@ours.network/fleet 1.2.0-nightly.67 → 1.2.0-nightly.68

package/dist/build-info.json

@@ -1,14 +1,15 @@
 {
-  "version": "1.2.0-nightly.67",
-  "buildId": "d2cb52fe4185",
-  "commit": "7e8a265a65327167e2b2eb95fc8c246f67cf4460",
+  "version": "1.2.0-nightly.68",
+  "buildId": "ec9481a2cd81",
+  "commit": "7c3095b817127cff76cac375f21e8124558e8f38",
   "dirty": true,
-  "builtAt": "2026-10-16T08:04:29.151Z",
+  "builtAt": "2026-10-16T12:16:06.490Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",
     "managed-cli.setup-v1",
     "workspace.enroll.preserve-profile-v1",
+    "workspace.enroll.optional-profile-v1",
     "cowork.http-management-v1",
     "monitor.interrupt.after_tool"
   ]

package/dist/capabilities.d.ts

@@ -15,6 +15,7 @@
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export declare const CAP_MONITOR_INTERRUPT_AFTER_TOOL = "monitor.interrupt.after_tool";
 export declare const CAP_HTTP_COWORK = "cowork.http-management-v1";
+export declare const CAP_WORKSPACE_OPTIONAL_PROFILE = "workspace.enroll.optional-profile-v1";
 export declare const CAP_WORKSPACE_PRESERVE_PROFILE = "workspace.enroll.preserve-profile-v1";
 /** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
 export declare const CAP_MANAGED_CLI_SETUP = "managed-cli.setup-v1";
@@ -22,7 +23,7 @@ export declare const CAP_MANAGED_CLI_SETUP = "managed-cli.setup-v1";
 export declare const CAP_MANAGED_CLI_CODEX_EFFORT = "managed-cli.codex-reasoning-effort-v1";
 /** `ours-fleet service check|refresh`: re-point service definitions after an update. */
 export declare const CAP_SERVICE_REFRESH = "service.refresh-v1";
-export declare const CAPABILITIES: readonly ["service.refresh-v1", "managed-cli.codex-reasoning-effort-v1", "managed-cli.setup-v1", "workspace.enroll.preserve-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
+export declare const CAPABILITIES: readonly ["service.refresh-v1", "managed-cli.codex-reasoning-effort-v1", "managed-cli.setup-v1", "workspace.enroll.preserve-profile-v1", "workspace.enroll.optional-profile-v1", "cowork.http-management-v1", "monitor.interrupt.after_tool"];
 export type Capability = (typeof CAPABILITIES)[number];
 /** Does this build declare `token`? */
 export declare const hasCapability: (token: string) => boolean;

package/dist/capabilities.js

@@ -15,6 +15,7 @@
 /** `monitor.interrupt: after_tool` — cancel at the next tool boundary (#67). */
 export const CAP_MONITOR_INTERRUPT_AFTER_TOOL = 'monitor.interrupt.after_tool';
 export const CAP_HTTP_COWORK = 'cowork.http-management-v1';
+export const CAP_WORKSPACE_OPTIONAL_PROFILE = 'workspace.enroll.optional-profile-v1';
 export const CAP_WORKSPACE_PRESERVE_PROFILE = 'workspace.enroll.preserve-profile-v1';
 /** `ours-fleet managed-cli setup|status` and the `managed_cli` Agent key (#233). */
 export const CAP_MANAGED_CLI_SETUP = 'managed-cli.setup-v1';
@@ -27,6 +28,7 @@ export const CAPABILITIES = [
     CAP_MANAGED_CLI_CODEX_EFFORT,
     CAP_MANAGED_CLI_SETUP,
     CAP_WORKSPACE_PRESERVE_PROFILE,
+    CAP_WORKSPACE_OPTIONAL_PROFILE,
     CAP_HTTP_COWORK,
     CAP_MONITOR_INTERRUPT_AFTER_TOOL,
 ];

package/dist/workspace-enrollment.d.ts

@@ -4,8 +4,9 @@ export interface WorkspacePayload {
     appOrigin: string;
     hostname: string;
     rootName: string;
-    name: string;
-    surname: string;
+    fullName?: string | null;
+    name?: string | null;
+    surname?: string | null;
     connectorToken?: string;
     invitation: string;
     serverCid: string;

