@ours.network/fleet 1.2.0-nightly.6 → 1.2.0-nightly.7

package/README.md

@@ -1710,3 +1710,43 @@ Explicit Cowork socket, config or state-directory overrides continue to select
 local Unix management. Profiles without `serverUrl` retain legacy behavior. The
 HTTP API grants operator room authority; use the installer's supported private
 or authenticated external gateway entry, and keep its backend ports private.
+
+### Agent ours tools through the supervisor
+
+Operators can invoke the running agent's ordinary ours MCP tools without sending
+an LLM prompt or binding another session to its identity:
+
+```sh
+ours-fleet ours tools Critic1
+ours-fleet ours call Critic1 current_identity
+ours-fleet ours call Critic1 list_contacts
+ours-fleet ours call Critic1 generate_invite --args-file /private/invite-options.json
+ours-fleet ours call Critic1 add_contact --args-file /private/contact.json
+```
+
+`tools` returns the managed MCP tool names and argument schemas, plus the selected
+agent's identity name, CID, and supervisor generation. `call` returns the same
+identity metadata and the MCP result. The private JSON file contains the tool's
+arguments (for example `{"invite":"…"}` for `add_contact`); omitted arguments mean
+`{}`. Protect files containing invites and protect command output containing a
+new invite. Tool errors set a nonzero CLI exit status.
+
+The authenticated REST equivalents are `GET /api/v1/roles/:id/ours/tools` and
+`POST /api/v1/roles/:id/ours/call`, with the normal Fleet session and CSRF token.
+The POST body is `{"tool":"list_contacts","arguments":{}}`. MCP tool errors
+remain in `result.isError`; transport failures use the normal Fleet error envelope.
+Request arguments and results are excluded from the Fleet audit log.
+
+Both interfaces use the supervisor's existing fixed-identity MCP server and tool
+policy. Identity creation, removal, switching, and binding are not exposed. The
+supervisor must be running. Older descriptors are supported only when a unique
+existing runtime journal, instance record, and identity pin prove the selected
+agent and generation, and the same MCP connection confirms its identity and
+lifetime before the operation. This reads existing state without rewriting the
+descriptor or restarting the agent. Missing, ambiguous, stale, or mismatched
+proofs fail closed. Unknown identity descriptions also fail closed. Closing an operator call
+retains the supervisor's identity. An interrupted mutation can have an unknown
+outcome: inspect state before retrying, because there is no automatic retry or
+exactly-once guarantee. Contact acceptance alone does not prove peer verification
+or message delivery. File tools resolve paths in the invoking CLI process or
+Fleet web server's filesystem context, with that process's access permissions.

package/dist/agent-ours/bridge.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createHash } from 'node:crypto';
 import { connect } from 'node:net';
 import { access, mkdir, open, readFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
@@ -12,6 +13,14 @@ export async function runBridge(descriptorPath) {
         typeof descriptor.capability !== 'string' ||
         !Number.isInteger(descriptor.generation))
         throw Error('INVALID_BRIDGE_DESCRIPTOR');
+    if (process.env.FLEET_OURS_BRIDGE_EXPECTED) {
+        const expected = JSON.parse(process.env.FLEET_OURS_BRIDGE_EXPECTED);
+        const digest = createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex');
+        if (expected.transportDigest !== digest)
+            throw Error('SUPERVISOR_TRANSPORT_CHANGED');
+        if (['role', 'identity', 'cid', 'generation'].some(key => descriptor[key] !== expected[key]))
+            throw Error('SUPERVISOR_SELECTION_CHANGED');
+    }
     const wire = new Wire(connect(descriptor.socket));
     const handles = new Map();
     const cleanup = async () => {

package/dist/agent-ours/service.js

@@ -219,7 +219,7 @@ export async function prepareManagedAgent(role, stateDir, temporary) {
         });
         partialEndpoint = endpoint;
         const descriptor = join(bridgeDir, 'descriptor.json');
-        atomicPrivateWrite(descriptor, { socket, capability, generation });
+        atomicPrivateWrite(descriptor, { socket, capability, generation, role: role.name, identity: role.identity, cid: runtime.snapshot.cid });
         return {
             runtime,
             descriptor,

