@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.50

package/dist/notifications/outbox.js

@@ -0,0 +1,158 @@
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { readPrivateFile } from '@ours.network/sdk/connector';
+import { readClientProfile } from '../client-profile.js';
+function defaultProfile() {
+    try {
+        return readClientProfile();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The installer delivers the producer credential beside the profile credential, bound to that server installation. */
+export const PRODUCER_CREDENTIAL_FILE = 'notifications-producer.json';
+const loopback = (url) => ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname);
+export function producerConfig(env = process.env, profile = defaultProfile, warn = () => { }) {
+    const origin = env.OURS_NOTIFICATIONS_ORIGIN, token = env.OURS_NOTIFICATIONS_PRODUCER_TOKEN;
+    if (origin || token) {
+        if (!origin || !token || token.length < 32)
+            throw new Error('notifications producer requires origin and scoped token');
+        const url = new URL(origin);
+        if (!['http:', 'https:'].includes(url.protocol) || url.origin !== origin || url.username || url.password)
+            throw new Error('invalid notification service origin');
+        if (url.protocol === 'http:' && !loopback(url))
+            throw new Error('notification credentials require HTTPS or loopback');
+        return { origin, token };
+    }
+    const selected = profile();
+    if (!selected)
+        return;
+    const file = join(dirname(selected.credentialPath), PRODUCER_CREDENTIAL_FILE);
+    if (!existsSync(file))
+        return;
+    // Reasons are fixed text: parser and file errors can quote the secret-bearing contents.
+    let reason = 'it is not a private owner-only file';
+    try {
+        const text = readPrivateFile(file, 4096).toString('utf8');
+        reason = 'it is not valid producer JSON';
+        const bound = JSON.parse(text);
+        reason = 'it belongs to another server installation';
+        if (!bound || bound.schema !== 1 || bound.serverUrl !== selected.serverUrl || bound.expectedInstanceId !== selected.expectedInstanceId)
+            throw new Error();
+        reason = 'its credential is invalid';
+        if (typeof bound.token !== 'string' || bound.token.length < 32)
+            throw new Error();
+        reason = 'the server requires HTTPS or loopback';
+        const server = new URL(selected.serverUrl);
+        if (server.protocol !== 'https:' && !(server.protocol === 'http:' && loopback(server)))
+            throw new Error();
+        reason = 'the client credential is unreadable';
+        const gatewayCredential = readPrivateFile(selected.credentialPath, 4096).toString('utf8').trim();
+        return { origin: selected.serverUrl.replace(/\/$/, '') + '/notifications', token: bound.token, gatewayCredential };
+    }
+    catch {
+        warn(`Notifications are not produced: ${file} is unusable (${reason}). Re-run the installer to repair it.`);
+        return;
+    }
+}
+/** Durable producer queue. Service dedupe makes crash-after-acceptance replay safe. */
+export class NotificationOutbox {
+    file;
+    config;
+    project;
+    warn;
+    entries;
+    cursor;
+    checkpoint;
+    running;
+    retired = false;
+    timer;
+    constructor(file, config, project, warn = () => { }) {
+        this.file = file;
+        this.config = config;
+        this.project = project;
+        this.warn = warn;
+        mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+        const saved = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { entries: [] };
+        this.entries = Array.isArray(saved) ? saved : saved.entries;
+        this.cursor = saved.cursor;
+        this.checkpoint = saved.checkpoint;
+        if (!Array.isArray(this.entries))
+            throw new Error('invalid notification outbox');
+        this.timer = setInterval(() => { void this.drain(); }, 3000);
+        this.timer.unref();
+    }
+    persist(entries, cursor = this.cursor, checkpoint = this.checkpoint) {
+        const tmp = this.file + '.tmp', fd = openSync(tmp, 'w', 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify({ entries, cursor, checkpoint }));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, this.file);
+        const dir = openSync(dirname(this.file), 'r');
+        try {
+            fsyncSync(dir);
+        }
+        finally {
+            closeSync(dir);
+        }
+        this.entries = entries;
+        this.cursor = cursor;
+        this.checkpoint = checkpoint;
+    }
+    advance(cursor) { this.persist(this.entries, cursor); }
+    saveCheckpoint(checkpoint) { this.persist(this.entries, this.cursor, checkpoint); }
+    enqueue(id, value, cursor = this.cursor) {
+        if (this.retired)
+            return false;
+        if (this.entries.some(e => e.id === id)) {
+            if (cursor !== this.cursor)
+                this.advance(cursor);
+            return true;
+        }
+        if (this.entries.length >= 2000)
+            return false;
+        this.persist([...this.entries, { id, value }], cursor);
+        return true;
+    }
+    drain() {
+        if (this.retired)
+            return Promise.resolve();
+        return this.running ??= this.drainOnce().finally(() => { this.running = undefined; });
+    }
+    async drainOnce() {
+        for (const entry of [...this.entries].slice(0, 32)) {
+            if (this.retired)
+                break;
+            try {
+                const value = entry.payload ?? await this.project(entry.value, entry.id);
+                // Freeze the canonical projection before any network attempt. A crash
+                // after service acceptance must replay the identical dedupe payload.
+                if (!entry.payload)
+                    this.persist(this.entries.map(e => e.id === entry.id ? { ...e, payload: value } : e));
+                const response = await fetch(this.config.origin + '/api/v1/send', {
+                    method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+                    headers: { ...(this.config.gatewayCredential
+                            ? { 'X-Ours-Api-Token': this.config.gatewayCredential, 'X-Ours-Notifications-Producer': this.config.token }
+                            : { Authorization: `Bearer ${this.config.token}` }), 'Content-Type': 'application/json' },
+                    body: JSON.stringify(value),
+                });
+                await response.body?.cancel();
+                if (!response.ok)
+                    throw new Error('notification service rejected event');
+                this.persist(this.entries.filter(e => e.id !== entry.id));
+            }
+            catch {
+                this.warn('Notification producer delivery pending; retrying from durable outbox');
+                break;
+            }
+        }
+    }
+    /** Wait for the current send before clearing queued sends and retiring its target. */
+    async retire() { this.retired = true; clearInterval(this.timer); await this.running; this.persist([]); }
+    async close() { clearInterval(this.timer); await this.running; }
+}

