@ours.network/fleet 1.2.0-nightly.70 → 1.2.0-nightly.72

package/dist/paths.d.ts

@@ -13,6 +13,9 @@ export declare function deriveXdgRuntimeDir(env?: NodeJS.ProcessEnv, uid?: numbe
 export declare const stateRoot: () => string;
 /** The Owner invitation file that tunnel setup writes itself after enrollment. */
 export declare const workspaceOwnerInvite: () => string;
+/** Serializes writers of the workspace binding and of its unfinished replacement record. */
+export declare const workspaceBindingLock: () => string;
+export declare const workspaceReplacementFile: () => string;
 export declare const agentsRoot: () => string;
 export declare const tmpRoot: () => string;
 export declare const logsRoot: () => string;

package/dist/paths.js

@@ -23,6 +23,9 @@ export function deriveXdgRuntimeDir(env = process.env, uid = process.getuid?.(),
 export const stateRoot = () => join(home(), '.ours-fleet');
 /** The Owner invitation file that tunnel setup writes itself after enrollment. */
 export const workspaceOwnerInvite = () => join(stateRoot(), 'workspace', 'owner.invite');
+/** Serializes writers of the workspace binding and of its unfinished replacement record. */
+export const workspaceBindingLock = () => join(stateRoot(), 'workspace', '.binding.lock');
+export const workspaceReplacementFile = () => join(stateRoot(), 'workspace', 'replacement.json');
 export const agentsRoot = () => join(stateRoot(), 'agents');
 export const tmpRoot = () => join(stateRoot(), 'tmp');
 export const logsRoot = () => join(stateRoot(), 'logs');

package/dist/rooms-tasks/add-member.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -62,7 +63,7 @@ export async function requestMemberAddition(input) {
         })();
         const template = sealTemplateSnapshot(plan.snapshot, input.cfg.agentTemplates ?? {}, plan.launchDefinitions);
         const receipt = { taskId, requestId: r.requestId, roleId, hash, state: 'running' };
-        const save = () => replaceFileAtomically(path, JSON.stringify(receipt) + '\n', 0o600);
+        const save = () => { replaceFileAtomically(path, JSON.stringify(receipt) + '\n', 0o600); publishFleetResourceCommit(path); };
         save();
         running.add(path);
         void (input.provision ?? provisionMembers)({ cfg: input.cfg, cowork: input.cowork, configPath: input.configPath, binPath: input.binPath,

package/dist/rooms-tasks/layout.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 /** Durable local room-layout controller.
  * Uses native Cowork operations and a supervising Fleet's exact-instance port.
  * Unknown mutation outcomes stop for reconciliation; they are never replayed.
@@ -45,7 +46,7 @@ export class RoomLayout {
     }
     get cowork() { return this.coworkAdapter ??= this.coworkFactory(); }
     snapshot() { return JSON.parse(readFileSync(this.file, 'utf8')); }
-    save(s) { replaceFileAtomically(this.file, JSON.stringify(s, null, 2)); }
+    save(s) { replaceFileAtomically(this.file, JSON.stringify(s, null, 2)); publishFleetResourceCommit(this.file); }
     async verify(i) {
         need(i.supervisor === this.supervisor.id || i.remote, 'remote binding unsupported');
         need(i.launch && i.cid && i.session, 'incomplete instance reference');

package/dist/rooms-tasks/task-state.d.ts

@@ -39,6 +39,7 @@ export declare function listTasks(filter?: {
     state?: TaskState | TaskState[];
     listId?: string;
     includeDeleting?: boolean;
+    strict?: boolean;
 }): TaskRecord[];
 export declare function moveTaskToList(id: string, listId: string): TaskRecord;
 export declare function findByIdempotencyKey(key: string): TaskRecord | undefined;

