@ours.network/fleet 1.2.0-nightly.34 → 1.2.0-nightly.36

package/dist/subscriptions/cli.js

@@ -81,11 +81,18 @@ export class CodexAppServer {
             this.pending.clear();
         });
     }
-    static async start(bin, env) {
+    static async start(bin, env, initializeTimeoutMs = 20_000) {
         const child = spawn(bin, ['app-server'], { env, stdio: ['pipe', 'pipe', 'pipe'] });
         await new Promise((resolve, reject) => { child.once('spawn', resolve); child.once('error', reject); });
         const server = new CodexAppServer(child);
-        await server.call('initialize', { clientInfo: { name: 'ours-fleet', title: 'Ours Fleet', version: '1' } });
+        // A server that does not answer is not handed out, so nobody else can close it: end it here.
+        try {
+            await server.call('initialize', { clientInfo: { name: 'ours-fleet', title: 'Ours Fleet', version: '1' } }, initializeTimeoutMs);
+        }
+        catch (error) {
+            server.close();
+            throw error;
+        }
         child.stdin.write(`${JSON.stringify({ method: 'initialized' })}\n`);
         return server;
     }
@@ -140,8 +147,8 @@ export class CodexAppServer {
     }
 }
 /** One-shot use of an app-server for a profile. */
-export async function withCodex(bin, env, fn) {
-    const server = await CodexAppServer.start(bin, env);
+export async function withCodex(bin, env, fn, initializeTimeoutMs) {
+    const server = await CodexAppServer.start(bin, env, initializeTimeoutMs);
     try {
         return await fn(server);
     }
@@ -149,6 +156,36 @@ export async function withCodex(bin, env, fn) {
         server.close();
     }
 }
+/**
+ * Ask this Codex executable, with this profile's environment, which models it offers (`model/list`,
+ * the call the ACP adapter itself uses). Nothing is inferred when it does not answer.
+ */
+export async function codexOfferedModels(bin, env, budgetMs = 30_000) {
+    // One budget for the whole question: onboarding waits for this answer.
+    const deadline = Date.now() + budgetMs;
+    const left = () => Math.max(1, deadline - Date.now());
+    try {
+        return await withCodex(bin, env, async (server) => {
+            const models = [];
+            let cursor = null;
+            while (Date.now() < deadline) {
+                const answer = await server.call('model/list', { cursor, limit: null }, left());
+                if (!Array.isArray(answer?.data))
+                    return { state: 'unknown', reason: 'Codex did not return a model list' };
+                for (const model of answer.data)
+                    if (model && typeof model.id === 'string' && model.id && model.hidden !== true)
+                        models.push(model.id);
+                cursor = typeof answer.nextCursor === 'string' && answer.nextCursor ? answer.nextCursor : null;
+                if (!cursor)
+                    return { state: 'known', models: [...new Set(models)] };
+            }
+            return { state: 'unknown', reason: 'Codex did not finish listing its models in time' };
+        }, left());
+    }
+    catch (error) {
+        return { state: 'unknown', reason: error instanceof Error ? error.message : String(error) };
+    }
+}
 /** Flatten `account/rateLimits/read` into display windows. */
 export function codexUsageWindows(result) {
     const snapshots = result.rateLimitsByLimitId && Object.keys(result.rateLimitsByLimitId).length

package/dist/web/auth.d.ts

@@ -54,7 +54,7 @@ export declare class WebAuth {
     mintBootstrap(): string;
     /** The configured account origin, when this request comes from it and workspace devices are enabled. */
     accountOrigin(request: Pick<FastifyRequest, 'headers'>): string | undefined;
-    validateBoundary(request: FastifyRequest, requireOrigin: boolean, allowPageNavigation?: boolean): void;
+    validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;
     anonymous(request: FastifyRequest): BrowserSession;

