@ours.network/fleet 1.2.0-nightly.71 → 1.2.0-nightly.73

package/dist/account-origin.d.ts

@@ -1,2 +1,5 @@
-export declare const accountOrigins: readonly ["https://app.ours.network", "https://app.ours-tunnel.com"];
+/** Syntax validation for an authority already selected by trusted private state/configuration. */
 export declare function validateAccountOrigin(value: unknown): string;
+/** Incoming grants/payloads must match explicit operator configuration before any network action. */
+export declare function validateConfiguredAccountOrigin(value: unknown): string;
+export declare function validateConfiguredWorkspaceHost(value: unknown): boolean;

package/dist/account-origin.js

@@ -1,6 +1,31 @@
-export const accountOrigins = ['https://app.ours.network', 'https://app.ours-tunnel.com'];
+/** Syntax validation for an authority already selected by trusted private state/configuration. */
 export function validateAccountOrigin(value) {
-    if (typeof value !== 'string' || !accountOrigins.some(origin => origin === value))
+    let url;
+    try {
+        if (typeof value !== 'string')
+            throw Error();
+        url = new URL(value);
+    }
+    catch {
+        throw Error('Unsupported account origin');
+    }
+    if (url.protocol !== 'https:' || url.origin !== value || url.username || url.password)
         throw Error('Unsupported account origin');
     return value;
 }
+/** Incoming grants/payloads must match explicit operator configuration before any network action. */
+export function validateConfiguredAccountOrigin(value) {
+    const configured = validateAccountOrigin(process.env.OURS_ACCOUNT_ORIGIN);
+    if (value !== configured)
+        throw Error('Unsupported account origin');
+    return configured;
+}
+const dnsName = (value) => typeof value === 'string' && value.length <= 253 && value.includes('.') && value.split('.').every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+export function validateConfiguredWorkspaceHost(value) {
+    if (!dnsName(value))
+        return false;
+    if (process.env.OURS_WORKSPACE_HOST !== undefined)
+        return dnsName(process.env.OURS_WORKSPACE_HOST) && value === process.env.OURS_WORKSPACE_HOST;
+    const domain = process.env.OURS_WORKSPACE_DOMAIN;
+    return dnsName(domain) && value.endsWith('.' + domain) && !value.slice(0, -domain.length - 1).includes('.');
+}

package/dist/application/role-removal-service.js

@@ -100,7 +100,7 @@ export class RoleRemovalService {
                 renameSync(sourceState, join(recoveryPath, 'orphan-state'));
                 removeReminderState(join(recoveryPath, 'orphan-state'));
             }
-            await retireNotificationTarget(`/fleet/chats/agents/${encodeURIComponent(preview.role)}`).catch(() => { });
+            await retireNotificationTarget({ kind: 'agent', agentId: preview.role }).catch(() => { });
             this.options.ops.log(`removed orphaned backend/state '${preview.role}'`);
         }
         return { ...preview, removed: true, recoveryPath };

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.71",
-  "buildId": "ec6069200698",
-  "commit": "80250c2c6fbaa1818aeaaf2089eb9d396dee5d93",
+  "version": "1.2.0-nightly.73",
+  "buildId": "b6b76cb3faf6",
+  "commit": "45058aae764ba12d712ea74da7bbdb840c497171",
   "dirty": true,
-  "builtAt": "2026-10-17T21:21:29.368Z",
+  "builtAt": "2026-10-18T13:27:24.108Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/notifications/fleet-producer.js

@@ -1,6 +1,6 @@
 import { observeFleetResources } from '../application/resource-observer.js';
 import { roomsDir } from '../rooms-tasks/room-state.js';
-import { cleanupDir, drainNotificationTargetCleanup, notificationAgentId } from './target-cleanup.js';
+import { cleanupDir, drainNotificationTargetCleanup, notificationAgentId, hasPendingNotificationTargetCleanup } from './target-cleanup.js';
 import { closeSync, existsSync, lstatSync, openSync, readSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -79,8 +79,8 @@ export class FleetNotificationProducer {
     poll() {
         if (this.stopped)
             return;
-        this.cleanup ??= drainNotificationTargetCleanup(this.config, undefined, undefined, { beforeDelete: async (url) => {
-                const name = notificationAgentId(url);
+        this.cleanup ??= drainNotificationTargetCleanup(this.config, undefined, undefined, { beforeDelete: async (target) => {
+                const name = notificationAgentId(target);
                 if (!name || !/^[A-Za-z0-9_-]+$/.test(name))
                     return false;
                 // A recreated or retained role still has a valid target. Filesystem errors cannot prove removal.
@@ -117,7 +117,7 @@ export class FleetNotificationProducer {
             } }).catch(() => { }).finally(() => {
             this.cleanup = undefined;
             try {
-                if (readdirSync(cleanupDir()).some(name => /^[a-f0-9]{64}\.json$/.test(name)))
+                if (hasPendingNotificationTargetCleanup())
                     this.resume(3000);
             }
             catch { }
@@ -142,7 +142,7 @@ export class FleetNotificationProducer {
                     if (!outbox) {
                         const key = createHash('sha256').update(roleDir).digest('hex');
                         outbox = new NotificationOutbox(join(this.stateDir, key + '.json'), this.config, async (value, eventId) => ({ eventId, title: `${roleId}: agent completed`, body: 'Your agent finished responding. Open the chat to view the result.',
-                            url: `/fleet/chats/agents/${encodeURIComponent(roleId)}`, ...value }), this.warn);
+                            ...value, target: { kind: 'agent', agentId: roleId } }), this.warn);
                         if (!outbox.checkpoint) {
                             const segment = this.existing.has(roleDir) ? segments.at(-1) : segments[0];
                             outbox.saveCheckpoint({ segment, offset: this.existing.has(roleDir) ? statSync(join(dir, segment)).size : 0, prompts: [] });
@@ -205,7 +205,7 @@ export class FleetNotificationProducer {
                         if (['message.chunk', 'message.replace'].includes(event.kind) && event.promptId && event.messageId && current.prompts.includes(prompt))
                             current.messages[prompt] = event.messageId;
                         if (event.kind === 'turn.completed' && event.promptId && current.prompts.includes(prompt)) {
-                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(taskRoles ? { taskId: taskRoles.get(roleId) ?? null } : {}), url: `/fleet/chats/agents/${encodeURIComponent(roleId)}#fleet-message-${encodeURIComponent(current.messages[prompt] ?? event.promptId)}` })) {
+                            if (!outbox.enqueue(`${roleId}:${event.sessionGeneration}:${event.seq}`, { ...(taskRoles ? { taskId: taskRoles.get(roleId) ?? null } : {}), anchor: { kind: 'fleet-message', messageId: current.messages[prompt] ?? event.promptId } })) {
                                 this.resume(1000);
                                 break;
                             }

