@ours.network/fleet 2.1.0 → 2.1.2

package/README.md

@@ -100,7 +100,8 @@ The maintained Codex and Claude ACP adapters remain bundled optional dependencie
 and are resolved internally; users do not install adapter commands or add them to
 `PATH`. Explicit `session_options.codex_app_server.command` and
 `session_options.acp.command` overrides remain available. ours-fleet and its
-maintained adapters require Node 22 or newer.
+maintained adapters require a patched Node.js 22.23.4+, 24.22.1+ or 26.12.1+
+release (see [Security version requirements](#security-version-requirements)).
 
 Each OS user manages their own fleet — to host roles under a sandboxed account,
 become that account and repeat.
@@ -1737,7 +1738,7 @@ These package checks do not replace native Fleet/harness or platform acceptance.
 
 ### Build with selected SDK and CLI archives
 
-Run in the build container with Node 22+, npm and tar available:
+Run in the build container with a patched Node.js (22.23.4+, 24.22.1+ or 26.12.1+), npm and tar available:
 
 ```sh
 node scripts/build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tgz --cli /artifacts/ours.network-cli-2.7.2.tgz --out-dir /artifacts/consumer
@@ -1971,3 +1972,41 @@ existing role/default configuration when applying this change. Meaningful agent
 commentary, attention requests and final answers continue to be delivered.
 The app associates activity with the channel's bound CID, never a display name.
 It shows unavailable status when the directory observation disconnects.
+
+## Security version requirements
+
+Ours refuses to run on Node.js or cloudflared releases with known security
+defects that affect it. The checks run before setup changes anything and
+again before every tunnel start, and the refusal names the minimum version,
+the version found and where to update.
+
+**Node.js.** Only reviewed stable release lines are accepted, each with its
+own patched floor: 22 (22.23.4+), 24 (24.22.1+) and 26 (26.12.1+). Earlier
+patch levels of these lines, end-of-life lines (20, 21, 23, 25), prerelease
+or nightly builds and release lines that have not been reviewed yet (such as
+27) are refused. A new line is admitted by a reviewed change that adds its
+floor, never by a single global "newer than" comparison. The
+[October 2026 Node.js security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
+fix CVE-2026-111497: the bundled Brotli decoder can write out of bounds when
+decompressing attacker-controlled data, which can cause memory corruption,
+crashes, information disclosure and potentially remote code execution.
+Update from [nodejs.org](https://nodejs.org/en/download) or your package
+manager. The `engines` field in `package.json` records the same floors but
+is advisory; the runtime checks enforce them.
+
+**cloudflared.** A tunnel requires cloudflared **2026.10.2 or later**, as
+reported by `cloudflared --version` for the executable found on the PATH of
+the process that starts the tunnel. Older, prerelease, unrecognized, failing,
+missing or timed-out version checks are refused.
+[Cloudflare's eMudhra incident explanation](https://blog.cloudflare.com/emudhra-certificate-compromise/)
+describes why: earlier releases trust compromised eMudhra intermediate
+certificates, which allows server impersonation. Update with your package
+manager or
+[Cloudflare's update instructions](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/),
+then check `cloudflared --version` again.
+
+These checks do not install or upgrade prerequisites, disable TLS
+verification, rotate credentials or restart services. A process that is
+already running keeps the binaries it started with: update Node.js and
+cloudflared, then restart the affected services (and rebuild or recreate
+containers) yourself.