package/dist/rooms-tasks/task-state.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, rmSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -100,15 +101,27 @@ function writeTask(record) {
         pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
             title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
             body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
-            url: `/fleet/tasks/${record.task_id}` });
+            target: { kind: 'task', taskId: record.task_id } });
     }
     if (pending.length)
         persisted.notification_events = pending;
     else
         delete persisted.notification_events;
     replaceFileAtomically(taskPath(record.task_id), JSON.stringify(persisted, null, 2) + '\n');
+    publishFleetResourceCommit(taskPath(record.task_id));
 }
 const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
+function typedTaskNotification(value, id) {
+    if (!value || typeof value !== 'object' || Object.keys(value).some(key => !['eventId', 'title', 'body', 'target', 'taskId'].includes(key)))
+        return false;
+    const target = value.target;
+    return typeof value.eventId === 'string' && value.eventId.startsWith(`task:${id}:`) && value.eventId.length <= 512
+        && value.taskId === id && !!target && typeof target === 'object' && !Array.isArray(target)
+        && Object.keys(target).every(key => ['kind', 'taskId'].includes(key)) && target.taskId === id
+        && (target.kind === 'task' || (target.kind === 'task-deleted' && value.eventId === `task:${id}:deleted`))
+        && typeof value.title === 'string' && !!value.title.trim() && value.title.length <= 160
+        && typeof value.body === 'string' && !!value.body.trim() && value.body.length <= 512;
+}
 /** Atomic snapshots contain the events, including intermediate states between polls. */
 export function pendingTaskNotifications(warn = () => { }) {
     const result = [];
@@ -127,13 +140,13 @@ export function pendingTaskNotifications(warn = () => { }) {
                     continue;
                 if (value.notification_events === undefined)
                     continue;
-                if (!Array.isArray(value.notification_events) || value.notification_events.some(e => !e
-                    || typeof e.eventId !== 'string' || !e.eventId.startsWith(`task:${id}:`) || e.eventId.length > 512
-                    || e.taskId !== id || (e.url !== `/fleet/tasks/${id}` && !(e.eventId === `task:${id}:deleted` && e.url === `/fleet/tasks?deletedTask=${id}`)) || typeof e.title !== 'string' || !e.title.trim() || e.title.length > 160
-                    || typeof e.body !== 'string' || !e.body.trim() || e.body.length > 512))
+                if (!Array.isArray(value.notification_events))
                     throw new Error('invalid notification events');
-                if (value.notification_events.length)
-                    result.push({ taskId: id, events: value.notification_events });
+                // Only typed task events are delivered. Unsupported entries are never sent or converted,
+                // and they do not block later lifecycle events.
+                const events = value.notification_events.filter(event => typedTaskNotification(event, id));
+                if (events.length)
+                    result.push({ taskId: id, events });
             }
             catch (error) {
                 if (!isNotFoundError(error))
@@ -151,9 +164,9 @@ export function acknowledgeTaskNotification(id, eventId) {
             if (!existsSync(path))
                 continue;
             const value = JSON.parse(readFileSync(path, 'utf8'));
-            if (!value.notification_events?.some(event => event.eventId === eventId))
+            if (!value.notification_events?.some(event => typedTaskNotification(event, id) && event.eventId === eventId))
                 continue;
-            value.notification_events = value.notification_events.filter(event => event.eventId !== eventId);
+            value.notification_events = value.notification_events.filter(event => !typedTaskNotification(event, id) || event.eventId !== eventId);
             replaceFileAtomically(path, JSON.stringify(value, null, 2) + '\n');
             if (path.startsWith(retiredNotificationsDir() + '/') && !value.notification_events.length)
                 unlinkSync(path);
@@ -280,7 +293,10 @@ export function listTasks(filter) {
             if ((!states || states.includes(t.state)) && (!filter?.listId || t.list_id === filter.listId))
                 tasks.push(t);
         }
-        catch { /* corrupt file, skip */ }
+        catch (error) {
+            if (filter?.strict)
+                throw error; /* legacy CLI inventory tolerates corrupt files */
+        }
     }
     const order = new Map(readTaskLists().map((item, index) => [item.list_id, index]));
     return tasks.sort((a, b) => (order.get(a.list_id) - order.get(b.list_id))
@@ -885,7 +901,7 @@ export function unlinkDeletedTask(id) {
         // before unlink may replay two copies; both carry identical service dedupe IDs.
         const removed = { eventId: `task:${id}:deleted`, taskId: id,
             title: `Task deleted: ${stored.title}`.slice(0, 160), body: `Task ${id}: deleting → deleted.`,
-            url: `/fleet/tasks?deletedTask=${id}` };
+            target: { kind: 'task-deleted', taskId: id } };
         replaceFileAtomically(join(retiredNotificationsDir(), `${id}.json`), JSON.stringify({ notification_events: [...(stored.notification_events ?? []), removed] }) + '\n');
         try {
             unlinkSync(taskPath(id));