package/dist/notifications/outbox.d.ts

@@ -1,10 +1,23 @@
+export type NotificationTarget = {
+    kind: 'agent';
+    agentId: string;
+} | {
+    kind: 'task' | 'task-deleted';
+    taskId: string;
+};
 export interface NotificationInput {
     eventId: string;
     title: string;
     body: string;
-    url: string;
+    target: NotificationTarget;
+    anchor?: {
+        kind: 'fleet-message';
+        messageId: string;
+    };
     taskId?: string | null;
 }
+/** Only the closed typed contract is sent; any other payload is never sent or converted. */
+export declare function isNotificationInput(value: unknown): value is NotificationInput;
 export interface ProducerConfig {
     /** Service base URL. With a gateway credential it is the server gateway's notifications route. */
     origin: string;

package/dist/notifications/outbox.js

@@ -2,6 +2,38 @@ import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, re
 import { dirname, join } from 'node:path';
 import { readPrivateFile } from '@ours.network/sdk/connector';
 import { readClientProfile } from '../client-profile.js';
+const object = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const closed = (value, keys) => Object.keys(value).every(key => keys.includes(key));
+const domainId = (id) => typeof id === 'string' && /^[A-Za-z0-9_-]{1,120}$/.test(id);
+const text = (value, max) => typeof value === 'string' && !!value.trim() && value.length <= max;
+/** Only the closed typed contract is sent; any other payload is never sent or converted. */
+export function isNotificationInput(value) {
+    if (!object(value) || !closed(value, ['eventId', 'title', 'body', 'target', 'anchor', 'taskId'])
+        || !text(value.eventId, 512) || !text(value.title, 160) || !text(value.body, 512) || !object(value.target))
+        return false;
+    const target = value.target;
+    if (target.kind === 'agent') {
+        if (!closed(target, ['kind', 'agentId']) || !domainId(target.agentId))
+            return false;
+    }
+    else if (target.kind === 'task' || target.kind === 'task-deleted') {
+        if (!closed(target, ['kind', 'taskId']) || !domainId(target.taskId) || (value.taskId !== undefined && value.taskId !== target.taskId))
+            return false;
+    }
+    else
+        return false;
+    if (value.taskId !== undefined && value.taskId !== null && !domainId(value.taskId))
+        return false;
+    return value.anchor === undefined || (target.kind === 'agent' && object(value.anchor)
+        && closed(value.anchor, ['kind', 'messageId']) && value.anchor.kind === 'fleet-message' && text(value.anchor.messageId, 1024) && !/[\x00-\x1f\x7f]/.test(value.anchor.messageId));
+}
+const has = (entry, key) => Object.hasOwn(entry, key);
+// An entry is sent only when it is an object with a string ID and its frozen payload is the closed
+// typed contract or, with no payload field at all, it carries the current version marker. Anything
+// else, including null or scalar entries, is never read further, projected, sent or changed.
+const supported = (entry) => object(entry) && typeof entry.id === 'string' && !has(entry, 'operation')
+    && (has(entry, 'payload') ? isNotificationInput(entry.payload) : entry.targetVersion === 1);
+const same = (id) => (entry) => supported(entry) && entry.id === id;
 function defaultProfile() {
     try {
         return readClientProfile();
@@ -75,11 +107,12 @@ export class NotificationOutbox {
         this.warn = warn;
         mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
         const saved = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { entries: [] };
-        this.entries = Array.isArray(saved) ? saved : saved.entries;
+        // Only the current state shape is read; anything else is refused and left unchanged on disk.
+        if (!saved || typeof saved !== 'object' || Array.isArray(saved) || !Array.isArray(saved.entries))
+            throw new Error('Unsupported notification outbox state');
+        this.entries = saved.entries;
         this.cursor = saved.cursor;
         this.checkpoint = saved.checkpoint;
-        if (!Array.isArray(this.entries))
-            throw new Error('invalid notification outbox');
         this.timer = setInterval(() => { void this.drain(); }, 3000);
         this.timer.unref();
     }
@@ -109,14 +142,14 @@ export class NotificationOutbox {
     enqueue(id, value, cursor = this.cursor) {
         if (this.retired)
             return false;
-        if (this.entries.some(e => e.id === id)) {
+        if (this.entries.some(same(id))) {
             if (cursor !== this.cursor)
                 this.advance(cursor);
             return true;
         }
-        if (this.entries.length >= 2000)
+        if (this.entries.filter(supported).length >= 2000)
             return false;
-        this.persist([...this.entries, { id, value }], cursor);
+        this.persist([...this.entries, { id, value, targetVersion: 1 }], cursor);
         return true;
     }
     drain() {
@@ -125,15 +158,23 @@ export class NotificationOutbox {
         return this.running ??= this.drainOnce().finally(() => { this.running = undefined; });
     }
     async drainOnce() {
-        for (const entry of [...this.entries].slice(0, 32)) {
+        let attempts = 0;
+        for (const entry of [...this.entries]) {
+            if (!supported(entry))
+                continue;
+            if (attempts >= 32)
+                break;
             if (this.retired)
                 break;
             try {
                 const value = entry.payload ?? await this.project(entry.value, entry.id);
+                if (!isNotificationInput(value))
+                    continue;
+                attempts++;
                 // Freeze the canonical projection before any network attempt. A crash
                 // after service acceptance must replay the identical dedupe payload.
                 if (!entry.payload)
-                    this.persist(this.entries.map(e => e.id === entry.id ? { ...e, payload: value } : e));
+                    this.persist(this.entries.map(e => same(entry.id)(e) ? { ...e, payload: value } : e));
                 const response = await fetch(this.config.origin + '/api/v1/send', {
                     method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
                     headers: { ...(this.config.gatewayCredential
@@ -144,7 +185,7 @@ export class NotificationOutbox {
                 await response.body?.cancel();
                 if (!response.ok)
                     throw new Error('notification service rejected event');
-                this.persist(this.entries.filter(e => e.id !== entry.id));
+                this.persist(this.entries.filter(e => !same(entry.id)(e)));
             }
             catch {
                 this.warn('Notification producer delivery pending; retrying from durable outbox');
@@ -153,6 +194,6 @@ export class NotificationOutbox {
         }
     }
     /** Wait for the current send before clearing queued sends and retiring its target. */
-    async retire() { this.retired = true; clearInterval(this.timer); await this.running; this.persist([]); }
+    async retire() { this.retired = true; clearInterval(this.timer); await this.running; this.persist(this.entries.filter(entry => !supported(entry))); }
     async close() { clearInterval(this.timer); await this.running; }
 }