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.1.0",
-  "buildId": "697e8bf9e53c",
-  "commit": "2805e0e84c2a3bad05efdbe895fd8fb6e9d2aff4",
+  "version": "2.1.2",
+  "buildId": "5bf10a772912",
+  "commit": "dd8adad553ca71b0edae5cc1040eacaaed51e50a",
   "dirty": false,
-  "builtAt": "2026-10-27T12:22:22.859Z",
+  "builtAt": "2026-10-28T20:22:31.826Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/cli.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import './runtime-security.js';
 import './harness/claude-code.js';
 import './harness/codex.js';
 import './harness/hermes.js';

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import './runtime-security.js';
 import { beginWorkspaceReplacement, abandonWorkspaceReplacement, discardRetiredWorkspaceReplacement, clearWorkspaceReplacement, confirmWorkspaceReplacement, finishWorkspaceReplacement, readWorkspaceBinding, readWorkspaceReplacement, requiresWorkspaceReplacement, refreshWorkspaceReplacement } from './workspace-replacement.js';
 import { completeTunnelSetup } from './tunnel-setup-completion.js';
 import { readTunnelSetupFile, readTunnelSetupStdin, readTunnelSetupArgument, redeemTunnelSetup, inspectTunnelSetup, verifyTunnelSetupTarget } from './tunnel-setup-input.js';

package/dist/doctor.js

@@ -1,4 +1,6 @@
+import { cloudflaredUnavailableError, cloudflaredVersionError, CLOUDFLARED_VERSION_TIMEOUT_MS, isSecureCloudflaredVersion, isSecureNodeVersion, nodeVersionError, parseCloudflaredVersion } from './security-versions.js';
 import { describeRegistration, refreshServiceRegistrations, registrationDrift } from './supervisor/registration-refresh.js';
+import { join } from 'node:path';
 import { userInfo } from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { attachOursClient, } from '@ours.network/sdk/client';
@@ -8,7 +10,7 @@ import { getAdapter, productionAdapters } from './harness/registry.js';
 import { analyzeFleetPermissions, formatNative } from './permissions.js';
 import { managedCliReport } from './managed-cli.js';
 import { resolveBundledAcpAgent } from './harness/acp-agent.js';
-import { agentDir, deriveXdgRuntimeDir } from './paths.js';
+import { agentDir, deriveXdgRuntimeDir, stateRoot } from './paths.js';
 import { resolveIsolation, harnessRuntimeDir } from './isolation/policy.js';
 import { hermesConfiguredProvider } from './harness/hermes-startup.js';
 import { makeBubblewrapBackend } from './isolation/bubblewrap.js';
@@ -116,11 +118,22 @@ export async function doctor(opts = {}, exec = realExec, platform = process.plat
                 detail: `could not inspect: ${error?.message ?? String(error)}` });
         }
     }
-    const major = Number(process.versions.node.split('.')[0]);
+    const secureNode = isSecureNodeVersion(process.versions.node);
     checks.push({
-        name: 'node', ok: major >= 20,
-        detail: major >= 20 ? `v${process.versions.node}` : `v${process.versions.node} — need >= 20`,
+        name: 'node', ok: secureNode,
+        detail: secureNode ? `v${process.versions.node}` : nodeVersionError(process.versions.node),
     });
+    // A configured workspace tunnel starts the cloudflared found on PATH.
+    if (existsSync(join(stateRoot(), 'workspace', 'tunnel.json'))) {
+        const connector = await exec('cloudflared', ['--version'], { timeout: CLOUDFLARED_VERSION_TIMEOUT_MS });
+        const secure = connector.code === 0 && isSecureCloudflaredVersion(connector.stdout);
+        checks.push({
+            name: 'cloudflared', ok: secure,
+            detail: secure ? `version ${parseCloudflaredVersion(connector.stdout).join('.')}`
+                : connector.code !== 0 ? cloudflaredUnavailableError(connector.code === 127 ? 'not found' : 'version check failed')
+                    : cloudflaredVersionError(connector.stdout),
+        });
+    }
     // The configuration is a checked prerequisite in its own right. A config the
     // `config` command rejects must fail here too, with the same cause — while the
     // host checks below still run, because they are what the operator needs next.

package/dist/runtime-security.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime-security.js

@@ -0,0 +1,6 @@
+// Imported first by the CLI entry point: refuse an unpatched Node.js before any other module runs.