package/dist/rooms-tasks/types.d.ts

@@ -110,7 +110,10 @@ export interface TaskNotificationEvent {
     eventId: string;
     title: string;
     body: string;
-    url: string;
+    target: {
+        kind: 'task' | 'task-deleted';
+        taskId: string;
+    };
     taskId: string;
 }
 export interface TaskRecord {

package/dist/runner.js

@@ -17,7 +17,7 @@ import { agentDir, stateRoot } from './paths.js';
 import { loadConfig, findRole, isolationContextFor, resolveSnapshotMonitor, resolvePermissions, } from './config.js';
 import { getAdapter } from './harness/registry.js';
 import { createMonitor, probeIdentityPresence, } from './monitor.js';
-import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, } from './daemon-recovery.js';
+import { DaemonGenerationObserver, RoleRecoveryController, probeDaemonGeneration, acquireSelectedDaemonHealth, } from './daemon-recovery.js';
 import { realExec } from './exec.js';
 import { resolveIsolation } from './isolation/policy.js';
 import { pinSubscriptionForLaunch } from './subscriptions/launch.js';
@@ -48,6 +48,7 @@ export class SupervisorRecycleRequiredError extends Error {
         this.name = 'SupervisorRecycleRequiredError';
     }
 }
+const defaultProbeGeneration = (env) => probeDaemonGeneration((url, init) => globalThis.fetch(url, init), env);
 const defaultDeps = () => ({
     prepareAgentOurs: prepareManagedAgent,
     releaseAgentOurs: releaseManagedAgent,
@@ -64,7 +65,7 @@ const defaultDeps = () => ({
     now: () => Date.now(),
     log: line => process.stderr.write(line + '\n'),
     fetch: (url, init) => globalThis.fetch(url, init),
-    probeGeneration: env => probeDaemonGeneration((url, init) => globalThis.fetch(url, init), env),
+    probeGeneration: defaultProbeGeneration,
     createMonitor: opts => createMonitor(opts),
     createOwnerChannel: opts => new OwnerChannel(opts),
     startAgentSession: (adapter, options) => adapter.start(options),
@@ -622,6 +623,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
     // Self-reminders live and die with this attempt's runtime binding: every exit
     // path below stops the dispatcher before that binding is released.
     let reminderManager;
+    let selectedHealth;
     try {
         const managedHarness = prepareManagedHarness(role, dir, runCwd, managedService.descriptor, { ...harnessChildEnv(role, launch.env, dir), ...subscription?.env });
         // Start-stagger: space this launch at least start_stagger_ms after the previous
@@ -669,8 +671,15 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             name, identity: role.identity, agentDir: dir, cfg: role.monitor,
             deps: resolvedMonitorDeps,
         }) : null;
+        // Injected legacy probes keep their test/embedding contract. Production uses
+        // one retained owner for generation and identity health in this process.
+        const retainHealth = deps.probeGeneration === defaultProbeGeneration
+            && !deps.identityProbeDeps ? acquireSelectedDaemonHealth : undefined;
+        selectedHealth = retainHealth?.(resolvedMonitorDeps.env);
         const daemonObserver = new DaemonGenerationObserver();
-        const initialDaemon = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+        const initialDaemon = daemonObserver.observe(selectedHealth
+            ? (await selectedHealth.sample()).generation
+            : await deps.probeGeneration(resolvedMonitorDeps.env));
         let sessionStartedWithoutDaemonBaseline = initialDaemon.kind !== 'baseline';
         if (monitor)
             await monitor.prime({ resetCursor: resetMonitorCursor });
@@ -1113,7 +1122,9 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             const now = deps.now();
             if (now >= nextDaemonProbeAt) {
                 nextDaemonProbeAt = now + 2_000;
-                const observation = daemonObserver.observe(await deps.probeGeneration(resolvedMonitorDeps.env));
+                const observation = daemonObserver.observe(selectedHealth
+                    ? (await selectedHealth.sample()).generation
+                    : await deps.probeGeneration(resolvedMonitorDeps.env));
                 if (observation.kind === 'lost')
                     recoveryController.noteLoss(observation.reason);
                 if (observation.kind === 'changed' || observation.kind === 'available'
@@ -1147,19 +1158,22 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
             }
             if (temp && now >= nextIdentityPollAt) {
                 nextIdentityPollAt = now + TEMP_IDENTITY_POLL_MS;
-                const presence = await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env, deps.identityProbeDeps);
+                const presence = selectedHealth
+                    ? selectedHealth.presence(role.identity, await selectedHealth.sample())
+                    : await probeIdentityPresence(role.identity, deps.fetch, resolvedMonitorDeps.env, deps.identityProbeDeps);
+                const identityObservedAt = deps.now();
                 if (presence.state === 'present') {
                     identityObserved = true;
                     identityAbsentSince = undefined;
                 }
                 else if (presence.state === 'absent' && identityObserved) {
-                    identityAbsentSince ??= now;
+                    identityAbsentSince ??= identityObservedAt;
                     // Require a continuous, time-bounded run of authoritative absence.
                     // The first positive observation is the readiness gate: cold harness
                     // starts may spend minutes loading the harness and briefing before the
                     // agent creates/binds its identity, and absence before then is not a
                     // close event. After readiness, debounce a real disappearance.
-                    if (now - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
+                    if (identityObservedAt - identityAbsentSince >= TEMP_IDENTITY_CLOSE_DEBOUNCE_MS) {
                         retirementReason = 'identity-closed';
                         deps.log(`[${name}] temporary identity '${role.identity}' closed; retiring session and supervisor`);
                         reminderManager?.stop();
@@ -1273,6 +1287,7 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         };
     }
     finally {
+        selectedHealth?.release();
         reminderManager?.stop();
         managedService.setReminders?.(undefined);
         await managedService.close(layoutRetiring);

