@ours.network/fleet 1.2.0-nightly.37 → 1.2.0-nightly.38

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.37",
-  "buildId": "4ab0c90048fe",
-  "commit": "46569b7ed2c22fd25fd6a019a3755768c817046e",
+  "version": "1.2.0-nightly.38",
+  "buildId": "2eaafbd42c9d",
+  "commit": "86c7af960f9b2cfdbf4dcddee25bc7303e78780c",
   "dirty": true,
-  "builtAt": "2026-10-02T21:13:43.143Z",
+  "builtAt": "2026-10-02T21:39:35.791Z",
   "capabilities": [
     "workspace.enroll.preserve-profile-v1",
     "cowork.http-management-v1",

package/dist/workspace-enrollment.d.ts

@@ -1,3 +1,4 @@
+import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
 export interface WorkspacePayload {
     version: 1;
     appOrigin: string;
@@ -16,18 +17,24 @@ export interface WorkspacePayload {
     };
 }
 export declare function readWorkspacePayload(file: string): WorkspacePayload;
+type DaemonClient = Pick<OursClient, 'listIdentities' | 'chooseIdentity' | 'addContact' | 'listContacts' | 'sendCommand' | 'removeContact' | 'releaseLease' | 'close'>;
+/** How tunnel setup reaches this host's daemon; replaced only by tests. */
+export type AttachDaemonClient = (options: AttachOursClientOptions) => Promise<DaemonClient>;
 /**
  * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
  * Reads only; an existing Owner is compared with this host's own Messenger identity.
  */
-export declare function checkWorkspaceConfiguration(configuration?: string): Promise<void>;
+export declare function checkWorkspaceConfiguration(configuration?: string, attach?: AttachDaemonClient): Promise<void>;
 export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
     migrateAppOrigin?: boolean;
     preserveProfile?: boolean;
+    attach?: AttachDaemonClient;
+    contactWaitMs?: number;
+    afterInvitation?: () => void;
 }): Promise<{
     origin: string;
     hostWorkspaceId: string;
-    rootCid: any;
+    rootCid: string;
 }>;
 /** Only the existing signed-root receipt authorizes the scoped tunnel target. */
 /**
@@ -35,7 +42,7 @@ export declare function enrollWorkspace(payload: WorkspacePayload, configuration
  * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
  * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
  */
-export declare function removeEnrollmentContact(): Promise<boolean>;
+export declare function removeEnrollmentContact(attach?: AttachDaemonClient): Promise<boolean>;
 export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
 /**
  * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
@@ -43,3 +50,4 @@ export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, '
  * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
  */
 export declare function confirmWorkspaceTarget(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number, cleanupFailed?: (error: unknown) => void): Promise<void>;
+export {};

package/dist/workspace-enrollment.js

@@ -5,7 +5,9 @@ import { readClientProfile } from './client-profile.js';
 import { stateRoot, defaultConfigPath, workspaceOwnerInvite } from './paths.js';
 import { replaceFileAtomically } from './atomic-file.js';
 import { loadConfig, splitRootFor } from './config.js';
-import { parse, stringify } from 'yaml';
+import { parse, parseDocument, stringify } from 'yaml';
+import { randomUUID } from 'node:crypto';
+import { attachOursClient } from '@ours.network/sdk/client';
 import { preflightInitPaths } from './init-wizard.js';
 import { WebAccessStore } from './web/access.js';
 import { WorkspaceDeviceStore } from './web/workspace-devices.js';
@@ -71,14 +73,105 @@ function hostMessenger() {
     const secret = readFileSync(profile.credentialPath, 'utf8').trim();
     return async (path, value) => { const response = await fetch(new URL('api/' + path, base), { method: value === undefined ? 'GET' : 'POST', headers: { 'X-Ours-Api-Token': secret, ...(value === undefined ? {} : { 'Content-Type': 'application/json', 'Origin': base.origin, 'X-Ours-Messenger-CSRF': '1' }) }, ...(value === undefined ? {} : { body: JSON.stringify(value) }), signal: AbortSignal.timeout(value === undefined ? 15000 : 60000), redirect: 'error' }); if (!response.ok) {
         await response.body?.cancel();
-        throw Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying');
+        throw Object.assign(Error('Workspace Messenger enrollment failed (HTTP ' + response.status + '); request a fresh setup payload before retrying'), { status: response.status });
     } return response.json(); };
 }
+const daemon = (attach, purpose) => { const profile = readClientProfile(); return attach({ endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId, credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken: `ours-fleet-workspace-${purpose}-${process.pid}-${randomUUID()}`, env: {} }); };
+const CID = /^[a-f0-9]{64}$/i, same = (a, b) => a.toLowerCase() === b.toLowerCase();
+/**
+ * Who this host's Messenger is. Messenger either runs as the Human root itself, or as the person's own
+ * identity and then names the root the daemon describes for it. That is accepted only when this host's
+ * daemon, asked by Fleet itself, lists exactly one Human root, that root is the named one, and the
+ * Messenger identity is listed as a permanent identity under it.