package/dist/notifications/target-cleanup.d.ts

@@ -1,11 +1,16 @@
 import { type ProducerConfig } from './outbox.js';
 export declare const cleanupDir: () => string;
-/** Only the canonical agent namespace can authorize role-target cleanup. */
-export declare function notificationAgentId(path: string): string | null;
+export type AgentTarget = {
+    kind: 'agent';
+    agentId: string;
+};
+/** Only a closed agent identity authorizes this producer's role-target cleanup. */
+export declare function notificationAgentId(target: unknown): string | null;
+export declare function hasPendingNotificationTargetCleanup(dir?: string): boolean;
 /** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */
-export declare function retireNotificationTarget(url: string, config?: ProducerConfig | undefined, dir?: string, request?: typeof fetch): Promise<void>;
+export declare function retireNotificationTarget(target: AgentTarget, config?: ProducerConfig | undefined, dir?: string, request?: typeof fetch): Promise<void>;
 /** Persisted retries also run from the ordinary web notification producer after restart. */
 export declare function drainNotificationTargetCleanup(config: ProducerConfig, dir?: string, request?: typeof fetch, options?: {
     retain?: boolean;
-    beforeDelete?: (url: string) => Promise<boolean>;
+    beforeDelete?: (target: AgentTarget) => Promise<boolean>;
 }): Promise<void>;

package/dist/notifications/target-cleanup.js

@@ -5,30 +5,35 @@ import { replaceFileAtomically } from '../atomic-file.js';
 import { stateRoot } from '../paths.js';
 import { producerConfig } from './outbox.js';
 export const cleanupDir = () => join(stateRoot(), 'notifications', 'removed-targets');
-/** Only the canonical agent namespace can authorize role-target cleanup. */
-export function notificationAgentId(path) {
-    try {
-        if (typeof path !== 'string' || /[\\\x00-\x20]|%(?:2f|5c|00|0[ad])/i.test(path))
-            return null;
-        const match = /^\/fleet\/chats\/agents\/([^/?#]+)(?:[?#]|$)/.exec(path);
-        if (!match)
-            return null;
-        const url = new URL(path, 'https://ours.invalid');
-        if (['source', 'chat', 'task', 'detail'].some(key => url.searchParams.has(key)))
-            return null;
-        const id = decodeURIComponent(match[1]);
-        return /^[A-Za-z0-9_-]+$/.test(id) ? id : null;
-    }
-    catch {
+/** Only a closed agent identity authorizes this producer's role-target cleanup. */
+export function notificationAgentId(target) {
+    if (!target || typeof target !== 'object' || Array.isArray(target))
         return null;
-    }
+    const value = target;
+    return Object.keys(value).every(key => ['kind', 'agentId'].includes(key)) && value.kind === 'agent'
+        && typeof value.agentId === 'string' && /^[A-Za-z0-9_-]{1,120}$/.test(value.agentId) ? value.agentId : null;
+}
+export function hasPendingNotificationTargetCleanup(dir = cleanupDir()) {
+    if (!existsSync(dir))
+        return false;
+    return readdirSync(dir).filter(file => /^[a-f0-9]{64}\.json$/.test(file)).some(file => {
+        try {
+            const value = JSON.parse(readFileSync(join(dir, file), 'utf8'));
+            return !!value && typeof value === 'object' && Object.keys(value).length === 1 && !!notificationAgentId(value.target);
+        }
+        catch (error) {
+            return !(error instanceof SyntaxError);
+        }
+    });
 }
 /** Queue only after the owning lifecycle has established deletion, never on a failed inventory read. */
-export async function retireNotificationTarget(url, config = producerConfig(), dir = cleanupDir(), request = fetch) {
+export async function retireNotificationTarget(target, config = producerConfig(), dir = cleanupDir(), request = fetch) {
     if (!config)
         return;
+    if (!notificationAgentId(target))
+        throw new Error('Invalid notification target');
     mkdirSync(dir, { recursive: true, mode: 0o700 });
-    replaceFileAtomically(join(dir, createHash('sha256').update(url).digest('hex') + '.json'), JSON.stringify({ url }) + '\n', 0o600);
+    replaceFileAtomically(join(dir, createHash('sha256').update(JSON.stringify({ kind: 'agent', agentId: target.agentId })).digest('hex') + '.json'), JSON.stringify({ target }) + '\n', 0o600);
     await drainNotificationTargetCleanup(config, dir, request, { retain: true });
 }
 /** Persisted retries also run from the ordinary web notification producer after restart. */
@@ -39,12 +44,19 @@ export async function drainNotificationTargetCleanup(config, dir = cleanupDir(),
     for (const file of readdirSync(dir).filter(file => /^[a-f0-9]{64}\.json$/.test(file))) {
         if (attempts >= 32)
             break;
+        const path = join(dir, file);
+        let value;
+        try {
+            value = JSON.parse(readFileSync(path, 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length !== 1 || !notificationAgentId(value.target))
+            continue;
         try {
-            const path = join(dir, file), value = JSON.parse(readFileSync(path, 'utf8'));
-            if (!notificationAgentId(value.url))
-                continue;
             attempts++;
-            if (options.beforeDelete && !(await options.beforeDelete(value.url))) {
+            if (options.beforeDelete && !(await options.beforeDelete(value.target))) {
                 rmSync(path, { force: true });
                 continue;
             }