package/dist/application/legacy-supervisor-identity.d.ts

@@ -0,0 +1,7 @@
+/** Read-only compatibility proof for supervisors predating descriptor identity metadata. */
+export declare function legacySupervisorIdentity(role: string, name: string, temporary: boolean, generation: number): {
+    name: string;
+    cid: string;
+    generation: number;
+    proof: string;
+};

package/dist/application/legacy-supervisor-identity.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { binderKey } from '../agent-ours/state.js';
+import { FleetError } from './errors.js';
+/** Read-only compatibility proof for supervisors predating descriptor identity metadata. */
+export function legacySupervisorIdentity(role, name, temporary, generation) {
+    const root = join(stateRoot(), 'private-ours');
+    try {
+        const matches = [];
+        for (const entry of readdirSync(root, { withFileTypes: true })) {
+            if (!entry.isDirectory() || !/^[a-f0-9]{64}$/.test(entry.name))
+                continue;
+            const dir = join(root, entry.name);
+            const instance = JSON.parse(readFileSync(join(dir, 'instance.json'), 'utf8'));
+            if (instance.role !== role)
+                continue;
+            const state = JSON.parse(readFileSync(join(dir, 'state.json'), 'utf8'));
+            const pin = JSON.parse(readFileSync(join(dir, 'identity-pin.json'), 'utf8'));
+            if (!Number.isSafeInteger(generation) || generation < 1
+                || typeof state.action !== 'string' || !state.action
+                || instance.temporary !== temporary || typeof instance.instance !== 'string' || !instance.instance
+                || state.version !== 1 || state.instance !== instance.instance
+                || state.name !== name || state.lifetime !== (temporary ? 'temporary' : 'permanent')
+                || state.generation !== generation || !['READY', 'SERVING'].includes(state.phase)
+                || typeof state.daemon !== 'string' || !state.daemon || binderKey(state.daemon, name) !== entry.name
+                || !/^[a-f0-9]{64}$/i.test(state.cid ?? '')
+                || pin.daemon !== state.daemon || pin.name !== name || pin.cid !== state.cid)
+                throw new Error('mismatched legacy ownership proof');
+            matches.push({ name, cid: state.cid, generation, proof: createHash('sha256').update(JSON.stringify([
+                    instance.instance, state.action, state.daemon, name, state.cid, state.lifetime, generation,
+                ])).digest('hex') });
+        }
+        if (matches.length !== 1)
+            throw new Error('missing or ambiguous legacy ownership proof');
+        return matches[0];
+    }
+    catch {
+        // The private directory also contains ownership material: never echo parse errors.
+        throw new FleetError('capability_unavailable', 'legacy supervisor ownership proof is missing, ambiguous, or mismatched');
+    }
+}

