@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.7

package/README.md

@@ -1710,3 +1710,43 @@ Explicit Cowork socket, config or state-directory overrides continue to select
 local Unix management. Profiles without `serverUrl` retain legacy behavior. The
 HTTP API grants operator room authority; use the installer's supported private
 or authenticated external gateway entry, and keep its backend ports private.
+
+### Agent ours tools through the supervisor
+
+Operators can invoke the running agent's ordinary ours MCP tools without sending
+an LLM prompt or binding another session to its identity:
+
+```sh
+ours-fleet ours tools Critic1
+ours-fleet ours call Critic1 current_identity
+ours-fleet ours call Critic1 list_contacts
+ours-fleet ours call Critic1 generate_invite --args-file /private/invite-options.json
+ours-fleet ours call Critic1 add_contact --args-file /private/contact.json
+```
+
+`tools` returns the managed MCP tool names and argument schemas, plus the selected
+agent's identity name, CID, and supervisor generation. `call` returns the same
+identity metadata and the MCP result. The private JSON file contains the tool's
+arguments (for example `{"invite":"…"}` for `add_contact`); omitted arguments mean
+`{}`. Protect files containing invites and protect command output containing a
+new invite. Tool errors set a nonzero CLI exit status.
+
+The authenticated REST equivalents are `GET /api/v1/roles/:id/ours/tools` and
+`POST /api/v1/roles/:id/ours/call`, with the normal Fleet session and CSRF token.
+The POST body is `{"tool":"list_contacts","arguments":{}}`. MCP tool errors
+remain in `result.isError`; transport failures use the normal Fleet error envelope.
+Request arguments and results are excluded from the Fleet audit log.
+
+Both interfaces use the supervisor's existing fixed-identity MCP server and tool
+policy. Identity creation, removal, switching, and binding are not exposed. The
+supervisor must be running. Older descriptors are supported only when a unique
+existing runtime journal, instance record, and identity pin prove the selected
+agent and generation, and the same MCP connection confirms its identity and
+lifetime before the operation. This reads existing state without rewriting the
+descriptor or restarting the agent. Missing, ambiguous, stale, or mismatched
+proofs fail closed. Unknown identity descriptions also fail closed. Closing an operator call
+retains the supervisor's identity. An interrupted mutation can have an unknown
+outcome: inspect state before retrying, because there is no automatic retry or
+exactly-once guarantee. Contact acceptance alone does not prove peer verification
+or message delivery. File tools resolve paths in the invoking CLI process or
+Fleet web server's filesystem context, with that process's access permissions.

package/dist/agent-ours/bridge.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createHash } from 'node:crypto';
 import { connect } from 'node:net';
 import { access, mkdir, open, readFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
@@ -12,6 +13,14 @@ export async function runBridge(descriptorPath) {
         typeof descriptor.capability !== 'string' ||
         !Number.isInteger(descriptor.generation))
         throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    if (process.env.FLEET_OURS_BRIDGE_EXPECTED) {
+        const expected = JSON.parse(process.env.FLEET_OURS_BRIDGE_EXPECTED);
+        const digest = createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex');
+        if (expected.transportDigest !== digest)
+            throw Error('SUPERVISOR_TRANSPORT_CHANGED');
+        if (['role', 'identity', 'cid', 'generation'].some(key => descriptor[key] !== expected[key]))
+            throw Error('SUPERVISOR_SELECTION_CHANGED');
+    }
     const wire = new Wire(connect(descriptor.socket));
     const handles = new Map();
     const cleanup = async () => {

