@ours.network/fleet 1.2.0-nightly.74 → 1.2.0-nightly.76

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.2.0-nightly.74",
-  "buildId": "a3cb6f23464e",
-  "commit": "0ada452c41fd1d4d9237f0f86caa11b2dcba6b69",
+  "version": "1.2.0-nightly.76",
+  "buildId": "adbb39fb78cd",
+  "commit": "54d1ea9c17b78705a6af6a9d83872078dbeaa41d",
   "dirty": true,
-  "builtAt": "2026-10-18T16:29:31.599Z",
+  "builtAt": "2026-10-19T11:49:00.042Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/web/server.js

@@ -56,8 +56,9 @@ export async function buildWebServer(services, boundary, options = {}) {
         if (auth.appOrigin && request.headers.origin === auth.appOrigin && request.url.startsWith('/api/')) {
             reply.header('Access-Control-Allow-Origin', auth.appOrigin).header('Vary', 'Origin');
             reply.header('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
-            reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id');
-            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key');
+            // The App binds resource reads by these headers; it must be able to send and read them cross-origin.
+            reply.header('Access-Control-Expose-Headers', 'X-Ours-Workspace-Auth, X-Ours-Request-Id, X-Resource-Producer, X-Resource-Revision, X-Resource-Source-Generation, X-Resource-Source-Position, X-Resource-Connection, X-Resource-View, X-Resource-Epoch, X-Resource-Baseline');
+            reply.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,X-CSRF-Token,Idempotency-Key,X-Ours-Messenger-CSRF,X-Resource-Connection,X-Resource-View,X-Resource-Epoch,X-Resource-Baseline');
             if (request.method === 'OPTIONS') {
                 auth.validateBoundary(request, false);
                 return reply.code(204).send();
@@ -428,6 +429,10 @@ export async function buildWebServer(services, boundary, options = {}) {
     app.get('/api/v1/resource-events', async (request, reply) => {
         const browser = auth.authenticate(request);
         reply.hijack();
+        // A hijacked reply bypasses Fastify headers: keep the exact-origin CORS and security headers.
+        for (const [name, value] of Object.entries(reply.getHeaders()))
+            if (value !== undefined)
+                reply.raw.setHeader(name, Array.isArray(value) ? value : String(value));
         reply.raw.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache, no-transform', Connection: 'keep-alive', 'X-Accel-Buffering': 'no' });
         reply.raw.flushHeaders();
         const opened = resources.open(reply.raw, browser.id, () => auth.sessionValid(browser));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "1.2.0-nightly.74",
+  "version": "1.2.0-nightly.76",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -48,9 +48,9 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "3.1.1-nightly.1",
-    "@ours.network/mcp": "1.2.0-nightly.15",
-    "@ours.network/sdk": "4.1.1-nightly.1",
+    "@ours.network/cli": "3.1.1-nightly.2",
+    "@ours.network/mcp": "1.2.0-nightly.16",
+    "@ours.network/sdk": "4.1.1-nightly.2",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "qrcode": "1.5.4",
@@ -64,7 +64,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "4.1.1-nightly.1",
+    "@ours.network/daemon": "4.1.1-nightly.2",
     "@types/node": "^22.20.4",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",