package/dist/application/supervisor-ours-tools.d.ts

@@ -0,0 +1,159 @@
+export interface SupervisorToolRequest {
+    tool: string;
+    arguments?: Record<string, unknown>;
+}
+/** CLI and REST use the same fixed-identity MCP server as the agent harness. */
+export declare class SupervisorOursTools {
+    private withClient;
+    list(role: string): Promise<{
+        tools: {
+            inputSchema: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: Record<string, object> | undefined;
+                required?: string[] | undefined;
+            };
+            name: string;
+            description?: string | undefined;
+            outputSchema?: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: Record<string, object> | undefined;
+                required?: string[] | undefined;
+            } | undefined;
+            annotations?: {
+                title?: string | undefined;
+                readOnlyHint?: boolean | undefined;
+                destructiveHint?: boolean | undefined;
+                idempotentHint?: boolean | undefined;
+                openWorldHint?: boolean | undefined;
+            } | undefined;
+            execution?: {
+                taskSupport?: "optional" | "required" | "forbidden" | undefined;
+            } | undefined;
+            _meta?: Record<string, unknown> | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        }[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        nextCursor?: string | undefined;
+        agent: string;
+        identity: {
+            name: string;
+            cid: string;
+            generation: number;
+        };
+    }>;
+    call(role: string, request: SupervisorToolRequest): Promise<{
+        agent: string;
+        identity: {
+            name: string;
+            cid: string;
+            generation: number;
+        };
+        result: {
+            [x: string]: unknown;
+            content: ({
+                type: "text";
+                text: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "image";
+                data: string;
+                mimeType: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "audio";
+                data: string;
+                mimeType: string;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                type: "resource";
+                resource: {
+                    uri: string;
+                    text: string;
+                    mimeType?: string | undefined;
+                    _meta?: Record<string, unknown> | undefined;
+                } | {
+                    uri: string;
+                    blob: string;
+                    mimeType?: string | undefined;
+                    _meta?: Record<string, unknown> | undefined;
+                };
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: Record<string, unknown> | undefined;
+            } | {
+                uri: string;
+                name: string;
+                type: "resource_link";
+                description?: string | undefined;
+                mimeType?: string | undefined;
+                size?: number | undefined;
+                annotations?: {
+                    audience?: ("user" | "assistant")[] | undefined;
+                    priority?: number | undefined;
+                    lastModified?: string | undefined;
+                } | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+                icons?: {
+                    src: string;
+                    mimeType?: string | undefined;
+                    sizes?: string[] | undefined;
+                    theme?: "light" | "dark" | undefined;
+                }[] | undefined;
+                title?: string | undefined;
+            })[];
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+            structuredContent?: Record<string, unknown> | undefined;
+            isError?: boolean | undefined;
+        } | {
+            [x: string]: unknown;
+            toolResult: unknown;
+            _meta?: {
+                [x: string]: unknown;
+                progressToken?: string | number | undefined;
+                "io.modelcontextprotocol/related-task"?: {
+                    taskId: string;
+                } | undefined;
+            } | undefined;
+        };
+    }>;
+}