package/dist/agent-ours/service.js

@@ -11,19 +11,31 @@ import { atomicPrivateWrite, binderKey } from './state.js';
 import { AgentOursRuntime } from './runtime.js';
 import { startMcpEndpoint } from './mcp-endpoint.js';
 export const privateRuntimeRoot = () => join(stateRoot(), 'private-ours');
+function roomSecretPath(role) {
+    const startup = role.roomMemberStartup;
+    return join(privateRuntimeRoot(), 'room-inputs', binderKey(startup.room_identity_cid, JSON.stringify([role.name, startup.invite_id])) + '.json');
+}
+function matchesRoomSecret(secret, role) {
+    const startup = role.roomMemberStartup;
+    return secret.room_id === startup.room_id && secret.room_identity_cid === startup.room_identity_cid
+        && secret.invite_id === startup.invite_id && secret.identity_name === role.identity
+        && secret.role === startup.role;
+}
 /** Only trusted launch orchestration may write this descriptor, never the child. */
 export function storeRoomSecret(role) {
     const startup = role.roomMemberStartup;
     if (!startup?.invite)
         return;
+    if (startup.identity_name !== role.identity)
+        throw Error('ROOM_SECRET_MISMATCH');
     const root = join(privateRuntimeRoot(), 'room-inputs');
     mkdirSync(root, { recursive: true, mode: 0o700 });
-    const path = join(root, binderKey(startup.room_identity_cid, role.name) + '.json');
+    // Failed attempts retain private evidence. A new invite must never overwrite
+    // or consume a previous attempt's descriptor.
+    const path = roomSecretPath(role);
     if (existsSync(path)) {
         const old = JSON.parse(readFileSync(path, 'utf8'));
-        if (old.room_id !== startup.room_id ||
-            old.invite_id !== startup.invite_id ||
-            old.identity_name !== startup.identity_name)
+        if (!matchesRoomSecret(old, role) || old.invite !== startup.invite)
             throw Error('ROOM_SECRET_COLLISION');
         return;
     }
@@ -144,7 +156,9 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         let room;
         if (role.roomMemberStartup) {
             const startup = role.roomMemberStartup;
-            const path = join(root, 'room-inputs', binderKey(startup.room_identity_cid, role.name) + '.json');
+            const legacyPath = join(root, 'room-inputs', binderKey(startup.room_identity_cid, role.name) + '.json');
+            const currentPath = roomSecretPath(role);
+            const path = existsSync(currentPath) ? currentPath : legacyPath;
             const cowork = createCoworkAdapter();
             room = {
                 id: startup.room_id,
@@ -153,9 +167,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
                 action: startup.invite_id,
                 redeem: async (attached) => {
                     const secret = JSON.parse(readFileSync(path, 'utf8'));
-                    if (secret.room_id !== startup.room_id ||
-                        secret.invite_id !== startup.invite_id ||
-                        secret.identity_name !== role.identity)
+                    if (!matchesRoomSecret(secret, role))
                         throw Error('ROOM_SECRET_MISMATCH');
                     return attached.addContact({ invite: secret.invite });
                 },
@@ -207,7 +219,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
-        atomicPrivateWrite(descriptor, { socket, capability, generation });
+        atomicPrivateWrite(descriptor, { socket, capability, generation, role: role.name, identity: role.identity, cid: runtime.snapshot.cid });
         return {
             runtime,
             descriptor,

package/dist/application/legacy-supervisor-identity.d.ts

@@ -0,0 +1,7 @@
+/** Read-only compatibility proof for supervisors predating descriptor identity metadata. */
+export declare function legacySupervisorIdentity(role: string, name: string, temporary: boolean, generation: number): {
+    name: string;
+    cid: string;
+    generation: number;
+    proof: string;
+};

package/dist/application/legacy-supervisor-identity.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { binderKey } from '../agent-ours/state.js';
+import { FleetError } from './errors.js';
+/** Read-only compatibility proof for supervisors predating descriptor identity metadata. */
+export function legacySupervisorIdentity(role, name, temporary, generation) {
+    const root = join(stateRoot(), 'private-ours');
+    try {
+        const matches = [];
+        for (const entry of readdirSync(root, { withFileTypes: true })) {
+            if (!entry.isDirectory() || !/^[a-f0-9]{64}$/.test(entry.name))
+                continue;
+            const dir = join(root, entry.name);
+            const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+            if (instance.role !== role)
+                continue;
+            const state = JSON.parse(readFileSync(join(dir, 'state.json'), 'utf8'));
+            const pin = JSON.parse(readFileSync(join(dir, 'identity-pin.json'), 'utf8'));
+            if (!Number.isSafeInteger(generation) || generation < 1
+                || typeof state.action !== 'string' || !state.action
+                || instance.temporary !== temporary || typeof instance.instance !== 'string' || !instance.instance
+                || state.version !== 1 || state.instance !== instance.instance
+                || state.name !== name || state.lifetime !== (temporary ? 'temporary' : 'permanent')
+                || state.generation !== generation || !['READY', 'SERVING'].includes(state.phase)
+                || typeof state.daemon !== 'string' || !state.daemon || binderKey(state.daemon, name) !== entry.name
+                || !/^[a-f0-9]{64}$/i.test(state.cid ?? '')
+                || pin.daemon !== state.daemon || pin.name !== name || pin.cid !== state.cid)
+                throw new Error('mismatched legacy ownership proof');
+            matches.push({ name, cid: state.cid, generation, proof: createHash('sha256').update(JSON.stringify([
+                    instance.instance, state.action, state.daemon, name, state.cid, state.lifetime, generation,
+                ])).digest('hex') });
+        }
+        if (matches.length !== 1)
+            throw new Error('missing or ambiguous legacy ownership proof');
+        return matches[0];
+    }
+    catch {
+        // The private directory also contains ownership material: never echo parse errors.
+        throw new FleetError('capability_unavailable', 'legacy supervisor ownership proof is missing, ambiguous, or mismatched');
+    }
+}