package/dist/subscriptions/login.d.ts

@@ -33,6 +33,7 @@ declare abstract class BaseLogin implements LoginHandle {
     readonly provider: SubscriptionProvider;
     readonly owner: string;
     readonly kind: LoginView['kind'];
+    protected readonly changed: () => void;
     readonly loginId: string;
     readonly expiresAt: number;
     state: LoginState;
@@ -42,7 +43,7 @@ declare abstract class BaseLogin implements LoginHandle {
     done: Promise<boolean>;
     protected finish: (ok: boolean) => void;
     private readonly timer;
-    constructor(provider: SubscriptionProvider, owner: string, kind: LoginView['kind'], now?: number);
+    constructor(provider: SubscriptionProvider, owner: string, kind: LoginView['kind'], now?: number, changed?: () => void);
     view(): LoginView;
     abstract submitCode(code: string): void;
     protected abstract stop(): void;
@@ -59,7 +60,7 @@ export declare class ClaudeLogin extends BaseLogin {
     private continued;
     /** Resolves with the CLI exit status once it exits. */
     exited: Promise<number | null>;
-    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string, changed?: () => void);
     submitCode(code: string): void;
     protected stop(): void;
 }
@@ -69,7 +70,7 @@ export declare class CodexDeviceLogin extends BaseLogin {
     private codexLoginId?;
     /** Resolves true when the app-server reports a successful login. */
     completed: Promise<boolean>;
-    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string, changed?: () => void);
     submitCode(): void;
     protected stop(): void;
 }