package/dist/web/auth.js

@@ -58,7 +58,7 @@ export class WebAuth {
     accountOrigin(request) {
         return this.workspaceDevices && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
     }
-    validateBoundary(request, requireOrigin, allowPageNavigation = false) {
+    validateBoundary(request, requireOrigin) {
         const host = request.headers.host;
         const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);
         const origins = this.allowedOrigins.size ? this.allowedOrigins : new Set([this.origin]);
@@ -71,10 +71,7 @@ export class WebAuth {
         if (requireOrigin && !workspaceRequest && (!request.headers.origin || !origins.has(request.headers.origin)))
             throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
         const fetchSite = request.headers['sec-fetch-site'];
-        const pageNavigation = allowPageNavigation && !requireOrigin && request.method === 'GET'
-            && request.headers['sec-fetch-mode'] === 'navigate'
-            && (request.headers['sec-fetch-dest'] === 'document' || (Boolean(this.workspaceDevices) && request.headers['sec-fetch-dest'] === 'iframe' && new URL(request.url || '/', this.origin).searchParams.get('workspace-frame') === '1'));
-        if (!workspaceRequest && !pageNavigation && fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
+        if (!workspaceRequest && fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
             throw new FleetError('forbidden', 'cross-site request rejected');
     }
     exchange(request) {

package/dist/web/control.d.ts

@@ -1,4 +1,4 @@
-export type WebControlCommand = 'open' | 'revoke-all' | 'link-device';
+export type WebControlCommand = 'revoke-all' | 'link-device';
 export declare const webControlPath: (dir?: string) => string;
 export interface WebControlServer {
     path: string;
@@ -6,7 +6,6 @@ export interface WebControlServer {
 }
 export declare function startWebControlServer(options: {
     dir?: string;
-    onOpen(): void | Promise<void>;
     onLinkDevice?(): Record<string, unknown> | Promise<Record<string, unknown>>;
     onRevokeAll(): void | Promise<void>;
     now?: () => number;

package/dist/web/control.js

@@ -38,8 +38,6 @@ export async function startWebControlServer(options) {
                     let result;
                     if (parsed.command === 'link-device' && options.onLinkDevice)
                         result = await options.onLinkDevice();
-                    else if (parsed.command === 'open')
-                        await options.onOpen();
                     else if (parsed.command === 'revoke-all')
                         await options.onRevokeAll();
                     else

package/dist/web/prefix-gateway.js

@@ -27,7 +27,7 @@ export function createPrefixGateway(options) {
         const path = raw.split('?')[0];
         const service = services.find(x => path === x.prefix || path.startsWith(x.prefix + '/'));
         const fleet = path === '/fleet/api' || path.startsWith('/fleet/api/');
-        return { service, page: !service && !fleet && !path.startsWith('/api/'), origin: service?.origin ?? options.fleetOrigin,
+        return { service, origin: service?.origin ?? options.fleetOrigin,
             path: service ? (service.upstreamPrefix || '') + (raw.slice(service.prefix.length) || '/').replace(/^\?/, '/?') : fleet ? raw.slice('/fleet'.length) : raw };
     };
     const prepare = (req, upgrade = false) => {
@@ -35,7 +35,7 @@ export function createPrefixGateway(options) {
         const request = { headers: req.headers, method: req.method, url: route.path };
         if (!auth && (req.headers.origin || req.headers['sec-fetch-site'] || !route.service))
             throw new Error('machine-client listener rejects browser requests');
-        auth?.validateBoundary(request, upgrade, route.page);
+        auth?.validateBoundary(request, upgrade);
         const session = route.service && auth ? auth.authenticate(request, !upgrade && !['GET', 'HEAD', 'OPTIONS'].includes(req.method ?? 'GET')) : undefined;
         const headers = headersFor(req);
         // Forward only the explicit browser context, never an attacker-selected forwarding chain.
@@ -100,11 +100,6 @@ export function createPrefixGateway(options) {
             res.end(JSON.stringify({ error: { code: code ?? 'forbidden', message: error.message } }));
             return;
         }
-        if (req.url === '/') {
-            res.writeHead(302, { location: '/fleet' });
-            res.end();
-            return;
-        }
         const upstream = (route.origin.startsWith('https:') ? httpsRequest : httpRequest)(route.origin, {
             method: req.method, path: route.path, headers: route.headers,
         }, response => {