package/dist/application/supervisor-ours-tools.d.ts

@@ -0,0 +1,159 @@
+export interface SupervisorToolRequest {
+    tool: string;
+    arguments?: Record<string, unknown>;
+}
+/** CLI and REST use the same fixed-identity MCP server as the agent harness. */
+export declare class SupervisorOursTools {
+    private withClient;
+    list(role: string): Promise<{
+        tools: {
+            inputSchema: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: Record<string, object> | undefined;
+                required?: string[] | undefined;
+            };
+            name: string;
+            description?: string | undefined;
+            outputSchema?: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: Record<string, object> | undefined;
+                required?: string[] | undefined;
+            } | undefined;
+            annotations?: {
+                title?: string | undefined;
+                readOnlyHint?: boolean | undefined;
+                destructiveHint?: boolean | undefined;
+                idempotentHint?: boolean | undefined;
+                openWorldHint?: boolean | undefined;
+            } | undefined;
+            execution?: {
+                taskSupport?: "optional" | "required" | "forbidden" | undefined;
+            } | undefined;
+            _meta?: Record<string, unknown> | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        }[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        nextCursor?: string | undefined;
+        agent: string;
+        identity: {
+            name: string;
+            cid: string;
+            generation: number;
+        };
+    }>;
+    call(role: string, request: SupervisorToolRequest): Promise<{
+        agent: string;
+        identity: {
+            name: string;
+            cid: string;
+            generation: number;
+        };
+        result: {
+            [x: string]: unknown;
+            content: ({
+                type: "text";
+                text: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "image";
+                data: string;
+                mimeType: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "audio";
+                data: string;
+                mimeType: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "resource";
+                resource: {
+                    uri: string;
+                    text: string;
+                    mimeType?: string | undefined;
+                    _meta?: Record<string, unknown> | undefined;
+                } | {
+                    uri: string;
+                    blob: string;
+                    mimeType?: string | undefined;
+                    _meta?: Record<string, unknown> | undefined;
+                };
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                uri: string;
+                name: string;
+                type: "resource_link";
+                description?: string | undefined;
+                mimeType?: string | undefined;
+                size?: number | undefined;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+                icons?: {
+                    src: string;
+                    mimeType?: string | undefined;
+                    sizes?: string[] | undefined;
+                    theme?: "light" | "dark" | undefined;
+                }[] | undefined;
+                title?: string | undefined;
+            })[];
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+            structuredContent?: Record<string, unknown> | undefined;
+            isError?: boolean | undefined;
+        } | {
+            [x: string]: unknown;
+            toolResult: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        };
+    }>;
+}