package/dist/notifications/target-cleanup.d.ts

@@ -0,0 +1,8 @@
+import { type ProducerConfig } from './outbox.js';
+/** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */
+export declare function retireNotificationTarget(url: string, config?: ProducerConfig | undefined, dir?: string, request?: typeof fetch): Promise<void>;
+/** Persisted retries also run from the ordinary web notification producer after restart. */
+export declare function drainNotificationTargetCleanup(config: ProducerConfig, dir?: string, request?: typeof fetch, options?: {
+    retain?: boolean;
+    beforeDelete?: (url: string) => Promise<boolean>;
+}): Promise<void>;

package/dist/notifications/target-cleanup.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { stateRoot } from '../paths.js';
+import { producerConfig } from './outbox.js';
+const cleanupDir = () => join(stateRoot(), 'notifications', 'removed-targets');
+/** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */
+export async function retireNotificationTarget(url, config = producerConfig(), dir = cleanupDir(), request = fetch) {
+    if (!config)
+        return;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    replaceFileAtomically(join(dir, createHash('sha256').update(url).digest('hex') + '.json'), JSON.stringify({ url }) + '\n', 0o600);
+    await drainNotificationTargetCleanup(config, dir, request, { retain: true });
+}
+/** Persisted retries also run from the ordinary web notification producer after restart. */
+export async function drainNotificationTargetCleanup(config, dir = cleanupDir(), request = fetch, options = {}) {
+    if (!existsSync(dir))
+        return;
+    for (const file of readdirSync(dir).filter(file => /^[a-f0-9]{64}\.json$/.test(file)).slice(0, 32)) {
+        try {
+            const path = join(dir, file), value = JSON.parse(readFileSync(path, 'utf8'));
+            if (typeof value.url !== 'string' || !value.url.startsWith('/fleet/chats?'))
+                continue;
+            if (options.beforeDelete && !(await options.beforeDelete(value.url))) {
+                rmSync(path, { force: true });
+                continue;
+            }
+            const response = await request(config.origin + '/api/v1/delete-target', { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10000),
+                headers: { ...(config.gatewayCredential ? { 'X-Ours-Api-Token': config.gatewayCredential, 'X-Ours-Notifications-Producer': config.token } : { Authorization: `Bearer ${config.token}` }), 'Content-Type': 'application/json' }, body: JSON.stringify(value) });
+            await response.body?.cancel();
+            if (!response.ok)
+                break;
+            if (!options.retain)
+                rmSync(path, { force: true });
+        }
+        catch {
+            break; /* No credentials or response bodies are included in logs. */
+        }
+    }
+}