package/dist/ops.js

@@ -271,7 +271,7 @@ export async function rmRole(cfg, name, deps) {
     rmSync(agentDir(name), { recursive: true, force: true });
     if (generatedSource && existsSync(role.sourceFile)) {
         unlinkSync(role.sourceFile);
-        await retireNotificationTarget(`/fleet/chats/agents/${encodeURIComponent(name)}`).catch(() => { });
+        await retireNotificationTarget({ kind: 'agent', agentId: name }).catch(() => { });
         deps.log(`removed ${role.sourceFile}`);
     }
     deps.log(`removed '${name}' (its ours identity is left intact)`);

package/dist/paths.d.ts

@@ -13,6 +13,9 @@ export declare function deriveXdgRuntimeDir(env?: NodeJS.ProcessEnv, uid?: numbe
 export declare const stateRoot: () => string;
 /** The Owner invitation file that tunnel setup writes itself after enrollment. */
 export declare const workspaceOwnerInvite: () => string;
+/** Serializes writers of the workspace binding and of its unfinished replacement record. */
+export declare const workspaceBindingLock: () => string;
+export declare const workspaceReplacementFile: () => string;
 export declare const agentsRoot: () => string;
 export declare const tmpRoot: () => string;
 export declare const logsRoot: () => string;

package/dist/paths.js

@@ -23,6 +23,9 @@ export function deriveXdgRuntimeDir(env = process.env, uid = process.getuid?.(),
 export const stateRoot = () => join(home(), '.ours-fleet');
 /** The Owner invitation file that tunnel setup writes itself after enrollment. */
 export const workspaceOwnerInvite = () => join(stateRoot(), 'workspace', 'owner.invite');
+/** Serializes writers of the workspace binding and of its unfinished replacement record. */
+export const workspaceBindingLock = () => join(stateRoot(), 'workspace', '.binding.lock');
+export const workspaceReplacementFile = () => join(stateRoot(), 'workspace', 'replacement.json');
 export const agentsRoot = () => join(stateRoot(), 'agents');
 export const tmpRoot = () => join(stateRoot(), 'tmp');
 export const logsRoot = () => join(stateRoot(), 'logs');

package/dist/rooms-tasks/task-state.js

@@ -101,7 +101,7 @@ function writeTask(record) {
         pending.push({ eventId: `task:${record.task_id}:${randomUUID()}`, taskId: record.task_id,
             title: `Task ${!previous ? 'created' : 'updated'}: ${record.title}`.slice(0, 160),
             body: `Task ${record.task_id}: ${before ? `${before} → ` : 'created in '}${next}.`,
-            url: `/fleet/tasks/${record.task_id}` });
+            target: { kind: 'task', taskId: record.task_id } });
     }
     if (pending.length)
         persisted.notification_events = pending;
@@ -111,6 +111,17 @@ function writeTask(record) {
     publishFleetResourceCommit(taskPath(record.task_id));
 }
 const retiredNotificationsDir = () => join(tasksDir(), '.notification-retired');
+function typedTaskNotification(value, id) {
+    if (!value || typeof value !== 'object' || Object.keys(value).some(key => !['eventId', 'title', 'body', 'target', 'taskId'].includes(key)))
+        return false;
+    const target = value.target;
+    return typeof value.eventId === 'string' && value.eventId.startsWith(`task:${id}:`) && value.eventId.length <= 512
+        && value.taskId === id && !!target && typeof target === 'object' && !Array.isArray(target)
+        && Object.keys(target).every(key => ['kind', 'taskId'].includes(key)) && target.taskId === id
+        && (target.kind === 'task' || (target.kind === 'task-deleted' && value.eventId === `task:${id}:deleted`))
+        && typeof value.title === 'string' && !!value.title.trim() && value.title.length <= 160
+        && typeof value.body === 'string' && !!value.body.trim() && value.body.length <= 512;
+}
 /** Atomic snapshots contain the events, including intermediate states between polls. */
 export function pendingTaskNotifications(warn = () => { }) {
     const result = [];
@@ -129,13 +140,13 @@ export function pendingTaskNotifications(warn = () => { }) {
                     continue;
                 if (value.notification_events === undefined)
                     continue;
-                if (!Array.isArray(value.notification_events) || value.notification_events.some(e => !e
-                    || typeof e.eventId !== 'string' || !e.eventId.startsWith(`task:${id}:`) || e.eventId.length > 512
-                    || e.taskId !== id || (e.url !== `/fleet/tasks/${id}` && !(e.eventId === `task:${id}:deleted` && e.url === `/fleet/tasks?deletedTask=${id}`)) || typeof e.title !== 'string' || !e.title.trim() || e.title.length > 160
-                    || typeof e.body !== 'string' || !e.body.trim() || e.body.length > 512))
+                if (!Array.isArray(value.notification_events))
                     throw new Error('invalid notification events');
-                if (value.notification_events.length)
-                    result.push({ taskId: id, events: value.notification_events });
+                // Only typed task events are delivered. Unsupported entries are never sent or converted,
+                // and they do not block later lifecycle events.
+                const events = value.notification_events.filter(event => typedTaskNotification(event, id));
+                if (events.length)
+                    result.push({ taskId: id, events });
             }
             catch (error) {
                 if (!isNotFoundError(error))
@@ -153,9 +164,9 @@ export function acknowledgeTaskNotification(id, eventId) {
             if (!existsSync(path))
                 continue;
             const value = JSON.parse(readFileSync(path, 'utf8'));
-            if (!value.notification_events?.some(event => event.eventId === eventId))
+            if (!value.notification_events?.some(event => typedTaskNotification(event, id) && event.eventId === eventId))
                 continue;
-            value.notification_events = value.notification_events.filter(event => event.eventId !== eventId);
+            value.notification_events = value.notification_events.filter(event => !typedTaskNotification(event, id) || event.eventId !== eventId);
             replaceFileAtomically(path, JSON.stringify(value, null, 2) + '\n');
             if (path.startsWith(retiredNotificationsDir() + '/') && !value.notification_events.length)
                 unlinkSync(path);
@@ -890,7 +901,7 @@ export function unlinkDeletedTask(id) {
         // before unlink may replay two copies; both carry identical service dedupe IDs.
         const removed = { eventId: `task:${id}:deleted`, taskId: id,
             title: `Task deleted: ${stored.title}`.slice(0, 160), body: `Task ${id}: deleting → deleted.`,
-            url: `/fleet/tasks?deletedTask=${id}` };
+            target: { kind: 'task-deleted', taskId: id } };
         replaceFileAtomically(join(retiredNotificationsDir(), `${id}.json`), JSON.stringify({ notification_events: [...(stored.notification_events ?? []), removed] }) + '\n');
         try {
             unlinkSync(taskPath(id));