package/dist/application/supervisor-ours-tools.js

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { agentDir } from '../paths.js';
+import { ROLE_NAME_RE } from '../config.js';
+import { legacySupervisorIdentity } from './legacy-supervisor-identity.js';
+import { FleetError } from './errors.js';
+/** CLI and REST use the same fixed-identity MCP server as the agent harness. */
+export class SupervisorOursTools {
+    async withClient(role, work) {
+        if (!ROLE_NAME_RE.test(role))
+            throw new FleetError('invalid_request', 'invalid agent name');
+        const findCandidates = () => [false, true].map(temporary => ({ temporary, dir: agentDir(role, temporary) }))
+            .map(row => ({ ...row, path: join(row.dir, '.ours-bridge', 'descriptor.json') }))
+            .filter(row => existsSync(row.path));
+        const candidates = findCandidates();
+        if (candidates.length !== 1)
+            throw new FleetError('capability_unavailable', 'agent supervisor endpoint is missing or ambiguous');
+        const selected = candidates[0];
+        let descriptor;
+        let identityName;
+        try {
+            descriptor = JSON.parse(readFileSync(selected.path, 'utf8'));
+            identityName = readFileSync(join(selected.dir, '.identity'), 'utf8').trim();
+            if (!descriptor || typeof descriptor !== 'object')
+                throw new Error();
+        }
+        catch {
+            throw new FleetError('capability_unavailable', 'supervisor identity metadata cannot be read');
+        }
+        const legacy = ['role', 'identity', 'cid'].every(key => descriptor[key] === undefined);
+        const identity = legacy
+            ? legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation)
+            : { name: identityName, cid: descriptor.cid, generation: descriptor.generation };
+        if (legacy && descriptor.socket !== join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`))
+            throw new FleetError('capability_unavailable', 'legacy supervisor socket does not match the selected agent');
+        if ((!legacy && (descriptor.role !== role || descriptor.identity !== identityName))
+            || !/^[a-f0-9]{64}$/i.test(identity.cid ?? '') || !Number.isSafeInteger(descriptor.generation) || descriptor.generation < 1)
+            throw new FleetError('capability_unavailable', 'supervisor identity metadata is unavailable or mismatched');
+        const verifySelection = () => {
+            try {
+                const current = findCandidates();
+                const freshDescriptor = JSON.parse(readFileSync(selected.path, 'utf8'));
+                if (current.length !== 1 || current[0].path !== selected.path
+                    || readFileSync(join(selected.dir, '.identity'), 'utf8').trim() !== identityName
+                    || ['role', 'identity', 'cid', 'socket', 'capability', 'generation']
+                        .some(key => freshDescriptor[key] !== descriptor[key]))
+                    throw new Error();
+            }
+            catch {
+                throw new FleetError('capability_unavailable', 'selected supervisor assignment changed');
+            }
+        };
+        const client = new Client({ name: 'ours-fleet-supervisor-tools', version: '1' });
+        const transport = new StdioClientTransport({
+            command: process.execPath,
+            args: [fileURLToPath(new URL('../agent-ours/bridge.js', import.meta.url))],
+            env: { ...Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined)),
+                FLEET_OURS_BRIDGE_DESCRIPTOR: selected.path,
+                FLEET_OURS_BRIDGE_EXPECTED: JSON.stringify({ role: descriptor.role, identity: descriptor.identity, cid: descriptor.cid, generation: descriptor.generation,
+                    transportDigest: createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex') }) },
+            stderr: 'pipe',
+        });
+        try {
+            await client.connect(transport);
+            const verify = async () => {
+                if (!legacy) {
+                    verifySelection();
+                    return;
+                }
+                const actual = await client.callTool({ name: 'current_identity', arguments: {} });
+                const blocks = actual.content;
+                const lines = blocks?.length === 1 && blocks[0].type === 'text' ? blocks[0].text?.split('\n') : undefined;
+                const prefix = `Bound to "${identity.name}" (${identity.cid})`;
+                const suffix = lines?.[0].startsWith(prefix) ? lines[0].slice(prefix.length) : undefined;
+                const roleSuffix = typeof suffix === 'string' && /^ — role "[^"\r\n]+" under root "[^"\r\n]+"\.$/.test(suffix);
+                const temporaryLine = 'TEMPORARY identity owned by the Fleet supervisor for this logical agent instance. Bridge or harness disconnect retains it; terminal supervisor release deletes local state with best-effort peer notices.';
+                if (actual.isError || !(roleSuffix || (selected.temporary && suffix === '.'))
+                    || (selected.temporary ? lines?.[1] !== temporaryLine : lines?.[1]?.startsWith('TEMPORARY')))
+                    throw new FleetError('capability_unavailable', 'connected supervisor identity does not match legacy ownership proof');
+                const fresh = legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation);
+                if (!('proof' in identity) || fresh.proof !== identity.proof)
+                    throw new FleetError('capability_unavailable', 'legacy supervisor identity changed');
+                verifySelection();
+            };
+            await verify();
+            return await work(client, { name: identity.name, cid: identity.cid, generation: identity.generation }, verify);
+        }
+        catch (error) {
+            if (error instanceof FleetError)
+                throw error;
+            // Do not leak arguments, invites, capabilities, or raw transport errors.
+            throw new FleetError('control_unavailable', 'supervisor tool request failed; its outcome may be unknown, do not retry a mutation automatically', { retryable: false });
+        }
+        finally {
+            await client.close().catch(() => { });
+            await transport.close().catch(() => { });
+        }
+    }
+    list(role) {
+        return this.withClient(role, async (client, identity) => ({
+            agent: role, identity, ...(await client.listTools()),
+        }));
+    }
+    call(role, request) {
+        if (!request || typeof request.tool !== 'string'
+            || (request.arguments !== undefined && (!request.arguments || typeof request.arguments !== 'object' || Array.isArray(request.arguments))))
+            throw new FleetError('invalid_request', 'tool and object arguments are required');
+        return this.withClient(role, async (client, identity, verify) => {
+            const { tools } = await client.listTools();
+            if (!tools.some(tool => tool.name === request.tool))
+                throw new FleetError('forbidden', 'tool is not exposed by the fixed-identity supervisor');
+            await verify();
+            const result = await client.callTool({ name: request.tool, arguments: request.arguments ?? {} });
+            return { agent: role, identity, result };
+        });
+    }
+}