package/dist/application/supervisor-ours-tools.js

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { agentDir } from '../paths.js';
+import { ROLE_NAME_RE } from '../config.js';
+import { legacySupervisorIdentity } from './legacy-supervisor-identity.js';
+import { FleetError } from './errors.js';
+/** CLI and REST use the same fixed-identity MCP server as the agent harness. */
+export class SupervisorOursTools {
+    async withClient(role, work) {
+        if (!ROLE_NAME_RE.test(role))
+            throw new FleetError('invalid_request', 'invalid agent name');
+        const findCandidates = () => [false, true].map(temporary => ({ temporary, dir: agentDir(role, temporary) }))
+            .map(row => ({ ...row, path: join(row.dir, '.ours-bridge', 'descriptor.json') }))
+            .filter(row => existsSync(row.path));
+        const candidates = findCandidates();
+        if (candidates.length !== 1)
+            throw new FleetError('capability_unavailable', 'agent supervisor endpoint is missing or ambiguous');
+        const selected = candidates[0];
+        let descriptor;
+        let identityName;
+        try {
+            descriptor = JSON.parse(readFileSync(selected.path, 'utf8'));
+            identityName = readFileSync(join(selected.dir, '.identity'), 'utf8').trim();
+            if (!descriptor || typeof descriptor !== 'object')
+                throw new Error();
+        }
+        catch {
+            throw new FleetError('capability_unavailable', 'supervisor identity metadata cannot be read');
+        }
+        const legacy = ['role', 'identity', 'cid'].every(key => descriptor[key] === undefined);
+        const identity = legacy
+            ? legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation)
+            : { name: identityName, cid: descriptor.cid, generation: descriptor.generation };
+        if (legacy && descriptor.socket !== join(selected.dir, '.ours-bridge', `g${descriptor.generation}.sock`))
+            throw new FleetError('capability_unavailable', 'legacy supervisor socket does not match the selected agent');
+        if ((!legacy && (descriptor.role !== role || descriptor.identity !== identityName))
+            || !/^[a-f0-9]{64}$/i.test(identity.cid ?? '') || !Number.isSafeInteger(descriptor.generation) || descriptor.generation < 1)
+            throw new FleetError('capability_unavailable', 'supervisor identity metadata is unavailable or mismatched');
+        const verifySelection = () => {
+            try {
+                const current = findCandidates();
+                const freshDescriptor = JSON.parse(readFileSync(selected.path, 'utf8'));
+                if (current.length !== 1 || current[0].path !== selected.path
+                    || readFileSync(join(selected.dir, '.identity'), 'utf8').trim() !== identityName
+                    || ['role', 'identity', 'cid', 'socket', 'capability', 'generation']
+                        .some(key => freshDescriptor[key] !== descriptor[key]))
+                    throw new Error();
+            }
+            catch {
+                throw new FleetError('capability_unavailable', 'selected supervisor assignment changed');
+            }
+        };
+        const client = new Client({ name: 'ours-fleet-supervisor-tools', version: '1' });
+        const transport = new StdioClientTransport({
+            command: process.execPath,
+            args: [fileURLToPath(new URL('../agent-ours/bridge.js', import.meta.url))],
+            env: { ...Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined)),
+                FLEET_OURS_BRIDGE_DESCRIPTOR: selected.path,
+                FLEET_OURS_BRIDGE_EXPECTED: JSON.stringify({ role: descriptor.role, identity: descriptor.identity, cid: descriptor.cid, generation: descriptor.generation,
+                    transportDigest: createHash('sha256').update(JSON.stringify([descriptor.socket, descriptor.capability, descriptor.generation])).digest('hex') }) },
+            stderr: 'pipe',
+        });
+        try {
+            await client.connect(transport);
+            const verify = async () => {
+                if (!legacy) {
+                    verifySelection();
+                    return;
+                }
+                const actual = await client.callTool({ name: 'current_identity', arguments: {} });
+                const blocks = actual.content;
+                const lines = blocks?.length === 1 && blocks[0].type === 'text' ? blocks[0].text?.split('\n') : undefined;
+                const prefix = `Bound to "${identity.name}" (${identity.cid})`;
+                const suffix = lines?.[0].startsWith(prefix) ? lines[0].slice(prefix.length) : undefined;
+                const roleSuffix = typeof suffix === 'string' && /^ — role "[^"\r\n]+" under root "[^"\r\n]+"\.$/.test(suffix);
+                const temporaryLine = 'TEMPORARY identity owned by the Fleet supervisor for this logical agent instance. Bridge or harness disconnect retains it; terminal supervisor release deletes local state with best-effort peer notices.';
+                if (actual.isError || !(roleSuffix || (selected.temporary && suffix === '.'))
+                    || (selected.temporary ? lines?.[1] !== temporaryLine : lines?.[1]?.startsWith('TEMPORARY')))
+                    throw new FleetError('capability_unavailable', 'connected supervisor identity does not match legacy ownership proof');
+                const fresh = legacySupervisorIdentity(role, identityName, selected.temporary, descriptor.generation);
+                if (!('proof' in identity) || fresh.proof !== identity.proof)
+                    throw new FleetError('capability_unavailable', 'legacy supervisor identity changed');
+                verifySelection();
+            };
+            await verify();
+            return await work(client, { name: identity.name, cid: identity.cid, generation: identity.generation }, verify);
+        }
+        catch (error) {
+            if (error instanceof FleetError)
+                throw error;
+            // Do not leak arguments, invites, capabilities, or raw transport errors.
+            throw new FleetError('control_unavailable', 'supervisor tool request failed; its outcome may be unknown, do not retry a mutation automatically', { retryable: false });
+        }
+        finally {
+            await client.close().catch(() => { });
+            await transport.close().catch(() => { });
+        }
+    }
+    list(role) {
+        return this.withClient(role, async (client, identity) => ({
+            agent: role, identity, ...(await client.listTools()),
+        }));
+    }
+    call(role, request) {
+        if (!request || typeof request.tool !== 'string'
+            || (request.arguments !== undefined && (!request.arguments || typeof request.arguments !== 'object' || Array.isArray(request.arguments))))
+            throw new FleetError('invalid_request', 'tool and object arguments are required');
+        return this.withClient(role, async (client, identity, verify) => {
+            const { tools } = await client.listTools();
+            if (!tools.some(tool => tool.name === request.tool))
+                throw new FleetError('forbidden', 'tool is not exposed by the fixed-identity supervisor');
+            await verify();
+            const result = await client.callTool({ name: request.tool, arguments: request.arguments ?? {} });
+            return { agent: role, identity, result };
+        });
+    }
+}