package/dist/workspace-enrollment.js

@@ -25,14 +25,24 @@ export function decodeWorkspacePayload(input, options = {}) {
     catch {
         throw Error('Invalid workspace payload');
     }
-    if (p.version !== 1 || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || (!options.allowExpired && p.challenge.expiresAt <= Date.now()) || !Number.isSafeInteger(p.challenge.expiresAt) || p.challenge.expiresAt > Date.now() + 16 * 60000)
+    if (!p || typeof p !== 'object' || Array.isArray(p) || p.version !== 1 || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || (!options.allowExpired && p.challenge.expiresAt <= Date.now()) || !Number.isSafeInteger(p.challenge.expiresAt) || p.challenge.expiresAt > Date.now() + 16 * 60000)
         throw Error('Workspace payload is invalid or expired');
-    for (const k of ['connectorToken', 'invitation', 'name', 'surname']) {
+    for (const k of ['connectorToken', 'invitation']) {
         if (k === 'connectorToken' && p[k] === undefined)
             continue;
         if (typeof p[k] !== 'string' || !p[k] || p[k].length > 8192 || /[\x00-\x1f\x7f]/.test(p[k]))
             throw Error('Invalid workspace payload');
     }
+    for (const k of ['fullName', 'name', 'surname']) {
+        const value = p[k];
+        if (value == null || value === '') {
+            p[k] = null;
+            continue;
+        }
+        if (typeof value !== 'string' || value.length > 8192 || /[\x00-\x1f\x7f]/.test(value))
+            throw Error('Invalid workspace profile');
+        p[k] = value.trim() || null;
+    }
     return p;
 }
 /** Credential-free renewal is allowed only on the host already holding this private connector. */
@@ -120,11 +130,11 @@ const CID = /^[a-f0-9]{64}$/i, same = (a, b) => a.toLowerCase() === b.toLowerCas
 async function messengerIdentity(request, attach) {
     const bound = await request('workspace/enrollment-identity');
     if (bound.rootCid === undefined)
-        return { cid: bound.cid, preserveProfile: bound.preserveProfile === true };
+        return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, optionalWorkspaceProfileV1: bound.optionalWorkspaceProfileV1 === true };
     if (typeof bound.cid !== 'string' || !CID.test(bound.cid) || typeof bound.rootCid !== 'string' || !CID.test(bound.rootCid) || same(bound.cid, bound.rootCid))
         throw Error('Bound Messenger identity unavailable');
     const root = await humanRoot(attach, bound.rootCid, bound.cid);
-    return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, root };
+    return { cid: bound.cid, preserveProfile: bound.preserveProfile === true, optionalWorkspaceProfileV1: bound.optionalWorkspaceProfileV1 === true, root };
 }
 /** This host's only Human root, as its daemon lists it; optionally with a permanent identity that must be listed under it. */
 async function humanRoot(attach, rootCid, under) {
@@ -280,6 +290,8 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         && (options.replacingWorkspace !== undefined || JSON.parse(readFileSync(previousFile, 'utf8')).serverCid?.toUpperCase() === payload.serverCid.toUpperCase());
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
+    if (!options.preserveProfile && (payload.fullName?.trim() || !payload.name?.trim() || !payload.surname?.trim()) && !identity.optionalWorkspaceProfileV1)
+        throw Error('Optional workspace profile requires updated Messenger; update the host Messenger before retrying (the host is not enrolled)');
     if (loaded.rooms && !lost && !moved && loaded.rooms.owner.expected_cid.toLowerCase() !== identity.cid.toLowerCase())
         throw Error('Retained room owner CID conflicts with the Human root');
     const inviteFile = loaded.rooms?.owner.public_invite_file || join(dir, 'owner.invite');
@@ -291,7 +303,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const devices = new WorkspaceDeviceStore();
     const hostWorkspaceId = devices.workspaceId;
     devices.close();
-    const { name, surname, ...proofPayload } = payload;
+    const { fullName, name, surname, ...proofPayload } = payload;
     let result, ownerCid;
     // A replacement can stop after its one-time proof but before local files commit. Read the
     // account's existing signed receipt first; a verified proof must not be sent a second time.
@@ -316,6 +328,8 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         }
     }
     if (identity.root) {
+        if (!options.preserveProfile)
+            await request('identity/profile', { fullName: fullName ?? null, name: name ?? null, surname: surname ?? null });
         // The Human root signs the binding; the person's own Messenger identity is the room Owner and issues the Owner invitation.
         if (!proofAlreadyConfirmed)
             await proveWithHumanRoot(attach, identity.root, payload, hostWorkspaceId, options.contactWaitMs ?? 10000, options.replacingWorkspace !== undefined);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.67",
+  "version": "1.2.0-nightly.68",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",