package/dist/application/task-room-service.js

@@ -136,7 +136,7 @@ export class TaskRoomApplicationService {
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
-                    persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    persistBlockTask(task.task_id, 'Cowork management is unavailable');
                 // Once the durable Room exists, provisioning errors are resumable
                 // saga state. Return that explicit state so the command can launch a
                 // continuation and report the durable in-progress outcome.
@@ -234,17 +234,23 @@ export class TaskRoomApplicationService {
         const ready = task.state === 'active' && room?.state === 'active'
             && active === expected && launched === expected;
         const blocker = task.outcome?.summary ?? task.blocked?.reason ?? room?.saga.error;
-        const nextAction = room?.provisioning_detail === 'waiting_owner_authorization'
-            ? `Ensure ours-cowork 1.3.0 or newer is running and available, then run ours-fleet task start ${task.task_id}.`
-            : room?.provisioning_detail === 'waiting_owner_invite'
-                ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
-                : room?.provisioning_detail === 'owner_cid_mismatch'
-                    ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
-                    : room?.provisioning_detail === 'waiting_cowork'
-                        ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
-                        : failed
-                            ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
-                            : undefined;
+        const nextAction = task.terminal_intent
+            ? `Complete the accepted ${task.terminal_intent.kind} operation; do not restart provisioning.`
+            : room?.state === 'closing' || room?.state === 'closed'
+                ? `Complete room cleanup; do not restart provisioning.`
+                : room?.provisioning_detail === 'member_failed'
+                    ? `Inspect the failed launch, then run ours-fleet task start ${task.task_id}.`
+                    : room?.provisioning_detail === 'waiting_owner_authorization'
+                        ? `Ensure ours-cowork 1.3.0 or newer is running and available, then run ours-fleet task start ${task.task_id}.`
+                        : room?.provisioning_detail === 'waiting_owner_invite'
+                            ? `Rotate rooms.owner.public_invite, then run ours-fleet task start ${task.task_id}.`
+                            : room?.provisioning_detail === 'owner_cid_mismatch'
+                                ? `Verify rooms.owner.expected_cid, rotate the Owner invite, then run ours-fleet task start ${task.task_id}.`
+                                : room?.provisioning_detail === 'waiting_cowork'
+                                    ? `Restore ours-cowork, then run ours-fleet task start ${task.task_id}.`
+                                    : failed
+                                        ? `Correct the blocker, then run ours-fleet task start ${task.task_id}.`
+                                        : undefined;
         return {
             kind: failed ? 'failed' : ready ? 'ready' : 'in_progress', task, room,
             launch: {
@@ -410,7 +416,9 @@ export class TaskRoomApplicationService {
         let task = readTask(input.taskId);
         let room = task.room_id ? getRoomRecord(task.room_id) : undefined;
         const issues = [];
-        if (task.state !== 'provisioning')
+        if (task.state !== 'provisioning' || task.terminal_intent
+            || room?.state === 'closing' || room?.state === 'closed'
+            || room?.provisioning_detail === 'member_failed')
             return {
                 kind: 'no_op', task, room, issues,
             };
@@ -784,7 +792,7 @@ export class TaskRoomApplicationService {
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
-                    persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    persistBlockTask(task.task_id, 'Cowork management is unavailable');
                 const current = readTask(task.task_id);
                 if (!current.room_id || !getRoomRecord(current.room_id))
                     throw error;
@@ -802,7 +810,7 @@ export class TaskRoomApplicationService {
                 }
                 catch (error) {
                     if (error instanceof CoworkUnavailableError)
-                        persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                        persistBlockTask(task.task_id, 'Cowork management is unavailable');
                     task = readTask(task.task_id);
                     return { task, status: 'in_progress' };
                 }
@@ -820,7 +828,7 @@ export class TaskRoomApplicationService {
             }
             catch (error) {
                 if (error instanceof CoworkUnavailableError)
-                    persistBlockTask(task.task_id, 'Cowork management socket is unavailable');
+                    persistBlockTask(task.task_id, 'Cowork management is unavailable');
                 task = readTask(task.task_id);
             }
         }
@@ -878,11 +886,17 @@ export class TaskRoomApplicationService {
                     if (fresh.deletion?.status === 'pending')
                         throw new TaskRoomApplicationError('task_deleting', `task ${task.task_id} is pending deletion`, { task: task.task_id });
                 }
+                const requiredRoles = new Map();
+                if (attachOwner)
+                    requiredRoles.set(rooms.owner.role, 1);
+                for (const member of launchTemplate?.members ?? [])
+                    requiredRoles.set(member.role, (requiredRoles.get(member.role) ?? 0) + member.count);
                 const created = await cowork.createRoom({
                     room_name: roomName, goal: task.goal?.trim() || task.title,
                     briefing: task.brief?.trim() || launchTemplate?.contract?.trim() || task.goal?.trim() || task.title,
                     quiet_membership: launchTemplate?.room?.quiet_membership,
                     anonymous: policy.anonymous,
+                    activation_requirements: [...requiredRoles].map(([role, count]) => ({ role, count })),
                 });
                 const record = createRoomRecord({
                     room_id: created.room_id, room_name: roomName, room_identity_cid: created.identity_cid,