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.6",
-  "buildId": "2075277a291e",
-  "commit": "01660e304fff7ee37784669ec601299c92df4912",
+  "version": "1.2.0-nightly.7",
+  "buildId": "f5cfd3c1f10c",
+  "commit": "a5d6f736733fa419e6acf7306affb4a662261bbf",
   "dirty": true,
-  "builtAt": "2026-09-23T10:49:32.469Z",
+  "builtAt": "2026-09-23T20:14:37.547Z",
   "capabilities": [
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { SupervisorOursTools } from './application/supervisor-ours-tools.js';
 import { runTempSupervisor, TEMP_RECYCLE_EXIT } from './temp-supervisor-recovery.js';
 import { spawn as spawnChild } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
@@ -496,6 +497,40 @@ program.command('peek <name> [lines]').description('pane snapshot without attach
         die(controlFailure(name, 'peek', e));
     }
 });
+const oursToolsCommand = program.command('ours').description('invoke tools through a named agent supervisor and its fixed identity');
+oursToolsCommand.command('tools <agent>').description('list the same tools and schemas exposed to the agent MCP')
+    .action(async (agent) => {
+    try {
+        console.log(JSON.stringify(await new SupervisorOursTools().list(agent), null, 2));
+    }
+    catch (error) {
+        die(error);
+    }
+});
+oursToolsCommand.command('call <agent> <tool>').description('call a supervisor MCP tool without prompting the agent')
+    .option('--args-file <path>', 'JSON object arguments from a private file; omitted means {}')
+    .action(async (agent, tool, options) => {
+    try {
+        let args = {};
+        if (options.argsFile) {
+            try {
+                args = JSON.parse(readFileSync(options.argsFile, 'utf8'));
+            }
+            catch {
+                throw new Error('cannot read tool arguments: expected a readable JSON object file');
+            }
+        }
+        const response = await new SupervisorOursTools().call(agent, { tool, arguments: args });
+        console.log(JSON.stringify(response, null, 2));
+        if ('isError' in response.result && response.result.isError)
+            throw new FleetCliExit(1, 'runtime', 'unknown');
+    }
+    catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
+        die(error);
+    }
+});
 program.command('send <name> [text...]').description("type into the agent's console")
     .action(async (name, text, opts) => {
     const stateDir = acpStateDir(name);
@@ -1612,6 +1647,8 @@ async function parseFleetCli() {
         await program.parseAsync(process.argv);
     }
     catch (error) {
+        if (error instanceof FleetCliExit)
+            throw error;
         const commander = error;
         if (commander.exitCode === 0)
             return;

package/dist/fleet-command-audit.js

@@ -117,6 +117,7 @@ export function consumeFleetAuditCollection() {
 const SAFE_READ = new Set(['docs', 'version', 'config', 'ls', 'peek', 'logs', 'status', 'doctor']);
 const AGENT_SURFACES = {
     spawn: new Set(['<none>']),
+    ours: new Set(['tools', 'call']),
     template: new Set(['list', 'show', 'validate']),
     task: new Set(['create', 'list', 'lists', 'list-create', 'list-rename', 'list-delete', 'move',
         'show', 'start', 'block', 'unblock', 'review', 'done', 'cancel', 'delete', 'work', 'finish']),
@@ -189,7 +190,7 @@ const sensitiveValueFlags = new Set([
     '--identity', '--invite', '--token', '--api-token', '--password', '--password-file',
     '--env', '--brief', '--brief-file', '--bio-file', '--persona-file', '--isolation-file', '--loops-file',
     '--configuration', '-c', '--public-invite', '--public-invite-file', '--invite-file',
-    '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
+    '--args-file', '--summary-file', '--text', '--message', '--summary', '--reason', '--goal', '--cwd',
     '--identity-cid', '--owner-cid', '--contact-cid', '--codex-config', '--add-dir',
 ]);
 function redactUrl(value) {