package/dist/subscriptions/login.js

@@ -26,6 +26,7 @@ class BaseLogin {
     provider;
     owner;
     kind;
+    changed;
     loginId = randomBytes(16).toString('hex');
     expiresAt;
     state = 'starting';
@@ -35,10 +36,11 @@ class BaseLogin {
     done;
     finish;
     timer;
-    constructor(provider, owner, kind, now = Date.now()) {
+    constructor(provider, owner, kind, now = Date.now(), changed = () => { }) {
         this.provider = provider;
         this.owner = owner;
         this.kind = kind;
+        this.changed = changed;
         this.expiresAt = now + LOGIN_TTL_MS;
         this.done = new Promise(resolve => { this.finish = resolve; });
         this.timer = setTimeout(() => this.end('expired', 'login timed out'), LOGIN_TTL_MS);
@@ -64,6 +66,7 @@ class BaseLogin {
         clearTimeout(this.timer);
         this.stop();
         this.finish(state === 'succeeded');
+        this.changed();
     }
     /** Called by the service after verifying the new home. */
     complete(ok, error) { this.end(ok ? 'succeeded' : 'failed', error); }
@@ -76,8 +79,8 @@ export class ClaudeLogin extends BaseLogin {
     continued = false;
     /** Resolves with the CLI exit status once it exits. */
     exited;
-    constructor(owner, bins, home, profileId) {
-        super('claude', owner, 'paste_code');
+    constructor(owner, bins, home, profileId, changed) {
+        super('claude', owner, 'paste_code', Date.now(), changed);
         const darwin = process.platform === 'darwin';
         const args = darwin
             ? ['-q', '/dev/null', bins.claude, 'auth', 'login']
@@ -109,6 +112,7 @@ export class ClaudeLogin extends BaseLogin {
                     }
                     this.url = url;
                     this.state = 'awaiting_user';
+                    this.changed();
                 }
             }
             // Claude asks for Enter after success; the answer carries no secret.
@@ -131,6 +135,7 @@ export class ClaudeLogin extends BaseLogin {
             throw new FleetError('invalid_request', 'that does not look like a sign-in code');
         this.submitted = true;
         this.state = 'verifying';
+        this.changed();
         this.output = '';
         this.child?.stdin.write(`${code}\r`);
     }
@@ -151,8 +156,8 @@ export class CodexDeviceLogin extends BaseLogin {
     codexLoginId;
     /** Resolves true when the app-server reports a successful login. */
     completed;
-    constructor(owner, bins, home, profileId) {
-        super('codex', owner, 'device_code');
+    constructor(owner, bins, home, profileId, changed) {
+        super('codex', owner, 'device_code', Date.now(), changed);
         this.completed = (async () => {
             try {
                 this.server = await CodexAppServer.start(bins.codex, profileEnv('CODEX_HOME', profileId, home));
@@ -184,9 +189,12 @@ export class CodexDeviceLogin extends BaseLogin {
                 this.url = url;
                 this.userCode = String(started.userCode).slice(0, 32);
                 this.state = 'awaiting_user';
+                this.changed();
                 const ok = await Promise.race([completion, this.done.then(() => false)]);
-                if (this.state === 'awaiting_user')
+                if (this.state === 'awaiting_user') {
                     this.state = 'verifying';
+                    this.changed();
+                }
                 return ok;
             }
             catch {

package/dist/subscriptions/service.d.ts

@@ -71,7 +71,7 @@ export declare class SubscriptionService {
     private readonly logins;
     private readonly probes;
     constructor(options: SubscriptionServiceOptions);
-    list(): Promise<ProviderView[]>;
+    list(observeOnly?: boolean): Promise<ProviderView[]>;
     /** Health + account + (Codex) usage for one profile. Concurrent calls share one run. */
     check(provider: SubscriptionProvider, profileId: string): Promise<CheckResult>;
     private checkClaude;