package/dist/web/runtime.d.ts

@@ -5,9 +5,7 @@ export interface StartWebOptions {
     /** Separate console state for an independently launched gateway. */
     webStateDir?: string;
     control?: boolean;
-    staticRoot?: string;
     port?: number;
-    open?: boolean;
     binPath: string;
     log?(line: string): void;
     bind?: string;

package/dist/web/runtime.js

@@ -6,10 +6,10 @@ import { readClientProfile } from '../client-profile.js';
 import { readPrivateFile } from '@ours.network/sdk/connector';
 import { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
 import { RoomLayoutService } from '../rooms-tasks/layout-service.js';
-import { spawn } from 'node:child_process';
 import { FleetNotificationProducer } from '../notifications/fleet-producer.js';
 import { producerConfig } from '../notifications/outbox.js';
 import { SubscriptionService } from '../subscriptions/service.js';
+import { createCodexModelDiscovery } from '../application/codex-models.js';
 import { existsSync, mkdirSync, realpathSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { loadConfig } from '../config.js';
@@ -202,6 +202,7 @@ export async function startWebConsole(options) {
                     publish: publishSetup,
                 });
             },
+            codexModels: createCodexModelDiscovery(),
             subscriptions: new SubscriptionService({
                 agents: async () => (await query.list(true)).map(({ role, status }) => ({
                     roleId: role.id, stateDir: repository.stateDir(role), running: status.supervisor.liveness === 'running',
@@ -221,7 +222,7 @@ export async function startWebConsole(options) {
                 }
                 throw new FleetError('capability_unavailable', 'role session backend is unavailable');
             },
-        }, { origin: `http://127.0.0.1:${requestedPort}`, host: `127.0.0.1:${requestedPort}` }, { auth, staticRoot: options.staticRoot });
+        }, { origin: `http://127.0.0.1:${requestedPort}`, host: `127.0.0.1:${requestedPort}` }, { auth });
     }
     catch (error) {
         lock.release();
@@ -282,11 +283,6 @@ export async function startWebConsole(options) {
         if (options.control !== false)
             control = await startWebControlServer({
                 dir: webDir,
-                onOpen() {
-                    const url = access.mode === 'pairing'
-                        ? `${browserOrigin}/#bootstrap=${server.auth.mintBootstrap()}` : `${browserOrigin}/`;
-                    openBrowser(url);
-                },
                 onLinkDevice() { return { version: 1, origin: browserOrigin, ...server.auth.workspaceEnrollment() }; },
                 onRevokeAll() { server.auth.revokeAllTrustedDevices(); },
             });
@@ -297,9 +293,6 @@ export async function startWebConsole(options) {
         lock.release();
         throw error;
     }
-    if (options.open !== false)
-        openBrowser(access.mode === 'pairing'
-            ? `${browserOrigin}/#bootstrap=${server.auth.bootstrapSecret}` : `${browserOrigin}/`);
     let stopTunnel;
     try {
         stopTunnel = startWorkspaceTunnel(browserOrigin);
@@ -335,11 +328,3 @@ export async function startWebConsole(options) {
 function isLoopback(host) {
     return ['127.0.0.1', 'localhost', '::1'].includes(host);
 }
-function openBrowser(url) {
-    const command = process.platform === 'darwin' ? 'open'
-        : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    const child = spawn(command, args, { stdio: 'ignore', detached: true, shell: false });
-    child.on('error', () => undefined);
-    child.unref();
-}