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.5",
-  "buildId": "4d7255bd137c",
-  "commit": "273d3bec2505bd1a4244c6b00b836238faaac99e",
+  "version": "1.2.0-nightly.7",
+  "buildId": "f5cfd3c1f10c",
+  "commit": "a5d6f736733fa419e6acf7306affb4a662261bbf",
   "dirty": true,
-  "builtAt": "2026-09-22T18:42:44.399Z",
+  "builtAt": "2026-09-23T20:14:37.547Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
@@ -496,6 +497,40 @@ program.command('peek <name> [lines]').description('pane snapshot without attach
         die(controlFailure(name, 'peek', e));
     }
 });
+const oursToolsCommand = program.command('ours').description('invoke tools through a named agent supervisor and its fixed identity');
+oursToolsCommand.command('tools <agent>').description('list the same tools and schemas exposed to the agent MCP')
+    .action(async (agent) => {
+    try {
+        console.log(JSON.stringify(await new SupervisorOursTools().list(agent), null, 2));
+    }
+    catch (error) {
+        die(error);
+    }
+});
+oursToolsCommand.command('call <agent> <tool>').description('call a supervisor MCP tool without prompting the agent')
+    .option('--args-file <path>', 'JSON object arguments from a private file; omitted means {}')
+    .action(async (agent, tool, options) => {
+    try {
+        let args = {};
+        if (options.argsFile) {
+            try {
+                args = JSON.parse(readFileSync(options.argsFile, 'utf8'));
+            }
+            catch {
+                throw new Error('cannot read tool arguments: expected a readable JSON object file');
+            }
+        }
+        const response = await new SupervisorOursTools().call(agent, { tool, arguments: args });
+        console.log(JSON.stringify(response, null, 2));
+        if ('isError' in response.result && response.result.isError)
+            throw new FleetCliExit(1, 'runtime', 'unknown');
+    }
+    catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
+        die(error);
+    }
+});
 program.command('send <name> [text...]').description("type into the agent's console")
     .action(async (name, text, opts) => {
     const stateDir = acpStateDir(name);
@@ -1612,6 +1647,8 @@ async function parseFleetCli() {
         await program.parseAsync(process.argv);
     }
     catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
         const commander = error;
         if (commander.exitCode === 0)
             return;

package/dist/docs.d.ts

@@ -17,8 +17,8 @@ export declare const AI_DOCS = "# ours-fleet reference\n\nours-fleet runs persis
  * \`forbidden\` is the more important half. The old skills prescribed
  * \`--approval ask --filesystem workspace --unattended deny\` as a blanket
  * default while also telling the agent to stop at a failed doctor check — and
- * that combination is exactly what \`doctor\` FAILS, because \`ask\` grants an
- * unattended role nothing but \`read-state\` and \`deny\` makes the shortfall
+ * that combination is exactly what \`doctor\` FAILS, because \`ask\` cannot
+ * guarantee unattended capabilities and \`deny\` makes the shortfall
  * fatal. Following the skill produced a role the CLI then refused.
  */
 export declare const SPAWN_SKILL_CONTRACT: {