+import { isSecureNodeVersion, nodeVersionError } from './security-versions.js';
+if (!isSecureNodeVersion(process.versions.node)) {
+    process.stderr.write(`${nodeVersionError(process.versions.node)}\n`);
+    process.exit(1);
+}

package/dist/security-versions.d.ts

@@ -0,0 +1,20 @@
+export declare const NODE_PATCHED_FLOORS: Readonly<Record<number, readonly [number, number, number]>>;
+export declare const NODE_SECURITY_ADVISORY = "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases";
+export declare const NODE_DOWNLOAD_URL = "https://nodejs.org/en/download";
+export declare const NODE_SECURITY_REQUIREMENT: string;
+export declare const CLOUDFLARED_MIN_VERSION: readonly number[];
+export declare const CLOUDFLARED_SECURITY_ADVISORY = "https://blog.cloudflare.com/emudhra-certificate-compromise/";
+export declare const CLOUDFLARED_UPDATE_URL = "https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/";
+export declare const CLOUDFLARED_VERSION_TIMEOUT_MS = 10000;
+/** Returns [major, minor, patch] for a stable Node.js version string, otherwise null. */
+export declare function parseNodeVersion(version: string): number[] | null;
+export declare function isSecureNodeVersion(version: string): boolean;
+export declare function nodeVersionError(version: string): string;
+export declare function assertSecureNodeVersion(version?: string): void;
+/** Returns [year, month, patch] for exact stable `cloudflared --version` output, otherwise null. */
+export declare function parseCloudflaredVersion(output: string): number[] | null;
+/** `reason` must be a fixed description such as "not found" or "timed out", never command output. */
+export declare function cloudflaredUnavailableError(reason: string): string;
+export declare function cloudflaredVersionError(output: string): string;
+export declare function isSecureCloudflaredVersion(output: string): boolean;
+export declare function assertSecureCloudflaredVersion(output: string): void;

package/dist/security-versions.js

@@ -0,0 +1,70 @@
+// Security version floors for the runtimes Ours executes. Keep this file
+// identical in ours-network, ours-fleet and ours-app.
+//
+// Node.js policy: only reviewed stable release lines are admitted, each with
+// its own patched floor. A new line (for example a future 27 or 28 release) is
+// added by a reviewed change once its security releases have been checked;
+// until then it is refused, as are prerelease builds, end-of-life lines and
+// earlier patch levels of a listed line. A single global ">=" comparison would
+// admit vulnerable intermediate lines, so every line keeps an explicit floor.
+export const NODE_PATCHED_FLOORS = Object.freeze({ 22: [22, 23, 4], 24: [24, 22, 1], 26: [26, 12, 1] });
+export const NODE_SECURITY_ADVISORY = 'https://nodejs.org/en/blog/vulnerability/october-2026-security-releases';
+export const NODE_DOWNLOAD_URL = 'https://nodejs.org/en/download';
+export const NODE_SECURITY_REQUIREMENT = Object.values(NODE_PATCHED_FLOORS).map(floor => `${floor.join('.')}+`).join(', ');
+// cloudflared releases before 2026.10.2 trust compromised eMudhra intermediates.
+export const CLOUDFLARED_MIN_VERSION = Object.freeze([2026, 10, 2]);
+export const CLOUDFLARED_SECURITY_ADVISORY = 'https://blog.cloudflare.com/emudhra-certificate-compromise/';
+export const CLOUDFLARED_UPDATE_URL = 'https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/';
+export const CLOUDFLARED_VERSION_TIMEOUT_MS = 10_000;
+const atLeast = (version, floor) => {
+    for (let i = 0; i < floor.length; i++)
+        if (version[i] !== floor[i])
+            return version[i] > floor[i];
+    return true;
+};
+/** Returns [major, minor, patch] for a stable Node.js version string, otherwise null. */
+export function parseNodeVersion(version) {
+    const match = /^v?(\d{1,9})\.(\d{1,9})\.(\d{1,9})$/.exec(String(version));
+    return match ? match.slice(1).map(Number) : null;
+}
+export function isSecureNodeVersion(version) {
+    const parsed = parseNodeVersion(version);
+    const floor = parsed && NODE_PATCHED_FLOORS[parsed[0]];
+    return Boolean(floor && atLeast(parsed, floor));
+}
+export function nodeVersionError(version) {
+    const shown = /^v?[0-9A-Za-z.+-]{1,64}$/.test(String(version)) ? String(version).replace(/^v/, '') : 'unrecognized';
+    return `Node.js ${shown} is not permitted. Ours requires a patched supported Node.js release: ${NODE_SECURITY_REQUIREMENT} `
+        + 'within those release lines; prerelease, end-of-life and unreviewed release lines are refused. '
+        + `Earlier patch levels are affected by CVE-2026-111497 (Brotli decompression out-of-bounds write) and the other October 2026 fixes: ${NODE_SECURITY_ADVISORY} `
+        + `Update Node.js from ${NODE_DOWNLOAD_URL} or your package manager, then retry.`;
+}