package/dist/rooms-tasks/types.d.ts

@@ -110,7 +110,10 @@ export interface TaskNotificationEvent {
     eventId: string;
     title: string;
     body: string;
-    url: string;
+    target: {
+        kind: 'task' | 'task-deleted';
+        taskId: string;
+    };
     taskId: string;
 }
 export interface TaskRecord {

package/dist/tunnel-setup-input.js

@@ -1,3 +1,4 @@
+import { validateConfiguredAccountOrigin } from './account-origin.js';
 import { lstatSync, readFileSync } from 'node:fs';
 import { decodeWorkspacePayload } from './workspace-enrollment.js';
 /** Read the same private-file transport as enrollment, without consuming the grant. */
@@ -31,8 +32,13 @@ function decodeTunnelSetupGrant(input) {
     catch {
         throw Error('Invalid tunnel setup payload');
     }
+    try {
+        validateConfiguredAccountOrigin(grant?.appOrigin);
+    }
+    catch {
+        throw Error('Tunnel setup grant is invalid or expired; get a fresh command from the App');
+    }
     if (grant?.version !== 2 || Object.keys(grant).sort().join(',') !== 'appOrigin,code,expiresAt,version'
-        || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(grant.appOrigin)
         || !/^[A-Za-z0-9_-]{43}$/.test(grant.code) || !Number.isSafeInteger(grant.expiresAt)
         || grant.expiresAt <= Date.now() || grant.expiresAt > Date.now() + 16 * 60000)
         throw Error('Tunnel setup grant is invalid or expired; get a fresh command from the App');

package/dist/web/auth.d.ts

@@ -32,7 +32,7 @@ export declare class WebAuth {
     private readonly devices;
     private readonly access;
     private readonly workspaceDevices?;
-    readonly appOrigin: string;
+    readonly appOrigin?: string | undefined;
     private _bootstrapSecret;
     private bootstrapExpiresAt;
     private bootstrapUsed;
@@ -43,7 +43,7 @@ export declare class WebAuth {
     private readonly transports;
     private readonly renewals;
     private readonly sockets;
-    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig, workspaceDevices?: WorkspaceDeviceStore | undefined, appOrigin?: string);
+    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig, workspaceDevices?: WorkspaceDeviceStore | undefined, appOrigin?: string | undefined);
     get bootstrapSecret(): string;
     get origin(): string;
     get host(): string;

package/dist/web/auth.js

@@ -27,7 +27,7 @@ export class WebAuth {
     transports = new Map();
     renewals = new Map();
     sockets = new Map();
-    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }, workspaceDevices, appOrigin = 'https://app.ours.network') {
+    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }, workspaceDevices, appOrigin) {
         this._origin = _origin;
         this._host = _host;
         this.now = now;
@@ -58,7 +58,7 @@ export class WebAuth {
     }
     /** The configured account origin, when this request comes from it and workspace devices are enabled. */
     accountOrigin(request) {
-        return this.workspaceDevices && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
+        return this.workspaceDevices && this.appOrigin && request.headers.origin === this.appOrigin ? this.appOrigin : undefined;
     }
     validateBoundary(request, requireOrigin) {
         const host = request.headers.host;
@@ -68,7 +68,7 @@ export class WebAuth {
             throw new FleetError('forbidden', `This address is not configured for the fleet console. Open ${this.origin} or set --public-origin.`);
         if (this.workspaceDevices && String(request.headers.authorization ?? '').startsWith('Bearer ') && request.headers.origin && request.headers.origin !== this.appOrigin && !origins.has(request.headers.origin))
             throw new FleetError('forbidden', 'workspace request Origin does not match configured account origin');
-        const workspaceRequest = Boolean(this.workspaceDevices) && request.headers.origin === this.appOrigin
+        const workspaceRequest = Boolean(this.workspaceDevices) && Boolean(this.appOrigin) && request.headers.origin === this.appOrigin
             && (String(request.headers.authorization ?? '').startsWith('Bearer ') || (request.url ?? '').split('?')[0] === '/api/v1/devices/enroll' || request.method === 'OPTIONS');
         if (requireOrigin && !workspaceRequest && (!request.headers.origin || !origins.has(request.headers.origin)))
             throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
@@ -131,7 +131,7 @@ export class WebAuth {
             return session;
         }
         this.validateBoundary(request, mutation);
-        if (request.headers.origin === this.appOrigin && !this.allowedOrigins.has(this.appOrigin))
+        if (this.appOrigin && request.headers.origin === this.appOrigin && !this.allowedOrigins.has(this.appOrigin))
             throw new FleetError('unauthorized', 'workspace bearer credential required');
         const id = parseCookies(request.headers.cookie ?? '').ofs_session;
         const session = id ? this.sessions.get(id) : undefined;