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
 import type { FleetQueryService } from '../application/fleet-query-service.js';
 import type { RoleRepository } from '../application/role-repository.js';
@@ -31,6 +32,7 @@ export interface WebServices {
     topologyPromote?: TopologyPromoteService;
     removal?: RoleRemovalService;
     taskRooms?: TaskRoomApplicationService;
+    oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
 }
 export interface WebServer {
     app: FastifyInstance;

package/dist/web/server.js

@@ -1,3 +1,4 @@
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -51,7 +52,11 @@ export async function buildWebServer(services, boundary, options = {}) {
         }
     });
     app.setErrorHandler(async (error, request, reply) => {
-        const fleetError = normalizeError(error, request.id);
+        const privateToolParseError = request.routeOptions.url === '/api/v1/roles/:id/ours/call'
+            && error instanceof Error && 'code' in error
+            && typeof error.code === 'string' && error.code.startsWith('FST_ERR_CTP_');
+        const fleetError = normalizeError(privateToolParseError
+            ? new FleetError('invalid_request', 'expected a valid JSON tool request') : error, request.id);
         await audit.record({
             requestId: request.id, action: `${request.method} ${request.routeOptions.url ?? request.url}`,
             result: 'rejected', errorCode: fleetError.code,
@@ -311,6 +316,18 @@ export async function buildWebServer(services, boundary, options = {}) {
         });
         return result;
     });
+    const oursTools = services.oursTools ?? new SupervisorOursTools();
+    app.get('/api/v1/roles/:id/ours/tools', async (request) => {
+        auth.authenticate(request);
+        return oursTools.list(request.params.id);
+    });
+    app.post('/api/v1/roles/:id/ours/call', async (request) => {
+        const session = auth.authenticate(request, true);
+        const result = await oursTools.call(request.params.id, request.body);
+        await audit.record({ requestId: request.id, browser: session.id,
+            action: 'ours.call', result: result.result.isError === true ? 'tool_error' : 'succeeded' });
+        return result;
+    });
     app.get('/api/v1/roles/:id', async (request) => {
         auth.authenticate(request);
         return services.query.detail(request.params.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.6",
+  "version": "1.2.0-nightly.7",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",

package/presets/fleet/roles/Coordinator.yaml

@@ -12,6 +12,28 @@ persona: |
   Only execute task work yourself when the owner explicitly orders you to override this boundary
   for that specific task.
 
+  Agent identity and contact management requested by the owner is Fleet management work.
+  For requests such as "generate an invite for this agent", "accept this invite for that agent",
+  "list its contacts", or "send this message as that agent", select the named agent and call the
+  corresponding deterministic supervisor operation through the Fleet CLI or REST API. The
+  supervisor owns and binds that agent's identity; verify that the selected agent and returned
+  identity match the owner's request. Use the shared supervisor tool interface for these
+  operations, including generate_invite, add_contact, list_contacts, and send_message.
+  Discover schemas with `ours-fleet ours tools <agent>`; invoke with
+  `ours-fleet ours call <agent> <tool> --args-file <private-json-file>` (omit the file for {}).
+  REST equivalents are GET `/api/v1/roles/<agent>/ours/tools` and POST
+  `/api/v1/roles/<agent>/ours/call` with body {"tool":"<tool>","arguments":{...}}.
+  Use the normal authenticated Fleet session and CSRF token for REST calls.
+  Do not ask the agent in its conversation to perform these operations, send the invite to its
+  LLM session, or use session steering as an identity-management API. Do not create a separate
+  identity, choose or rebind an identity, force a binding, or restart a supervisor to perform a
+  contact operation. If the supported supervisor operation is unavailable or identity matching
+  fails, report that exact blocker and retain the request without attempting a substitute path.
+  Keep invite inputs in the supported private-file or request-body channel, out of logs and
+  unrelated rooms. Report the operation's actual result: accepting an invite may leave contact
+  verification pending, so do not claim that contact establishment or message delivery is complete
+  until the corresponding result confirms it.
+
   For every new task:
   1. Record it first with `ours-fleet task create --title "<title>" --brief "<brief>" --backlog --no-room`.
   2. Ask the owner which room template to use: `single`, `pair`, or `team`.