+export function assertSecureNodeVersion(version = process.versions.node) {
+    if (!isSecureNodeVersion(version))
+        throw new Error(nodeVersionError(version));
+}
+/** Returns [year, month, patch] for exact stable `cloudflared --version` output, otherwise null. */
+export function parseCloudflaredVersion(output) {
+    const match = /^cloudflared version (\d{4})\.(\d{1,2})\.(\d{1,6})(?: \(built [^\r\n()]*\))?\r?\n?$/.exec(String(output));
+    const parsed = match?.slice(1).map(Number);
+    return parsed && parsed[1] >= 1 && parsed[1] <= 12 ? parsed : null;
+}
+const cloudflaredGuidance = () => `cloudflared releases before ${CLOUDFLARED_MIN_VERSION.join('.')} trust compromised eMudhra intermediate certificates, which allows server impersonation: ${CLOUDFLARED_SECURITY_ADVISORY} `
+    + `Update the cloudflared executable on this host's PATH (${CLOUDFLARED_UPDATE_URL}, or your package manager), check it with "cloudflared --version", then retry.`;
+/** `reason` must be a fixed description such as "not found" or "timed out", never command output. */
+export function cloudflaredUnavailableError(reason) {
+    return `cloudflared could not be verified (${reason}). A tunnel requires cloudflared ${CLOUDFLARED_MIN_VERSION.join('.')} or later. ${cloudflaredGuidance()}`;
+}
+export function cloudflaredVersionError(output) {
+    const parsed = parseCloudflaredVersion(output);
+    const found = parsed ? `version ${parsed.join('.')}` : 'with an unrecognized version';
+    return `cloudflared ${found} is not permitted; a tunnel requires cloudflared ${CLOUDFLARED_MIN_VERSION.join('.')} or later. ${cloudflaredGuidance()}`;
+}
+export function isSecureCloudflaredVersion(output) {
+    const parsed = parseCloudflaredVersion(output);
+    return Boolean(parsed && atLeast(parsed, CLOUDFLARED_MIN_VERSION));
+}
+export function assertSecureCloudflaredVersion(output) {
+    if (!isSecureCloudflaredVersion(output))
+        throw new Error(cloudflaredVersionError(output));
+}

package/dist/session/control.js

@@ -699,13 +699,27 @@ export async function controlRequest(stateDir, request, timeoutMs = 120_000) {
     const socket = createConnection(controlSocketPath(stateDir));
     socket.setEncoding('utf8');
     return new Promise((resolve, reject) => {
+        let settled = false, expiry;
+        const settle = () => { settled = true; clearTimeout(timer); if (expiry)
+            clearImmediate(expiry); };
+        // Timers run before pending I/O. When this process was busy past the deadline, a reply
+        // already waiting on the socket is still unread: give it the next poll phase before
+        // declaring the supervisor silent. That is one event-loop turn, not added time; a reply
+        // arriving within that turn is accepted, and a silent supervisor fails in the same turn.
         const timer = setTimeout(() => {
-            socket.destroy();
-            reject(new SessionControlError('timeout', `the role control plane did not answer '${request.command}' within ${timeoutMs}ms`));
+            expiry = setImmediate(() => {
+                if (settled)
+                    return;
+                settle();
+                socket.destroy();
+                reject(new SessionControlError('timeout', `the role control plane did not answer '${request.command}' within ${timeoutMs}ms`));
+            });
         }, timeoutMs);
         let buffer = '';
         socket.once('error', error => {
-            clearTimeout(timer);
+            if (settled)
+                return;
+            settle();
             const code = error.code;
             const permissionHint = code === 'EPERM' || code === 'EACCES'
                 ? `; the operating system denied access before '${request.command}' reached the supervisor. `
@@ -718,9 +732,9 @@ export async function controlRequest(stateDir, request, timeoutMs = 120_000) {
         socket.on('data', chunk => {
             buffer += chunk;
             const newline = buffer.indexOf('\n');
-            if (newline < 0)
+            if (newline < 0 || settled)
                 return;
-            clearTimeout(timer);
+            settle();
             try {
                 resolve(JSON.parse(buffer.slice(0, newline)));
             }

package/dist/setup-tunnel-preflight.js

@@ -1,3 +1,4 @@
+import { cloudflaredUnavailableError, cloudflaredVersionError, CLOUDFLARED_VERSION_TIMEOUT_MS, isSecureCloudflaredVersion, isSecureNodeVersion, nodeVersionError } from './security-versions.js';
 import { existsSync, lstatSync, readFileSync, rmSync } from 'node:fs';
 import { userInfo } from 'node:os';
 import { join } from 'node:path';
@@ -10,9 +11,8 @@ const UNCHANGED = 'Nothing was changed and this host was not bound.';
  * proof is sent: a failure afterwards cannot be retried with a fresh command.
