@ours.network/fleet 1.2.0-nightly.4 → 1.2.0-nightly.41

package/dist/cli.js

@@ -1,8 +1,16 @@
 #!/usr/bin/env node
+import { ensureMinimalSetup } from './minimal-setup.js';
+import { confirmWorkspaceTarget } from './workspace-enrollment.js';
+import { clearPendingTunnelSetup, readPendingTunnelSetup, requiredPortAfterExpiry, savePendingTunnelSetup, setupTunnelPreflight } from './setup-tunnel-preflight.js';
+import { availableWebPort } from './web/available-port.js';
+import QRCode from 'qrcode';
+import { readWorkspacePayload, enrollWorkspace, checkWorkspaceConfiguration } from './workspace-enrollment.js';
+import { waitForRoleDaemon } from './startup-readiness.js';
+import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, rmSync } from 'node:fs';
 import { realpathSync } from 'node:fs';
 import { join as joinPath, resolve as resolvePath } from 'node:path';
 import { createInterface } from 'node:readline';
@@ -12,7 +20,7 @@ import { INIT_COMPLETION_GUIDANCE } from './init-guidance.js';
 import { migrateLegacyStarterPresets, migratePackagedRoleDefaults } from './preset-migration.js';
 import { executeInitAnswers, executeInitWizard, isInteractiveTerminal, publishSetup, readInitSettings, TerminalPrompter, } from './init-wizard.js';
 import { analyzeInstalls, buildInfo, buildLabel, discoverInstalls, runningLabel, } from './provenance.js';
-import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir, defaultConfigPath } from './paths.js';
+import { agentDir, agentsRoot, tmpRoot, logsRoot, deriveXdgRuntimeDir, defaultConfigPath, stateRoot } from './paths.js';
 import { findRole, loadConfig, ROLE_NAME_RE } from './config.js';
 import { formatDuration } from './duration.js';
 import { redactSensitive, resolvedPlan, resolvedRolePlan } from './resolved-plan.js';
@@ -37,7 +45,7 @@ import { controlRequest, controlSocketPath, followControl, livenessNote, } from
 import { SessionControlError } from './session/types.js';
 import { readScheduledLoops, storedLoopHealth } from './loops/state.js';
 import { startWebConsole } from './web/runtime.js';
-import { requestWebControl } from './web/control.js';
+import { requestWebControl, webControlPath } from './web/control.js';
 import { WebServiceManager } from './web/service.js';
 import { WebAccessStore, passwordAccess, validatePublicOrigin } from './web/access.js';
 import { FLEET_PROXY_CALLER_ENV, FLEET_PROXY_STATE_DIR_ENV, } from './fleet-proxy.js';
@@ -45,6 +53,7 @@ import { beginFleetAuditCollection, consumeFleetAuditCollection, FleetCliExit, s
 import './harness/claude-code.js'; // registers the claude-code adapter
 import './harness/codex.js'; // registers the codex adapter
 import './harness/hermes.js';
+import { registerLayoutCommands } from './rooms-tasks/layout-cli.js';
 import { registerTemplateCommands, registerTaskCommands, registerRoomCommands } from './rooms-tasks/cli.js';
 import { RoleCreationService } from './application/role-creation-service.js';
 import { RoleRemovalService } from './application/role-removal-service.js';
@@ -496,6 +505,40 @@ program.command('peek <name> [lines]').description('pane snapshot without attach
         die(controlFailure(name, 'peek', e));
     }
 });
+const oursToolsCommand = program.command('ours').description('invoke tools through a named agent supervisor and its fixed identity');
+oursToolsCommand.command('tools <agent>').description('list the same tools and schemas exposed to the agent MCP')
+    .action(async (agent) => {
+    try {
+        console.log(JSON.stringify(await new SupervisorOursTools().list(agent), null, 2));
+    }
+    catch (error) {
+        die(error);
+    }
+});
+oursToolsCommand.command('call <agent> <tool>').description('call a supervisor MCP tool without prompting the agent')
+    .option('--args-file <path>', 'JSON object arguments from a private file; omitted means {}')
+    .action(async (agent, tool, options) => {
+    try {
+        let args = {};
+        if (options.argsFile) {
+            try {
+                args = JSON.parse(readFileSync(options.argsFile, 'utf8'));
+            }
+            catch {
+                throw new Error('cannot read tool arguments: expected a readable JSON object file');
+            }
+        }
+        const response = await new SupervisorOursTools().call(agent, { tool, arguments: args });
+        console.log(JSON.stringify(response, null, 2));
+        if ('isError' in response.result && response.result.isError)
+            throw new FleetCliExit(1, 'runtime', 'unknown');
+    }