package/dist/web/runtime.js

@@ -79,10 +79,10 @@ export async function startWebConsole(options) {
     }
     const access = options.access ?? new WebAccessStore(webDir).read();
     const bindingFile = resolve(stateRoot(), 'workspace', 'binding.json');
-    let appOrigin = 'https://app.ours.network';
+    let appOrigin;
     try {
         if (existsSync(bindingFile))
-            appOrigin = validateAccountOrigin(JSON.parse(readFileSync(bindingFile, 'utf8')).appOrigin ?? appOrigin);
+            appOrigin = validateAccountOrigin(JSON.parse(readFileSync(bindingFile, 'utf8')).appOrigin);
     }
     catch (error) {
         lock.release();

package/dist/web/server.js

@@ -53,7 +53,7 @@ export async function buildWebServer(services, boundary, options = {}) {
         reply.header('Content-Security-Policy', "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'");
         if (request.url.startsWith('/api/'))
             reply.header('Cache-Control', 'no-store');
-        if (request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
+        if (auth.appOrigin && request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
             reply.header('Access-Control-Allow-Origin', auth.appOrigin).header('Vary', 'Origin');
             reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
             reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id');

package/dist/workspace-enrollment.js

@@ -1,9 +1,9 @@
-import { validateAccountOrigin } from './account-origin.js';
+import { validateAccountOrigin, validateConfiguredAccountOrigin, validateConfiguredWorkspaceHost } from './account-origin.js';
 import { lstatSync, readFileSync, readdirSync, mkdirSync, existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { readClientProfile } from './client-profile.js';
-import { stateRoot, defaultConfigPath, workspaceOwnerInvite } from './paths.js';
-import { replaceFileAtomically } from './atomic-file.js';
+import { stateRoot, defaultConfigPath, workspaceOwnerInvite, workspaceBindingLock, workspaceReplacementFile } from './paths.js';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
 import { loadConfig, splitRootFor } from './config.js';
 import { parse, parseDocument, stringify } from 'yaml';
 import { randomUUID } from 'node:crypto';
@@ -25,7 +25,13 @@ export function decodeWorkspacePayload(input, options = {}) {
     catch {
         throw Error('Invalid workspace payload');
     }
-    if (!p || typeof p !== 'object' || Array.isArray(p) || p.version !== 1 || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(p.appOrigin) || !/^[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || (!options.allowExpired && p.challenge.expiresAt <= Date.now()) || !Number.isSafeInteger(p.challenge.expiresAt) || p.challenge.expiresAt > Date.now() + 16 * 60000)
+    try {
+        validateConfiguredAccountOrigin(p?.appOrigin);
+    }
+    catch {
+        throw Error('Workspace payload is invalid or expired');
+    }
+    if (!p || typeof p !== 'object' || Array.isArray(p) || p.version !== 1 || !validateConfiguredWorkspaceHost(p.hostname) || !/^[a-z0-9-]{2,30}@[a-z0-9-]{2,30}$/.test(p.rootName) || !/^[a-f0-9]{64}$/i.test(p.serverCid) || !p.challenge || !['nonce', 'accountId', 'workspaceId'].every(k => /^[\w-]{43}$/.test(String(p.challenge[k]))) || (!options.allowExpired && p.challenge.expiresAt <= Date.now()) || !Number.isSafeInteger(p.challenge.expiresAt) || p.challenge.expiresAt > Date.now() + 16 * 60000)
         throw Error('Workspace payload is invalid or expired');
     for (const k of ['connectorToken', 'invitation']) {
         if (k === 'connectorToken' && p[k] === undefined)
@@ -58,7 +64,7 @@ export function checkWorkspaceConnector(payload) {
     catch {
         reject();
     }
-    if (previous.workspaceId !== payload.challenge.workspaceId || validateAccountOrigin(previous.appOrigin ?? 'https://app.ours.network') !== payload.appOrigin || (previous.serverCid && previous.serverCid.toUpperCase() !== payload.serverCid.toUpperCase()))
+    if (previous.workspaceId !== payload.challenge.workspaceId || validateAccountOrigin(previous.appOrigin) !== payload.appOrigin || (previous.serverCid && previous.serverCid.toUpperCase() !== payload.serverCid.toUpperCase()))
         reject();
     try {
         const file = join(dir, 'connector'), stat = lstatSync(file);
@@ -264,11 +270,24 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
     const appOrigin = validateAccountOrigin(payload.appOrigin);
     const previousFile = join(dir, 'binding.json');
     let migrating = false;
-    if (existsSync(previousFile)) {
-        const previous = JSON.parse(readFileSync(previousFile, 'utf8'));
+    // Every decision below rests on this binding and on the unfinished replacement record (none, or the
+    // one this setup completes); both are rechecked under the binding lock before the first change and
+    // again at the final write, so a concurrent setup or replacement is never overwritten.
+    const read = (file) => existsSync(file) ? readFileSync(file, 'utf8') : null;
+    const priorBinding = read(previousFile), priorReplacement = read(workspaceReplacementFile());
+    if (priorReplacement !== null && options.replacingWorkspace === undefined)
+        throw Error('An unfinished replacement exists; resume or abandon it before setup. Existing setup preserved');
+    const unchangedBinding = () => {
+        if (read(previousFile) !== priorBinding)
+            throw Error('The workspace binding changed during setup; existing setup preserved. Run the setup command again');
+        if (read(workspaceReplacementFile()) !== priorReplacement)
+            throw Error('The unfinished replacement changed during setup; existing setup preserved. Review it with setup-tunnel --resume');
+    };
+    if (priorBinding !== null) {