  */
 export async function setupTunnelPreflight({ exec = realExec, platform = process.platform, node = process.versions.node } = {}) {
-    const [major, minor] = node.split('.').map(Number);
-    if (major < 22 || (major === 22 && minor < 13))
-        throw Error(`Tunnel setup requires Node.js 22.13 or newer; this is ${node}. Update Node.js, then run a fresh tunnel setup command. ${UNCHANGED}`);
+    if (!isSecureNodeVersion(node))
+        throw Error(`${nodeVersionError(node)} ${UNCHANGED}`);
     if (platform === 'linux') {
         const manager = await exec('systemctl', ['--user', 'show-environment'], { timeout: 10_000 });
         if (manager.code !== 0)
@@ -20,6 +20,13 @@ export async function setupTunnelPreflight({ exec = realExec, platform = process
                 + `Log in directly as ${userInfo().username} (not through su or sudo), or run: sudo loginctl enable-linger ${userInfo().username} && export XDG_RUNTIME_DIR=/run/user/${process.getuid?.()} `
                 + `Then run a fresh tunnel setup command. ${UNCHANGED}`);
     }
+    // Refuse an unsafe connector before anything is redeemed; the service checks its own
+    // PATH-selected cloudflared again before every tunnel start.
+    const version = await exec('cloudflared', ['--version'], { timeout: CLOUDFLARED_VERSION_TIMEOUT_MS });
+    if (version.code !== 0)
+        throw Error(`${cloudflaredUnavailableError(version.code === 127 ? 'not found' : 'version check failed')} ${UNCHANGED}`);
+    if (!isSecureCloudflaredVersion(version.stdout))
+        throw Error(`${cloudflaredVersionError(version.stdout)} ${UNCHANGED}`);
     const help = await exec('cloudflared', ['tunnel', 'run', '--help'], { timeout: 10_000 });
     if (help.code === 127)
         throw Error(`cloudflared is not installed or not on PATH. Install it, then run a fresh tunnel setup command. ${UNCHANGED}`);

package/dist/web/resource-views.d.ts

@@ -131,6 +131,8 @@ export declare class FleetResourceViews {
     private retire;
     private emit;
     private coverage;
+    /** Certify each view's last projected source; never a position its capture did not read. */
+    private cover;
     private affects;
     private schedule;
     private refresh;

package/dist/web/resource-views.js

@@ -25,6 +25,8 @@ export const RESOURCE_ASSEMBLY_BYTES = 16 * 1024 * 1024;
 const CHUNK_BYTES = 256 * 1024;
 /** Minimum spacing of activity-only follow-up captures of one view. */
 export const ACTIVITY_CAPTURE_INTERVAL_MS = 1000;
+/** Sparse health: a current view is qualified at most this often without data. */
+const COVERAGE_INTERVAL_MS = 15000;
 /** Lazily yield byte chunks so backpressure never queues an entire large record.
  * Base64 prevents splitting a Unicode scalar from corrupting JSON/SSE parsing. */
 export function* resourceFrames(envelope) {
@@ -263,7 +265,7 @@ export class FleetResourceViews {
                 this.coverage(connection).catch(close);
                 if (!connection.views.size)
                     response.write(': keepalive\n\n');
-            }, 15000);
+            }, COVERAGE_INTERVAL_MS);
             healthTimer.unref();
         }
         return { connectionId: id, close };
@@ -347,7 +349,11 @@ export class FleetResourceViews {
     // complete batch behind any active chunk assembly and earlier data records.
     coverage(connection) {
         const now = Date.now();
-        const eligible = [...connection.views.values()].filter(view => this.current(connection, view) && !view.failed && !view.running && !view.dirty && view.payload !== undefined && view.covered && view.covered.health === 'healthy' && view.covered.position === view.source.snapshot().position && now - (view.qualifiedAt ?? 0) >= 15000);
+        return this.cover(connection, [...connection.views.values()].filter(view => !view.running && !view.dirty && view.covered?.position === view.source.snapshot().position && now - (view.qualifiedAt ?? 0) >= COVERAGE_INTERVAL_MS), now);
+    }
+    /** Certify each view's last projected source; never a position its capture did not read. */
+    cover(connection, candidates, now) {
+        const eligible = candidates.filter(view => this.current(connection, view) && !view.failed && view.payload !== undefined && view.covered && view.covered.health === 'healthy');
         if (!eligible.length)
             return Promise.resolve();
         const views = eligible.map(view => ({ protocolVersion: 1, producerGeneration: this.producerGeneration, viewId: view.descriptor.viewId, subscriptionEpoch: view.epoch, baselineId: view.baselineId, sequence: view.sequence + 1, revision: view.revision, source: view.covered }));
@@ -502,6 +508,10 @@ export class FleetResourceViews {
                     return;
                 view.payload = payload;
             }
+            // Sustained activity can keep a view dirty at every health tick while its payload is
+            // unchanged; the completed capture still qualifies the source it read.