+ */
+async function messengerIdentity(request, attach) {
+    const bound = await request('workspace/enrollment-identity');
+    if (bound.rootCid === undefined)
+        return { cid: bound.cid, preserveProfile: bound.preserveProfile === true };
+    if (typeof bound.cid !== 'string' || !CID.test(bound.cid) || typeof bound.rootCid !== 'string' || !CID.test(bound.rootCid) || same(bound.cid, bound.rootCid))
+        throw Error('Bound Messenger identity unavailable');
+    const root = await humanRoot(attach, bound.rootCid, bound.cid);
+    return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, root };
+}
+/** This host's only Human root, as its daemon lists it; optionally with a permanent identity that must be listed under it. */
+async function humanRoot(attach, rootCid, under) {
+    const client = await daemon(attach, 'identities');
+    const rows = await client.listIdentities().finally(() => client.close());
+    const roots = rows.filter(row => 'kind' in row && row.kind === 'root'), root = roots[0], row = under === undefined ? undefined : rows.find(row => 'cid' in row && same(row.cid, under));
+    if (roots.length !== 1 || !('kind' in root) || !same(root.cid, rootCid) || (under !== undefined && (!row || !('kind' in row) || row.kind !== 'role' || row.temp !== null)))
+        throw Error("This host's Messenger identity is not a permanent identity under this host's Human root. Tunnel setup changed nothing.");
+    return { name: root.name, cid: root.cid };
+}
+/** Run one operation as the Human root and always give the root back, whatever happens. */
+async function asHumanRoot(attach, root, purpose, use) {
+    const client = await daemon(attach, purpose);
+    let done = false;
+    try {
+        const bound = await client.chooseIdentity({ name: root.name, force: false }).catch((error) => {
+            throw Error(`This host's Human root cannot be used right now (${error.code ?? error.message}). Close the session that holds it, then run setup again. Nothing was changed.`);
+        });
+        if (!same(bound.cid, root.cid))
+            throw Error("This host's Human root changed while setup was running. Nothing was changed.");
+        const result = await use(client);
+        // The operation is not reported as done while the root may still be held. The release is attempted exactly once.
+        done = true;
+        const released = await client.releaseLease();
+        if (released.failed > 0)
+            throw Error("This host's Human root was not given back completely. Run setup again.");
+        return result;
+    }
+    finally {
+        // After a failure the root is released once as well; what failed first is what is reported.
+        if (!done)
+            await client.releaseLease().catch(() => { });
+        await client.close().catch(() => { });
+    }
+}
+/** The signed workspace binding, sent by the Human root itself: the same command Messenger sends when it runs as the root. */
+async function proveWithHumanRoot(attach, root, payload, hostWorkspaceId, contactWaitMs) {
+    const serverCid = payload.serverCid.toUpperCase();
+    await asHumanRoot(attach, root, 'proof', async (client) => {
+        const peer = await client.addContact({ invite: payload.invitation });
+        if (peer.cid.toUpperCase() !== serverCid)
+            throw Error('Enrollment server identity mismatch');
+        const deadline = Date.now() + contactWaitMs;
+        while (!(await client.listContacts()).contacts.some(contact => contact.container_id.toUpperCase() === serverCid)) {
+            if (Date.now() >= deadline)
+                throw Error('Enrollment contact is not ready; obtain a fresh setup payload before retrying');
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+        const outcome = await client.sendCommand({ contact: serverCid, command: 'bind-workspace', arguments: { type: 'ours.app.bind-workspace.v1', accountId: payload.challenge.accountId, workspaceId: payload.challenge.workspaceId, nonce: payload.challenge.nonce, hostWorkspaceId } });
+        if (!('sent' in outcome) || !outcome.sent)
+            throw Error('Workspace proof was not sent');
+    });
+}
+/**
+ * True when the Owner entry is the one tunnel setup manages and it still names the Human root of an
+ * installation whose Messenger now runs as the person's own identity under that root. Only then is the
+ * entry moved to that identity; an Owner entry anyone else wrote is never touched.
+ */
+function managedRootOwner(configuration, rooms, root) {
+    if (!same(rooms.owner.expected_cid, root.cid) || rooms.owner.public_invite_file !== workspaceOwnerInvite() || rooms.defaults?.attach_owner === false)
+        return false;
+    if (!existsSync(join(stateRoot(), 'workspace', 'binding.json')))
+        return false;
+    let written;
+    try {
+        written = parseDocument(readFileSync(configuration, 'utf8')).toJS()?.rooms;
+    }
+    catch {
+        return false;
+    }
+    const entry = written?.owner, defaults = written?.defaults, keys = (value) => Object.keys(value).sort().join();
+    // Exactly the Owner entry and defaults tunnel setup writes; anything added or changed beside them is someone's own configuration.