+        const previous = JSON.parse(priorBinding);
         if (previous.workspaceId !== payload.challenge.workspaceId && options.replacingWorkspace !== previous.workspaceId)
             throw Error('This host is already associated with another workspace');
-        const priorOrigin = validateAccountOrigin(previous.appOrigin ?? 'https://app.ours.network');
+        const priorOrigin = validateAccountOrigin(previous.appOrigin);
         migrating = priorOrigin !== appOrigin && options.replacingWorkspace !== previous.workspaceId;
         if (migrating && !options.migrateAppOrigin)
             throw Error('Account origin change requires explicit --migrate-app-origin and a fresh setup payload');
@@ -287,7 +306,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
         throw Error('Bound Messenger identity unavailable');
     // An installation that ran Messenger as the Human root and now runs it as the person's own identity keeps its managed Owner entry, moved to that identity.
     const moved = Boolean(loaded.rooms) && !lost && !!identity.root && !same(loaded.rooms.owner.expected_cid, identity.cid) && managedRootOwner(resolve(configuration), loaded.rooms, identity.root)
-        && (options.replacingWorkspace !== undefined || JSON.parse(readFileSync(previousFile, 'utf8')).serverCid?.toUpperCase() === payload.serverCid.toUpperCase());
+        && (options.replacingWorkspace !== undefined || JSON.parse(priorBinding).serverCid?.toUpperCase() === payload.serverCid.toUpperCase());
     if (options.preserveProfile && identity.preserveProfile !== true)
         throw Error('Existing-host setup requires Messenger profile-preservation support; update the host Messenger before retrying');
     if (!options.preserveProfile && (payload.fullName?.trim() || !payload.name?.trim() || !payload.surname?.trim()) && !identity.optionalWorkspaceProfileV1)
@@ -327,6 +346,7 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
             throw Error('Invalid replacement proof receipt');
         }
     }
+    withSynchronousFileLock(workspaceBindingLock(), unchangedBinding);
     if (identity.root) {
         if (!options.preserveProfile)
             await request('identity/profile', { fullName: fullName ?? null, name: name ?? null, surname: surname ?? null });
@@ -376,26 +396,31 @@ export async function enrollWorkspace(payload, configuration = defaultConfigPath
             await new Promise(resolve => setTimeout(resolve, 500));
         }
     }
-    replaceFileAtomically(inviteFile, result.ownerInvite + '\n', 0o600);
-    options.afterInvitation?.();
-    const split = splitRootFor(configuration);
-    mkdirSync(split, { recursive: true, mode: 0o700 });
-    if (!loaded.rooms)
-        replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
-    else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== ownerCid.toLowerCase())
-        replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
-    else if (moved) {
-        // The invitation above and this entry are two files. A setup interrupted between them leaves the entry naming the root,
-        // which is this same case again: running setup once more writes both.
-        const document = parseDocument(readFileSync(configuration, 'utf8'));
-        document.setIn(['rooms', 'owner', 'expected_cid'], ownerCid);
-        replaceFileAtomically(configuration, document.toString(), 0o600);
-    }
-    if (payload.connectorToken !== undefined)
-        replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
     const origin = `https://${payload.hostname}`;
-    replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
-    replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase(), ...(identity.root ? { proofRootCid: identity.root.cid } : {}) }) + '\n', 0o600);
+    // Local files commit together under the binding lock, after rechecking the binding this setup decided
+    // on, so a stale concurrent setup refuses before changing any of them.
+    withSynchronousFileLock(workspaceBindingLock(), () => {
+        unchangedBinding();
+        replaceFileAtomically(inviteFile, result.ownerInvite + '\n', 0o600);
+        options.afterInvitation?.();
+        const split = splitRootFor(configuration);
+        mkdirSync(split, { recursive: true, mode: 0o700 });
+        if (!loaded.rooms)
+            replaceFileAtomically(configuration, readFileSync(configuration, 'utf8') + '\n' + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
+        else if (lost && loaded.rooms.owner.expected_cid.toLowerCase() !== ownerCid.toLowerCase())
+            replaceFileAtomically(configuration, `api_version: ${GENERATED_VERSION}\n\n` + stringify(generatedRooms(ownerCid, inviteFile)), 0o600);
+        else if (moved) {
+            // The invitation above and this entry are two files. A setup interrupted between them leaves the entry naming the root,
+            // which is this same case again: running setup once more writes both.
+            const document = parseDocument(readFileSync(configuration, 'utf8'));
+            document.setIn(['rooms', 'owner', 'expected_cid'], ownerCid);
+            replaceFileAtomically(configuration, document.toString(), 0o600);
+        }
+        if (payload.connectorToken !== undefined)
+            replaceFileAtomically(join(dir, 'connector'), payload.connectorToken + '\n', 0o600);
+        replaceFileAtomically(join(dir, 'tunnel.json'), JSON.stringify({ origin, tokenFile: join(dir, 'connector') }) + '\n', 0o600);
+        replaceFileAtomically(previousFile, JSON.stringify({ workspaceId: payload.challenge.workspaceId, hostWorkspaceId, appOrigin, serverCid: payload.serverCid.toUpperCase(), ...(identity.root ? { proofRootCid: identity.root.cid } : {}) }) + '\n', 0o600);
+    });
     loadConfig(configuration);
     return { origin, hostWorkspaceId, rootCid: result.rootCid };
 }

