@ours.network/fleet 1.2.0-nightly.34 → 1.2.0-nightly.36

package/README.md

@@ -139,76 +139,55 @@ the caller's owner channel with the caller and spawned-role details. This is an
 honest-actor convenience and attribution path, not a security boundary; host
 shells and deliberately bypassed absolute binaries retain direct behavior.
 
-## Local web API
+## Local HTTP service
 
-Frontend source and builds are maintained in the standalone `ours-web` repository. Fleet builds only its backend API. Configure a separately built frontend static root when serving the unified application through the gateway. The former console source is preserved there under `legacy-fleet/`.
-
-### Console API usage
-
-The interactive console is packaged with `@ours.network/fleet` and binds to
-IPv4 loopback by default. Remote or proxy exposure is always explicit:
+Fleet is an HTTP backend. It serves no pages, bundles no frontend and opens no
+browser: every screen belongs to the App, which calls this API with a device
+credential. Any address outside `/api/` answers JSON `404`.
 
 ```sh
-npm run build
-ours-fleet web
+ours-fleet setup-tunnel                # connect this host to your App workspace
+ours-fleet link-device                 # connect another browser or device
 # choose a free port for an isolated test:
-ours-fleet web serve --port 0 --no-open
-# nginx/TLS terminates at the declared browser origin; fleet remains loopback-bound
+ours-fleet web serve --port 0
+# nginx/TLS terminates at the declared origin; fleet remains loopback-bound
 ours-fleet web install --public-origin https://fleet.example.com --password-file /secure/fleet-password
-# Intentional no-password mode, for example when nginx already authenticates:
-ours-fleet web install --public-origin https://fleet.example.com --no-password
 ```
 
-The normal `ours-fleet web` command installs or updates an owner-level native
-service, starts it on stable `127.0.0.1:49271`, and opens/re-pairs the browser.
-Linux uses a systemd user unit and macOS uses a LaunchAgent; both restart after
-process failures and send logs to the native supervisor. Service management is
-explicit through `ours-fleet web install|start|stop|restart|status|uninstall`.
-Use `ours-fleet web serve` for a foreground development process. Linux login
-persistence requires linger; the installer reports when it is missing but
+`ours-fleet web` installs or updates an owner-level native service and starts
+it on stable `127.0.0.1:49271`. Linux uses a systemd user unit and macOS uses a
+LaunchAgent; both restart after process failures and send logs to the native
+supervisor. Service management is explicit through
+`ours-fleet web install|start|stop|restart|status|uninstall`. Use
+`ours-fleet web serve` for a foreground development process. `--no-open` is
+still accepted because installed service units pass it; it has no effect. Linux
+login persistence requires linger; the installer reports when it is missing but
 never enables it or requests root privileges.
 
-The normal command opens a one-time five-minute fragment directly in the local
-browser; it does not print a reusable secret. If the browser needs pairing
-again while the server is running, use `ours-fleet web open`. The fragment is
-exchanged once and removed from history. A paired browser receives a rotating,
-30-day `HttpOnly; SameSite=Strict` device credential and can return after a
-session idle timeout or server restart. Use **Sign out** to revoke the current
-browser, or `ours-fleet web revoke-all` to revoke every trusted browser and
-active web session.
-
-Only a domain-separated SHA-256 device-secret hash and bounded timestamps are
-stored in the owner-private fleet state directory (`0700` directory, `0600`
-atomic file). The re-pair and revoke controls use an owner-private Unix socket;
-local processes running as the same OS user are therefore inside the trust
-boundary.
+Use `ours-fleet web revoke-all` to revoke every linked device and active
+session. Only a domain-separated SHA-256 device-secret hash and bounded
+timestamps are stored in the owner-private fleet state directory (`0700`
+directory, `0600` atomic file). The link and revoke controls use an
+owner-private Unix socket; local processes running as the same OS user are
+therefore inside the trust boundary.
 
 On first setup, the CLI requires an explicit access choice: `--password-file`
 or `--pairing` for protected access, or `--no-password` for intentional
 unprotected access. `--password-file` stores only a salted scrypt verifier in
-the owner-private web state; the source file remains operator-managed. New
-browsers sign in and then receive the same rotating HttpOnly trusted-device
-credential. `--no-password` is deliberately named and prints a warning: anyone
-who can reach that origin can control the fleet.
+the owner-private web state; the source file remains operator-managed.
+`--no-password` is deliberately named and prints a warning: anyone who can
+reach that origin can control the fleet.
 