+            else if (Date.now() - (view.qualifiedAt ?? 0) >= COVERAGE_INTERVAL_MS)
+                await this.cover(connection, [view], Date.now());
             if (first) {
                 await this.emit(connection, view, 'ready', { baselineId: view.baselineId, source });
                 if (this.current(connection, view))

package/dist/web/runtime.js

@@ -310,7 +310,7 @@ export async function startWebConsole(options) {
     }
     let stopTunnel;
     try {
-        stopTunnel = startWorkspaceTunnel(browserOrigin);
+        stopTunnel = await startWorkspaceTunnel(browserOrigin);
     }
     catch (error) {
         try {

package/dist/web/workspace-tunnel.d.ts

@@ -1 +1,2 @@
-export declare function startWorkspaceTunnel(origin: string): () => Promise<void>;
+import { type Exec } from '../exec.js';
+export declare function startWorkspaceTunnel(origin: string, exec?: Exec): Promise<() => Promise<void>>;

package/dist/web/workspace-tunnel.js

@@ -1,8 +1,10 @@
 import { spawn } from 'node:child_process';
 import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { realExec } from '../exec.js';
+import { assertSecureCloudflaredVersion, cloudflaredUnavailableError, CLOUDFLARED_VERSION_TIMEOUT_MS } from '../security-versions.js';
 import { stateRoot } from '../paths.js';
-export function startWorkspaceTunnel(origin) {
+export async function startWorkspaceTunnel(origin, exec = realExec) {
     const dir = join(stateRoot(), 'workspace'), file = join(dir, 'tunnel.json');
     if (!existsSync(file))
         return async () => { };
@@ -15,7 +17,31 @@ export function startWorkspaceTunnel(origin) {
     const stat = lstatSync(tokenFile);
     if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.())
         throw Error('Connector credential must be an owned private file');
-    let stopped = false, child, timer, backoff = 1000;
+    // The connector is the executable named cloudflared on this process's PATH, the
+    // same lookup spawn uses. Its version is verified before the first start and
+    // before every reconnect, so a downgrade is refused and an upgrade is picked up.
+    const verify = async () => {
+        const result = await exec('cloudflared', ['--version'], { timeout: CLOUDFLARED_VERSION_TIMEOUT_MS });
+        if (result.code !== 0)
+            throw Error(cloudflaredUnavailableError(result.code === 127 ? 'not found' : 'version check failed'));
+        assertSecureCloudflaredVersion(result.stdout);
+    };
+    await verify();
+    let stopped = false, child, timer, backoff = 1000, reported = '';
+    const schedule = () => { if (stopped)
+        return; timer = setTimeout(reconnect, backoff); backoff = Math.min(30000, backoff * 2); };
+    // A refused or unverifiable connector is never started; retry after the backoff.
+    const reconnect = () => {
+        timer = undefined;
+        void verify().then(() => { reported = ''; launch(); }, (error) => {
+            if (stopped)
+                return;
+            if (error.message !== reported)
+                console.error(`Workspace tunnel not restarted: ${error.message}`);
+            reported = error.message;
+            schedule();
+        });
+    };
     const launch = () => {
         if (stopped)
             return;
@@ -23,7 +49,7 @@ export function startWorkspaceTunnel(origin) {
         let scheduled = false;
         // Keep an error listener for the child's whole lifetime, including shutdown.
         const retry = () => { if (scheduled || stopped)
-            return; scheduled = true; timer = setTimeout(launch, backoff); backoff = Math.min(30000, backoff * 2); };
+            return; scheduled = true; schedule(); };
         child.on('error', retry);
         child.once('exit', retry);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -30,7 +30,7 @@
     "docs/task-progress-review.md"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27"
   },
   "scripts": {
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",