@ours.network/fleet 1.2.0-nightly.74 → 1.2.0-nightly.75

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.74",
-  "buildId": "a3cb6f23464e",
-  "commit": "0ada452c41fd1d4d9237f0f86caa11b2dcba6b69",
+  "version": "1.2.0-nightly.75",
+  "buildId": "adbb39fb78cd",
+  "commit": "3a4e46ab47afdcfe370c827809357d8c67f69783",
   "dirty": true,
-  "builtAt": "2026-10-18T16:29:31.599Z",
+  "builtAt": "2026-10-18T20:22:00.847Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/web/server.js

@@ -56,8 +56,9 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (auth.appOrigin && request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
             reply.header('Access-Control-Allow-Origin', auth.appOrigin).header('Vary', 'Origin');
             reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
-            reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id');
-            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key');
+            // The App binds resource reads by these headers; it must be able to send and read them cross-origin.
+            reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id, X-Resource-Producer, X-Resource-Revision, X-Resource-Source-Generation, X-Resource-Source-Position, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline');
+            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key,X-Ours-Messenger-CSRF,X-Resource-Connection,X-Resource-View,X-Resource-Epoch,X-Resource-Baseline');
             if (request.method === 'OPTIONS') {
                 auth.validateBoundary(request, false);
                 return reply.code(204).send();
@@ -428,6 +429,10 @@ export async function buildWebServer(services, boundary, options = {}) {
     app.get('/api/v1/resource-events', async (request, reply) => {
         const browser = auth.authenticate(request);
         reply.hijack();
+        // A hijacked reply bypasses Fastify headers: keep the exact-origin CORS and security headers.
+        for (const [name, value] of Object.entries(reply.getHeaders()))
+            if (value !== undefined)
+                reply.raw.setHeader(name, Array.isArray(value) ? value : String(value));
         reply.raw.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache, no-transform', Connection: 'keep-alive', 'X-Accel-Buffering': 'no' });
         reply.raw.flushHeaders();
         const opened = resources.open(reply.raw, browser.id, () => auth.sessionValid(browser));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.74",
+  "version": "1.2.0-nightly.75",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",