+    return !!written && keys(written) === 'defaults,owner' && !!entry && keys(entry) === 'expected_cid,provider,public_invite_file,role' && entry.provider === 'messenger-server' && entry.role === 'Owner' && typeof entry.expected_cid === 'string' && same(entry.expected_cid, root.cid)
+        && !!defaults && keys(defaults) === 'attach_owner,close_when_task_done' && defaults.attach_owner === true && defaults.close_when_task_done === true;
+}
 /**
  * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
  * Reads only; an existing Owner is compared with this host's own Messenger identity.
  */
-export async function checkWorkspaceConfiguration(configuration = defaultConfigPath()) {
+export async function checkWorkspaceConfiguration(configuration = defaultConfigPath(), attach = attachOursClient) {
     const paths = preflightInitPaths(configuration);
     if (!paths.manifestExisted) {
         if (paths.rootExisted)
@@ -92,19 +185,20 @@ export async function checkWorkspaceConfiguration(configuration = defaultConfigP
         throw Error(`${paths.configPath}: rooms.defaults.attach_owner is disabled; enable it before tunnel setup.`);
     if (!loaded.rooms.owner.public_invite_file)
         throw Error(`${paths.configPath}: rooms.owner must use public_invite_file before tunnel setup.`);
-    let cid;
+    let cid, root;
     try {
-        cid = (await hostMessenger()('workspace/enrollment-identity')).cid;
+        ({ cid, root } = await messengerIdentity(hostMessenger(), attach));
     }
     catch {
         cid = undefined;
     }
     if (typeof cid !== 'string' || !/^[a-f0-9]{64}$/i.test(cid))
         throw Error(`${paths.configPath} names a room Owner, and this host's Messenger identity cannot be read to compare with it. Start Messenger on this host first.`);
-    if (loaded.rooms.owner.expected_cid.toLowerCase() !== cid.toLowerCase() && !recordsLostEnrollment(paths.configPath))
+    if (loaded.rooms.owner.expected_cid.toLowerCase() !== cid.toLowerCase() && !recordsLostEnrollment(paths.configPath) && !(root && managedRootOwner(paths.configPath, loaded.rooms, root)))
         throw Error(`${paths.configPath}: rooms.owner.expected_cid names a different Owner than this host's Messenger identity. Tunnel setup does not replace an existing Owner.`);
 }
 export async function enrollWorkspace(payload, configuration = defaultConfigPath(), options = {}) {
+    const attach = options.attach ?? attachOursClient;
     const request = hostMessenger();
     if (new WebAccessStore().read().mode === 'none')
         throw Error('Workspace enrollment requires protected web access; enable pairing or password before setup');
@@ -131,12 +225,15 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         throw Error('Existing rooms.defaults.attach_owner is disabled; enable automatic Human Owner admission before workspace setup');
     if (loaded.rooms && !loaded.rooms.owner.public_invite_file)
         throw Error('Existing room owner configuration must be reviewed before workspace enrollment');
-    const identity = await request('workspace/enrollment-identity');
+    const identity = await messengerIdentity(request, attach);
     if (!/^[a-f0-9]{64}$/i.test(identity.cid))
         throw Error('Bound Messenger identity unavailable');
+    // An installation that ran Messenger as the Human root and now runs it as the person's own identity keeps its managed Owner entry, moved to that identity.
+    const moved = Boolean(loaded.rooms) && !lost && !!identity.root && !same(loaded.rooms.owner.expected_cid, identity.cid) && managedRootOwner(resolve(configuration), loaded.rooms, identity.root)
+        && JSON.parse(readFileSync(previousFile, 'utf8')).serverCid?.toUpperCase() === payload.serverCid.toUpperCase();
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
-    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
+    if (loaded.rooms && !lost && !moved && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
     if (existsSync(inviteFile)) {
@@ -148,14 +245,30 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const hostWorkspaceId = devices.workspaceId;
     devices.close();
     const { name, surname, ...proofPayload } = payload;
-    const result = await request('workspace/enroll', options.preserveProfile ? { ...proofPayload, hostWorkspaceId, preserveProfile: true } : { ...payload, hostWorkspaceId });
-    if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
-        throw Error('Malformed workspace enrollment response');
-    // Whatever the configuration said before, what is recorded from here on is this host's own root.
-    if (result.rootCid.toLowerCase() !== identity.cid.toLowerCase())
-        throw Error('Workspace enrollment answered for a different root than this host identity; local configuration is unchanged');
-    if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
-        throw Error('Retained room owner CID conflicts with the Human root');
+    let result, ownerCid;
+    if (identity.root) {
+        // The Human root signs the binding; the person's own Messenger identity is the room Owner and issues the Owner invitation.
+        await proveWithHumanRoot(attach, identity.root, payload, hostWorkspaceId, options.contactWaitMs ?? 10000);
+        const invite = await request('invites', { mode: 'public' });
+        if (typeof invite.blob !== 'string' || !invite.blob)
+            throw Error('Malformed workspace enrollment response');
+        const after = await request('workspace/enrollment-identity');
+        if (typeof after.cid !== 'string' || !same(after.cid, identity.cid) || typeof after.rootCid !== 'string' || !same(after.rootCid, identity.root.cid))
+            throw Error("This host's Messenger identity changed while setup was running; local configuration is unchanged");
+        result = { submitted: true, rootCid: identity.root.cid, ownerInvite: invite.blob };
+        ownerCid = identity.cid;
+    }
+    else {
+        result = await request('workspace/enroll', options.preserveProfile ? { ...proofPayload, hostWorkspaceId, preserveProfile: true } : { ...payload, hostWorkspaceId });
+        if (!result.submitted || !/^[a-f0-9]{64}$/i.test(result.rootCid) || typeof result.ownerInvite !== 'string')
+            throw Error('Malformed workspace enrollment response');
+        // Whatever the configuration said before, what is recorded from here on is this host's own root.
+        if (result.rootCid.toLowerCase() !== identity.cid.toLowerCase())
+            throw Error('Workspace enrollment answered for a different root than this host identity; local configuration is unchanged');
+        if (loaded.rooms && !lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
+            throw Error('Retained room owner CID conflicts with the Human root');
+        ownerCid = result.rootCid;
+    }
     if (migrating) {
         const deadline = Date.now() + 15000;
         while (true) {
@@ -173,16 +286,24 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         }
     }
     replaceFileAtomically(inviteFile, result.ownerInvite + '\n', 0o600);
+    options.afterInvitation?.();
     const split = splitRootFor(configuration);
     mkdirSync(split, { recursive: true, mode: 0o700 });
     if (!loaded.rooms)
-        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
-    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== result.rootCid.toLowerCase())
-        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(result.rootCid, inviteFile)), 0o600);
+        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
+    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== ownerCid.toLowerCase())
+        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
+    else if (moved) {
+        // The invitation above and this entry are two files. A setup interrupted between them leaves the entry naming the root,
+        // which is this same case again: running setup once more writes both.
+        const document = parseDocument(readFileSync(configuration, 'utf8'));
+        document.setIn(['rooms', 'owner', 'expected_cid'], ownerCid);
+        replaceFileAtomically(configuration, document.toString(), 0o600);
+    }
     replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
     const origin = `https://${payload.hostname}`;
     replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
-    replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase() }) + '\n', 0o600);
+    replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase(), ...(identity.root ? { proofRootCid: identity.root.cid } : {}) }) + '\n', 0o600);
     loadConfig(configuration);
     return { origin, hostWorkspaceId, rootCid: result.rootCid };
 }
@@ -192,18 +313,30 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
  * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
  * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
  */
-export async function removeEnrollmentContact() {
-    let serverCid;
+export async function removeEnrollmentContact(attach = attachOursClient) {
+    let serverCid, proofRootCid;
     try {
-        serverCid = JSON.parse(readFileSync(join(stateRoot(), 'workspace', 'binding.json'), 'utf8')).serverCid;
+        ({ serverCid, proofRootCid } = JSON.parse(readFileSync(join(stateRoot(), 'workspace', 'binding.json'), 'utf8')));
     }
     catch {
         return false;
     }
     if (typeof serverCid !== 'string' || !/^[A-F0-9]{64}$/i.test(serverCid))
         return false;
+    const contact = serverCid.toUpperCase();
+    // The contact belongs to whoever sent the binding. When that was the Human root itself, the binding records it.
+    if (typeof proofRootCid === 'string' && CID.test(proofRootCid)) {
+        try {
+            const root = await humanRoot(attach, proofRootCid);
+            await asHumanRoot(attach, root, 'cleanup', client => client.removeContact({ contact }));
+        }
+        catch {
+            throw Error('the Human root did not remove it');
+        }
+        return true;
+    }
     try {
-        await hostMessenger()('contacts/remove', { contact: serverCid.toUpperCase() });
+        await hostMessenger()('contacts/remove', { contact });
     }
     catch {
         throw Error('Messenger did not remove it');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.37",
+  "version": "1.2.0-nightly.38",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",