package/dist/workspace-replacement.js

@@ -3,20 +3,21 @@ import { existsSync, lstatSync, readFileSync, rmSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { validateAccountOrigin } from './account-origin.js';
-import { replaceFileAtomically } from './atomic-file.js';
-import { stateRoot } from './paths.js';
+import { replaceFileAtomically, withSynchronousFileLock } from './atomic-file.js';
+import { stateRoot, workspaceBindingLock, workspaceReplacementFile } from './paths.js';
 import { decodeWorkspacePayload, enrollWorkspace, unregisterWorkspace, checkWorkspaceConnector } from './workspace-enrollment.js';
 import { WorkspaceDeviceStore } from './web/workspace-devices.js';
 import { webControlPath } from './web/control.js';
 import { WebServiceManager } from './web/service.js';
 const workspaceDir = () => join(stateRoot(), 'workspace');
-const replacementPath = () => join(workspaceDir(), 'replacement.json');
+const replacementPath = workspaceReplacementFile;
 const opaque = /^[\w-]{43}$/;
 function binding(value) {
-    if (!value || !opaque.test(value.workspaceId) || !opaque.test(value.hostWorkspaceId) || (value.serverCid !== undefined && !/^[a-f0-9]{64}$/i.test(value.serverCid))
-        || (value.proofRootCid !== undefined && !/^[a-f0-9]{64}$/i.test(value.proofRootCid)))
+    const text = (id, pattern) => typeof id === 'string' && pattern.test(id);
+    if (!value || typeof value !== 'object' || !text(value.workspaceId, opaque) || !text(value.hostWorkspaceId, opaque) || (value.serverCid !== undefined && !text(value.serverCid, /^[a-f0-9]{64}$/i))
+        || (value.proofRootCid !== undefined && !text(value.proofRootCid, /^[a-f0-9]{64}$/i)))
         throw Error('Existing workspace binding is invalid; restore it before tunnel setup');
-    return { ...value, appOrigin: validateAccountOrigin(value.appOrigin ?? 'https://app.ours.network') };
+    return { ...value, appOrigin: validateAccountOrigin(value.appOrigin) };
 }
 export function readWorkspaceBinding() {
     const file = join(workspaceDir(), 'binding.json');
@@ -53,7 +54,7 @@ export async function confirmWorkspaceReplacement(previous, explicit = false, ef
     let hostname = '';
     try {
         const tunnel = JSON.parse(readFileSync(join(workspaceDir(), 'tunnel.json'), 'utf8'));
-        if (typeof tunnel.origin === 'string' && /^https:\/\/[a-z0-9][a-z0-9-]{2,60}\.ours-tunnel\.com$/.test(tunnel.origin))
+        if (typeof tunnel.origin === 'string' && validateAccountOrigin(tunnel.origin))
             hostname = ` (${new URL(tunnel.origin).hostname})`;
     }
     catch { }
@@ -84,7 +85,7 @@ export async function confirmWorkspaceReplacement(previous, explicit = false, ef
     return false;
 }
 export function saveWorkspaceReplacement(record) {
-    replaceFileAtomically(replacementPath(), JSON.stringify(record) + '\n', 0o600);
+    withSynchronousFileLock(workspaceBindingLock(), () => replaceFileAtomically(replacementPath(), JSON.stringify(record) + '\n', 0o600));
 }
 export function readWorkspaceReplacement() {
     const file = replacementPath();
@@ -110,7 +111,7 @@ export function readWorkspaceReplacement() {
     record.payload = decodeWorkspacePayload(Buffer.from(JSON.stringify(record.payload)).toString('base64url'), { allowExpired: true });
     return record;
 }
-export function clearWorkspaceReplacement() { rmSync(replacementPath(), { force: true }); }
+export function clearWorkspaceReplacement() { withSynchronousFileLock(workspaceBindingLock(), () => rmSync(replacementPath(), { force: true })); }
 /** Explicit recovery after the user removes an unsuccessful successor in the App. */
 export function discardRetiredWorkspaceReplacement() {
     const record = readWorkspaceReplacement(), current = readWorkspaceBinding();
@@ -132,9 +133,26 @@ export async function beginWorkspaceReplacement(previous, payload, configuration
     if (!requiresWorkspaceReplacement(previous, { workspaceId: payload.challenge.workspaceId, appOrigin: payload.appOrigin, serverCid: payload.serverCid }))
         throw Error('The same workspace must never be retired');
     checkReplacementService(configuration);
+    // The record is created only for the binding this decision was made on, and only if no other
+    // replacement or setup changed the binding or the record meanwhile; enrollment checks the same pair.
+    const bindingFile = join(workspaceDir(), 'binding.json'), current = () => existsSync(bindingFile) ? readFileSync(bindingFile, 'utf8') : null;
+    const unchanged = (bytes) => {
+        if (current() !== bytes)
+            throw Error('The workspace binding changed during setup; existing setup preserved. Run the setup command again');
+        if (existsSync(replacementPath()))
+            throw Error('Another replacement started during setup; existing setup preserved. Review it with setup-tunnel --resume');
+    };
+    const before = withSynchronousFileLock(workspaceBindingLock(), () => {
+        const bytes = current();
+        unchanged(bytes);
+        const now = readWorkspaceBinding();
+        if (!now || now.workspaceId !== previous.workspaceId || now.hostWorkspaceId !== previous.hostWorkspaceId || now.appOrigin !== previous.appOrigin || now.serverCid?.toUpperCase() !== previous.serverCid?.toUpperCase())
+            throw Error('The workspace binding changed during setup; existing setup preserved. Run the setup command again');
+        return bytes;
+    });
     const record = { version: 2, previous: previous, payload, configuration: resolve(configuration), operationNonce: randomBytes(32).toString('base64url'), dispatchAttempted: false, operationExpiresAt: Date.now() + 86400000 - 5 * 60000 };
     record.rootCid = await (effects.preflight ?? unregisterWorkspace)(record.previous, payload, record.operationNonce, effects.attach, { checkOnly: true, operationExpiresAt: record.operationExpiresAt });
-    saveWorkspaceReplacement(record);
+    withSynchronousFileLock(workspaceBindingLock(), () => { unchanged(before); replaceFileAtomically(replacementPath(), JSON.stringify(record) + '\n', 0o600); });
     return record;
 }
 /** Abandon only after a private receipt confirms no deletion and dispatch was unsent or terminally rejected. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.71",
+  "version": "1.2.0-nightly.73",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -48,9 +48,9 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "2.8.1-nightly.16",
-    "@ours.network/mcp": "1.2.0-nightly.14",
-    "@ours.network/sdk": "3.8.1-nightly.18",
+    "@ours.network/cli": "3.1.1-nightly.1",
+    "@ours.network/mcp": "1.2.0-nightly.15",
+    "@ours.network/sdk": "4.1.1-nightly.1",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "qrcode": "1.5.4",
@@ -64,7 +64,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "3.8.1-nightly.10",
+    "@ours.network/daemon": "4.1.1-nightly.1",
     "@types/node": "^22.20.4",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",