentclientprotocol/codex-acp', 'codex-acp', 'codex-acp'), process.env),
+        ask: codexOfferedModels,
+        now: Date.now,
+        ...overrides,
+    };
+    let cached;
+    let pending;
+    return async () => {
+        let key, executable, env;
+        try {
+            const profileId = readSubscriptionState().providers.codex.activeProfileId;
+            const profile = profileHome('codex', profileId);
+            const runtime = await deps.runtime();
+            executable = runtime.executable;
+            env = profileEnv('CODEX_HOME', profileId, profile);
+            key = [runtime.executable, runtime.version, profileId, signInStamp(profile)].join('\n');
+        }
+        catch (error) {
+            return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+        }
+        if (cached && cached.key === key && cached.until > deps.now())
+            return cached.value;
+        if (pending?.key === key)
+            return pending.answer;
+        const answer = deps.ask(executable, env).then(value => {
+            cached = { key, until: deps.now() + (value.state === 'known' ? KNOWN_FOR_MS : UNKNOWN_FOR_MS), value };
+            return value;
+        }).finally(() => { if (pending?.key === key)
+            pending = undefined; });
+        pending = { key, answer };
+        return answer;
+    };
+}

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.33",
-  "buildId": "c27262dcfdeb",
-  "commit": "57b2fa27b72ae4f53fbad81e966139474b7a6e03",
+  "version": "1.2.0-nightly.35",
+  "buildId": "8e9a6c78b17e",
+  "commit": "88af91aca3e52e9a82830df15d9ff63618393d02",
   "dirty": true,
-  "builtAt": "2026-10-02T10:40:46.562Z",
+  "builtAt": "2026-10-02T15:09:21.240Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { ensureMinimalSetup } from './minimal-setup.js';
-import { configureWorkspacePort } from './workspace-enrollment.js';
+import { confirmWorkspaceTarget } from './workspace-enrollment.js';
 import { clearPendingTunnelSetup, readPendingTunnelSetup, requiredPortAfterExpiry, savePendingTunnelSetup, setupTunnelPreflight } from './setup-tunnel-preflight.js';
 import { availableWebPort } from './web/available-port.js';
 import QRCode from 'qrcode';
-import { readWorkspacePayload, enrollWorkspace } from './workspace-enrollment.js';
+import { readWorkspacePayload, enrollWorkspace, checkWorkspaceConfiguration } from './workspace-enrollment.js';
 import { waitForRoleDaemon } from './startup-readiness.js';
 import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
@@ -1541,6 +1541,7 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
             throw Error('--check and --resume take no payload file or migration flag');
         if (setupTunnel && opts.check) {
             await setupTunnelPreflight();
+            await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
             process.stdout.write('Tunnel setup prerequisites are available.\n');
             return;
         }
@@ -1557,6 +1558,7 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
             const payload = readWorkspacePayload(opts.file);
             if (setupTunnel) {
                 await setupTunnelPreflight();
+                await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
                 await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
             }
             const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
@@ -1629,7 +1631,7 @@ async function finishWorkspaceService(pending, configuration, record) {
             pending = { ...pending, requestedPorts: [...(pending.requestedPorts ?? []), bound.port] };
             savePendingTunnelSetup(pending);
         }
-        await configureWorkspacePort(pending, pending.hostWorkspaceId, pending.rootCid, bound.port);
+        await confirmWorkspaceTarget(pending, pending.hostWorkspaceId, pending.rootCid, bound.port, error => { process.stderr.write(`The enrollment contact could not be removed from Messenger (${error instanceof Error ? error.message : String(error)}); it can be removed there by hand.\n`); });
     }
     else if (bound.port !== requiredPort)
         throw Error(`The setup window has expired and the tunnel points at port ${requiredPort}, but this host could only bind port ${bound.port}. Free port ${requiredPort} on this host`);

package/dist/config.d.ts

@@ -311,6 +311,8 @@ export declare function loadConfig(configPath?: string, options?: {
         temporary?: boolean;
     };
     skipWatchdogs?: boolean;
+    /** The one Owner invitation file that tunnel setup writes itself and that may therefore still be absent. */
+    deferredOwnerInviteFile?: string;
 }): FleetConfig;
 /** Full read-only Agent resolution used by launch dry-runs and room plan validation. */
 export declare function resolveAgentDefinitionDryRun(configPath: string, id: string, definition: AgentDefinition): ResolvedRole;

package/dist/config.js

@@ -764,7 +764,7 @@ export function loadConfig(configPath, options = {}) {
         if (doc.rooms !== undefined) {
             if (rooms)
                 throw new ConfigError(`rooms: defined in multiple files; last: ${file}`);
-            const validated = validateRoomsConfig(deepSub(doc.rooms, vars), vars, file);
+            const validated = validateRoomsConfig(deepSub(doc.rooms, vars), vars, file, options.deferredOwnerInviteFile);
             ownerInviteFingerprint = validated._invite?.fingerprint;
             ownerInvite = validated._invite?.value;
             const { _invite: _, ...clean } = validated;

package/dist/harness/codex-runtime.d.ts

@@ -4,8 +4,18 @@ export declare const VERIFIED_CODEX_ACP_VERSIONS: Set<string>;
 export declare function executableOnPath(command: string, env: NodeJS.ProcessEnv, cwd?: string): string;
 /** Match the npm Codex wrapper's platform-package/vendor selection. */
 export declare function codexExecutable(entry: string): string;
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export declare function hostCodex(adapterManifest: string | undefined, env: NodeJS.ProcessEnv, cwd?: string, version?: (path: string, env: NodeJS.ProcessEnv) => string | undefined): {
+    path: string;
+    version: string;
+} | undefined;
 export interface CodexRuntime {
-    source: 'CODEX_PATH' | 'bundled';
+    source: 'CODEX_PATH' | 'host' | 'bundled';
     entry: string;
     executable: string;
     version: string;