package/dist/subscriptions/service.js

@@ -23,7 +23,7 @@ export class SubscriptionService {
         this.bins = options.binaries ?? defaultBinaries();
         this.now = options.now ?? Date.now;
     }
-    async list() {
+    async list(observeOnly = false) {
         const state = readSubscriptionState();
         const pins = await this.pins();
         return SUBSCRIPTION_PROVIDERS.map(provider => {
@@ -31,7 +31,7 @@ export class SubscriptionService {
             const profiles = p.profiles.map(profile => {
                 const key = `${provider}/${profile.id}`;
                 const cached = this.checks.get(key);
-                if (!cached || this.now() - Date.parse(cached.health.checkedAt ?? '0') > STALE_CHECK_MS)
+                if (!observeOnly && (!cached || this.now() - Date.parse(cached.health.checkedAt ?? '0') > STALE_CHECK_MS))
                     void this.check(provider, profile.id).catch(() => { });
                 const observed = provider === 'claude' ? this.observedUsage(pins, profile.id) : undefined;
                 const probed = provider === 'claude' ? this.probedUsage(profile.id) : undefined;
@@ -135,8 +135,8 @@ export class SubscriptionService {
         }
         const { id: profileId, home } = createProfileHome(provider);
         const login = provider === 'claude'
-            ? new ClaudeLogin(owner, this.bins, home, profileId)
-            : new CodexDeviceLogin(owner, this.bins, home, profileId);
+            ? new ClaudeLogin(owner, this.bins, home, profileId, this.options.onChange)
+            : new CodexDeviceLogin(owner, this.bins, home, profileId, this.options.onChange);
         const loginId = login.view().loginId;
         this.logins.set(loginId, login);
         void this.completeLogin(provider, profileId, login);

package/dist/subscriptions/store.js

@@ -1,3 +1,4 @@
+import { publishFleetResourceCommit } from '../application/resource-observer.js';
 import { existsSync, mkdirSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
@@ -94,6 +95,7 @@ export async function updateSubscriptionState(fn) {
         const state = readSubscriptionState();
         const result = fn(state);
         replaceFileAtomically(stateFile(), `${JSON.stringify(state, null, 2)}\n`, 0o600);
+        publishFleetResourceCommit(stateFile());
         return result;
     });
 }
@@ -137,4 +139,5 @@ export function readPin(stateDir, provider) {
 }
 export function writePin(stateDir, pin) {
     replaceFileAtomically(join(stateDir, PIN_FILE), `${JSON.stringify({ [pin.provider]: pin })}\n`, 0o600);
+    publishFleetResourceCommit(join(stateDir, PIN_FILE));
 }

package/dist/tunnel-setup-input.js

@@ -1,3 +1,4 @@
+import { validateConfiguredAccountOrigin } from './account-origin.js';
 import { lstatSync, readFileSync } from 'node:fs';
 import { decodeWorkspacePayload } from './workspace-enrollment.js';
 /** Read the same private-file transport as enrollment, without consuming the grant. */
@@ -31,8 +32,13 @@ function decodeTunnelSetupGrant(input) {
     catch {
         throw Error('Invalid tunnel setup payload');
     }
+    try {
+        validateConfiguredAccountOrigin(grant?.appOrigin);
+    }
+    catch {
+        throw Error('Tunnel setup grant is invalid or expired; get a fresh command from the App');
+    }
     if (grant?.version !== 2 || Object.keys(grant).sort().join(',') !== 'appOrigin,code,expiresAt,version'
-        || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(grant.appOrigin)
         || !/^[A-Za-z0-9_-]{43}$/.test(grant.code) || !Number.isSafeInteger(grant.expiresAt)
         || grant.expiresAt <= Date.now() || grant.expiresAt > Date.now() + 16 * 60000)
         throw Error('Tunnel setup grant is invalid or expired; get a fresh command from the App');

package/dist/watchdog/query.d.ts

@@ -39,7 +39,9 @@ export declare function buildWatchdogFindings(cfg: {
  * polling. `now` is injectable (defaults to Date.now) so the TTL boundary is
  * unit-testable without real timers.
  */
-export declare function cachedWatchdogFindingsProvider(build: () => Map<string, WatchdogRoleFinding>, ttlMs: number, now?: () => number): () => Map<string, WatchdogRoleFinding>;
+export declare function cachedWatchdogFindingsProvider(build: () => Map<string, WatchdogRoleFinding>, ttlMs: number, now?: () => number): (() => Map<string, WatchdogRoleFinding>) & {
+    invalidate: () => void;
+};
 export interface WatchdogSummary {
     name: string;
     enabled: boolean;