package/dist/ops.js

@@ -1,3 +1,4 @@
+import { retireNotificationTarget } from './notifications/target-cleanup.js';
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, unlinkSync, } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
@@ -5,6 +6,7 @@ import { agentDir, watchdogsRoot } from './paths.js';
 import { findRole } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { generateBriefing } from './briefing.js';
+import { managedCliBriefing } from './managed-cli.js';
 import { resetRestartLedger } from './runner.js';
 import { archiveTempState, stopTempSupervisor, tempSupervisorLiveness, } from './temp-lifecycle.js';
 import { realExec } from './exec.js';
@@ -28,7 +30,7 @@ export function applyRole(role, opts = {}) {
     // brought up from so the supervised process can reload the SAME file instead of
     // silently falling back to the default ~/fleet.yaml. Temp roles snapshot their
     // whole resolved role into role.yaml instead and don't need this.
-    if (!opts.temp)
+    if (!opts.temp || opts.configPath)
         writeFileSync(join(dir, '.config-path'), (opts.configPath ?? '') + '\n');
     writeFileSync(join(dir, '.identity'), role.identity + '\n');
     if (role.cwd)
@@ -43,6 +45,7 @@ export function applyRole(role, opts = {}) {
         routinesPath: join(dir, 'ROUTINES.md'), briefingBody,
         identityGuarantee: opts.identityGuarantee,
         temporaryIdentity: opts.temp === true,
+        managedCli: managedCliBriefing(role, opts.configPath, opts.temp === true),
     }));
     if (opts.fresh)
         for (const f of ['.booted', '.session-id', '.exit-status'])
@@ -255,6 +258,7 @@ export async function rmRole(cfg, name, deps) {
     rmSync(agentDir(name), { recursive: true, force: true });
     if (generatedSource && existsSync(role.sourceFile)) {
         unlinkSync(role.sourceFile);
+        await retireNotificationTarget(`/fleet/chats?chat=${encodeURIComponent(name)}`).catch(() => { });
         deps.log(`removed ${role.sourceFile}`);
     }
     deps.log(`removed '${name}' (its ours identity is left intact)`);

package/dist/owner-channel/channel.d.ts

@@ -14,6 +14,8 @@ export interface OwnerChannelOptions {
     harness: string;
     config: OwnerChannelConfig;
     session: AgentSession;
+    /** Ordinary owner input must not cancel the initial briefing turn. */
+    startupPending?: () => boolean;
     stateDir: string;
     env?: Record<string, string>;
     log(line: string): void;
@@ -269,6 +271,7 @@ export declare class OwnerChannel implements OwnerChannelHandle {
     private attachmentGroups;
     private handleAttachmentGroup;
     private handle;
+    private ownerPromptPolicy;
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the

package/dist/owner-channel/channel.js

@@ -883,8 +883,15 @@ export class OwnerChannel {
         const recovered = [];
         for (const claim of this.messageRecovery.list()) {
             const item = await this.client.getHistoryItem(claim.wireId);
-            if (!item)
-                throw new Error(`journaled owner message ${claim.wireId} is missing from persistent history`);
+            if (!item) {
+                // The daemon has definitively lost this body. Retrying the claim would
+                // block every later owner message, including after a supervisor restart.
+                // Keep transient lookup errors retryable; only an explicit absence skips.
+                this.messageRecovery.pruneHandled(wireId => wireId === claim.wireId);
+                this.options.log(`[${this.options.role}] skipped journaled owner message ${claim.wireId} `
+                    + `(seq=${claim.seq}): missing from persistent history`);
+                continue;
+            }
             recovered.push(this.historyMessage(item, claim));
         }
         const listed = await this.client.listIncomingMessages();
@@ -1123,6 +1130,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');
@@ -1136,8 +1150,7 @@ export class OwnerChannel {
             await mkdir(outbox, { recursive: true, mode: 0o700 });
             const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
             const queued = await queueSessionPrompt(this.options.session, this.ownerAttachmentPrompt(sender, originWireId, requestId, admitted, group.caption), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId,
                     ...(group.caption ? { displayText: String(group.caption.text ?? '') } : {}) },
             });
@@ -1263,8 +1276,7 @@ export class OwnerChannel {
         const activityCursor = this.latestEventSeq(this.options.session.eventsSince(0));
         try {
             queued = await queueSessionPrompt(this.options.session, this.ownerPrompt(sender, text, wireId), {
-                interrupt: this.options.config.interrupt,
-                ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+                ...this.ownerPromptPolicy(),
                 origin: { kind: 'owner', requestId, displayText: text },
             });
         }
@@ -1309,6 +1321,14 @@ export class OwnerChannel {
         this.completionTasks.add(task);
         return true;
     }
+    ownerPromptPolicy() {
+        if (this.options.startupPending?.())
+            return { interrupt: false, steer: true };
+        return {
+            interrupt: this.options.config.interrupt,
+            ...(this.options.config.interrupt ? { interruptSource: 'owner' } : {}),
+        };
+    }
     /**
      * Deterministic command path: the message never becomes an agent prompt.
      * Authorization already happened — the managed-agent relay branch and the
@@ -1378,6 +1398,7 @@ export class OwnerChannel {
                     await this.fleetOps.provisionTask(task.task_id);
                 return outcome;
             }),
+            observeTaskReadiness: taskId => new TaskRoomApplicationService(this.options.configPath).observeTaskReadiness(taskId),
             taskProvisioningOutcome: taskId => new TaskRoomApplicationService(this.options.configPath).taskProvisioningOutcome(taskId),
             listTasks: filter => new TaskRoomApplicationService(this.options.configPath).listTasks(filter),
             groupedTasks: filter => new TaskRoomApplicationService(this.options.configPath).groupedTasks(filter),
@@ -1762,6 +1783,13 @@ export class OwnerChannel {
             const retrieved = unread.length
                 ? parseRetrievedAttachments(await this.client.getFiles(unread.map(file => file.wireId)), unread)
                 : [];
+            // getFiles returns daemon-local paths, which need not exist in Fleet's
+            // filesystem (for example with an HTTP daemon in a container). Fetch
+            // through the bound client and keep the daemon's integrity metadata for
+            // admission below; never trust or remap the returned filesystem path.
+            for (const file of retrieved) {
+                file.path = await writeRecoveredAttachment(requestDir, file.wireId, await this.client.fetchFile(file.wireId));
+            }
             for (const file of historyRecovered) {
                 if (!group.recovery)
                     throw new Error('unexpected read attachment without recovery route');

package/dist/owner-channel/commands.d.ts

@@ -1,3 +1,4 @@
+import type { TaskReadinessIssue } from '../rooms-tasks/live-readiness.js';
 import type { InterruptOutcome, SessionEvent, SessionSnapshot } from '../session/types.js';
 import type { RoomOrchestrationRecord, TaskOutcome, TaskRecord, TaskTerminalIntent, TaskListRecord } from '../rooms-tasks/types.js';
 import { type OwnerCommentsState } from './notices.js';
@@ -58,6 +59,9 @@ export interface OwnerCommandContext {
     terminalTask(taskId: string, kind: TaskTerminalIntent['kind'], outcome?: TaskOutcome): Promise<void>;
     createTask(input: Omit<CreateTaskRequest, 'actor'>): Promise<TaskRecord>;
     startTask(taskId: string): Promise<TaskProvisioningOutcome | TaskRecord>;
+    observeTaskReadiness?(taskId: string): Promise<{
+        state: 'ready';
+    } | TaskReadinessIssue>;
     taskProvisioningOutcome?(taskId: string): TaskProvisioningOutcome;
     listTasks(filter?: {
         state?: TaskState | TaskState[];

package/dist/owner-channel/commands.js

@@ -47,6 +47,11 @@ function isKnownOwnerRoomState(message) {
     ].some(pattern => pattern.test(message));
 }
 function ownerTaskFailure(error) {
+    if (error instanceof TaskRoomApplicationError && error.code === 'task_not_ready')
+        return {
+            kind: 'state', detail: error.message,
+            action: 'Ask Fleet Coordinator to inspect room and member status and choose supported recovery.',
+        };
     if (error instanceof TaskListError)
         return {
             kind: error.code === 'list_not_found' ? 'not_found'
@@ -301,6 +306,7 @@ export const ownerCommands = [
             const trailingLines = argLines.slice(1).join('\n').trim() || undefined;
             const showTask = async (id) => {
                 const { task: t } = ctx.getTask(id);
+                const readiness = t.state === 'active' ? await ctx.observeTaskReadiness?.(id) : undefined;
                 await ctx.reply(renderMarkdownResult({
                     icon: '📋', title: 'Task details',
                     fields: [
@@ -308,6 +314,8 @@ export const ownerCommands = [
                         { label: 'Title', value: t.title },
                         { label: 'Status', value: taskStatus(t.state), kind: 'markdown' },
                         { label: 'List', value: t.list_name ?? 'default', kind: 'code' },
+                        ...(readiness ? [{ label: 'Readiness', value: readiness.state },
+                            ...('reason' in readiness ? [{ label: 'Reason', value: readiness.reason }] : [])] : []),
                         ...(t.blocked ? [{ label: 'Blocked', value: t.blocked.reason }] : []),
                         ...(t.template ? [{ label: 'Template', value: `${t.template.name}@${t.template.version}`, kind: 'code' }] : []),
                         ...(t.room_id ? [{ label: 'Room', value: t.room_id, kind: 'code' }] : []),

package/dist/owner-channel/lifecycle-outbox.js

@@ -1,6 +1,6 @@
+import { redactErasedContent, writePrivacyFilteredLedger } from '../erased-resources.js';
 import { createHash } from 'node:crypto';
 import { chmodSync, existsSync, readFileSync } from 'node:fs';
-import { replaceFileAtomically } from '../atomic-file.js';
 import { lifecycleEventDigestBasis, validateFleetAuditPresentations, } from '../fleet-command-audit.js';
 const DIGEST = /^[a-f0-9]{64}$/u;
 const LIMIT = 5_000;
@@ -63,7 +63,7 @@ export class FleetLifecycleOutbox {
     }
     pending() {
         this.assertHealthy();
-        return this.entries.filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
+        return redactErasedContent(this.entries).filter(entry => entry.delivery === 'pending').map(entry => structuredClone(entry));
     }
     finish(digest, delivery) {
         this.assertHealthy();
@@ -82,6 +82,7 @@ export class FleetLifecycleOutbox {
             throw new Error(this.corruptReason);
     }
     persist() {
-        replaceFileAtomically(this.path, `${JSON.stringify({ version: 1, entries: this.entries })}\n`, 0o600);
+        this.entries = redactErasedContent(this.entries);
+        writePrivacyFilteredLedger(this.path, { version: 1, entries: this.entries });
     }
 }

package/dist/owner-channel/ours-client.js

@@ -1,7 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { extname, join } from 'node:path';
-import { readDaemonConfig, resolveEndpoint } from '../monitor.js';
+import { extname } from 'node:path';
 import { readClientProfile } from '../client-profile.js';
 import { OursError, attachOursClient, } from '@ours.network/sdk/client';
 /** Any failure of a daemon operation. Never carries a message body or a token. */
@@ -131,24 +130,10 @@ export class OursSdkClient {
             return;
         const environment = { ...process.env, ...this.env };
         const profile = readClientProfile(environment);
-        // Reuse existing connection configuration. Identity selection checks the
-        // daemon capability before reading the client's protected token delivery file.
-        const endpoint = !profile && environment.OURS_DAEMON_ID
-            ? resolveEndpoint(environment, false) : undefined;
-        const token = endpoint ? environment.OURS_API_TOKEN?.trim() || readDaemonConfig(environment).apiToken : undefined;
-        const options = profile ? {
+        const options = {
             endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId,
             credentialPath: profile.credentialPath,
             sessionMode: 'external', leaseToken: this.leaseToken, env: {},
-        } : endpoint ? {
-            endpoint: endpoint.origin, expectedInstanceId: environment.OURS_DAEMON_ID,
-            sessionMode: 'external', leaseToken: this.leaseToken,
-            ...(token ? { token } : { credentialPath: join(endpoint.stateDir, 'daemon-token') }),
-        } : {
-            env: environment,
-            leaseToken: this.leaseToken,
-            clientPid: process.pid,
-            fetch: notificationDeadlineFetch(this.deps.fetch ?? globalThis.fetch, this.deps.notificationRequestDeadlineMs ?? NOTIFICATION_REQUEST_DEADLINE_MS),
         };
         this.client = await (this.deps.attachClient?.(options) ?? attachOursClient(options));
         this.terminalReleasePending = true;

package/dist/paths.d.ts

@@ -11,6 +11,8 @@ export declare const home: () => string;
  */
 export declare function deriveXdgRuntimeDir(env?: NodeJS.ProcessEnv, uid?: number | undefined, exists?: (p: string) => boolean): string | undefined;
 export declare const stateRoot: () => string;
+/** The Owner invitation file that tunnel setup writes itself after enrollment. */
+export declare const workspaceOwnerInvite: () => string;
 export declare const agentsRoot: () => string;
 export declare const tmpRoot: () => string;
 export declare const logsRoot: () => string;

package/dist/paths.js

@@ -21,6 +21,8 @@ export function deriveXdgRuntimeDir(env = process.env, uid = process.getuid?.(),
     return env.XDG_RUNTIME_DIR;
 }
 export const stateRoot = () => join(home(), '.ours-fleet');
+/** The Owner invitation file that tunnel setup writes itself after enrollment. */
+export const workspaceOwnerInvite = () => join(stateRoot(), 'workspace', 'owner.invite');
 export const agentsRoot = () => join(stateRoot(), 'agents');
 export const tmpRoot = () => join(stateRoot(), 'tmp');
 export const logsRoot = () => join(stateRoot(), 'logs');

package/dist/preset-migration.js

@@ -67,10 +67,21 @@ const V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS = Object.freeze({
     'agent_templates/Developer.yaml': 'fdd953aab72d042e62780dd273598745aae59521b39edf4876d7676bb7189c83',
     'agent_templates/Critic.yaml': '3e98a28f17876061cfadf984351aa59fdbe19629e514eff52c74546545c64a91',
 });
+// The packaged Coordinator role of revisions 8 and 9 addressed a named owner channel that a
+// fresh installation does not have. Untouched copies adopt the current role; edited ones stay.
+const OWNER_CHANNEL_COORDINATOR_FINGERPRINTS = Object.freeze({
+    'roles/Coordinator.yaml': [
+        '8c8ad28d9bb9ddf9dba8c5c9c7859f25edd8fa10ebf833e2340124a6e49583ec',
+        'f0d8b169ad0a18051b57e5280b93cf01e05faa5c12f4e12bdf89973edf2ef58a',
+    ],
+});
 const CURRENT_ROLE_DEFAULTS = new Set([
     'roles/Coordinator.yaml', 'roles/LocalCoordinator.yaml', 'roles/Developer.yaml', 'roles/Critic.yaml',
+    'roles/Engineer.yaml',
     'agent_templates/LocalCoordinator.yaml', 'agent_templates/Developer.yaml', 'agent_templates/Critic.yaml',
+    'agent_templates/Engineer.yaml',
     'room_templates/single.yaml', 'room_templates/pair.yaml', 'room_templates/team.yaml',
+    'room_templates/engineering.yaml',
     'agents/FleetCoordinator.yaml',
 ]);
 export const legacyStarterMigrationManifest = Object.freeze({
@@ -193,6 +204,7 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
             ...Object.keys(V3_ROLE_DEFAULT_FINGERPRINTS),
             ...Object.keys(V4_ROLE_DEFAULT_FINGERPRINTS),
             ...Object.keys(V5_ROLE_DEFAULT_FINGERPRINTS),
+            ...Object.keys(OWNER_CHANNEL_COORDINATOR_FINGERPRINTS),
         ]);
         for (const relative of known) {
             const path = join(root, relative);
@@ -206,6 +218,7 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
                 V4_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
                 V5_ROLE_DEFAULT_FINGERPRINTS[relative],
                 V5_GENERATED_ROLE_DEFAULT_FINGERPRINTS[relative],
+                ...(OWNER_CHANNEL_COORDINATOR_FINGERPRINTS[relative] ?? []),
             ].some(expected => expected !== undefined && actual === expected);
             if (recognized)
                 (CURRENT_ROLE_DEFAULTS.has(relative) ? replacements : removals).push(path);
@@ -258,6 +271,18 @@ export function migratePackagedRoleDefaults(configuration, options = {}, hooks =
                 unlinkSync(target);
             copyFileSync(join(source, relative), target, constants.COPYFILE_EXCL);
             chmodSync(target, 0o600);
+            // New Engineer seats use the existing Developer's selected brain. This
+            // preserves wizard/custom provider choices without copying permissions.
+            if (relative === 'agent_templates/Engineer.yaml' && classified.additions.includes(path)) {
+                const developer = join(root, 'agent_templates/Developer.yaml');
+                if (existsSync(developer)) {
+                    const value = parseFleetDocument(developer, readFileSync(developer, 'utf8'), 'strict').value;
+                    if (value.brain !== undefined && JSON.stringify(value.brain) !== JSON.stringify({ ref: 'claude-default' })) {
+                        const bytes = readFileSync(target, 'utf8').replace('brain: { ref: claude-default }', () => `brain: ${JSON.stringify(value.brain)}`);
+                        writeFileSync(target, bytes, { mode: 0o600 });
+                    }
+                }
+            }
             fsyncPath(target);
         }
         for (const kind of ['roles', 'agent_templates', 'room_templates', 'agents'])

package/dist/resolved-plan.js

@@ -103,6 +103,7 @@ export function resolvedRolePlan(role, manifestDir = dirname(role.sourceFile)) {
         isolation: role.isolation ?? null,
         worklog: role.worklog ?? null,
         authProxy: role.auth_proxy ?? null,
+        managedCli: role.managed_cli ?? [],
         oversee: role.oversee ?? [],
         harnessOptions: redactSensitive(role.harness_options ?? null),
         env: {

package/dist/rooms-tasks/add-member.d.ts

@@ -0,0 +1,48 @@
+import type { FleetConfig } from '../config.js';
+import { TaskStateError } from './task-state.js';
+import { provisionMembers } from './provision.js';
+import type { CoworkAdapter } from './cowork-adapter.js';
+export declare class MemberAdditionRejected extends TaskStateError {
+    readonly accepted = false;
+}
+export interface AddMemberRequest {
+    requestId: string;
+    slot: string;
+    role: string;
+    brain: string;
+    agentTemplate: string;
+}
+export declare function memberAddition(taskId: string, requestId: string): {
+    requestId: string;
+    taskId: string;
+    roleId: string;
+    state: "running" | "succeeded" | "attention" | "failed";
+    error?: string;
+} | {
+    state: string;
+    error: string;
+    requestId: string;
+    taskId: string;
+    roleId: string;
+};
+export declare function requestMemberAddition(input: {
+    taskId: string;
+    request: AddMemberRequest;
+    cfg: FleetConfig;
+    cowork: CoworkAdapter;
+    configPath?: string;
+    binPath: string;
+    provision?: typeof provisionMembers;
+}): Promise<{
+    requestId: string;
+    taskId: string;
+    roleId: string;
+    state: "running" | "succeeded" | "attention" | "failed";
+    error?: string;
+} | {
+    state: string;
+    error: string;
+    requestId: string;
+    taskId: string;
+    roleId: string;
+}>;