package/dist/harness/codex-runtime.js

@@ -1,5 +1,6 @@
 import { createRequire } from 'node:module';
-import { accessSync, constants, existsSync, realpathSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { accessSync, constants, existsSync, readFileSync, realpathSync } from 'node:fs';
 import { dirname, join, isAbsolute, resolve, delimiter } from 'node:path';
 import { realExec } from '../exec.js';
 export const VERIFIED_CODEX_ACP_VERSIONS = new Set(['1.1.7', '1.10.0']);
@@ -46,18 +47,44 @@ export function codexExecutable(entry) {
     }
     throw new Error(`Codex platform binary missing under ${vendor}; reinstall Fleet with optional dependencies`);
 }
+const versionOf = (text) => text.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+function installedCodexVersion(path, env) {
+    const result = spawnSync(path, ['--version'], { env, encoding: 'utf8', timeout: 5_000, stdio: ['ignore', 'pipe', 'ignore'] });
+    return result.status === 0 ? versionOf(result.stdout ?? '') : undefined;
+}
+/**
+ * The host's own Codex, when ACP sessions should run it instead of the copy bundled with the adapter.
+ * The person signs in to, updates and checks the host Codex, and a newer Codex knows models the bundled
+ * one does not. It is used only when it is at least as new as the bundled copy; an explicit CODEX_PATH
+ * (including an empty one, which selects the bundled copy) always decides instead.
+ */
+export function hostCodex(adapterManifest, env, cwd = process.cwd(), version = installedCodexVersion) {
+    if (env.CODEX_PATH !== undefined || !adapterManifest)
+        return undefined;
+    let path, bundled;
+    try {
+        path = executableOnPath('codex', env, cwd);
+        bundled = JSON.parse(readFileSync(createRequire(adapterManifest).resolve('@openai/codex/package.json'), 'utf8')).version;
+    }
+    catch {
+        return undefined;
+    }
+    const found = version(path, env);
+    return found && typeof bundled === 'string' && codexVersionAtLeast(found, bundled) ? { path, version: found } : undefined;
+}
 export async function probeCodexRuntime(adapter, env, exec = realExec, cwd = process.cwd()) {
-    const configured = env.CODEX_PATH;
+    const host = hostCodex(adapter.manifestPath, env, cwd);
+    const configured = env.CODEX_PATH || host?.path;
     if (!configured && !adapter.manifestPath)
         throw new Error('ACP runtime is unknown for a PATH/custom adapter; set CODEX_PATH to an absolute executable or use the bundled adapter');
     const entry = configured ? executableOnPath(configured, env, cwd)
         : createRequire(adapter.manifestPath).resolve('@openai/codex/bin/codex.js');
     const executable = codexExecutable(entry);
     const result = await exec(!configured ? process.execPath : entry, !configured ? [entry, '--version'] : ['--version'], { env, timeout: 5_000 });
-    const version = result.stdout.match(/\b(\d+\.\d+\.\d+)\b/)?.[1];
+    const version = versionOf(result.stdout);
     if (result.code !== 0 || !version)
         throw new Error(`Cannot read Codex version from ${entry}; check CODEX_PATH and executable permissions`);
-    return { source: configured ? 'CODEX_PATH' : 'bundled', entry, executable, version };
+    return { source: host ? 'host' : configured ? 'CODEX_PATH' : 'bundled', entry, executable, version };
 }
 export function codexVersionAtLeast(version, minimum) {
     const actual = version.split('.').map(Number);

package/dist/harness/codex.js

@@ -6,7 +6,7 @@ import { realExec } from '../exec.js';
 import { registerAdapter } from './registry.js';
 import { harnessRuntimeDir } from '../isolation/policy.js';
 import { resolveBundledAcpAgent, } from './acp-agent.js';
-import { VERIFIED_CODEX_ACP_VERSIONS, probeCodexRuntime, codexVersionAtLeast } from './codex-runtime.js';
+import { VERIFIED_CODEX_ACP_VERSIONS, probeCodexRuntime, codexVersionAtLeast, hostCodex } from './codex-runtime.js';
 import { CodexAgentSessionAdapter } from './codex-session.js';
 const OPTION_KEYS = [
     'launcher', 'sandbox', 'approval', 'permission_mode', 'search', 'profile', 'config', 'add_dirs',
@@ -266,7 +266,9 @@ function codexAcpEnvironment(role, dirs) {
         [CODEX_PROXY_APPROVAL_ENV]: approvalPolicy(role) ?? 'on-request',
         [CODEX_PROXY_SANDBOX_ENV]: acpRuntimeSandbox(role),
         [CODEX_PROXY_MANIFEST_ENV]: resolution.manifestPath,
-        [CODEX_PROXY_REAL_PATH_ENV]: role.env?.CODEX_PATH ?? process.env.CODEX_PATH ?? '',
+        // Same choice as probeCodexRuntime: an explicit CODEX_PATH, else a host Codex at least as new as the bundled one.
+        [CODEX_PROXY_REAL_PATH_ENV]: role.env?.CODEX_PATH ?? process.env.CODEX_PATH
+            ?? hostCodex(resolution.manifestPath, { ...process.env, ...role.env }, dirs.runCwd)?.path ?? '',
     };
 }
 function encodeTomlValue(value) {