package/dist/web/server.d.ts

@@ -19,6 +19,7 @@ import type { RoleRemovalService } from '../application/role-removal-service.js'
 import type { TaskRoomApplicationService } from '../application/task-room-service.js';
 import type { RoomLayoutDefinitions } from '../application/room-layout-definitions.js';
 import type { PresetProvenance } from '../application/preset-provenance.js';
+import type { OfferedModels } from '../subscriptions/cli.js';
 import type { SubscriptionService } from '../subscriptions/service.js';
 import type { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
 export interface WebServices {
@@ -44,6 +45,8 @@ export interface WebServices {
     subscriptions?: SubscriptionService;
     /** First-time setup from the packaged presets; the account App supplies only the model choices. */
     onboardingSetup?(answers: InitAnswers): Promise<void>;
+    /** The Codex models the runtime that sessions will use offers the active account. Absent: this server cannot tell, and filters nothing. */
+    codexModels?(): Promise<OfferedModels>;
 }
 export interface WebServer {
     app: FastifyInstance;
@@ -57,5 +60,4 @@ export declare function buildWebServer(services: WebServices, boundary: {
     host: string;
 }, options?: {
     auth?: WebAuth;
-    staticRoot?: string;
 }): Promise<WebServer>;

package/dist/web/server.js

@@ -6,11 +6,8 @@ import { storeAgentAttachment, attachmentPrompt, MAX_ATTACHMENT_BODY, readAgentA
 import { readChatIdle } from '../temp-idle.js';
 import { agentDir } from '../paths.js';
 import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
-import { existsSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 import Fastify from 'fastify';
-import fastifyStatic from '@fastify/static';
 import fastifyWebsocket from '@fastify/websocket';
 import { createHmac, randomBytes } from 'node:crypto';
 import { FleetError, normalizeError } from '../application/errors.js';
@@ -44,10 +41,8 @@ export async function buildWebServer(services, boundary, options = {}) {
         reply.header('X-Content-Type-Options', 'nosniff');
         reply.header('Referrer-Policy', 'no-referrer');
         reply.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=(), payment=()');
-        // Only the configured account launcher may embed workspace pages.
-        reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; frame-src 'self' blob:; ` +
-            `connect-src 'self' ${auth.secureCookies ? 'wss' : 'ws'}://${auth.host}; object-src 'none'; base-uri 'none'; ` +
-            `frame-ancestors 'self' ${auth.appOrigin}; form-action 'self'; manifest-src 'self'; worker-src 'self'`);
+        // Fleet serves an API only: nothing it returns may run, load or be framed as a page.
+        reply.header('Content-Security-Policy', "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'");
         if (request.url.startsWith('/api/'))
             reply.header('Cache-Control', 'no-store');
         if (request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
@@ -59,15 +54,7 @@ export async function buildWebServer(services, boundary, options = {}) {
                 return reply.code(204).send();
             }
         }
-        try {
-            auth.validateBoundary(request, false, !request.url.startsWith('/api/'));
-        }
-        catch (error) {
-            if (request.url.startsWith('/api/'))
-                throw error;
-            const message = normalizeError(error).message;
-            return reply.code(421).type('text/html').send(`<!doctype html><html><head><title>Fleet console address</title></head><body><main><h1>This fleet-console address is not configured</h1><p>${escapeHtml(message)}</p><p>For nginx or VPS access, configure an explicit public origin. The console does not guess proxy hosts.</p></main></body></html>`);
-        }
+        auth.validateBoundary(request, false);
     });
     app.post('/api/v1/layout-bindings/:id/control', async (request) => {
         // Initial support is direct same-host Fleet-to-Fleet transport.
@@ -166,7 +153,11 @@ export async function buildWebServer(services, boundary, options = {}) {
             }
         }));
         const catalog = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8')));
-        return { harnesses, catalog: catalog.models, providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
+        // Codex models are offered only when the runtime itself listed them for the active account.
+        // When it could not be asked, none is offered and the reason is reported.
+        const codexModels = services.codexModels ? await services.codexModels() : undefined;
+        const offered = (model) => model.harness !== 'codex' || !codexModels || (codexModels.state === 'known' && codexModels.models.includes(model.model));