 For nginx on a VPS, keep the default loopback bind and set the exact external
 `--public-origin` (scheme, hostname, optional port). nginx should proxy HTTP and
 WebSocket upgrades to `127.0.0.1:49271` and provide TLS; rewriting the upstream
-Host is not required because the declared browser Origin remains authoritative. To listen beyond
+Host is not required because the declared Origin remains authoritative. To listen beyond
 loopback, add an explicit `--bind`; fleet refuses a non-loopback bind without a
 public origin. Host and Origin validation use that declaration rather than
 trusting forwarded headers. `localhost` and `127.0.0.1` both work in normal
-local mode; an unconfigured hostname gets a self-describing HTML page instead
-of raw internal Host-header JSON.
-
-The console is installable as a standalone PWA. Its service worker caches only
-the data-free offline page and successful content-hashed JavaScript/CSS assets.
-HTML stays network-first and no API, authentication, bootstrap, device,
-WebSocket, terminal, event, audit, log, session, query-bearing, or error response
-is cached. When the local daemon is unavailable, the PWA shows an explicit
-offline shell and no stale fleet state.
+local mode; an unconfigured hostname is refused with a JSON error.
 
-The console provides evidence-separated inventory and status, ACP activity and
+The API provides evidence-separated inventory and status, ACP activity and
 permission controls, redacted logs, typed text send, confirmed lifecycle
 actions, and transactional permanent/temporary creation. Identity is fixed to
 the role name. Creation uses the authenticated

package/dist/application/codex-models.d.ts

@@ -0,0 +1,15 @@
+import { type OfferedModels } from '../subscriptions/cli.js';
+export interface CodexModelDiscoveryDeps {
+    /** The Codex executable ACP sessions will run, and its version. */
+    runtime(): Promise<{
+        executable: string;
+        version: string;
+    }>;
+    ask(executable: string, env: NodeJS.ProcessEnv): Promise<OfferedModels>;
+    now(): number;
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export declare function createCodexModelDiscovery(overrides?: Partial<CodexModelDiscoveryDeps>): () => Promise<OfferedModels>;

package/dist/application/codex-models.js

@@ -0,0 +1,56 @@
+import { statSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveBundledAcpAgent } from '../harness/acp-agent.js';
+import { probeCodexRuntime } from '../harness/codex-runtime.js';
+import { codexOfferedModels, profileEnv } from '../subscriptions/cli.js';
+import { profileHome, readSubscriptionState } from '../subscriptions/store.js';
+const KNOWN_FOR_MS = 5 * 60_000;
+const UNKNOWN_FOR_MS = 10_000;
+/** When the profile's sign-in last changed; a new sign-in must not reuse another account's answer. */
+function signInStamp(home) {
+    try {
+        return statSync(join(home, 'auth.json')).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * The models offered to the active Codex account by the runtime that sessions will actually use.
+ * An answer is reused only for the same executable, version, profile and sign-in.
+ */
+export function createCodexModelDiscovery(overrides = {}) {
+    const deps = {
+        runtime: () => probeCodexRuntime(resolveBundledAcpAgent('@agentclientprotocol/codex-acp', 'codex-acp', 'codex-acp'), process.env),
+        ask: codexOfferedModels,
+        now: Date.now,
+        ...overrides,
+    };
+    let cached;
+    let pending;
+    return async () => {
+        let key, executable, env;
+        try {
+            const profileId = readSubscriptionState().providers.codex.activeProfileId;
+            const profile = profileHome('codex', profileId);
+            const runtime = await deps.runtime();
+            executable = runtime.executable;
+            env = profileEnv('CODEX_HOME', profileId, profile);
+            key = [runtime.executable, runtime.version, profileId, signInStamp(profile)].join('\n');
+        }
+        catch (error) {
+            return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+        }
+        if (cached && cached.key === key && cached.until > deps.now())
+            return cached.value;
+        if (pending?.key === key)
+            return pending.answer;
+        const answer = deps.ask(executable, env).then(value => {
+            cached = { key, until: deps.now() + (value.state === 'known' ? KNOWN_FOR_MS : UNKNOWN_FOR_MS), value };
+            return value;
+        }).finally(() => { if (pending?.key === key)
+            pending = undefined; });
+        pending = { key, answer };
+        return answer;
+    };
+}

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.34",
-  "buildId": "1d0ffc344d7e",
-  "commit": "b17e975b8f21b865f6690fc7299851447b53fdad",
+  "version": "1.2.0-nightly.36",
+  "buildId": "63df63bcda45",
+  "commit": "b4575c95acd1ae2fee42f8f8871bfe9d816a1b1a",
   "dirty": true,
-  "builtAt": "2026-10-02T12:17:07.327Z",
+  "builtAt": "2026-10-02T18:04:01.351Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { ensureMinimalSetup } from './minimal-setup.js';
-import { configureWorkspacePort } from './workspace-enrollment.js';
+import { confirmWorkspaceTarget } from './workspace-enrollment.js';
 import { clearPendingTunnelSetup, readPendingTunnelSetup, requiredPortAfterExpiry, savePendingTunnelSetup, setupTunnelPreflight } from './setup-tunnel-preflight.js';
 import { availableWebPort } from './web/available-port.js';
 import QRCode from 'qrcode';
-import { readWorkspacePayload, enrollWorkspace } from './workspace-enrollment.js';
+import { readWorkspacePayload, enrollWorkspace, checkWorkspaceConfiguration } from './workspace-enrollment.js';
 import { waitForRoleDaemon } from './startup-readiness.js';
 import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
@@ -1394,7 +1394,7 @@ cOpt(program.command('migrate-role-defaults')
         die(error);
     }
 });
-const webCommand = cOpt(program.command('web').description('start or open the secure localhost fleet web console'))
+const webCommand = cOpt(program.command('web').description('start the Fleet HTTP service used by the App'))
     .enablePositionalOptions()
     .option('--port <port>', 'loopback service port (default: 49271)', value => {
     const port = Number(value);
@@ -1402,7 +1402,7 @@ const webCommand = cOpt(program.command('web').description('start or open the se
         throw new Error('invalid port');
     return port;
 })
-    .option('--no-open', 'do not open a browser automatically')
+    .option('--no-open', 'accepted for existing service units; Fleet opens no browser')
     .option('--bind <address>', 'explicit listen address (default: 127.0.0.1)')
     .option('--public-origin <url>', 'browser origin served by an explicit reverse proxy')
     .option('--password-file <path>', 'configure password protection from an owner-readable file')
@@ -1419,12 +1419,7 @@ const webCommand = cOpt(program.command('web').description('start or open the se
         if (accessNotice)
             process.stdout.write(accessNotice + '\n');
         await manager.start();
-        if (opts.open !== false) {
-            await requestWebControlWhenReady('open');
-            process.stdout.write('Control-panel authentication opened in the browser.\n');
-        }
-        else
-            process.stdout.write('Web service started; run `ours-fleet web open` to pair a browser.\n');
+        process.stdout.write('Fleet service started.\n');
     }
     catch (e) {
         die(e);
@@ -1437,7 +1432,7 @@ const webPort = (command) => cOpt(command)
         throw new Error('invalid port');
     return port;
 });
-const webServe = cOpt(webCommand.command('serve').description('run the web console in the foreground'))
+const webServe = cOpt(webCommand.command('serve').description('run the Fleet HTTP service in the foreground'))
     .option('--port <port>', 'loopback port (default: 49271; 0 chooses a free port)', value => {
     const port = Number(value);
     if (!Number.isInteger(port) || port < 0 || port > 65_535)
@@ -1445,7 +1440,7 @@ const webServe = cOpt(webCommand.command('serve').description('run the web conso
     return port;
 });
 webServe
-    .option('--no-open', 'do not open a browser automatically')
+    .option('--no-open', 'accepted for existing service units; Fleet opens no browser')
     .option('--bind <address>', 'explicit listen address (default: 127.0.0.1)')
     .option('--public-origin <url>', 'browser origin served by an explicit reverse proxy')
     .option('--password-file <path>', 'configure password protection from an owner-readable file')
@@ -1456,15 +1451,12 @@ webServe
         const accessNotice = configureWebAccess(opts);
         const consoleServer = await startWebConsole({
             configPath: opts.configuration, port: opts.port,
-            open: opts.open !== false, binPath, bind: opts.bind, publicOrigin: opts.publicOrigin,
+            binPath, bind: opts.bind, publicOrigin: opts.publicOrigin,
             log: line => process.stderr.write(line + '\n'),
         });
         if (accessNotice)
             process.stdout.write(accessNotice + '\n');
         process.stdout.write(`ours-fleet web listening on ${consoleServer.address}\n`);
-        process.stdout.write(opts.open !== false
-            ? 'Control-panel authentication opened in the browser.\n'
-            : 'Run `ours-fleet web open` to authenticate a browser.\n');
         const shutdown = async () => { await consoleServer.close(); process.exit(0); };
         process.once('SIGINT', () => { void shutdown(); });
         process.once('SIGTERM', () => { void shutdown(); });
@@ -1523,16 +1515,6 @@ webCommand.command('uninstall').description('stop and uninstall the owner web se
         die(e);
     }
 });
-webCommand.command('open').description('securely open or re-pair a browser with the running console')
-    .action(async () => {
-    try {
-        await requestWebControl('open');
-        process.stdout.write('Control-panel authentication opened in the browser.\n');
-    }
-    catch (e) {
-        die(e);
-    }
-});
 async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
     try {
         if (setupTunnel && opts.check && opts.resume)
@@ -1541,6 +1523,7 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
             throw Error('--check and --resume take no payload file or migration flag');
         if (setupTunnel && opts.check) {
             await setupTunnelPreflight();
+            await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
             process.stdout.write('Tunnel setup prerequisites are available.\n');
             return;
         }
@@ -1557,6 +1540,7 @@ async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
             const payload = readWorkspacePayload(opts.file);
             if (setupTunnel) {
                 await setupTunnelPreflight();
+                await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
                 await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
             }
             const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
@@ -1629,7 +1613,7 @@ async function finishWorkspaceService(pending, configuration, record) {
             pending = { ...pending, requestedPorts: [...(pending.requestedPorts ?? []), bound.port] };
             savePendingTunnelSetup(pending);
         }
-        await configureWorkspacePort(pending, pending.hostWorkspaceId, pending.rootCid, bound.port);
+        await confirmWorkspaceTarget(pending, pending.hostWorkspaceId, pending.rootCid, bound.port, error => { process.stderr.write(`The enrollment contact could not be removed from Messenger (${error instanceof Error ? error.message : String(error)}); it can be removed there by hand.\n`); });
     }
     else if (bound.port !== requiredPort)
         throw Error(`The setup window has expired and the tunnel points at port ${requiredPort}, but this host could only bind port ${bound.port}. Free port ${requiredPort} on this host`);
@@ -1669,20 +1653,6 @@ webCommand.command('revoke-all').description('revoke all trusted browsers and ac
         die(e);
     }
 });
-async function requestWebControlWhenReady(command) {
-    let last;
-    for (let attempt = 0; attempt < 40; attempt++) {
-        try {
-            await requestWebControl(command, undefined, 500);
-            return;
-        }
-        catch (error) {
-            last = error;
-            await new Promise(resolve => setTimeout(resolve, 125));
-        }
-    }
-    throw last;
-}
 function configureWebAccess(opts) {
     if (opts.publicOrigin)
         validatePublicOrigin(opts.publicOrigin);

package/dist/config.d.ts

@@ -311,6 +311,8 @@ export declare function loadConfig(configPath?: string, options?: {
         temporary?: boolean;
     };
     skipWatchdogs?: boolean;
+    /** The one Owner invitation file that tunnel setup writes itself and that may therefore still be absent. */
+    deferredOwnerInviteFile?: string;
 }): FleetConfig;
 /** Full read-only Agent resolution used by launch dry-runs and room plan validation. */
 export declare function resolveAgentDefinitionDryRun(configPath: string, id: string, definition: AgentDefinition): ResolvedRole;

package/dist/config.js

@@ -764,7 +764,7 @@ export function loadConfig(configPath, options = {}) {
         if (doc.rooms !== undefined) {
             if (rooms)
                 throw new ConfigError(`rooms: defined in multiple files; last: ${file}`);
-            const validated = validateRoomsConfig(deepSub(doc.rooms, vars), vars, file);
+            const validated = validateRoomsConfig(deepSub(doc.rooms, vars), vars, file, options.deferredOwnerInviteFile);
             ownerInviteFingerprint = validated._invite?.fingerprint;
             ownerInvite = validated._invite?.value;
             const { _invite: _, ...clean } = validated;