package/dist/watchdog/query.js

@@ -59,12 +59,13 @@ export function buildWatchdogFindings(cfg, latestReport) {
  */
 export function cachedWatchdogFindingsProvider(build, ttlMs, now = Date.now) {
     let cached;
-    return () => {
+    const read = () => {
         const at = now();
         if (!cached || at - cached.at >= ttlMs)
             cached = { at, value: build() };
         return cached.value;
     };
+    return Object.assign(read, { invalidate: () => { cached = undefined; } });
 }
 const DEFAULT_REPORTS_LIMIT = 50;
 const MAX_REPORTS_LIMIT = 500;

package/dist/web/auth.d.ts

@@ -32,7 +32,7 @@ export declare class WebAuth {
     private readonly devices;
     private readonly access;
     private readonly workspaceDevices?;
-    readonly appOrigin: string;
+    readonly appOrigin?: string | undefined;
     private _bootstrapSecret;
     private bootstrapExpiresAt;
     private bootstrapUsed;
@@ -43,7 +43,7 @@ export declare class WebAuth {
     private readonly transports;
     private readonly renewals;
     private readonly sockets;
-    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig, workspaceDevices?: WorkspaceDeviceStore | undefined, appOrigin?: string);
+    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig, workspaceDevices?: WorkspaceDeviceStore | undefined, appOrigin?: string | undefined);
     get bootstrapSecret(): string;
     get origin(): string;
     get host(): string;

package/dist/web/auth.js

@@ -27,7 +27,7 @@ export class WebAuth {
     transports = new Map();
     renewals = new Map();
     sockets = new Map();
-    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }, workspaceDevices, appOrigin = 'https://app.ours.network') {
+    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }, workspaceDevices, appOrigin) {
         this._origin = _origin;
         this._host = _host;
         this.now = now;
@@ -58,7 +58,7 @@ export class WebAuth {
     }
     /** The configured account origin, when this request comes from it and workspace devices are enabled. */
     accountOrigin(request) {
-        return this.workspaceDevices && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
+        return this.workspaceDevices && this.appOrigin && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
     }
     validateBoundary(request, requireOrigin) {
         const host = request.headers.host;
@@ -68,7 +68,7 @@ export class WebAuth {
             throw new FleetError('forbidden', `This address is not configured for the fleet console. Open ${this.origin} or set --public-origin.`);
         if (this.workspaceDevices && String(request.headers.authorization ?? '').startsWith('Bearer ') && request.headers.origin && request.headers.origin !== this.appOrigin && !origins.has(request.headers.origin))
             throw new FleetError('forbidden', 'workspace request Origin does not match configured account origin');
-        const workspaceRequest = Boolean(this.workspaceDevices) && request.headers.origin === this.appOrigin
+        const workspaceRequest = Boolean(this.workspaceDevices) && Boolean(this.appOrigin) && request.headers.origin === this.appOrigin
             && (String(request.headers.authorization ?? '').startsWith('Bearer ') || (request.url ?? '').split('?')[0] === '/api/v1/devices/enroll' || request.method === 'OPTIONS');
         if (requireOrigin && !workspaceRequest && (!request.headers.origin || !origins.has(request.headers.origin)))
             throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
@@ -131,7 +131,7 @@ export class WebAuth {
             return session;
         }
         this.validateBoundary(request, mutation);
-        if (request.headers.origin === this.appOrigin && !this.allowedOrigins.has(this.appOrigin))
+        if (this.appOrigin && request.headers.origin === this.appOrigin && !this.allowedOrigins.has(this.appOrigin))
             throw new FleetError('unauthorized', 'workspace bearer credential required');
         const id = parseCookies(request.headers.cookie ?? '').ofs_session;
         const session = id ? this.sessions.get(id) : undefined;

package/dist/web/events.d.ts

@@ -8,6 +8,8 @@ export interface FleetEvent {
 }
 export declare class FleetEventBus {
     private readonly events;
+    private readonly resourceListeners;
+    subscribeResources(listener: () => void): () => void;
     private readonly clients;
     publish(kind: string, payload: unknown, roleId?: string): FleetEvent;
     attach(socket: WebSocket, lastEventId?: string): () => void;