+        return { harnesses, catalog: catalog.models.filter(offered), ...(codexModels ? { codexModels: codexModels.state === 'known' ? { state: 'known' } : codexModels } : {}), providers: services.subscriptions ? await services.subscriptions.list() : [], coordinator: 'FleetCoordinator', configured: onboardingConfigured() };
     });
     // First-time setup is what creates the persistent coordinator. A configuration that loads and
     // has it is set up, whatever its brains are called; its models are then changed by editing it.
@@ -186,7 +177,9 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (!services.configuration || !services.onboardingSetup)
             throw new FleetError('capability_unavailable', 'first-time Fleet setup is unavailable');
         const requested = request.body?.models;
-        const supported = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8'))).models;
+        const codexModels = services.codexModels ? await services.codexModels() : undefined;
+        const supported = validateCatalog(JSON.parse(readFileSync(join(packagedPresetRoot(), 'brain-catalog.json'), 'utf8'))).models
+            .filter(model => model.harness !== 'codex' || !codexModels || (codexModels.state === 'known' && codexModels.models.includes(model.model)));
         const models = {};
         for (const work of ONBOARDING_WORK) {
             const matches = supported.filter(model => model.harness === requested?.[work]?.harness && model.model === requested?.[work]?.model);
@@ -1022,19 +1015,8 @@ export async function buildWebServer(services, boundary, options = {}) {
             socket.on('close', () => { clearInterval(heartbeat); follow.close(); });
         });
     });
-    const staticRoot = options.staticRoot ?? join(dirname(fileURLToPath(import.meta.url)), '..', 'web-app');
-    if (existsSync(staticRoot)) {
-        await app.register(fastifyStatic, { root: staticRoot, prefix: '/' });
-        app.setNotFoundHandler((request, reply) => {
-            if (request.url.startsWith('/api/'))
-                return reply.code(404).send({ error: 'not found' });
-            const path = request.url.split('?')[0];
-            if ((path === '/chats' || path.startsWith('/chats/')) && existsSync(join(staticRoot, 'fleet-index.html')))
-                return reply.redirect((request.url.includes('?') ? '/fleet/chats' : '/fleet') + (request.url.includes('?') ? request.url.slice(request.url.indexOf('?')) : ''));
-            const fleetEntry = (path === '/fleet' || path.startsWith('/fleet/')) && existsSync(join(staticRoot, 'fleet-index.html'));
-            return reply.sendFile(fleetEntry ? 'fleet-index.html' : 'index.html');
-        });
-    }
+    // Fleet has no pages of its own; every screen belongs to the App.
+    app.setNotFoundHandler((_request, reply) => reply.code(404).send({ error: 'not found' }));
     return {
         app, auth, audit, events,
         async close() {
@@ -1071,9 +1053,6 @@ function promoteRequest(body) {
     };
 }
 function cryptoRandomId() { return randomBytes(12).toString('hex'); }
-function escapeHtml(value) {
-    return value.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
-}
 function requireSubprotocol(request, expected) {
     const protocols = String(request.headers['sec-websocket-protocol'] ?? '')
         .split(',').map(value => value.trim());

package/dist/workspace-enrollment.d.ts

@@ -16,6 +16,11 @@ export interface WorkspacePayload {
     };
 }
 export declare function readWorkspacePayload(file: string): WorkspacePayload;
+/**
+ * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
+ * Reads only; an existing Owner is compared with this host's own Messenger identity.
+ */
+export declare function checkWorkspaceConfiguration(configuration?: string): Promise<void>;
 export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
     migrateAppOrigin?: boolean;
     preserveProfile?: boolean;
@@ -25,4 +30,16 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
     rootCid: any;
 }>;
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+/**
+ * The enrollment server contact exists only to carry the signed binding. Once the account has confirmed
+ * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
+ * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
+ */
+export declare function removeEnrollmentContact(): Promise<boolean>;
 export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
+/**
+ * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
+ * only after that answer is the enrollment contact removed; a refused or unconfirmed target leaves it,
+ * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
+ */
+export declare function confirmWorkspaceTarget(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number, cleanupFailed?: (error: unknown) => void): Promise<void>;