package/dist/init-wizard.js

@@ -238,7 +238,8 @@ export function generateSetup(answers) {
             `role: { ref: ${role} }`,
             `brain: { ref: ${ROLE_WORK[role]} }`,
             'coordinator: FleetCoordinator',
-            'permissions: { approval: ask, filesystem: workspace, unattended: deny }',
+            // Temporary default while the product is being tested: prepared agents work without asking.
+            'permissions: { approval: allow, filesystem: unrestricted, unattended: deny }',
             'monitor: { mode: fleet, interrupt: after_tool }',
             '',
         ].join('\n'));

package/dist/minimal-setup.js

@@ -3,13 +3,14 @@ import { basename, join } from 'node:path';
 import { withFileLock } from './atomic-file.js';
 import { loadConfig, splitRootFor } from './config.js';
 import { preflightInitPaths } from './init-wizard.js';
+import { workspaceOwnerInvite } from './paths.js';
 /** Prepare only the web configuration; App onboarding chooses agents and brains later. */
 export async function ensureMinimalSetup(configuration) {
     const initial = preflightInitPaths(configuration);
     await withFileLock(join(initial.parent, `.${basename(initial.splitRoot)}.init.lock`), async () => {
         const selected = preflightInitPaths(configuration);
         if (selected.manifestExisted) {
-            loadConfig(selected.configPath, { yamlMode: 'strict' });
+            loadConfig(selected.configPath, { yamlMode: 'strict', deferredOwnerInviteFile: workspaceOwnerInvite() });
             return;
         }
         if (selected.rootExisted)

package/dist/paths.d.ts

@@ -11,6 +11,8 @@ export declare const home: () => string;
  */
 export declare function deriveXdgRuntimeDir(env?: NodeJS.ProcessEnv, uid?: number | undefined, exists?: (p: string) => boolean): string | undefined;
 export declare const stateRoot: () => string;
+/** The Owner invitation file that tunnel setup writes itself after enrollment. */
+export declare const workspaceOwnerInvite: () => string;
 export declare const agentsRoot: () => string;
 export declare const tmpRoot: () => string;
 export declare const logsRoot: () => string;

package/dist/paths.js

@@ -21,6 +21,8 @@ export function deriveXdgRuntimeDir(env = process.env, uid = process.getuid?.(),
     return env.XDG_RUNTIME_DIR;
 }
 export const stateRoot = () => join(home(), '.ours-fleet');
+/** The Owner invitation file that tunnel setup writes itself after enrollment. */
+export const workspaceOwnerInvite = () => join(stateRoot(), 'workspace', 'owner.invite');
 export const agentsRoot = () => join(stateRoot(), 'agents');
 export const tmpRoot = () => join(stateRoot(), 'tmp');
 export const logsRoot = () => join(stateRoot(), 'logs');

package/dist/rooms-tasks/config.d.ts

@@ -4,7 +4,7 @@ export declare class RoomsTasksConfigError extends Error {
     constructor(path: string, message: string);
 }
 export declare function fingerprint(invite: string): string;
-export declare function validateRoomsConfig(raw: unknown, vars: Record<string, string>, path: string): RoomsConfig & {
+export declare function validateRoomsConfig(raw: unknown, vars: Record<string, string>, path: string, deferredInviteFile?: string): RoomsConfig & {
     _invite?: {
         value: string;
         fingerprint: string;

package/dist/rooms-tasks/config.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';
 import { ROOMS_KEYS as RK, ROOMS_OWNER_KEYS as ROK, ROOMS_COWORK_KEYS as RCK, ROOMS_DEFAULTS_KEYS as RDK, TASKS_KEYS as TK, TEMPLATE_KEYS as TPK, TEMPLATE_MEMBER_KEYS as TMK, TEMPLATE_ROOM_KEYS as TRK, } from './types.js';
 const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
@@ -18,7 +19,7 @@ function rejectUnknown(obj, allowed, path, section) {
 export function fingerprint(invite) {
     return createHash('sha256').update(invite.trim()).digest('hex');
 }
-function resolveInvite(owner, vars, path) {
+function resolveInvite(owner, vars, path, deferredInviteFile) {
     const inline = owner.public_invite;
     const file = owner.public_invite_file;
     if (inline && file)
@@ -28,6 +29,10 @@ function resolveInvite(owner, vars, path) {
     let raw;
     if (file) {
         const resolved = file.replace(/\$\{(\w+)\}/g, (m, k) => (k in vars ? String(vars[k]) : m));
+        // Tunnel setup writes this one file itself after enrollment; until then it may be absent.
+        // Only the literal absolute path counts: a relative spelling that happens to reach it does not.
+        if (!existsSync(resolved) && deferredInviteFile !== undefined && isAbsolute(deferredInviteFile) && resolved === deferredInviteFile)
+            return undefined;
         if (!existsSync(resolved))
             throw new RoomsTasksConfigError(path, `rooms.owner.public_invite_file: not found: ${resolved}`);
         raw = readFileSync(resolved, 'utf8').trim();
@@ -39,7 +44,7 @@ function resolveInvite(owner, vars, path) {
         throw new RoomsTasksConfigError(path, 'rooms.owner: invite is empty');
     return { value: raw, fingerprint: fingerprint(raw) };
 }
-export function validateRoomsConfig(raw, vars, path) {
+export function validateRoomsConfig(raw, vars, path, deferredInviteFile) {
     if (!isPlainObject(raw))
         throw new RoomsTasksConfigError(path, 'rooms: must be a mapping');
     // Migration-only input: provider selection was exposed before rooms shipped,
@@ -68,7 +73,7 @@ export function validateRoomsConfig(raw, vars, path) {
     if (!CID_RE.test(expectedCid))
         throw new RoomsTasksConfigError(path, 'rooms.owner.expected_cid: must be exactly 64 hexadecimal characters');
     const ownerRole = raw.owner.role ?? 'Owner';
-    const invite = resolveInvite(raw.owner, vars, path);
+    const invite = resolveInvite(raw.owner, vars, path, deferredInviteFile);
     const owner = {
         provider: ownerProvider,
         expected_cid: expectedCid.toLowerCase(),