package/dist/web/events.js

@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto';
 export class FleetEventBus {
     events = [];
+    resourceListeners = new Set();
+    subscribeResources(listener) { this.resourceListeners.add(listener); return () => { this.resourceListeners.delete(listener); }; }
     clients = new Set();
     publish(kind, payload, roleId) {
         const event = { eventId: randomUUID(), at: new Date().toISOString(), roleId, kind, payload };
@@ -12,6 +14,12 @@ export class FleetEventBus {
             if (socket.readyState === socket.OPEN && socket.bufferedAmount < 1024 * 1024)
                 socket.send(frame);
         }
+        for (const listener of this.resourceListeners) {
+            try {
+                listener();
+            }
+            catch { }
+        }
         return event;
     }
     attach(socket, lastEventId) {
@@ -30,5 +38,6 @@ export class FleetEventBus {
         for (const socket of this.clients)
             socket.close(1001, 'server shutdown');
         this.clients.clear();
+        this.resourceListeners.clear();
     }
 }

package/dist/web/prefix-gateway.js

@@ -103,17 +103,24 @@ export function createPrefixGateway(options) {
             delete headers['sec-websocket-protocol'];
         return { ...route, headers, session, authHeaders, deviceSocket: socketCredential !== undefined };
     };
-    const track = (authHeaders, session, close) => {
+    const track = (authHeaders, session, close, neutral = false) => {
         if (!session)
             return () => { };
         // The session authenticated for this request, with its own deadline, not whatever is current later.
         const unbind = auth.bindTransport(session, close);
-        const timer = setInterval(() => { try {
-            auth.authenticate({ headers: authHeaders });
-        }
-        catch {
-            close();
-        } }, 30_000);
+        const timer = setInterval(() => {
+            if (neutral) {
+                if (!auth.sessionValid(session))
+                    close();
+            }
+            else
+                try {
+                    auth.authenticate({ headers: authHeaders });
+                }
+                catch {
+                    close();
+                }
+        }, neutral ? 1000 : 30_000);
         timer.unref();
         return () => { clearInterval(timer); unbind(); };
     };
@@ -123,7 +130,7 @@ export function createPrefixGateway(options) {
     const accountCors = (req) => {
         const origin = auth?.accountOrigin(req);
         return origin ? { 'access-control-allow-origin': origin, vary: 'Origin',
-            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag, X-Ours-Workspace-Auth, X-Ours-Request-Id' } : {};
+            'access-control-expose-headers': 'Accept-Ranges, Content-Disposition, Content-Length, Content-Range, Content-Type, ETag, X-Ours-Workspace-Auth, X-Ours-Request-Id, X-Resource-Producer, X-Resource-Revision, X-Resource-Source-Generation, X-Resource-Source-Position, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline' } : {};
     };
     const server = createServer((req, res) => {
         const cors = accountCors(req);
@@ -134,7 +141,7 @@ export function createPrefixGateway(options) {
                 auth.validateBoundary({ headers: req.headers, method: req.method, url: req.url }, false);
                 res.writeHead(204, { ...cors, 'cache-control': 'no-store', 'access-control-max-age': '600',
                     'access-control-allow-methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
-                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration' });
+                    'access-control-allow-headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match, Range, X-CSRF-Token, X-Ours-Messenger-CSRF, X-Voice-Duration, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline' });
                 res.end();
                 return;
             }
@@ -186,7 +193,10 @@ export function createPrefixGateway(options) {
                 res.writeHead(502, { ...(route.service ? cors : {}), 'content-type': 'application/json' });
             res.end(JSON.stringify({ error: { code: 'upstream_unavailable', message: 'Service is unavailable' } }));
         });
-        const untrack = track(route.authHeaders, route.session, () => { upstream.destroy(); res.destroy(); });
+        const neutral = req.method === 'GET' && route.service?.prefix === '/notifications'
+            && new URL(req.url ?? '/', 'http://gateway.invalid').searchParams.get('resources') === '1'
+            && new URL(req.url ?? '/', 'http://gateway.invalid').pathname === '/notifications/api/v1/events';
+        const untrack = track(route.authHeaders, route.session, () => { upstream.destroy(); res.destroy(); }, neutral);
         res.on('close', untrack);
         req.on('aborted', () => upstream.destroy());
         res.on('close', () => upstream.destroy());