package/dist/workspace-enrollment.js

@@ -1,11 +1,12 @@
 import { validateAccountOrigin } from './account-origin.js';
-import { lstatSync, readFileSync, mkdirSync, existsSync } from 'node:fs';
+import { lstatSync, readFileSync, readdirSync, mkdirSync, existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { readClientProfile } from './client-profile.js';
-import { stateRoot, defaultConfigPath } from './paths.js';
+import { stateRoot, defaultConfigPath, workspaceOwnerInvite } from './paths.js';
 import { replaceFileAtomically } from './atomic-file.js';
 import { loadConfig, splitRootFor } from './config.js';
-import { stringify } from 'yaml';
+import { parse, stringify } from 'yaml';
+import { preflightInitPaths } from './init-wizard.js';
 import { WebAccessStore } from './web/access.js';
 import { WorkspaceDeviceStore } from './web/workspace-devices.js';
 export function readWorkspacePayload(file) {
@@ -26,17 +27,85 @@ export function readWorkspacePayload(file) {
             throw Error('Invalid workspace payload');
     return p;
 }
-export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+const GENERATED_VERSION = 'ours.network/fleet/v2';
+/** The rooms section tunnel setup writes for the enrolled Human root. */
+const generatedRooms = (rootCid, inviteFile) => ({ rooms: { owner: { provider: 'messenger-server', expected_cid: rootCid, public_invite_file: inviteFile, role: 'Owner' }, defaults: { attach_owner: true, close_when_task_done: true } } });
+/**
+ * True only when this configuration is, key for key, what tunnel setup generated itself and nothing
+ * else was added beside it. Only then may its Owner entry be treated as the record of an enrollment.
+ */
+function generatedConfigurationOnly(configuration) {
+    let document;
+    try {
+        document = parse(readFileSync(configuration, 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    const only = (value, keys) => !!value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).sort().join() === [...keys].sort().join();
+    if (!only(document, ['api_version', 'rooms']) || document.api_version !== GENERATED_VERSION)
+        return false;
+    const rooms = document.rooms;
+    if (!only(rooms, ['owner', 'defaults']) || !only(rooms.owner, ['provider', 'expected_cid', 'public_invite_file', 'role']) || !only(rooms.defaults, ['attach_owner', 'close_when_task_done']))
+        return false;
+    if (rooms.owner.provider !== 'messenger-server' || rooms.owner.role !== 'Owner' || rooms.owner.public_invite_file !== workspaceOwnerInvite() || typeof rooms.owner.expected_cid !== 'string' || !/^[a-f0-9]{64}$/i.test(rooms.owner.expected_cid)
+        || rooms.defaults.attach_owner !== true || rooms.defaults.close_when_task_done !== true)
+        return false;
+    const split = splitRootFor(configuration);
+    if (!existsSync(split))
+        return true;
+    const entries = readdirSync(split);
+    return entries.every(entry => entry === 'agents') && (!entries.length || (lstatSync(join(split, 'agents')).isDirectory() && readdirSync(join(split, 'agents')).length === 0));
+}
+/**
+ * The Owner entry of a generated configuration records an enrollment whose host state is gone:
+ * no binding and no invitation remain. Nothing else is ever replaced.
+ */
+const recordsLostEnrollment = (configuration) => !existsSync(join(stateRoot(), 'workspace', 'binding.json')) && !existsSync(workspaceOwnerInvite()) && generatedConfigurationOnly(configuration);
+function hostMessenger() {
     const profile = readClientProfile();
     const base = new URL(profile.endpoint);
     base.pathname = base.pathname.replace(/\/daemon\/?$/, '/messenger/');
     if (!base.pathname.endsWith('/messenger/'))
         throw Error('Workspace setup requires the supported gateway client profile');
     const secret = readFileSync(profile.credentialPath, 'utf8').trim();
-    const request = async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
+    return async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
         await response.body?.cancel();
         throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
     } return response.json(); };