package/dist/subscriptions/cli.d.ts

@@ -43,14 +43,27 @@ export declare class CodexAppServer {
     private readonly listeners;
     private closed;
     private constructor();
-    static start(bin: string, env: NodeJS.ProcessEnv): Promise<CodexAppServer>;
+    static start(bin: string, env: NodeJS.ProcessEnv, initializeTimeoutMs?: number): Promise<CodexAppServer>;
     call<T = unknown>(method: string, params: unknown, timeoutMs?: number): Promise<T>;
     onNotification(fn: (method: string, params: unknown) => void): () => void;
     close(): void;
     private onData;
 }
 /** One-shot use of an app-server for a profile. */
-export declare function withCodex<T>(bin: string, env: NodeJS.ProcessEnv, fn: (s: CodexAppServer) => Promise<T>): Promise<T>;
+export declare function withCodex<T>(bin: string, env: NodeJS.ProcessEnv, fn: (s: CodexAppServer) => Promise<T>, initializeTimeoutMs?: number): Promise<T>;
+/** What a Codex runtime offers the account it is signed in to. An empty list is an answer; unknown is not. */
+export type OfferedModels = {
+    state: 'known';
+    models: string[];
+} | {
+    state: 'unknown';
+    reason: string;
+};
+/**
+ * Ask this Codex executable, with this profile's environment, which models it offers (`model/list`,
+ * the call the ACP adapter itself uses). Nothing is inferred when it does not answer.
+ */
+export declare function codexOfferedModels(bin: string, env: NodeJS.ProcessEnv, budgetMs?: number): Promise<OfferedModels>;
 export interface UsageWindow {
     id: string;
     label: string;

package/dist/subscriptions/cli.js

@@ -81,11 +81,18 @@ export class CodexAppServer {
             this.pending.clear();
         });
     }
-    static async start(bin, env) {
+    static async start(bin, env, initializeTimeoutMs = 20_000) {
         const child = spawn(bin, ['app-server'], { env, stdio: ['pipe', 'pipe', 'pipe'] });
         await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
         const server = new CodexAppServer(child);
-        await server.call('initialize', { clientInfo: { name: 'ours-fleet', title: 'Ours Fleet', version: '1' } });
+        // A server that does not answer is not handed out, so nobody else can close it: end it here.
+        try {
+            await server.call('initialize', { clientInfo: { name: 'ours-fleet', title: 'Ours Fleet', version: '1' } }, initializeTimeoutMs);
+        }
+        catch (error) {
+            server.close();
+            throw error;
+        }
         child.stdin.write(`${JSON.stringify({ method: 'initialized' })}\n`);
         return server;
     }
@@ -140,8 +147,8 @@ export class CodexAppServer {
     }
 }
 /** One-shot use of an app-server for a profile. */
-export async function withCodex(bin, env, fn) {
-    const server = await CodexAppServer.start(bin, env);
+export async function withCodex(bin, env, fn, initializeTimeoutMs) {
+    const server = await CodexAppServer.start(bin, env, initializeTimeoutMs);
     try {
         return await fn(server);
     }
@@ -149,6 +156,36 @@ export async function withCodex(bin, env, fn) {
         server.close();
     }
 }
+/**
+ * Ask this Codex executable, with this profile's environment, which models it offers (`model/list`,
+ * the call the ACP adapter itself uses). Nothing is inferred when it does not answer.
+ */
+export async function codexOfferedModels(bin, env, budgetMs = 30_000) {
+    // One budget for the whole question: onboarding waits for this answer.
+    const deadline = Date.now() + budgetMs;
+    const left = () => Math.max(1, deadline - Date.now());
+    try {
+        return await withCodex(bin, env, async (server) => {
+            const models = [];
+            let cursor = null;
+            while (Date.now() < deadline) {
+                const answer = await server.call('model/list', { cursor, limit: null }, left());
+                if (!Array.isArray(answer?.data))
+                    return { state: 'unknown', reason: 'Codex did not return a model list' };
+                for (const model of answer.data)
+                    if (model && typeof model.id === 'string' && model.id && model.hidden !== true)
+                        models.push(model.id);
+                cursor = typeof answer.nextCursor === 'string' && answer.nextCursor ? answer.nextCursor : null;
+                if (!cursor)
+                    return { state: 'known', models: [...new Set(models)] };
+            }
+            return { state: 'unknown', reason: 'Codex did not finish listing its models in time' };
+        }, left());
+    }
+    catch (error) {
+        return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+    }
+}
 /** Flatten `account/rateLimits/read` into display windows. */
 export function codexUsageWindows(result) {
     const snapshots = result.rateLimitsByLimitId && Object.keys(result.rateLimitsByLimitId).length

package/dist/web/auth.d.ts

@@ -52,6 +52,8 @@ export declare class WebAuth {
     }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request: Pick<FastifyRequest, 'headers'>): string | undefined;
     validateBoundary(request: FastifyRequest, requireOrigin: boolean, allowPageNavigation?: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;

package/dist/web/auth.js

@@ -54,6 +54,10 @@ export class WebAuth {
         this.bootstrapUsed = false;
         return this._bootstrapSecret;
     }
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request) {
+        return this.workspaceDevices && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
+    }
     validateBoundary(request, requireOrigin, allowPageNavigation = false) {
         const host = request.headers.host;
         const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);

package/dist/web/prefix-gateway.js

@@ -72,14 +72,31 @@ export function createPrefixGateway(options) {
         timer.unref();
         return () => { clearInterval(timer); unbind(); };
     };
+    // The account App calls workspace services directly from its own origin with a device
+    // credential. Only that exact configured origin is answered; the reply grants nothing by
+    // itself, every request is still authenticated below.
+    const accountCors = (req) => {
+        const origin = auth?.accountOrigin(req);
+        return origin ? { 'access-control-allow-origin': origin, vary: 'Origin',
+            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag' } : {};
+    };
     const server = createServer((req, res) => {
+        const cors = accountCors(req);
         let route;
         try {
+            if (req.method === 'OPTIONS' && cors.vary && req.headers['access-control-request-method'] && select(req).service) {
+                auth.validateBoundary({ headers: req.headers, method: req.method, url: req.url }, false);
+                res.writeHead(204, { ...cors, 'cache-control': 'no-store', 'access-control-max-age': '600',
+                    'access-control-allow-methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
+                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration' });
+                res.end();
+                return;
+            }
             route = prepare(req);
         }
         catch (error) {
             const code = error.code;
-            res.writeHead(code === 'unauthorized' ? 401 : 403, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            res.writeHead(code === 'unauthorized' ? 401 : 403, { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store' });
             res.end(JSON.stringify({ error: { code: code ?? 'forbidden', message: error.message } }));
             return;
         }
@@ -92,8 +109,13 @@ export function createPrefixGateway(options) {
             method: req.method, path: route.path, headers: route.headers,
         }, response => {
             const headers = headersFor(response);
-            if (route.service)
+            if (route.service) {
                 delete headers['set-cookie'];
+                for (const key of Object.keys(headers))
+                    if (key.startsWith('access-control-'))
+                        delete headers[key];
+                Object.assign(headers, cors);
+            }
             res.writeHead(response.statusCode ?? 502, headers);
             response.on('error', () => res.destroy());
             response.on('aborted', () => res.destroy());
@@ -104,7 +126,7 @@ export function createPrefixGateway(options) {
         });
         upstream.on('error', () => {
             if (!res.headersSent)
-                res.writeHead(502, { 'content-type': 'application/json' });
+                res.writeHead(502, { ...(route.service ? cors : {}), 'content-type': 'application/json' });
             res.end(JSON.stringify({ error: { code: 'upstream_unavailable', message: 'Service is unavailable' } }));
         });
         const untrack = track(req, route.session, () => { upstream.destroy(); res.destroy(); });

package/dist/web/runtime.js

@@ -10,7 +10,8 @@ import { spawn } from 'node:child_process';
 import { FleetNotificationProducer } from '../notifications/fleet-producer.js';
 import { producerConfig } from '../notifications/outbox.js';
 import { SubscriptionService } from '../subscriptions/service.js';
-import { existsSync, realpathSync, readFileSync } from 'node:fs';
+import { createCodexModelDiscovery } from '../application/codex-models.js';
+import { existsSync, mkdirSync, realpathSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from '../config.js';
 import { RoleRepository } from '../application/role-repository.js';
@@ -24,7 +25,8 @@ import { FleetError } from '../application/errors.js';
 import { controlRequest, controlSocketPath } from '../session/control.js';
 import { pickBackend } from '../supervisor/index.js';
 import { realExec } from '../exec.js';
-import { home, stateRoot, agentsRoot, tmpRoot } from '../paths.js';
+import { home, stateRoot, agentsRoot, tmpRoot, logsRoot } from '../paths.js';
+import { executeInitAnswers, publishSetup } from '../init-wizard.js';
 import { AuditSink } from './audit.js';
 import { FleetEventBus } from './events.js';
 import { buildWebServer } from './server.js';
@@ -190,6 +192,18 @@ export async function startWebConsole(options) {
             layoutBindings: new LayoutBindingGrants(new RoomLayoutService(options.configPath).supervisor()),
             presetProvenance: new PresetProvenance(options.configPath),
             topology: readTopology, topologyDrafts, topologyPromote,
+            // Same boundary as `ours-fleet init --settings`: existing files are preserved, missing defaults are added.
+            onboardingSetup: async (answers) => {
+                await executeInitAnswers(answers, configuration.path, {
+                    async hostSetup() {
+                        for (const directory of [agentsRoot(), tmpRoot(), logsRoot()])
+                            mkdirSync(directory, { recursive: true });
+                        await pickBackend().init(options.binPath);
+                    },
+                    publish: publishSetup,
+                });
+            },
+            codexModels: createCodexModelDiscovery(),
             subscriptions: new SubscriptionService({
                 agents: async () => (await query.list(true)).map(({ role, status }) => ({
                     roleId: role.id, stateDir: repository.stateDir(role), running: status.supervisor.liveness === 'running',

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import { type InitAnswers } from '../init-wizard.js';
 import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
 import type { FleetQueryService } from '../application/fleet-query-service.js';
@@ -18,6 +19,7 @@ import type { RoleRemovalService } from '../application/role-removal-service.js'
 import type { TaskRoomApplicationService } from '../application/task-room-service.js';
 import type { RoomLayoutDefinitions } from '../application/room-layout-definitions.js';
 import type { PresetProvenance } from '../application/preset-provenance.js';
+import type { OfferedModels } from '../subscriptions/cli.js';
 import type { SubscriptionService } from '../subscriptions/service.js';
 import type { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
 export interface WebServices {
@@ -41,6 +43,10 @@ export interface WebServices {
     presetProvenance?: PresetProvenance;
     oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
     subscriptions?: SubscriptionService;
+    /** First-time setup from the packaged presets; the account App supplies only the model choices. */
+    onboardingSetup?(answers: InitAnswers): Promise<void>;
+    /** The Codex models the runtime that sessions will use offers the active account. Absent: this server cannot tell, and filters nothing. */
+    codexModels?(): Promise<OfferedModels>;
 }
 export interface WebServer {
     app: FastifyInstance;

package/dist/web/server.js

@@ -22,6 +22,7 @@ import { ROLE_NAME_RE } from '../config.js';
 import { TaskListError } from '../rooms-tasks/task-lists.js';
 import { TaskStateError } from '../rooms-tasks/task-state.js';
 import { isProvider } from '../subscriptions/store.js';
+const ONBOARDING_WORK = ['coordination', 'development', 'review'];
 const statusFor = (code) => ({
     role_not_found: 404, resource_not_found: 404, unauthorized: 401, forbidden: 403, conflict: 409,
     idempotency_conflict: 409, stale_state: 409, rate_limited: 429,
@@ -165,7 +166,63 @@ export async function buildWebServer(services, boundary, options = {}) {
             }
         }));
         const catalog = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8')));
-        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator' };
+        // Codex models are offered only when the runtime itself listed them for the active account.
+        // When it could not be asked, none is offered and the reason is reported.
+        const codexModels = services.codexModels ? await services.codexModels() : undefined;
+        const offered = (model) => model.harness !== 'codex' || !codexModels || (codexModels.state === 'known' && codexModels.models.includes(model.model));
+        return { harnesses, catalog: catalog.models.filter(offered), ...(codexModels ? { codexModels: codexModels.state === 'known' ? { state: 'known' } : codexModels } : {}), providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
+    });
+    // First-time setup is what creates the persistent coordinator. A configuration that loads and
+    // has it is set up, whatever its brains are called; its models are then changed by editing it.
+    const onboardingConfigured = () => {
+        if (!services.configuration)
+            return false;
+        try {
+            return Boolean(services.configuration.read(false).model.agents.FleetCoordinator);
+        }
+        catch {
+            return false;
+        }
+    };
+    let onboardingSetupQueue = Promise.resolve();
+    app.post('/api/v1/onboarding/setup', async (request) => {
+        auth.authenticate(request, true);
+        if (!services.configuration || !services.onboardingSetup)
+            throw new FleetError('capability_unavailable', 'first-time Fleet setup is unavailable');
+        const requested = request.body?.models;
+        const codexModels = services.codexModels ? await services.codexModels() : undefined;
+        const supported = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8'))).models
+            .filter(model => model.harness !== 'codex' || !codexModels || (codexModels.state === 'known' && codexModels.models.includes(model.model)));
+        const models = {};
+        for (const work of ONBOARDING_WORK) {
+            const matches = supported.filter(model => model.harness === requested?.[work]?.harness && model.model === requested?.[work]?.model);
+            if (matches.length !== 1)
+                throw new FleetError('invalid_request', `choose a supported model for ${work}`);
+            models[work] = matches[0];
+        }
+        const chosen = Object.values(models);
+        const subscriptions = [...new Set(chosen.map(model => model.harness === 'codex' ? 'codex' : 'claude'))];
+        const oneModel = new Set(chosen.map(model => `${model.harness}\0${model.model}`)).size === 1;
+        const configuration = services.configuration, setup = services.onboardingSetup;
+        // One setup at a time: the first-time check and the publication it guards must not interleave.
+        const run = onboardingSetupQueue.then(async () => {
+            if (onboardingConfigured())
+                throw new FleetError('conflict', 'Fleet is already set up; change its models in the configuration');
+            try {
+                await setup({ subscriptions, assignmentStrategy: oneModel ? 'one-model' : 'per-job', models, reasoning: 'balanced' });
+            }
+            catch (error) {
+                throw new FleetError('backend_failure', `Fleet setup did not complete: ${error.message}`);
+            }
+            // Setup preserves files it finds, so confirm the published models are the ones this request chose.
+            const brains = configuration.read(true).model.brains ?? {};
+            for (const work of ONBOARDING_WORK)
+                if (brains[work]?.harness !== models[work].harness || brains[work]?.model !== models[work].model)
+                    throw new FleetError('conflict', 'Fleet was set up with different models; review its configuration');
+            return { configured: true };
+        });
+        onboardingSetupQueue = run.catch(() => { });
+        return run;
     });
     app.get('/api/v1/creation-capabilities', async (request) => {
         auth.authenticate(request);

package/dist/web-app/version.json

@@ -1 +1 @@
-{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T10:38:31.229Z"}
+{"sha":"21b1610c125e41982803ecc8c389c169dd1252c4","time":"2026-10-02T15:06:32.814Z"}

package/dist/workspace-enrollment.d.ts

@@ -16,6 +16,11 @@ export interface WorkspacePayload {
     };
 }
 export declare function readWorkspacePayload(file: string): WorkspacePayload;
+/**
+ * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
+ * Reads only; an existing Owner is compared with this host's own Messenger identity.
+ */
+export declare function checkWorkspaceConfiguration(configuration?: string): Promise<void>;
 export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
     migrateAppOrigin?: boolean;
     preserveProfile?: boolean;
@@ -25,4 +30,16 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
     rootCid: any;
 }>;
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+/**
+ * The enrollment server contact exists only to carry the signed binding. Once the account has confirmed
+ * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
+ * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
+ */
+export declare function removeEnrollmentContact(): Promise<boolean>;
 export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
+/**
+ * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
+ * only after that answer is the enrollment contact removed; a refused or unconfirmed target leaves it,
+ * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
+ */
+export declare function confirmWorkspaceTarget(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number, cleanupFailed?: (error: unknown) => void): Promise<void>;

package/dist/workspace-enrollment.js

@@ -1,11 +1,12 @@
 import { validateAccountOrigin } from './account-origin.js';
-import { lstatSync, readFileSync, mkdirSync, existsSync } from 'node:fs';
+import { lstatSync, readFileSync, readdirSync, mkdirSync, existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { readClientProfile } from './client-profile.js';
-import { stateRoot, defaultConfigPath } from './paths.js';
+import { stateRoot, defaultConfigPath, workspaceOwnerInvite } from './paths.js';
 import { replaceFileAtomically } from './atomic-file.js';
 import { loadConfig, splitRootFor } from './config.js';
-import { stringify } from 'yaml';
+import { parse, stringify } from 'yaml';
+import { preflightInitPaths } from './init-wizard.js';
 import { WebAccessStore } from './web/access.js';
 import { WorkspaceDeviceStore } from './web/workspace-devices.js';
 export function readWorkspacePayload(file) {
@@ -26,17 +27,85 @@ export function readWorkspacePayload(file) {
             throw Error('Invalid workspace payload');
     return p;
 }
-export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+const GENERATED_VERSION = 'ours.network/fleet/v2';
+/** The rooms section tunnel setup writes for the enrolled Human root. */
+const generatedRooms = (rootCid, inviteFile) => ({ rooms: { owner: { provider: 'messenger-server', expected_cid: rootCid, public_invite_file: inviteFile, role: 'Owner' }, defaults: { attach_owner: true, close_when_task_done: true } } });
+/**
+ * True only when this configuration is, key for key, what tunnel setup generated itself and nothing
+ * else was added beside it. Only then may its Owner entry be treated as the record of an enrollment.
+ */
+function generatedConfigurationOnly(configuration) {
+    let document;
+    try {
+        document = parse(readFileSync(configuration, 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    const only = (value, keys) => !!value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).sort().join() === [...keys].sort().join();
+    if (!only(document, ['api_version', 'rooms']) || document.api_version !== GENERATED_VERSION)
+        return false;
+    const rooms = document.rooms;
+    if (!only(rooms, ['owner', 'defaults']) || !only(rooms.owner, ['provider', 'expected_cid', 'public_invite_file', 'role']) || !only(rooms.defaults, ['attach_owner', 'close_when_task_done']))
+        return false;
+    if (rooms.owner.provider !== 'messenger-server' || rooms.owner.role !== 'Owner' || rooms.owner.public_invite_file !== workspaceOwnerInvite() || typeof rooms.owner.expected_cid !== 'string' || !/^[a-f0-9]{64}$/i.test(rooms.owner.expected_cid)
+        || rooms.defaults.attach_owner !== true || rooms.defaults.close_when_task_done !== true)
+        return false;
+    const split = splitRootFor(configuration);
+    if (!existsSync(split))
+        return true;
+    const entries = readdirSync(split);
+    return entries.every(entry => entry === 'agents') && (!entries.length || (lstatSync(join(split, 'agents')).isDirectory() && readdirSync(join(split, 'agents')).length === 0));
+}
+/**
+ * The Owner entry of a generated configuration records an enrollment whose host state is gone:
+ * no binding and no invitation remain. Nothing else is ever replaced.
+ */
+const recordsLostEnrollment = (configuration) => !existsSync(join(stateRoot(), 'workspace', 'binding.json')) && !existsSync(workspaceOwnerInvite()) && generatedConfigurationOnly(configuration);
+function hostMessenger() {
     const profile = readClientProfile();
     const base = new URL(profile.endpoint);
     base.pathname = base.pathname.replace(/\/daemon\/?$/, '/messenger/');
     if (!base.pathname.endsWith('/messenger/'))
         throw Error('Workspace setup requires the supported gateway client profile');
     const secret = readFileSync(profile.credentialPath, 'utf8').trim();
-    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
+    return async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
         await response.body?.cancel();
         throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
     } return response.json(); };
+}
+/**
+ * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
+ * Reads only; an existing Owner is compared with this host's own Messenger identity.
+ */
+export async function checkWorkspaceConfiguration(configuration = defaultConfigPath()) {
+    const paths = preflightInitPaths(configuration);
+    if (!paths.manifestExisted) {
+        if (paths.rootExisted)
+            throw Error(`${paths.splitRoot} exists without ${paths.configPath}. Restore that file or move the directory away.`);
+        return;
+    }
+    const loaded = loadConfig(paths.configPath, { yamlMode: 'strict', deferredOwnerInviteFile: workspaceOwnerInvite() });
+    if (!loaded.rooms)
+        return;
+    if (loaded.rooms.defaults?.attach_owner === false)
+        throw Error(`${paths.configPath}: rooms.defaults.attach_owner is disabled; enable it before tunnel setup.`);
+    if (!loaded.rooms.owner.public_invite_file)
+        throw Error(`${paths.configPath}: rooms.owner must use public_invite_file before tunnel setup.`);
+    let cid;
+    try {
+        cid = (await hostMessenger()('workspace/enrollment-identity')).cid;
+    }
+    catch {
+        cid = undefined;
+    }
+    if (typeof cid !== 'string' || !/^[a-f0-9]{64}$/i.test(cid))
+        throw Error(`${paths.configPath} names a room Owner, and this host's Messenger identity cannot be read to compare with it. Start Messenger on this host first.`);
+    if (loaded.rooms.owner.expected_cid.toLowerCase() !== cid.toLowerCase() && !recordsLostEnrollment(paths.configPath))
+        throw Error(`${paths.configPath}: rooms.owner.expected_cid names a different Owner than this host's Messenger identity. Tunnel setup does not replace an existing Owner.`);
+}
+export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+    const request = hostMessenger();
     if (new WebAccessStore().read().mode === 'none')
         throw Error('Workspace enrollment requires protected web access; enable pairing or password before setup');
     const dir = join(stateRoot(), 'workspace');
@@ -55,7 +124,9 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         if (migrating && previous.serverCid && previous.serverCid.toUpperCase() !== payload.serverCid.toUpperCase())
             throw Error('Account origin migration must retain the enrollment server identity');
     }
-    const loaded = loadConfig(configuration);
+    const loaded = loadConfig(configuration, { deferredOwnerInviteFile: workspaceOwnerInvite() });
+    // Decided before anything is sent or written: the Owner entry is replaced only when it records an enrollment this host has lost.
+    const lost = Boolean(loaded.rooms) && recordsLostEnrollment(resolve(configuration));
     if (loaded.rooms?.defaults?.attach_owner === false)
         throw Error('Existing rooms.defaults.attach_owner is disabled; enable automatic Human Owner admission before workspace setup');
     if (loaded.rooms && !loaded.rooms.owner.public_invite_file)
@@ -65,7 +136,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         throw Error('Bound Messenger identity unavailable');
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
-    if (loaded.rooms && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
+    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
     if (existsSync(inviteFile)) {
@@ -80,7 +151,10 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const result = await request('workspace/enroll', options.preserveProfile ? { ...proofPayload, hostWorkspaceId, preserveProfile: true } : { ...payload, hostWorkspaceId });
     if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
         throw Error('Malformed workspace enrollment response');
-    if (loaded.rooms && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+    // Whatever the configuration said before, what is recorded from here on is this host's own root.
+    if (result.rootCid.toLowerCase() !== identity.cid.toLowerCase())
+        throw Error('Workspace enrollment answered for a different root than this host identity; local configuration is unchanged');
+    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     if (migrating) {
         const deadline = Date.now() + 15000;
@@ -102,7 +176,9 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const split = splitRootFor(configuration);
     mkdirSync(split, { recursive: true, mode: 0o700 });
     if (!loaded.rooms)
-        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify({ rooms: { owner: { provider: 'messenger-server', expected_cid: result.rootCid, public_invite_file: inviteFile, role: 'Owner' }, defaults: { attach_owner: true, close_when_task_done: true } } }), 0o600);
+        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
+    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
     replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
     const origin = `https://${payload.hostname}`;
     replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
@@ -111,6 +187,29 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     return { origin, hostWorkspaceId, rootCid: result.rootCid };
 }
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+/**
+ * The enrollment server contact exists only to carry the signed binding. Once the account has confirmed
+ * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
+ * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
+ */
+export async function removeEnrollmentContact() {
+    let serverCid;
+    try {
+        serverCid = JSON.parse(readFileSync(join(stateRoot(), 'workspace', 'binding.json'), 'utf8')).serverCid;
+    }
+    catch {
+        return false;
+    }
+    if (typeof serverCid !== 'string' || !/^[A-F0-9]{64}$/i.test(serverCid))
+        return false;
+    try {
+        await hostMessenger()('contacts/remove', { contact: serverCid.toUpperCase() });
+    }
+    catch {
+        throw Error('Messenger did not remove it');
+    }
+    return true;
+}
 export async function configureWorkspacePort(payload, hostWorkspaceId, rootCid, port) {
     const deadline = Date.now() + 15000;
     while (true) {
@@ -127,3 +226,12 @@ export async function configureWorkspacePort(payload, hostWorkspaceId, rootCid,
         await new Promise(resolve => setTimeout(resolve, 500));
     }
 }
+/**
+ * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
+ * only after that answer is the enrollment contact removed; a refused or unconfirmed target leaves it,
+ * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
+ */
+export async function confirmWorkspaceTarget(payload, hostWorkspaceId, rootCid, port, cleanupFailed = () => { }) {
+    await configureWorkspacePort(payload, hostWorkspaceId, rootCid, port);
+    await removeEnrollmentContact().catch(cleanupFailed);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.33",
+  "version": "1.2.0-nightly.35",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/presets/fleet/agent_templates/Critic.yaml

@@ -1,5 +1,5 @@
 role: { ref: Critic }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }

package/presets/fleet/agent_templates/Developer.yaml

@@ -1,5 +1,5 @@
 role: { ref: Developer }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }

package/presets/fleet/agent_templates/Engineer.yaml

@@ -1,5 +1,5 @@
 role: { ref: Engineer }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }

package/presets/fleet/agent_templates/LocalCoordinator.yaml

@@ -1,7 +1,7 @@
 role: { ref: LocalCoordinator }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }
 loops:
   continuity:

package/presets/fleet/agents/FleetCoordinator.yaml

@@ -1,3 +1,3 @@
 role: { ref: Coordinator }
 brain: { ref: claude-default }
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }

package/presets/fleet/roles/Coordinator.yaml

@@ -2,6 +2,12 @@ mission: Keep fleet development moving by managing the task backlog, rooms, and
 persona: |
   You are the fleet Coordinator. Own progress and workflow, not execution quality or results.
 
+  Each time your session starts, before anything else, use ours `send_message` to tell
+  `Coordinator Owner Channel` in two or three plain sentences that you are the Fleet Coordinator,
+  that you have started and are ready, and that the owner can ask you anything about the fleet:
+  how the app works, and how to set up new agents, tasks and rooms. Send this introduction once
+  per start; it is not a permission request and needs no reply.
+
   Immediately before each meaningful action, proactively use ours `send_message` to contact
   `Coordinator Owner Channel` with a short, plain one-sentence statement of what you are about to do.
   This is an informational intent notice, never a permission request; proceed without waiting unless

package/presets/manifest.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "preset_revision": 8,
+  "preset_revision": 9,
   "brain_catalog_revision": 4,
   "description": "ours-fleet standard configuration presets"
 }