+    catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
+        die(error);
+    }
+});
 program.command('send <name> [text...]').description("type into the agent's console")
     .action(async (name, text, opts) => {
     const stateDir = acpStateDir(name);
@@ -1351,7 +1394,7 @@ cOpt(program.command('migrate-role-defaults')
         die(error);
     }
 });
-const webCommand = cOpt(program.command('web').description('start or open the secure localhost fleet web console'))
+const webCommand = cOpt(program.command('web').description('start the Fleet HTTP service used by the App'))
     .enablePositionalOptions()
     .option('--port <port>', 'loopback service port (default: 49271)', value => {
     const port = Number(value);
@@ -1359,7 +1402,7 @@ const webCommand = cOpt(program.command('web').description('start or open the se
         throw new Error('invalid port');
     return port;
 })
-    .option('--no-open', 'do not open a browser automatically')
+    .option('--no-open', 'accepted for existing service units; Fleet opens no browser')
     .option('--bind <address>', 'explicit listen address (default: 127.0.0.1)')
     .option('--public-origin <url>', 'browser origin served by an explicit reverse proxy')
     .option('--password-file <path>', 'configure password protection from an owner-readable file')
@@ -1376,12 +1419,7 @@ const webCommand = cOpt(program.command('web').description('start or open the se
         if (accessNotice)
             process.stdout.write(accessNotice + '\n');
         await manager.start();
-        if (opts.open !== false) {
-            await requestWebControlWhenReady('open');
-            process.stdout.write('Control-panel authentication opened in the browser.\n');
-        }
-        else
-            process.stdout.write('Web service started; run `ours-fleet web open` to pair a browser.\n');
+        process.stdout.write('Fleet service started.\n');
     }
     catch (e) {
         die(e);
@@ -1394,7 +1432,7 @@ const webPort = (command) => cOpt(command)
         throw new Error('invalid port');
     return port;
 });
-const webServe = cOpt(webCommand.command('serve').description('run the web console in the foreground'))
+const webServe = cOpt(webCommand.command('serve').description('run the Fleet HTTP service in the foreground'))
     .option('--port <port>', 'loopback port (default: 49271; 0 chooses a free port)', value => {
     const port = Number(value);
     if (!Number.isInteger(port) || port < 0 || port > 65_535)
@@ -1402,7 +1440,7 @@ const webServe = cOpt(webCommand.command('serve').description('run the web conso
     return port;
 });
 webServe
-    .option('--no-open', 'do not open a browser automatically')
+    .option('--no-open', 'accepted for existing service units; Fleet opens no browser')
     .option('--bind <address>', 'explicit listen address (default: 127.0.0.1)')
     .option('--public-origin <url>', 'browser origin served by an explicit reverse proxy')
     .option('--password-file <path>', 'configure password protection from an owner-readable file')
@@ -1413,15 +1451,12 @@ webServe
         const accessNotice = configureWebAccess(opts);
         const consoleServer = await startWebConsole({
             configPath: opts.configuration, port: opts.port,
-            open: opts.open !== false, binPath, bind: opts.bind, publicOrigin: opts.publicOrigin,
+            binPath, bind: opts.bind, publicOrigin: opts.publicOrigin,
             log: line => process.stderr.write(line + '\n'),
         });
         if (accessNotice)
             process.stdout.write(accessNotice + '\n');
         process.stdout.write(`ours-fleet web listening on ${consoleServer.address}\n`);
-        process.stdout.write(opts.open !== false
-            ? 'Control-panel authentication opened in the browser.\n'
-            : 'Run `ours-fleet web open` to authenticate a browser.\n');
         const shutdown = async () => { await consoleServer.close(); process.exit(0); };
         process.once('SIGINT', () => { void shutdown(); });
         process.once('SIGTERM', () => { void shutdown(); });
@@ -1480,11 +1515,129 @@ webCommand.command('uninstall').description('stop and uninstall the owner web se
         die(e);
     }
 });
-webCommand.command('open').description('securely open or re-pair a browser with the running console')
+async function workspaceEnrollmentCommand(opts, setupTunnel = false) {
+    try {
+        if (setupTunnel && opts.check && opts.resume)
+            throw Error('Use either --check or --resume');
+        if (setupTunnel && (opts.check || opts.resume) && (opts.file || opts.migrateAppOrigin))
+            throw Error('--check and --resume take no payload file or migration flag');
+        if (setupTunnel && opts.check) {
+            await setupTunnelPreflight();
+            await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
+            process.stdout.write('Tunnel setup prerequisites are available.\n');
+            return;
+        }
+        let pending;
+        if (setupTunnel && opts.resume) {
+            pending = readPendingTunnelSetup();
+            if (opts.configuration && resolvePath(opts.configuration) !== pending.configuration)
+                throw Error(`This setup started with configuration ${pending.configuration}; resume it without --configuration`);
+            await setupTunnelPreflight();
+        }
+        else {
+            if (!opts.file)
+                throw Error('setup-tunnel requires --file <path> (or --resume to finish an interrupted setup)');
+            const payload = readWorkspacePayload(opts.file);
+            if (setupTunnel) {
+                await setupTunnelPreflight();
+                await checkWorkspaceConfiguration(opts.configuration ?? defaultConfigPath());
+                await ensureMinimalSetup(opts.configuration ?? defaultConfigPath());
+            }
+            const result = await enrollWorkspace(payload, opts.configuration, { migrateAppOrigin: opts.migrateAppOrigin, preserveProfile: setupTunnel || opts.preserveProfile });
+            pending = { appOrigin: payload.appOrigin, origin: result.origin, hostWorkspaceId: result.hostWorkspaceId, rootCid: result.rootCid, challenge: payload.challenge, configuration: resolvePath(opts.configuration ?? defaultConfigPath()) };
+            // The proof is one-time: keep what the remaining steps need so they can be finished without a new command.
+            if (setupTunnel)
+                savePendingTunnelSetup(pending);
+        }
+        try {
+            await finishWorkspaceService(pending, opts.resume ? pending.configuration : opts.configuration, setupTunnel);
+        }
+        catch (error) {
+            if (!setupTunnel)
+                throw error;
+            throw Error(`${error instanceof Error ? error.message : String(error)}\nThis host is already bound to the workspace; do not request a new command. Fix the problem above, then run: ours-fleet setup-tunnel --resume`);
+        }
+        clearPendingTunnelSetup();
+        if (setupTunnel) {
+            process.stdout.write('Tunnel setup submitted. Check verified binding and tunnel health in the App, then run ours-fleet link-device and paste its private code. Configure Fleet agents and models in the App after linking.\n');
+            return;
+        }
+        const link = await requestWebControl('link-device');
+        const code = Buffer.from(JSON.stringify(link)).toString('base64url');
+        process.stdout.write('Root proof submitted; account setup is ready only after tunnel health and binding verification.\nPrivate single-use device code:\n');
+        process.stdout.write(await QRCode.toString(code, { type: 'terminal', small: true }));
+        process.stdout.write('\n' + code + '\n');
+    }
+    catch (error) {
+        die(error);
+    }
+}
+/** Everything after the root proof: supervised web service, its bound port, and the tunnel target. Safe to repeat. */
+async function finishWorkspaceService(pending, configuration, record) {
+    if (!existsSync(new WebAccessStore().path))
+        configureWebAccess({ pairing: true });
+    // Once the challenge has expired the account can no longer retarget the tunnel. Decide before touching a running service.
+    const expired = pending.challenge.expiresAt <= Date.now();
+    const requiredPort = expired ? requiredPortAfterExpiry(pending) : undefined;
+    const manager = new WebServiceManager(), previous = manager.readMetadata();
+    if (previous)
+        await manager.stop();
+    const selectedPort = await availableWebPort(requiredPort ?? previous?.port ?? 49271);
+    mkdirSync(joinPath(stateRoot(), 'web'), { recursive: true, mode: 0o700 });
+    writeFileSync(joinPath(stateRoot(), 'web', 'port-selection.json'), JSON.stringify({ expiresAt: Date.now() + 60000 }) + '\n', { mode: 0o600 });
+    const notes = await manager.install(binPath, selectedPort, configuration, { bind: '127.0.0.1', publicOrigin: pending.origin });
+    await manager.restart();
+    // Without linger the user service, and with it the tunnel, stops at logout and does not start at boot.
+    for (const note of notes)
+        if (note.startsWith('warning:'))
+            process.stderr.write(`${note}\nUntil then the tunnel stops when you log out of this host.\n`);
+    const waitForControl = async () => {
+        const controlDeadline = Date.now() + 20000;
+        while (!existsSync(webControlPath())) {
+            if (Date.now() >= controlDeadline)
+                throw Error('Fleet backend did not become ready within 20 seconds. Run ours-fleet web status; on Linux inspect journalctl --user -u ours-fleet-web.service -n 25 --no-pager. Resolve the startup error before running ours-fleet link-device');
+            await new Promise(resolve => setTimeout(resolve, 200));
+        }
+    };
+    await waitForControl();
+    const bound = JSON.parse(readFileSync(joinPath(stateRoot(), 'web', 'workspace-port.json'), 'utf8'));
+    if (!Number.isInteger(bound.port) || bound.port < 1 || bound.port > 65535)
+        throw Error('Invalid workspace listener port');
+    if (bound.port !== selectedPort) {
+        await manager.retainBoundPort(binPath, bound.port, configuration, { bind: '127.0.0.1', publicOrigin: pending.origin });
+        await waitForControl();
+    }
+    if (requiredPort === undefined) {
+        // Record the request first: if its answer is lost, a later resume must not assume the default target.
+        if (record) {
+            pending = { ...pending, requestedPorts: [...(pending.requestedPorts ?? []), bound.port] };
+            savePendingTunnelSetup(pending);
+        }
+        await confirmWorkspaceTarget(pending, pending.hostWorkspaceId, pending.rootCid, bound.port, error => { process.stderr.write(`The enrollment contact could not be removed from Messenger (${error instanceof Error ? error.message : String(error)}); it can be removed there by hand.\n`); });
+    }
+    else if (bound.port !== requiredPort)
+        throw Error(`The setup window has expired and the tunnel points at port ${requiredPort}, but this host could only bind port ${bound.port}. Free port ${requiredPort} on this host`);
+    rmSync(joinPath(stateRoot(), 'web', 'port-selection.json'), { force: true });
+}
+cOpt(program.command('workspace-enroll').description('enroll this host using a private account setup file'))
+    .requiredOption('--file <path>', 'owned private payload file')
+    .option('--preserve-profile', 'retain the existing human profile without creating or rewriting it')
+    .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
+    .action(async (opts) => workspaceEnrollmentCommand(opts));
+cOpt(program.command('setup-tunnel').description('connect an installed host using scoped expiring App credentials; preserves identities and agent configuration'))
+    .option('--file <path>', 'owned private App payload file (chmod 600)')
+    .option('--check', 'only verify host prerequisites; changes nothing and needs no payload')
+    .option('--resume', 'finish a setup that stopped after this host was bound; needs no new payload')
+    .option('--migrate-app-origin', 'explicitly migrate the same workspace to its new account origin after verified signed proof')
+    .action(async (opts) => workspaceEnrollmentCommand(opts, true));
+program.command('link-device').description('create a single-use workspace device connection code (expires in five minutes)')
     .action(async () => {
     try {
-        await requestWebControl('open');
-        process.stdout.write('Control-panel authentication opened in the browser.\n');
+        const link = await requestWebControl('link-device');
+        process.stdout.write('Private connection code; share only with the intended device.\n');
+        const code = Buffer.from(JSON.stringify(link)).toString('base64url');
+        process.stdout.write(await QRCode.toString(code, { type: 'terminal', small: true }));
+        process.stdout.write('\n' + code + '\n');
     }
     catch (e) {
         die(e);
@@ -1500,20 +1653,6 @@ webCommand.command('revoke-all').description('revoke all trusted browsers and ac
         die(e);
     }
 });
-async function requestWebControlWhenReady(command) {
-    let last;
-    for (let attempt = 0; attempt < 40; attempt++) {
-        try {
-            await requestWebControl(command, undefined, 500);
-            return;
-        }
-        catch (error) {
-            last = error;
-            await new Promise(resolve => setTimeout(resolve, 125));
-        }
-    }
-    throw last;
-}
 function configureWebAccess(opts) {
     if (opts.publicOrigin)
         validatePublicOrigin(opts.publicOrigin);
@@ -1541,9 +1680,20 @@ function configureWebAccess(opts) {
     return undefined;
 }
 // ── rooms & tasks ──────────────────────────────────────────────────────────
+registerLayoutCommands(program, cOpt);
 registerTemplateCommands(program, cOpt);
 registerTaskCommands(program, cOpt);
 registerRoomCommands(program, cOpt);
+program.command('_wait-daemon <name>', { hidden: true }).description('internal: service startup readiness')
+    .option('-c, --configuration <file>')
+    .action(async (name, opts) => {
+    try {
+        await waitForRoleDaemon(name, opts.configuration);
+    }
+    catch (e) {
+        die(e);
+    }
+});
 program.command('_run <name>', { hidden: true }).description('internal: supervisor entrypoint')
     .option('-c, --configuration <file>')
     .action(async (name, opts) => {
@@ -1612,6 +1762,8 @@ async function parseFleetCli() {
         await program.parseAsync(process.argv);
     }
     catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
         const commander = error;
         if (commander.exitCode === 0)
             return;

package/dist/client-profile.d.ts

@@ -1,17 +1,6 @@
-export interface ExplicitClientProfile {
-    readonly endpoint: string;
-    readonly expectedInstanceId: string;
-    readonly credentialPath: string;
-    readonly configPath: string;
-}
-export declare class ClientProfileError extends Error {
-    constructor(message: string);
-}
-export declare function clientConfigPath(env: NodeJS.ProcessEnv): string;
-/**
- * Read Fleet's selected host-client profile without opening its credential.
- * A legacy daemon config remains legacy only when none of the profile fields is
- * present. Explicit and managed selections fail closed on invalid input.
- */
-export declare function readClientProfile(env: NodeJS.ProcessEnv): ExplicitClientProfile | undefined;
+import { clientProfilePath, readGatewayClientProfile } from '@ours.network/sdk/client';
+export { ClientProfileError } from '@ours.network/sdk/client';
+export type ExplicitClientProfile = ReturnType<typeof readGatewayClientProfile>;
+export declare const clientConfigPath: typeof clientProfilePath;
+export declare const readClientProfile: typeof readGatewayClientProfile;
 export declare function clientProfileKey(profile: ExplicitClientProfile): string;

package/dist/client-profile.js

@@ -1,115 +1,7 @@
-import { lstatSync, readFileSync, statSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { isAbsolute, join } from 'node:path';
-const PROFILE_FIELDS = ['endpoint', 'expectedInstanceId', 'credentialPath'];
-const LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-const LEGACY_CONFIG_FIELDS = ['apiToken', 'stateDir', 'port'];
-const LEGACY_ENV_FIELDS = ['OURS_API_TOKEN', 'OURS_STATE_DIR', 'OURS_PORT', 'OURS_DAEMON_ID'];
-export class ClientProfileError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ClientProfileError';
-    }
-}
-export function clientConfigPath(env) {
-    if (env.OURS_CONFIG !== undefined)
-        return env.OURS_CONFIG;
-    const managedPath = join(env.HOME || homedir(), '.ours-client', 'profile.json');
-    try {
-        lstatSync(managedPath);
-        return managedPath;
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw invalid(managedPath, 'could not be read');
-        return join(homedir(), '.ours', 'config.json');
-    }
-}
-function invalid(path, detail) {
-    return new ClientProfileError(`ours client profile ${JSON.stringify(path)} ${detail}`);
-}
-/**
- * Read Fleet's selected host-client profile without opening its credential.
- * A legacy daemon config remains legacy only when none of the profile fields is
- * present. Explicit and managed selections fail closed on invalid input.
- */
-export function readClientProfile(env) {
-    const configPath = clientConfigPath(env);
-    const managed = configPath === join(env.HOME || homedir(), '.ours-client', 'profile.json');
-    const named = env.OURS_CONFIG !== undefined || managed;
-    let text;
-    try {
-        text = readFileSync(configPath, 'utf8');
-    }
-    catch {
-        if (named)
-            throw invalid(configPath, 'could not be read');
-        return undefined;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        if (named)
-            throw invalid(configPath, 'is not valid JSON');
-        return undefined;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        if (named)
-            throw invalid(configPath, 'must contain a JSON object');
-        return undefined;
-    }
-    const row = parsed;
-    if (!PROFILE_FIELDS.some(field => Object.prototype.hasOwnProperty.call(row, field))) {
-        if (managed)
-            throw invalid(configPath, 'must contain a complete client profile');
-        return undefined;
-    }
-    let metadata;
-    try {
-        metadata = statSync(configPath);
-    }
-    catch {
-        throw invalid(configPath, 'could not be inspected');
-    }
-    if (!metadata.isFile())
-        throw invalid(configPath, 'must be a regular file');
-    const getuid = process.getuid;
-    if (getuid && metadata.uid !== getuid())
-        throw invalid(configPath, 'must be owned by this user');
-    if ((metadata.mode & 0o077) !== 0)
-        throw invalid(configPath, 'must not be accessible by group or other users');
-    for (const field of PROFILE_FIELDS)
-        if (typeof row[field] !== 'string' || !row[field].trim())
-            throw invalid(configPath, `has an invalid or missing ${field}`);
-    for (const field of LEGACY_CONFIG_FIELDS)
-        if (Object.prototype.hasOwnProperty.call(row, field))
-            throw invalid(configPath, `cannot combine ${field} with explicit profile selection`);
-    for (const field of LEGACY_ENV_FIELDS)
-        if (env[field]?.trim())
-            throw invalid(configPath, `cannot combine ${field} with explicit profile selection`);
-    const endpoint = row.endpoint.trim();
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        throw invalid(configPath, 'has an invalid endpoint');
-    }
-    if ((url.protocol !== 'http:' && url.protocol !== 'https:') || url.username || url.password || url.pathname !== '/'
-        || url.search || url.hash)
-        throw invalid(configPath, 'endpoint must be an HTTP or HTTPS origin');
-    const expectedInstanceId = row.expectedInstanceId.trim();
-    if (!LOWERCASE_UUID.test(expectedInstanceId))
-        throw invalid(configPath, 'expectedInstanceId must be a lowercase UUID');
-    const credentialPath = row.credentialPath.trim();
-    if (!isAbsolute(credentialPath))
-        throw invalid(configPath, 'credentialPath must be absolute');
-    return Object.freeze({
-        endpoint: url.origin, expectedInstanceId, credentialPath, configPath,
-    });
-}
+import { clientProfilePath, readGatewayClientProfile } from '@ours.network/sdk/client';
+export { ClientProfileError } from '@ours.network/sdk/client';
+export const clientConfigPath = clientProfilePath;
+export const readClientProfile = readGatewayClientProfile;
 export function clientProfileKey(profile) {
     return `${profile.endpoint}#${profile.expectedInstanceId}`;
 }

package/dist/config.d.ts

@@ -2,6 +2,7 @@ import { type ConfigDiagnostic, type YamlMode } from './config-yaml.js';
 import type { IsolationConfig, WrapContext } from './isolation/types.js';
 import type { ResolvedWatchdog } from './watchdog/config.js';
 import type { AgentLoopsConfig, ResolvedLoop, ResolvedRoleLoop } from './loops/config.js';
+import { validateRoomsConfig } from './rooms-tasks/config.js';
 export interface OverseeEntry {
     agent: string;
     interval: string;
@@ -178,6 +179,7 @@ export interface AgentTemplateInstance {
 }
 /** Internal first-boot payload for a Fleet-provisioned Cowork room member. */
 export interface RoomMemberStartup {
+    workspace?: import('./rooms-tasks/workspace.js').OwnedWorkspace;
     room_id: string;
     room_identity_cid: string;
     identity_name: string;
@@ -298,6 +300,8 @@ export declare function validateBrainValue(value: BarePreset, file: string, poin
 export declare function validateEffectiveAgentTemplate(definition: AgentTemplateDefinition, id?: string): AgentTemplateDefinition;
 export declare function assertBareKeys(value: unknown, allowed: string[], label: string): BarePreset;
 export declare function splitRootFor(base: string): string;
+/** Read only room connection/owner settings for an existing layout. */
+export declare function loadRoomsConfig(configPath?: string): ReturnType<typeof validateRoomsConfig>;
 /** Load a v2 manifest and bare Agent/Role/Brain documents from its stem directory. */
 export declare function loadConfig(configPath?: string, options?: {
     yamlMode?: YamlMode;
@@ -307,6 +311,8 @@ export declare function loadConfig(configPath?: string, options?: {
         temporary?: boolean;
     };
     skipWatchdogs?: boolean;
+    /** The one Owner invitation file that tunnel setup writes itself and that may therefore still be absent. */
+    deferredOwnerInviteFile?: string;
 }): FleetConfig;
 /** Full read-only Agent resolution used by launch dry-runs and room plan validation. */
 export declare function resolveAgentDefinitionDryRun(configPath: string, id: string, definition: AgentDefinition): ResolvedRole;
@@ -331,10 +337,22 @@ export declare function resolvePermissions(defaults: unknown, role: Partial<Comm
  * malformed block so a typo fails loudly rather than silently disarming a monitor.
  * Exported so temp-spawn (which builds a ResolvedRole by hand) resolves identically.
  */
+/**
+ * A monitor without an explicit `interrupt` steers wakes at the next tool
+ * boundary. Hermes cannot, so its default stays non-interrupting; sessions
+ * without tool-boundary steering fall back to non-cancelling delivery.
+ */
+export declare function defaultMonitorInterrupt(harness: string | undefined): MonitorInterrupt;
+/**
+ * Resolve a persisted temporary-role monitor. A snapshot written before
+ * monitor.interrupt existed keeps the non-interrupting delivery it ran with.
+ */
+export declare function resolveSnapshotMonitor(monitor: unknown): MonitorConfig;
 export declare function resolveMonitorConfig(defMonitor: unknown, roleMonitor?: Partial<MonitorConfig>, labels?: {
     base?: string;
     file?: string;
     name?: string;
+    harness?: string;
 }): MonitorConfig;
 export declare function findRole(cfg: FleetConfig, name: string): ResolvedRole;
 export {};

package/dist/config.js

@@ -575,6 +575,13 @@ function deepSub(v, vars) {
         return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, deepSub(x, vars)]));
     return v;
 }
+/** Read only room connection/owner settings for an existing layout. */
+export function loadRoomsConfig(configPath = defaultConfigPath()) {
+    assertTrustedPath(configPath, 'file');
+    const doc = parseFleetDocument(configPath, readFileSync(configPath, 'utf8')).value;
+    const vars = (doc.vars ?? {});
+    return validateRoomsConfig(deepSub(doc.rooms, vars), vars, configPath);
+}
 /** Load a v2 manifest and bare Agent/Role/Brain documents from its stem directory. */
 export function loadConfig(configPath, options = {}) {
     const base = configPath ?? defaultConfigPath();
@@ -649,11 +656,11 @@ export function loadConfig(configPath, options = {}) {
                 if (problems.length)
                     throw new ConfigError(`${file}: role '${name}' ${problems.join('; ')}`);
             }
-            const monitor = resolveMonitorConfig(defaults.monitor, r.monitor, { base, file, name });
+            const harness = r.harness ?? defaults.harness ?? 'claude-code';
+            const monitor = resolveMonitorConfig(defaults.monitor, r.monitor, { base, file, name, harness });
             const ownerChannel = resolveOwnerChannelConfig(defaults.owner_channel, r.owner_channel, session, file, name);
             const worklog = resolveWorklogPolicy(defaults.worklog, r.worklog, file, name);
             const authProxy = resolveAuthProxy(defaults.auth_proxy, r.auth_proxy, file, name);
-            const harness = r.harness ?? defaults.harness ?? 'claude-code';
             if (session === 'codex-app-server' && harness !== 'codex')
                 throw new ConfigError(`${file}: role '${name}' session: codex-app-server requires harness: codex`);
             const defaultHarness = defaults.harness ?? 'claude-code';
@@ -757,7 +764,7 @@ export function loadConfig(configPath, options = {}) {
         if (doc.rooms !== undefined) {
             if (rooms)
                 throw new ConfigError(`rooms: defined in multiple files; last: ${file}`);
-            const validated = validateRoomsConfig(deepSub(doc.rooms, vars), vars, file);
+            const validated = validateRoomsConfig(deepSub(doc.rooms, vars), vars, file, options.deferredOwnerInviteFile);
             ownerInviteFingerprint = validated._invite?.fingerprint;
             ownerInvite = validated._invite?.value;
             const { _invite: _, ...clean } = validated;
@@ -1135,6 +1142,23 @@ function resolveStartStaggerMs(raw, base) {
  * malformed block so a typo fails loudly rather than silently disarming a monitor.
  * Exported so temp-spawn (which builds a ResolvedRole by hand) resolves identically.
  */
+/**
+ * A monitor without an explicit `interrupt` steers wakes at the next tool
+ * boundary. Hermes cannot, so its default stays non-interrupting; sessions
+ * without tool-boundary steering fall back to non-cancelling delivery.
+ */
+export function defaultMonitorInterrupt(harness) {
+    return harness === 'hermes' ? false : 'after_tool';
+}
+/**
+ * Resolve a persisted temporary-role monitor. A snapshot written before
+ * monitor.interrupt existed keeps the non-interrupting delivery it ran with.
+ */
+export function resolveSnapshotMonitor(monitor) {
+    if (!isPlainObject(monitor))
+        return resolveMonitorConfig(undefined, monitor);
+    return resolveMonitorConfig(undefined, { interrupt: false, ...monitor });
+}
 export function resolveMonitorConfig(defMonitor, roleMonitor, labels = {}) {
     const where = labels.file && labels.name ? `${labels.file}: role '${labels.name}' ` : '';
     if (defMonitor !== undefined && !isPlainObject(defMonitor))
@@ -1169,7 +1193,7 @@ export function resolveMonitorConfig(defMonitor, roleMonitor, labels = {}) {
         wake_sources: merged.wake_sources ?? [...DEFAULT_WAKE_SOURCES],
         batch_ms: merged.batch_ms ?? MONITOR_DEFAULT_BATCH_MS,
         inject: merged.inject ?? 'notification',
-        interrupt: merged.interrupt ?? false,
+        interrupt: merged.interrupt ?? defaultMonitorInterrupt(labels.harness),
         ...(merged.stall_recovery !== undefined ? { stall_recovery: merged.stall_recovery } : {}),
         ...(merged.stall_timeout_ms !== undefined ? { stall_timeout_ms: merged.stall_timeout_ms } : {}),
         turn_fail_threshold: merged.turn_fail_threshold ?? MONITOR_DEFAULT_TURN_FAIL_THRESHOLD,

package/dist/creation.js

@@ -213,10 +213,10 @@ export async function ensureIdentity(name, profile, provisioner, log = () => { }
 export function daemonIdentityProvisioner(env = process.env, attachClient = attachOursClient, options = {}) {
     const connect = (leaseToken) => {
         const profile = readClientProfile(env);
-        return attachClient(profile ? {
+        return attachClient({
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath, sessionMode: 'external', leaseToken, env: {},
-        } : { env, leaseToken, clientPid: process.pid });
+        });
     };
     const provisioner = {
         async exists(name) {

package/dist/daemon-recovery.d.ts

@@ -34,14 +34,7 @@ interface GenerationProbeDeps {
     canonicalize?(path: string): string;
     attachClient?(options: AttachOursClientOptions): Pick<OursClient, 'version' | 'identities' | 'close'> | Promise<Pick<OursClient, 'version' | 'identities' | 'close'>>;
 }
-/**
- * Corroborate the loopback daemon's unauthenticated `/info`, its credentialed
- * identity-index readiness route, and its local boot-generation record. The
- * index enforces auth when the daemon visibility requires it; open visibility
- * deliberately does not. No source is sufficient
- * alone: `/info` has no boot id, the identity index has no generation, and a
- * stale `ready` file can outlive the process that wrote it.
- */
+/** Read generation and readiness through the selected gateway. Server paths are opaque. */
 export declare function probeDaemonGeneration(fetch: FetchLike, env: NodeJS.ProcessEnv, deps?: GenerationProbeDeps): Promise<DaemonGenerationProbe>;
 export declare class DaemonGenerationObserver {
     private current?;