+}
+/**
+ * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
+ * Reads only; an existing Owner is compared with this host's own Messenger identity.
+ */
+export async function checkWorkspaceConfiguration(configuration = defaultConfigPath()) {
+    const paths = preflightInitPaths(configuration);
+    if (!paths.manifestExisted) {
+        if (paths.rootExisted)
+            throw Error(`${paths.splitRoot} exists without ${paths.configPath}. Restore that file or move the directory away.`);
+        return;
+    }
+    const loaded = loadConfig(paths.configPath, { yamlMode: 'strict', deferredOwnerInviteFile: workspaceOwnerInvite() });
+    if (!loaded.rooms)
+        return;
+    if (loaded.rooms.defaults?.attach_owner === false)
+        throw Error(`${paths.configPath}: rooms.defaults.attach_owner is disabled; enable it before tunnel setup.`);
+    if (!loaded.rooms.owner.public_invite_file)
+        throw Error(`${paths.configPath}: rooms.owner must use public_invite_file before tunnel setup.`);
+    let cid;
+    try {
+        cid = (await hostMessenger()('workspace/enrollment-identity')).cid;
+    }
+    catch {
+        cid = undefined;
+    }
+    if (typeof cid !== 'string' || !/^[a-f0-9]{64}$/i.test(cid))
+        throw Error(`${paths.configPath} names a room Owner, and this host's Messenger identity cannot be read to compare with it. Start Messenger on this host first.`);
+    if (loaded.rooms.owner.expected_cid.toLowerCase() !== cid.toLowerCase() && !recordsLostEnrollment(paths.configPath))
+        throw Error(`${paths.configPath}: rooms.owner.expected_cid names a different Owner than this host's Messenger identity. Tunnel setup does not replace an existing Owner.`);
+}
+export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+    const request = hostMessenger();
     if (new WebAccessStore().read().mode === 'none')
         throw Error('Workspace enrollment requires protected web access; enable pairing or password before setup');
     const dir = join(stateRoot(), 'workspace');
@@ -55,7 +124,9 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         if (migrating && previous.serverCid && previous.serverCid.toUpperCase() !== payload.serverCid.toUpperCase())
             throw Error('Account origin migration must retain the enrollment server identity');
     }
-    const loaded = loadConfig(configuration);
+    const loaded = loadConfig(configuration, { deferredOwnerInviteFile: workspaceOwnerInvite() });
+    // Decided before anything is sent or written: the Owner entry is replaced only when it records an enrollment this host has lost.
+    const lost = Boolean(loaded.rooms) && recordsLostEnrollment(resolve(configuration));
     if (loaded.rooms?.defaults?.attach_owner === false)
         throw Error('Existing rooms.defaults.attach_owner is disabled; enable automatic Human Owner admission before workspace setup');
     if (loaded.rooms && !loaded.rooms.owner.public_invite_file)
@@ -65,7 +136,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         throw Error('Bound Messenger identity unavailable');
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
-    if (loaded.rooms && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
+    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
     if (existsSync(inviteFile)) {
@@ -80,7 +151,10 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const result = await request('workspace/enroll', options.preserveProfile ? { ...proofPayload, hostWorkspaceId, preserveProfile: true } : { ...payload, hostWorkspaceId });
     if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
         throw Error('Malformed workspace enrollment response');
-    if (loaded.rooms && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+    // Whatever the configuration said before, what is recorded from here on is this host's own root.
+    if (result.rootCid.toLowerCase() !== identity.cid.toLowerCase())
+        throw Error('Workspace enrollment answered for a different root than this host identity; local configuration is unchanged');
+    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     if (migrating) {
         const deadline = Date.now() + 15000;
@@ -102,7 +176,9 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const split = splitRootFor(configuration);
     mkdirSync(split, { recursive: true, mode: 0o700 });
     if (!loaded.rooms)
-        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify({ rooms: { owner: { provider: 'messenger-server', expected_cid: result.rootCid, public_invite_file: inviteFile, role: 'Owner' }, defaults: { attach_owner: true, close_when_task_done: true } } }), 0o600);
+        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
+    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
     replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
     const origin = `https://${payload.hostname}`;
     replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
@@ -111,6 +187,29 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     return { origin, hostWorkspaceId, rootCid: result.rootCid };
 }
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+/**
+ * The enrollment server contact exists only to carry the signed binding. Once the account has confirmed
+ * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
+ * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
+ */
+export async function removeEnrollmentContact() {
+    let serverCid;
+    try {
+        serverCid = JSON.parse(readFileSync(join(stateRoot(), 'workspace', 'binding.json'), 'utf8')).serverCid;
+    }
+    catch {
+        return false;
+    }
+    if (typeof serverCid !== 'string' || !/^[A-F0-9]{64}$/i.test(serverCid))
+        return false;
+    try {
+        await hostMessenger()('contacts/remove', { contact: serverCid.toUpperCase() });
+    }
+    catch {
+        throw Error('Messenger did not remove it');
+    }
+    return true;
+}
 export async function configureWorkspacePort(payload, hostWorkspaceId, rootCid, port) {
     const deadline = Date.now() + 15000;
     while (true) {
@@ -127,3 +226,12 @@ export async function configureWorkspacePort(payload, hostWorkspaceId, rootCid,
         await new Promise(resolve => setTimeout(resolve, 500));
     }
 }
+/**
+ * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
+ * only after that answer is the enrollment contact removed; a refused or unconfirmed target leaves it,
+ * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
+ */
+export async function confirmWorkspaceTarget(payload, hostWorkspaceId, rootCid, port, cleanupFailed = () => { }) {
+    await configureWorkspacePort(payload, hostWorkspaceId, rootCid, port);
+    await removeEnrollmentContact().catch(cleanupFailed);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.34",
+  "version": "1.2.0-nightly.36",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -27,7 +27,7 @@
   },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json && node scripts/copy-web.mjs && node scripts/build-info.mjs",
+    "build": "npm run clean && tsc -p tsconfig.json && node scripts/build-info.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "npm run typecheck",
     "test": "vitest run",
@@ -39,7 +39,6 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
-    "@fastify/static": "^10.1.2",
     "@fastify/websocket": "^11.2.0",
     "@ours.network/cli": "2.8.1-nightly.13",
     "@ours.network/mcp": "1.2.0-nightly.10",

package/presets/fleet/agent_templates/Critic.yaml

@@ -1,5 +1,5 @@
 role: { ref: Critic }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }

package/presets/fleet/agent_templates/Developer.yaml

@@ -1,5 +1,5 @@
 role: { ref: Developer }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }

package/presets/fleet/agent_templates/Engineer.yaml

@@ -1,5 +1,5 @@
 role: { ref: Engineer }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }

package/presets/fleet/agent_templates/LocalCoordinator.yaml

@@ -1,7 +1,7 @@
 role: { ref: LocalCoordinator }
 brain: { ref: claude-default }
 coordinator: FleetCoordinator
-permissions: { approval: ask, filesystem: workspace, unattended: deny }
+permissions: { approval: allow, filesystem: unrestricted, unattended: deny }
 monitor: { mode: fleet, interrupt: after_tool }
 loops:
   continuity: