@ours.network/fleet 2.3.3 → 2.4.0-nightly.2

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
-  "version": "2.3.3",
-  "buildId": "f813635f30d3",
-  "commit": "b0dbf450ed45e131fb34f64d71a16e8eb960b77f",
-  "dirty": false,
-  "builtAt": "2026-11-03T12:22:11.870Z",
+  "version": "2.4.0-nightly.2",
+  "buildId": "00857536f945",
+  "commit": "75b806fcaf0cb66fc066eb5a1b2a8578be9ab9b6",
+  "dirty": true,
+  "builtAt": "2026-11-03T18:50:41.228Z",
   "capabilities": [
     "service.refresh-v1",
     "managed-cli.codex-reasoning-effort-v1",

package/dist/channels/identity-reads.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Minimal HTTP adapter for the daemon's lease-free identity reads
+ * (`GET /identities/<name>/contacts-activity|history`, ours-sdk
+ * docs/identity-reads.md). Kept local so Fleet does not need a newer SDK client;
+ * the shapes are the daemon contract verbatim. The ordinary workspace client
+ * credential is reread on every request. No identity is ever bound.
+ */
+export interface IdentityRef {
+    identity: string;
+    expectedCid: string;
+    expectedProducerGeneration?: string;
+}
+export interface SourcePosition {
+    protocolVersion: 1;
+    producerGeneration: string;
+    position: number;
+}
+export interface ContactRootClaim {
+    root_cid: string;
+    root_name: string;
+    role_id: string;
+}
+export interface ContactsActivity {
+    identity: {
+        name: string;
+        cid: string;
+    };
+    source: SourcePosition;
+    contacts: Array<{
+        name: string;
+        container_id: string;
+    }>;
+    roots: Record<string, ContactRootClaim>;
+    activity: Record<string, {
+        at: string;
+    } | {
+        unavailable: true;
+    }>;
+}
+export interface IdentityHistoryPage {
+    identity: {
+        name: string;
+        cid: string;
+    };
+    source: SourcePosition;
+    items: Array<Record<string, unknown> & {
+        seq: number;
+        wire_id: string;
+    }>;
+    next_cursor: number | null;
+}
+export declare class IdentityReadError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    constructor(status: number, code: string | undefined, message: string);
+}
+export interface IdentityReader {
+    contactsActivity(ref: IdentityRef, signal?: AbortSignal): Promise<ContactsActivity>;
+    history(ref: IdentityRef & {
+        peer_cid: string;
+        before_seq?: number;
+        limit?: number;
+    }, signal?: AbortSignal): Promise<IdentityHistoryPage>;
+}
+export declare function createIdentityReader(options: {
+    endpoint: string;
+    credentialPath: string;
+    fetchImpl?: typeof fetch;
+}): IdentityReader;

package/dist/channels/identity-reads.js

@@ -0,0 +1,47 @@
+import { readPrivateFile } from '@ours.network/sdk/connector';
+export class IdentityReadError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+export function createIdentityReader(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const base = options.endpoint.replace(/\/+$/, '');
+    async function get(name, kind, query, signal) {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query))
+            if (value !== undefined)
+                params.set(key, String(value));
+        const response = await fetchImpl(`${base}/identities/${encodeURIComponent(name)}/${kind}?${params}`, {
+            redirect: 'error',
+            signal: signal ?? AbortSignal.timeout(15_000),
+            headers: { 'x-ours-api-token': readPrivateFile(options.credentialPath, 4096).toString('utf8').trim() },
+        });
+        let json;
+        try {
+            json = await response.json();
+        }
+        catch {
+            throw new IdentityReadError(response.status, undefined, `${kind}: non-JSON response (HTTP ${response.status})`);
+        }
+        if (response.ok)
+            return json;
+        const error = json?.error;
+        if (error && typeof error === 'object') {
+            const { code, message } = error;
+            throw new IdentityReadError(response.status, typeof code === 'string' ? code : undefined, `${kind}: ${String(message ?? code)}`);
+        }
+        throw new IdentityReadError(response.status, undefined, `${kind}: ${String(error ?? `HTTP ${response.status}`)}`);
+    }
+    return {
+        contactsActivity: (ref, signal) => get(ref.identity, 'contacts-activity', { expectedCid: ref.expectedCid, expectedProducerGeneration: ref.expectedProducerGeneration }, signal),
+        history: (ref, signal) => get(ref.identity, 'history', {
+            peer_cid: ref.peer_cid, before_seq: ref.before_seq, limit: ref.limit,
+            expectedCid: ref.expectedCid, expectedProducerGeneration: ref.expectedProducerGeneration,
+        }, signal),
+    };
+}

package/dist/channels/indexer.d.ts

@@ -0,0 +1,55 @@
+import { type ContactsActivity, type IdentityReader } from './identity-reads.js';
+import { type ChannelSources } from './sources.js';
+import type { ChannelEdge, ChannelsStore } from './store.js';
+export interface ResourceFrame {
+    kind: string;
+    producerGeneration: string;
+    position: number;
+}
+export interface ResourceEventSource {
+    resourceEvents(identity: string, options: {
+        signal: AbortSignal;
+        expectedGeneration?: string;
+        after?: number;
+    }): AsyncIterable<ResourceFrame>;
+}
+export interface ChannelsIndexerDeps {
+    store: ChannelsStore;
+    reader: IdentityReader;
+    events: ResourceEventSource;
+    discover(): Promise<ChannelSources>;
+    onChange(): void;
+    log(message: string): void;
+    debounceMs?: number;
+}
+/**
+ * Event-driven Channels projection. One passive resource-event stream per live
+ * perspective source; idle coverage frames are ignored and a committed frame
+ * only schedules work when the source position advanced. Work is debounced,
+ * at most one observation runs per source, and each observation reads only
+ * that source's contacts and activity (one lease-free daemon read), never other sources.
+ */
+export declare class ChannelsIndexer {
+    private readonly deps;
+    private readonly watches;
+    private internal;
+    private syncing?;
+    private resync;
+    private stopped;
+    private readonly debounceMs;
+    constructor(deps: ChannelsIndexerDeps);
+    /** Re-derive sources and the exclusion set; start/stop streams accordingly. */
+    sync(): Promise<void>;
+    stop(): void;
+    private syncOnce;
+    /** The daemon source of `sourceCid` changed under a caller: drop its pin and observe again. */
+    invalidate(sourceCid: string): void;
+    private retire;
+    private follow;
+    private retired;
+    private schedule;
+    private run;
+    private observe;
+}
+/** Contacts of one observation, minus internal identities, as metadata-only edges. */
+export declare function edgesFrom(observation: ContactsActivity, internal: Set<string>): ChannelEdge[];

package/dist/channels/indexer.js

@@ -0,0 +1,214 @@
+import { IdentityReadError } from './identity-reads.js';
+import { norm } from './sources.js';
+/**
+ * Event-driven Channels projection. One passive resource-event stream per live
+ * perspective source; idle coverage frames are ignored and a committed frame
+ * only schedules work when the source position advanced. Work is debounced,
+ * at most one observation runs per source, and each observation reads only
+ * that source's contacts and activity (one lease-free daemon read), never other sources.
+ */
+export class ChannelsIndexer {
+    deps;
+    watches = new Map();
+    internal = new Set();
+    syncing;
+    resync = false;
+    stopped = false;
+    debounceMs;
+    constructor(deps) {
+        this.deps = deps;
+        this.debounceMs = deps.debounceMs ?? 250;
+    }
+    /** Re-derive sources and the exclusion set; start/stop streams accordingly. */
+    sync() {
+        if (this.syncing) {
+            this.resync = true;
+            return this.syncing;
+        }
+        this.syncing = (async () => {
+            try {
+                do {
+                    this.resync = false;
+                    await this.syncOnce();
+                } while (this.resync && !this.stopped);
+            }
+            finally {
+                this.syncing = undefined;
+            }
+        })();
+        return this.syncing;
+    }
+    stop() {
+        this.stopped = true;
+        for (const watch of this.watches.values())
+            this.retire(watch);
+        this.watches.clear();
+    }
+    async syncOnce() {
+        if (this.stopped)
+            return;
+        const found = await this.deps.discover();
+        if (this.stopped)
+            return;
+        const internalChanged = found.internal.size !== this.internal.size || [...found.internal].some(cid => !this.internal.has(cid));
+        this.internal = found.internal;
+        this.deps.store.setSources(found.sources);
+        // Cached edges of every source, ended ones included, lose newly internal identities.
+        if (internalChanged)
+            this.deps.store.excludeContacts(found.internal);
+        const live = new Map(found.sources.filter(s => !s.ended).map(s => [s.cid, s]));
+        for (const [cid, watch] of this.watches) {
+            const next = live.get(cid);
+            if (!next || next.name !== watch.source.name) {
+                this.retire(watch);
+                this.watches.delete(cid);
+            }
+            else
+                watch.source = next;
+        }
+        for (const source of live.values()) {
+            let watch = this.watches.get(source.cid);
+            if (!watch) {
+                watch = { source, abort: new AbortController(), inflight: false, dirty: false };
+                this.watches.set(source.cid, watch);
+                void this.follow(watch);
+                this.schedule(watch); // bounded bootstrap/backfill for a new source
+            }
+            else if (internalChanged)
+                this.schedule(watch);
+        }
+        this.deps.onChange();
+    }
+    /** The daemon source of `sourceCid` changed under a caller: drop its pin and observe again. */
+    invalidate(sourceCid) {
+        const watch = this.watches.get(sourceCid.toUpperCase());
+        if (!watch || watch.abort.signal.aborted)
+            return;
+        watch.generation = undefined;
+        watch.position = undefined;
+        this.schedule(watch);
+    }
+    retire(watch) {
+        watch.abort.abort();
+        if (watch.timer)
+            clearTimeout(watch.timer);
+        watch.timer = undefined;
+    }
+    async follow(watch) {
+        let backoff = 1_000;
+        while (!watch.abort.signal.aborted) {
+            try {
+                for await (const frame of this.deps.events.resourceEvents(watch.source.name, {
+                    signal: watch.abort.signal, ...(watch.generation ? { expectedGeneration: watch.generation } : {}),
+                })) {
+                    backoff = 1_000;
+                    if (frame.kind === 'coverage')
+                        continue;
+                    // ready/committed at the already-observed position change nothing; resync always reads.
+                    if (frame.kind !== 'resync' && frame.producerGeneration === watch.generation && frame.position === watch.position)
+                        continue;
+                    if (frame.producerGeneration !== watch.generation)
+                        watch.position = undefined;
+                    watch.generation = frame.producerGeneration;
+                    this.schedule(watch);
+                }
+            }
+            catch (error) {
+                if (watch.abort.signal.aborted)
+                    return;
+                this.deps.log(`channels: ${watch.source.name} event stream interrupted: ${error.message}`);
+            }
+            if (this.retired(watch))
+                return;
+            // The stream ended or failed: data may be behind until it is re-established.
+            watch.generation = undefined;
+            this.deps.store.markStale(watch.source.cid);
+            this.deps.onChange();
+            await new Promise(resolve => setTimeout(resolve, backoff));
+            backoff = Math.min(backoff * 2, 30_000);
+        }
+    }
+    retired(watch) {
+        return this.stopped || watch.abort.signal.aborted || this.watches.get(watch.source.cid) !== watch;
+    }
+    schedule(watch) {
+        watch.dirty = true;
+        if (watch.timer || watch.inflight || watch.abort.signal.aborted)
+            return;
+        watch.timer = setTimeout(() => { watch.timer = undefined; void this.run(watch); }, this.debounceMs);
+    }
+    async run(watch) {
+        if (watch.inflight || watch.abort.signal.aborted)
+            return;
+        watch.inflight = true;
+        watch.dirty = false;
+        try {
+            const observation = await this.observe(watch);
+            // Retired (stopped, removed or replaced) work never touches the store or a successor.
+            if (!observation || this.retired(watch))
+                return;
+            this.deps.store.replaceEdges(watch.source.cid, edgesFrom(observation, this.internal), observation.source);
+            watch.generation = observation.source.producerGeneration;
+            watch.position = observation.source.position;
+            this.deps.onChange();
+        }
+        catch (error) {
+            if (this.retired(watch))
+                return;
+            this.deps.store.markStale(watch.source.cid);
+            this.deps.onChange();
+            if (error instanceof IdentityReadError && (error.code === 'identity_not_found' || error.code === 'identity_mismatch'))
+                void this.sync();
+            else
+                this.deps.log(`channels: ${watch.source.name} observation failed: ${error.message}`);
+        }
+        finally {
+            watch.inflight = false;
+            if (watch.dirty && !this.retired(watch))
+                this.schedule(watch);
+        }
+    }
+    async observe(watch) {
+        for (let attempt = 0;; attempt++) {
+            try {
+                return await this.deps.reader.contactsActivity({
+                    identity: watch.source.name, expectedCid: watch.source.cid,
+                    ...(watch.generation ? { expectedProducerGeneration: watch.generation } : {}),
+                }, watch.abort.signal);
+            }
+            catch (error) {
+                if (!(error instanceof IdentityReadError) || attempt >= 2)
+                    throw error;
+                // A new daemon source generation (daemon restart): drop the stale pin and read again.
+                if (error.code === 'source_generation_changed') {
+                    watch.generation = undefined;
+                    watch.position = undefined;
+                    continue;
+                }
+                // The identity committed during the read: its own wake will follow; retry briefly.
+                if (error.code !== 'source_changed')
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, 100 * (attempt + 1)));
+                if (watch.abort.signal.aborted)
+                    return undefined;
+            }
+        }
+    }
+}
+/** Contacts of one observation, minus internal identities, as metadata-only edges. */
+export function edgesFrom(observation, internal) {
+    const edges = [];
+    for (const contact of observation.contacts) {
+        const cid = norm(contact.container_id);
+        if (internal.has(cid))
+            continue;
+        const activity = observation.activity[contact.container_id];
+        const root = observation.roots[contact.container_id];
+        edges.push({
+            contactCid: cid, contactName: contact.name,
+            lastActivity: activity && 'at' in activity ? activity.at : '',
+            ...(root?.root_cid ? { rootCid: norm(root.root_cid), rootName: root.root_name, roleId: root.role_id } : {}),
+        });
+    }
+    return edges;
+}

package/dist/channels/runtime.d.ts

@@ -0,0 +1,30 @@
+import type { RoleRepository } from '../application/role-repository.js';
+import { ChannelsService } from './service.js';
+export declare const channelsPrivateDir: () => string;
+/**
+ * Build the Fleet-side Channels service over the workspace's ordinary daemon
+ * client profile: identity discovery, passive resource events and lease-free
+ * identity reads. No identity is ever bound. Returns undefined when this host
+ * has no daemon profile.
+ */
+export declare function createChannels(options: {
+    configPath: string;
+    repository: RoleRepository;
+    log?: (message: string) => void;
+}): {
+    service: ChannelsService;
+    close(): void;
+} | undefined;
+/**
+ * The files Channels source discovery reads: the manifest (Owner CID, roles), split role
+ * definitions, permanent and temporary role definitions, agent journals and room records.
+ * Conversation ledgers and other state under the role roots are not inputs.
+ */
+export declare function channelSourceInputs(configPath: string): {
+    journals: string;
+    rooms: string;
+    splitRoot: string;
+    permanentRoles: string;
+    temporaryRoles: string;
+    affects: (changed: string) => boolean;
+};

package/dist/channels/runtime.js

@@ -0,0 +1,125 @@
+import { join, relative, resolve, sep } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { attachOursClient } from '@ours.network/sdk/client';
+import { readClientProfile } from '../client-profile.js';
+import { loadConfig, splitRootFor } from '../config.js';
+import { agentsRoot, stateRoot, tmpRoot } from '../paths.js';
+import { observeFleetResources, publishFleetResourceCommit } from '../application/resource-observer.js';
+import { listRoomRecords } from '../rooms-tasks/room-state.js';
+import { privateRuntimeRoot } from '../agent-ours/service.js';
+import { createIdentityReader } from './identity-reads.js';
+import { ChannelsIndexer } from './indexer.js';
+import { ChannelsService } from './service.js';
+import { readAgentRecords, resolveSources } from './sources.js';
+import { ChannelsStore } from './store.js';
+export const channelsPrivateDir = () => join(stateRoot(), 'private-channels');
+/**
+ * Build the Fleet-side Channels service over the workspace's ordinary daemon
+ * client profile: identity discovery, passive resource events and lease-free
+ * identity reads. No identity is ever bound. Returns undefined when this host
+ * has no daemon profile.
+ */
+export function createChannels(options) {
+    let profile;
+    try {
+        profile = readClientProfile();
+    }
+    catch {
+        return undefined;
+    }
+    const log = options.log ?? (message => console.warn(message));
+    const store = new ChannelsStore(channelsPrivateDir());
+    const reader = createIdentityReader({ endpoint: profile.endpoint, credentialPath: profile.credentialPath });
+    const attach = () => attachOursClient({
+        endpoint: profile.endpoint, expectedInstanceId: profile.expectedInstanceId, credentialPath: profile.credentialPath,
+        sessionMode: 'external', leaseToken: `ours-fleet-channels-${process.pid}-${randomUUID()}`, env: {},
+    });
+    let eventsClient;
+    const events = {
+        async *resourceEvents(identity, opts) {
+            eventsClient ??= await attach();
+            yield* eventsClient.resourceEvents(identity, opts);
+        },
+    };
+    let last;
+    const discover = async () => {
+        const ownerCid = loadConfig(options.configPath).rooms?.owner.expected_cid;
+        const roleByIdentity = new Map();
+        for (const role of await options.repository.list(true))
+            if (role.config?.identity)
+                roleByIdentity.set(role.config.identity, role.id);
+        const client = await attach();
+        let identities;
+        try {
+            identities = (await client.listIdentities());
+        }
+        finally {
+            await client.close().catch(() => { });
+        }
+        const found = resolveSources({
+            ownerCid: ownerCid ?? '',
+            identities,
+            agents: readAgentRecords(privateRuntimeRoot()),
+            roleByIdentity,
+            roomCids: listRoomRecords().map(room => room.room_identity_cid).filter((cid) => typeof cid === 'string'),
+        });
+        if (!ownerCid)
+            found.internal.delete('');
+        last = found;
+        return found;
+    };
+    const indexer = new ChannelsIndexer({ store, reader, events, discover, log, onChange: () => publishFleetResourceCommit(store.path) });
+    const sync = () => { void indexer.sync().catch(error => log(`channels: sync failed: ${error.message}`)); };
+    const service = new ChannelsService({ store, reader, indexer, ownerRoot: () => last?.rootCid, ready: () => last !== undefined });
+    sync();
+    // Re-derive sources when one of their inputs commits, so new or stopped agents change
+    // perspectives without polling. Bursts coalesce. The configuration scope also tracks the
+    // manifest file itself; every wake is filtered to the actual inputs (never this index).
+    const lifetime = new AbortController();
+    const inputs = channelSourceInputs(options.configPath);
+    let pending, relevant = false;
+    observeFleetResources({
+        configPath: options.configPath, retryWatchFailures: true,
+        paths: [inputs.journals, inputs.rooms, inputs.splitRoot, inputs.permanentRoles, inputs.temporaryRoles],
+        onInvalidated: path => { if (path === undefined || inputs.affects(path))
+            relevant = true; },
+    }, () => {
+        if (!relevant || pending || lifetime.signal.aborted)
+            return;
+        relevant = false;
+        pending = setTimeout(() => { pending = undefined; sync(); }, 1_000);
+        pending.unref?.();
+    }, lifetime.signal);
+    return {
+        service,
+        close() { lifetime.abort(); if (pending)
+            clearTimeout(pending); indexer.stop(); void eventsClient?.close().catch(() => { }); store.close(); },
+    };
+}
+/**
+ * The files Channels source discovery reads: the manifest (Owner CID, roles), split role
+ * definitions, permanent and temporary role definitions, agent journals and room records.
+ * Conversation ledgers and other state under the role roots are not inputs.
+ */
+export function channelSourceInputs(configPath) {
+    const config = resolve(configPath);
+    const journals = resolve(privateRuntimeRoot()), rooms = resolve(stateRoot(), 'rooms'), splitRoot = resolve(splitRootFor(config));
+    const permanentRoles = resolve(agentsRoot()), temporaryRoles = resolve(tmpRoot());
+    const under = (path, root) => { const local = relative(root, path); return local !== '..' && !local.startsWith('..' + sep) && !local.startsWith(sep) ? local : undefined; };
+    const affects = (changed) => {
+        const path = resolve(changed);
+        if (path === config || under(path, journals) !== undefined || under(path, rooms) !== undefined || under(path, splitRoot) !== undefined)
+            return true;
+        for (const root of [permanentRoles, temporaryRoles]) {
+            const local = under(path, root);
+            if (local === undefined)
+                continue;
+            const parts = local.split(sep).filter(Boolean);
+            // The roles directory, a role directory appearing/disappearing, or its definition.
+            return parts.length <= 1 || (parts.length === 2 && parts[1] === 'role.yaml');
+        }
+        // Ancestor replacement of any input root.
+        return [config, journals, rooms, splitRoot, permanentRoles, temporaryRoles].some(root => under(root, path) !== undefined);
+    };
+    return { journals, rooms, splitRoot, permanentRoles, temporaryRoles, affects };
+}

package/dist/channels/service.d.ts

@@ -0,0 +1,61 @@
+import { type IdentityHistoryPage, type IdentityReader } from './identity-reads.js';
+import type { ChannelsIndexer } from './indexer.js';
+import type { ChannelPage, ChannelPerspective, ChannelRow, ChannelsStore } from './store.js';
+export interface ChannelsServiceDeps {
+    store: ChannelsStore;
+    reader: IdentityReader;
+    indexer: ChannelsIndexer;
+    /** Actual root CID of this workspace's Owner, when known. */
+    ownerRoot(): string | undefined;
+    /** False until the first discovery completed. */
+    ready(): boolean;
+}
+export type ChannelRowView = ChannelRow & {
+    claimsOwnerRoot: boolean;
+};
+/**
+ * Owner-facing Channels queries over the durable projection. Served only
+ * behind the Fleet web Owner session; agents get no route to it.
+ */
+export declare class ChannelsService {
+    private readonly deps;
+    constructor(deps: ChannelsServiceDeps);
+    status(): {
+        ready: boolean;
+        sources: ReturnType<ChannelsStore['sourcesSummary']>;
+    };
+    private view;
+    list(options: {
+        cursor?: string;
+        limit?: number;
+        q?: string;
+        root?: string;
+    }): ChannelPage & {
+        channels: ChannelRowView[];
+    };
+    /** The SSE snapshot: the first Recent page. */
+    snapshot(): {
+        ready: boolean;
+        channels: ChannelRowView[];
+        nextCursor: string | null;
+    };
+    get(cid: string): {
+        channel: ChannelRowView;
+        perspectives: ChannelPerspective[];
+    };
+    /**
+     * One perspective's own history with this contact; never a merged view, never consuming.
+     * Pinned to the source's CID and last observed daemon source generation; a response is
+     * released only while that same perspective is still current.
+     */
+    history(contactCid: string, sourceCid: string, page: {
+        before_seq?: number;
+        limit?: number;
+    }): Promise<IdentityHistoryPage & {
+        perspective: {
+            sourceCid: string;
+            kind: string;
+            roleId?: string;
+        };
+    }>;
+}

package/dist/channels/service.js

@@ -0,0 +1,88 @@
+import { FleetError } from '../application/errors.js';
+import { IdentityReadError } from './identity-reads.js';
+/**
+ * Owner-facing Channels queries over the durable projection. Served only
+ * behind the Fleet web Owner session; agents get no route to it.
+ */
+export class ChannelsService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    status() {
+        return { ready: this.deps.ready(), sources: this.deps.store.sourcesSummary() };
+    }
+    view(row) {
+        const root = this.deps.ownerRoot();
+        return { ...row, claimsOwnerRoot: !!root && row.claimedRoot?.rootCid === root };
+    }
+    list(options) {
+        let page;
+        try {
+            page = this.deps.store.list(options);
+        }
+        catch (error) {
+            throw new FleetError('invalid_request', error.message);
+        }
+        return { ...page, channels: page.channels.map(row => this.view(row)) };
+    }
+    /** The SSE snapshot: the first Recent page. */
+    snapshot() {
+        const page = this.deps.store.list({ limit: 50 });
+        return { ready: this.deps.ready(), channels: page.channels.map(row => this.view(row)), nextCursor: page.nextCursor };
+    }
+    get(cid) {
+        const found = this.deps.store.get(cid);
+        if (!found)
+            throw new FleetError('resource_not_found', 'no such channel');
+        return { channel: this.view(found.channel), perspectives: found.perspectives };
+    }
+    /**
+     * One perspective's own history with this contact; never a merged view, never consuming.
+     * Pinned to the source's CID and last observed daemon source generation; a response is
+     * released only while that same perspective is still current.
+     */
+    async history(contactCid, sourceCid, page) {
+        const contact = contactCid.toUpperCase(), source = sourceCid.toUpperCase();
+        const perspective = this.deps.store.hasPerspective(contact, source);
+        if (!perspective)
+            throw new FleetError('resource_not_found', 'that identity is not a perspective of this channel');
+        if (perspective.ended)
+            throw new FleetError('capability_unavailable', 'this perspective has ended; its history is no longer available');
+        let result;
+        try {
+            result = await this.deps.reader.history({
+                identity: perspective.name, expectedCid: source, peer_cid: contact,
+                ...(perspective.generation ? { expectedProducerGeneration: perspective.generation } : {}),
+                ...(page.before_seq !== undefined ? { before_seq: page.before_seq } : {}),
+                ...(page.limit !== undefined ? { limit: page.limit } : {}),
+            });
+        }
+        catch (error) {
+            if (error instanceof IdentityReadError) {
+                if (error.code === 'identity_not_found' || error.code === 'identity_mismatch') {
+                    void this.deps.indexer.sync();
+                    throw new FleetError('resource_not_found', 'this perspective is no longer available');
+                }
+                if (error.code === 'source_generation_changed') {
+                    // The daemon restarted under this perspective: re-observe it before paging again.
+                    this.deps.indexer.invalidate(source);
+                    throw new FleetError('conflict', 'the identity source changed; reload this history', { retryable: true });
+                }
+                if (error.code === 'source_changed')
+                    throw new FleetError('conflict', 'the identity changed during the read; retry', { retryable: true });
+                throw new FleetError('capability_unavailable', error.message);
+            }
+            throw error;
+        }
+        // The perspective may have ended, left or been replaced while the read was in flight.
+        const current = this.deps.store.hasPerspective(contact, source);
+        if (!current)
+            throw new FleetError('resource_not_found', 'this perspective is no longer available');
+        if (current.ended)
+            throw new FleetError('capability_unavailable', 'this perspective has ended; its history is no longer available');
+        if (current.name !== perspective.name || current.generation !== perspective.generation)
+            throw new FleetError('conflict', 'this perspective changed during the read; retry', { retryable: true });
+        return { ...result, perspective: { sourceCid: source, kind: current.kind, ...(current.roleId ? { roleId: current.roleId } : {}) } };
+    }
+}

package/dist/channels/sources.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Who Channels reads (perspective sources) and which CIDs are never channels
+ * (the internal-exclusion set). Both come from local records only: a peer's
+ * claimed root never makes it internal, because root claims are not proven.
+ */
+export interface PerspectiveSource {
+    kind: 'owner' | 'agent';
+    /** Daemon identity name. */
+    name: string;
+    cid: string;
+    /** Fleet role id for agent sources (the "Open chat with agent" target). */
+    roleId?: string;
+    /** Released/retired/removed: kept as metadata only, never read again. */
+    ended: boolean;
+}
+export interface ChannelSources {
+    ownerCid: string;
+    rootCid?: string;
+    sources: PerspectiveSource[];
+    internal: Set<string>;
+}
+export interface DaemonIdentityRow {
+    name: string;
+    cid?: string;
+    kind?: string;
+}
+export interface AgentRecord {
+    name: string;
+    cid: string;
+    phase: string;
+}
+export declare const norm: (cid: string) => string;
+/**
+ * Retained supervisor journals (`private-ours/<binder>/state.json` and archived
+ * `retired-<instance>/state.json`). They exist for stopped agents too, so a
+ * stopped agent stays a perspective source; retired generations mark ended.
+ */
+export declare function readAgentRecords(privateRoot: string): AgentRecord[];
+export declare function resolveSources(input: {
+    ownerCid: string;
+    identities: DaemonIdentityRow[];
+    agents: AgentRecord[];
+    /** Fleet role id by daemon identity name, for roles this workspace defines. */
+    roleByIdentity: Map<string, string>;
+    roomCids: string[];
+}): ChannelSources;

package/dist/channels/sources.js

@@ -0,0 +1,68 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const CID = /^[0-9a-f]{64}$/i;
+const ENDED_PHASES = new Set(['TERMINAL_INTENT', 'CLEANUP_PENDING', 'RELEASED', 'FAILED']);
+export const norm = (cid) => cid.toUpperCase();
+/**
+ * Retained supervisor journals (`private-ours/<binder>/state.json` and archived
+ * `retired-<instance>/state.json`). They exist for stopped agents too, so a
+ * stopped agent stays a perspective source; retired generations mark ended.
+ */
+export function readAgentRecords(privateRoot) {
+    if (!existsSync(privateRoot))
+        return [];
+    const records = [];
+    const read = (path, retired) => {
+        try {
+            const value = JSON.parse(readFileSync(path, 'utf8'));
+            if (typeof value.name !== 'string' || typeof value.cid !== 'string' || !CID.test(value.cid))
+                return;
+            records.push({ name: value.name, cid: norm(value.cid), phase: retired ? 'RELEASED' : String(value.phase ?? '') });
+        }
+        catch { /* missing or corrupt journal: not a source */ }
+    };
+    for (const entry of readdirSync(privateRoot, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const dir = join(privateRoot, entry.name);
+        read(join(dir, 'state.json'), false);
+        for (const child of readdirSync(dir, { withFileTypes: true })) {
+            if (child.isDirectory() && child.name.startsWith('retired-'))
+                read(join(dir, child.name, 'state.json'), true);
+        }
+    }
+    return records;
+}
+export function resolveSources(input) {
+    const ownerCid = norm(input.ownerCid);
+    const live = new Map(input.identities.filter(row => row.cid && CID.test(row.cid)).map(row => [norm(row.cid), row]));
+    const rootRow = input.identities.find(row => row.kind === 'root' && row.cid && CID.test(row.cid));
+    const rootCid = rootRow ? norm(rootRow.cid) : undefined;
+    const internal = new Set([ownerCid]);
+    if (rootCid)
+        internal.add(rootCid);
+    for (const cid of input.roomCids)
+        if (CID.test(cid))
+            internal.add(norm(cid));
+    const sources = [];
+    const ownerRow = live.get(ownerCid);
+    if (ownerRow)
+        sources.push({ kind: 'owner', name: ownerRow.name, cid: ownerCid, ended: false });
+    // One source per agent CID: a live journal wins over retired generations.
+    const byCid = new Map();
+    for (const record of input.agents) {
+        internal.add(record.cid);
+        const prior = byCid.get(record.cid);
+        if (!prior || (ENDED_PHASES.has(prior.phase) && !ENDED_PHASES.has(record.phase)))
+            byCid.set(record.cid, record);
+    }
+    for (const record of byCid.values()) {
+        const roleId = input.roleByIdentity.get(record.name);
+        if (roleId === undefined || record.cid === ownerCid)
+            continue; // not a workspace role: excluded, not a perspective
+        const row = live.get(record.cid);
+        sources.push({ kind: 'agent', name: record.name, cid: record.cid, roleId,
+            ended: ENDED_PHASES.has(record.phase) || !row || row.name !== record.name });
+    }
+    return { ownerCid, ...(rootCid ? { rootCid } : {}), sources, internal };
+}

package/dist/channels/store.d.ts

@@ -0,0 +1,103 @@
+import type { PerspectiveSource } from './sources.js';
+/** One local identity's view of one external contact. Metadata only, never bodies. */
+export interface ChannelEdge {
+    contactCid: string;
+    contactName: string;
+    lastActivity: string;
+    rootCid?: string;
+    rootName?: string;
+    roleId?: string;
+}
+export interface ChannelPerspective {
+    sourceCid: string;
+    sourceName: string;
+    kind: 'owner' | 'agent';
+    roleId?: string;
+    ended: boolean;
+    stale: boolean;
+    contactName: string;
+    lastActivity: string;
+    claimedRoot?: {
+        rootCid: string;
+        rootName: string;
+        roleId: string;
+    };
+}
+export interface ChannelRow {
+    cid: string;
+    name: string;
+    lastActivity: string;
+    /** Present only when every perspective with a claim agrees. Signed claim, not verified. */
+    claimedRoot?: {
+        rootCid: string;
+        rootName: string;
+    };
+    conflictingRootClaims: boolean;
+    perspectives: number;
+    ownerConnected: boolean;
+}
+export interface ChannelPage {
+    channels: ChannelRow[];
+    nextCursor: string | null;
+}
+/** Rows whose perspectives have all ended drop out of Recent after this long. */
+export declare const ENDED_RETENTION_MS: number;
+export declare const CHANNELS_DB = "channels.db";
+/**
+ * Durable Channels projection. Edges are keyed (source, contact) and replaced
+ * per source in one transaction; the per-contact row is recomputed from its
+ * edges, so the same external contact known to several identities is one row
+ * with several perspectives, and two contacts sharing a root stay two rows.
+ */
+export declare class ChannelsStore {
+    private readonly now;
+    private readonly db;
+    readonly path: string;
+    constructor(dir: string, now?: () => number);
+    close(): void;
+    private transaction;
+    /** Reconcile the source set: unknown sources and their edges are removed, ended ones keep metadata. */
+    setSources(sources: PerspectiveSource[]): void;
+    /** Replace one source's edges from a fresh observation at the given daemon source position. */
+    replaceEdges(sourceCid: string, edges: ChannelEdge[], observed?: {
+        producerGeneration: string;
+        position: number;
+    }): void;
+    /**
+     * Drop every edge to a now-internal identity, from every source including ended ones,
+     * whose cached edges are never re-observed. Local SQL only.
+     */
+    excludeContacts(internal: Set<string>): void;
+    markStale(sourceCid: string): void;
+    private recompute;
+    /**
+     * Keyset-paginated channel rows, newest activity first. `root` narrows to rows
+     * claiming that root; `q` matches contact name, root name or CID prefix.
+     */
+    list(options?: {
+        cursor?: string;
+        limit?: number;
+        q?: string;
+        root?: string;
+    }): ChannelPage;
+    /** One channel with every perspective; null when unknown. */
+    get(cid: string): {
+        channel: ChannelRow;
+        perspectives: ChannelPerspective[];
+    } | null;
+    /** Whether `sourceCid` is a recorded perspective of `contactCid`. */
+    hasPerspective(contactCid: string, sourceCid: string): {
+        name: string;
+        kind: string;
+        roleId?: string;
+        ended: boolean;
+        generation?: string;
+    } | null;
+    sourcesSummary(): Array<{
+        cid: string;
+        name: string;
+        kind: string;
+        ended: boolean;
+        stale: boolean;
+    }>;
+}

package/dist/channels/store.js

@@ -0,0 +1,204 @@
+import { createRequire } from 'node:module';
+import { chmodSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+/** Rows whose perspectives have all ended drop out of Recent after this long. */
+export const ENDED_RETENTION_MS = 30 * 86_400_000;
+export const CHANNELS_DB = 'channels.db';
+/**
+ * Durable Channels projection. Edges are keyed (source, contact) and replaced
+ * per source in one transaction; the per-contact row is recomputed from its
+ * edges, so the same external contact known to several identities is one row
+ * with several perspectives, and two contacts sharing a root stay two rows.
+ */
+export class ChannelsStore {
+    now;
+    db;
+    path;
+    constructor(dir, now = Date.now) {
+        this.now = now;
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        chmodSync(dir, 0o700);
+        this.path = join(dir, CHANNELS_DB);
+        this.db = new DatabaseSync(this.path);
+        chmodSync(this.path, 0o600);
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;
+      CREATE TABLE IF NOT EXISTS sources(cid TEXT PRIMARY KEY,name TEXT NOT NULL,kind TEXT NOT NULL,role_id TEXT,ended INTEGER NOT NULL DEFAULT 0,stale INTEGER NOT NULL DEFAULT 1,observed_at INTEGER);
+      CREATE TABLE IF NOT EXISTS edges(source_cid TEXT NOT NULL,contact_cid TEXT NOT NULL,contact_name TEXT NOT NULL,last_activity TEXT NOT NULL,root_cid TEXT,root_name TEXT,role_id TEXT,PRIMARY KEY(source_cid,contact_cid));
+      CREATE INDEX IF NOT EXISTS edges_contact ON edges(contact_cid);
+      CREATE TABLE IF NOT EXISTS channels(cid TEXT PRIMARY KEY,name TEXT NOT NULL,last_activity TEXT NOT NULL,root_cid TEXT,root_name TEXT,conflicting INTEGER NOT NULL,perspectives INTEGER NOT NULL,owner_connected INTEGER NOT NULL,live_perspectives INTEGER NOT NULL);
+      CREATE INDEX IF NOT EXISTS channels_recent ON channels(last_activity DESC,cid);
+      CREATE INDEX IF NOT EXISTS channels_root ON channels(root_cid,last_activity DESC,cid);`);
+        // The daemon source lifetime each source was last observed at (pins later history reads).
+        const columns = new Set(this.db.prepare('PRAGMA table_info(sources)').all().map(c => c.name));
+        if (!columns.has('generation'))
+            this.db.exec('ALTER TABLE sources ADD COLUMN generation TEXT');
+        if (!columns.has('position'))
+            this.db.exec('ALTER TABLE sources ADD COLUMN position INTEGER');
+    }
+    close() { this.db.close(); }
+    transaction(run) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = run();
+            this.db.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    /** Reconcile the source set: unknown sources and their edges are removed, ended ones keep metadata. */
+    setSources(sources) {
+        this.transaction(() => {
+            const keep = new Set(sources.map(s => s.cid));
+            const touched = new Set();
+            for (const row of this.db.prepare('SELECT cid FROM sources').all()) {
+                if (keep.has(row.cid))
+                    continue;
+                for (const edge of this.db.prepare('SELECT contact_cid FROM edges WHERE source_cid=?').all(row.cid))
+                    touched.add(edge.contact_cid);
+                this.db.prepare('DELETE FROM edges WHERE source_cid=?').run(row.cid);
+                this.db.prepare('DELETE FROM sources WHERE cid=?').run(row.cid);
+            }
+            for (const s of sources) {
+                this.db.prepare(`INSERT INTO sources(cid,name,kind,role_id,ended) VALUES(?,?,?,?,?)
+          ON CONFLICT(cid) DO UPDATE SET name=excluded.name,kind=excluded.kind,role_id=excluded.role_id,ended=excluded.ended`)
+                    .run(s.cid, s.name, s.kind, s.roleId ?? null, s.ended ? 1 : 0);
+                for (const edge of this.db.prepare('SELECT contact_cid FROM edges WHERE source_cid=?').all(s.cid))
+                    touched.add(edge.contact_cid);
+            }
+            for (const cid of touched)
+                this.recompute(cid);
+        });
+    }
+    /** Replace one source's edges from a fresh observation at the given daemon source position. */
+    replaceEdges(sourceCid, edges, observed) {
+        this.transaction(() => {
+            const touched = new Set(edges.map(e => e.contactCid));
+            for (const row of this.db.prepare('SELECT contact_cid FROM edges WHERE source_cid=?').all(sourceCid))
+                touched.add(row.contact_cid);
+            this.db.prepare('DELETE FROM edges WHERE source_cid=?').run(sourceCid);
+            const insert = this.db.prepare('INSERT INTO edges(source_cid,contact_cid,contact_name,last_activity,root_cid,root_name,role_id) VALUES(?,?,?,?,?,?,?)');
+            for (const e of edges)
+                insert.run(sourceCid, e.contactCid, e.contactName, e.lastActivity, e.rootCid ?? null, e.rootName ?? null, e.roleId ?? null);
+            this.db.prepare('UPDATE sources SET stale=0,observed_at=?,generation=?,position=? WHERE cid=?')
+                .run(this.now(), observed?.producerGeneration ?? null, observed?.position ?? null, sourceCid);
+            for (const cid of touched)
+                this.recompute(cid);
+        });
+    }
+    /**
+     * Drop every edge to a now-internal identity, from every source including ended ones,
+     * whose cached edges are never re-observed. Local SQL only.
+     */
+    excludeContacts(internal) {
+        if (!internal.size)
+            return;
+        this.transaction(() => {
+            const cids = [...internal];
+            const marks = cids.map(() => '?').join(',');
+            const touched = this.db.prepare(`SELECT DISTINCT contact_cid FROM edges WHERE contact_cid IN (${marks})`).all(...cids).map(r => r.contact_cid);
+            if (!touched.length)
+                return;
+            this.db.prepare(`DELETE FROM edges WHERE contact_cid IN (${marks})`).run(...cids);
+            for (const cid of touched)
+                this.recompute(cid);
+        });
+    }
+    markStale(sourceCid) {
+        this.db.prepare('UPDATE sources SET stale=1 WHERE cid=?').run(sourceCid);
+    }
+    recompute(contactCid) {
+        const edges = this.db.prepare(`SELECT e.*,s.kind,s.ended FROM edges e JOIN sources s ON s.cid=e.source_cid WHERE e.contact_cid=?`)
+            .all(contactCid);
+        if (!edges.length) {
+            this.db.prepare('DELETE FROM channels WHERE cid=?').run(contactCid);
+            return;
+        }
+        const newest = edges.reduce((a, b) => (b.last_activity > a.last_activity ? b : a));
+        const claims = new Map();
+        for (const e of edges)
+            if (e.root_cid)
+                claims.set(e.root_cid, e.root_name ?? '');
+        const single = claims.size === 1 ? [...claims.entries()][0] : undefined;
+        this.db.prepare(`INSERT INTO channels(cid,name,last_activity,root_cid,root_name,conflicting,perspectives,owner_connected,live_perspectives) VALUES(?,?,?,?,?,?,?,?,?)
+      ON CONFLICT(cid) DO UPDATE SET name=excluded.name,last_activity=excluded.last_activity,root_cid=excluded.root_cid,root_name=excluded.root_name,
+      conflicting=excluded.conflicting,perspectives=excluded.perspectives,owner_connected=excluded.owner_connected,live_perspectives=excluded.live_perspectives`)
+            .run(contactCid, newest.contact_name, newest.last_activity, single?.[0] ?? null, single?.[1] ?? null, claims.size > 1 ? 1 : 0, edges.length, edges.some(e => e.kind === 'owner' && !e.ended) ? 1 : 0, edges.filter(e => !e.ended).length);
+    }
+    /**
+     * Keyset-paginated channel rows, newest activity first. `root` narrows to rows
+     * claiming that root; `q` matches contact name, root name or CID prefix.
+     */
+    list(options = {}) {
+        const limit = Math.min(Math.max(Math.trunc(options.limit ?? 50), 1), 200);
+        const where = ['(live_perspectives>0 OR last_activity>=?)'];
+        const args = [new Date(this.now() - ENDED_RETENTION_MS).toISOString()];
+        if (options.root) {
+            where.push('root_cid=?');
+            args.push(options.root.toUpperCase());
+        }
+        if (options.q) {
+            const q = options.q.trim().toLowerCase();
+            where.push(`(instr(lower(name),?)>0 OR instr(lower(coalesce(root_name,'')),?)>0 OR cid LIKE ?)`);
+            args.push(q, q, `${q.toUpperCase().replace(/[%_]/g, '')}%`);
+        }
+        if (options.cursor) {
+            const [at, cid] = decodeCursor(options.cursor);
+            where.push('(last_activity<? OR (last_activity=? AND cid>?))');
+            args.push(at, at, cid);
+        }
+        const rows = this.db.prepare(`SELECT * FROM channels WHERE ${where.join(' AND ')} ORDER BY last_activity DESC,cid ASC LIMIT ?`)
+            .all(...args, limit + 1);
+        const more = rows.length > limit;
+        if (more)
+            rows.pop();
+        const last = rows.at(-1);
+        return { channels: rows.map(toRow), nextCursor: more && last ? encodeCursor(last.last_activity, last.cid) : null };
+    }
+    /** One channel with every perspective; null when unknown. */
+    get(cid) {
+        const row = this.db.prepare('SELECT * FROM channels WHERE cid=?').get(cid.toUpperCase());
+        if (!row)
+            return null;
+        const edges = this.db.prepare(`SELECT e.*,s.name AS source_name,s.kind,s.role_id AS source_role,s.ended,s.stale FROM edges e JOIN sources s ON s.cid=e.source_cid
+      WHERE e.contact_cid=? ORDER BY e.last_activity DESC,s.kind DESC`).all(row.cid);
+        return {
+            channel: toRow(row),
+            perspectives: edges.map(e => ({
+                sourceCid: e.source_cid, sourceName: e.source_name, kind: e.kind, ...(e.source_role ? { roleId: e.source_role } : {}),
+                ended: !!e.ended, stale: !!e.stale, contactName: e.contact_name, lastActivity: e.last_activity,
+                ...(e.root_cid ? { claimedRoot: { rootCid: e.root_cid, rootName: e.root_name ?? '', roleId: e.role_id ?? '' } } : {}),
+            })),
+        };
+    }
+    /** Whether `sourceCid` is a recorded perspective of `contactCid`. */
+    hasPerspective(contactCid, sourceCid) {
+        const row = this.db.prepare(`SELECT s.name,s.kind,s.role_id,s.ended,s.generation FROM edges e JOIN sources s ON s.cid=e.source_cid WHERE e.contact_cid=? AND e.source_cid=?`)
+            .get(contactCid.toUpperCase(), sourceCid.toUpperCase());
+        return row ? { name: row.name, kind: row.kind, ...(row.role_id ? { roleId: row.role_id } : {}), ended: !!row.ended, ...(row.generation ? { generation: row.generation } : {}) } : null;
+    }
+    sourcesSummary() {
+        return this.db.prepare('SELECT cid,name,kind,ended,stale FROM sources ORDER BY kind DESC,name').all()
+            .map(s => ({ cid: s.cid, name: s.name, kind: s.kind, ended: !!s.ended, stale: !!s.stale }));
+    }
+}
+function toRow(row) {
+    return {
+        cid: row.cid, name: row.name, lastActivity: row.last_activity,
+        ...(row.root_cid ? { claimedRoot: { rootCid: row.root_cid, rootName: row.root_name ?? '' } } : {}),
+        conflictingRootClaims: !!row.conflicting, perspectives: Number(row.perspectives), ownerConnected: !!row.owner_connected,
+    };
+}
+const encodeCursor = (at, cid) => Buffer.from(JSON.stringify([at, cid])).toString('base64url');
+function decodeCursor(cursor) {
+    try {
+        const value = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        if (Array.isArray(value) && value.length === 2 && value.every(v => typeof v === 'string'))
+            return value;
+    }
+    catch { /* fall through */ }
+    throw new Error('invalid channels cursor');
+}

package/dist/web/resource-views.d.ts

@@ -80,7 +80,7 @@ export declare class ResourceOutput {
 }
 export interface ResourceDescriptor {
     viewId: string;
-    resource: 'directory' | 'roles' | 'tasks' | 'task-lists' | 'configuration' | 'previews' | 'task-layout' | 'creation-action' | 'action' | 'member-addition' | 'login' | 'onboarding-health' | 'subscriptions';
+    resource: 'directory' | 'roles' | 'tasks' | 'task-lists' | 'configuration' | 'previews' | 'task-layout' | 'creation-action' | 'action' | 'member-addition' | 'login' | 'onboarding-health' | 'subscriptions' | 'channels';
     entityId?: string;
     receiptId?: string;
     provider?: 'claude' | 'codex';

package/dist/web/resource-views.js

@@ -155,7 +155,7 @@ export function canonicalResourceDescriptor(input) {
     if (!input || typeof input !== 'object' || Array.isArray(input))
         throw Error('invalid resource descriptor');
     const value = input;
-    if (!/^[A-Za-z0-9_-]{1,128}$/.test(value.viewId) || !['directory', 'roles', 'tasks', 'task-lists', 'configuration', 'previews', 'task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health', 'subscriptions'].includes(value.resource)
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(value.viewId) || !['directory', 'roles', 'tasks', 'task-lists', 'configuration', 'previews', 'task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health', 'subscriptions', 'channels'].includes(value.resource)
         || Object.keys(value).some(key => !['viewId', 'resource', 'includeTemporary', 'includeDefinitions', 'ids', 'state', 'list', 'groupByList', 'includeDeleting', 'entityId', 'receiptId', 'provider', 'activityOnly'].includes(key)))
         throw Error('invalid resource descriptor');
     if (value.activityOnly !== undefined && value.resource !== 'previews')
@@ -381,6 +381,12 @@ export class FleetResourceViews {
             || this.configurationInputs().some(input => within(resolve(input), changed));
     }
     affects(descriptor, path, structural = false) {
+        // The Channels projection commits only its own private database; no other view reads it.
+        const channelsRoot = resolve(stateRoot(), 'private-channels'), channelsPath = path === channelsRoot || path.startsWith(channelsRoot + sep);
+        if (descriptor.resource === 'channels')
+            return channelsPath || channelsRoot.startsWith(resolve(path) + sep);
+        if (channelsPath)
+            return false;
         if (descriptor.resource === 'configuration')
             return this.configurationDependency(path);
         // An explicitly selected manifest may use any pathname, including one

package/dist/web/runtime.js

@@ -1,3 +1,4 @@
+import { createChannels } from '../channels/runtime.js';
 import { ConversationRoleObserver } from '../application/conversation-role-observer.js';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { validateAccountOrigin } from '../account-origin.js';
@@ -196,6 +197,15 @@ export async function startWebConsole(options) {
     const taskRooms = new TaskRoomApplicationService(options.configPath, { binPath: () => options.binPath });
     // One-time, lock-guarded mission key migration before serving; failure leaves it to the next mutation.
     await taskRooms.prepareMissionKeys().catch(error => console.warn(`mission key migration deferred: ${error.message}`));
+    // Ours Channels runs only where a daemon client profile exists.
+    let channels;
+    try {
+        channels = createChannels({ configPath: configuration.path, repository });
+    }
+    catch (error) {
+        console.warn(`Ours Channels unavailable: ${error.message}`);
+        channels = undefined;
+    }
     let server;
     try {
         server = await buildWebServer({
@@ -219,6 +229,7 @@ export async function startWebConsole(options) {
                 });
             },
             codexModels: createCodexModelDiscovery(),
+            ...(channels ? { channels: channels.service } : {}),
             subscriptions: new SubscriptionService({
                 agents: async () => (await query.list(true)).map(({ role, status }) => ({
                     roleId: role.id, stateDir: repository.stateDir(role), running: status.supervisor.liveness === 'running',
@@ -241,6 +252,7 @@ export async function startWebConsole(options) {
         }, { origin: `http://127.0.0.1:${requestedPort}`, host: `127.0.0.1:${requestedPort}` }, { auth });
     }
     catch (error) {
+        channels?.close();
         lock.release();
         throw error;
     }
@@ -336,6 +348,7 @@ export async function startWebConsole(options) {
                 await control?.close();
                 await gateway?.close();
                 await server.close();
+                channels?.close();
             }
             finally {
                 lock.release();

package/dist/web/server.d.ts

@@ -24,6 +24,7 @@ import type { PresetProvenance } from '../application/preset-provenance.js';
 import type { OfferedModels } from '../subscriptions/cli.js';
 import type { SubscriptionService } from '../subscriptions/service.js';
 import type { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
+import type { ChannelsService } from '../channels/service.js';
 export interface WebServices {
     resourceScope?: FleetResourceScope;
     invalidateResourceCaches?(): void;
@@ -48,6 +49,8 @@ export interface WebServices {
     presetProvenance?: PresetProvenance;
     oursTools?: Pick<SupervisorOursTools, 'list' | 'call'>;
     subscriptions?: SubscriptionService;
+    /** Ours Channels: Owner-only cross-identity external contacts. Absent: not configured. */
+    channels?: ChannelsService;
     /** First-time setup from the packaged presets; the account App supplies only the model choices. */
     onboardingSetup?(answers: InitAnswers): Promise<void>;
     /** The Codex models the runtime that sessions will use offers the active account. Absent: this server cannot tell, and filters nothing. */

package/dist/web/server.js

@@ -460,6 +460,10 @@ export async function buildWebServer(services, boundary, options = {}) {
                     throw error;
                 }
             case 'subscriptions': return { providers: await subscriptions().list(true) };
+            case 'channels':
+                if (!services.channels)
+                    throw new FleetError('capability_unavailable', 'Ours Channels is not configured on this server');
+                return services.channels.snapshot();
             case 'onboarding-health': {
                 const revision = services.configuration?.read().revision;
                 if (onboardingObserved && onboardingObserved.revision !== revision)
@@ -556,6 +560,25 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     for (const resource of ['task-layout', 'creation-action', 'action', 'member-addition', 'login', 'onboarding-health'])
         app.get('/api/v1/' + resource, async () => { throw new ResourceBindingError(409, 'resource binding required'); });
+    const channels = () => { if (!services.channels)
+        throw new FleetError('capability_unavailable', 'Ours Channels is not configured on this server'); return services.channels; };
+    const channelCid = (value) => { const cid = String(value ?? ''); if (!/^[0-9A-Fa-f]{64}$/.test(cid))
+        throw new FleetError('invalid_request', 'a 64-hex container id is required'); return cid.toUpperCase(); };
+    const optionalInt = (value, name, max = Number.MAX_SAFE_INTEGER) => { if (value === undefined || value === '')
+        return undefined; const n = Number(value); if (!Number.isSafeInteger(n) || n < 1 || n > max)
+        throw new FleetError('invalid_request', `${name} must be an integer from 1 to ${max}`); return n; };
+    app.get('/api/v1/channels', async (request) => {
+        auth.authenticate(request);
+        const query = request.query;
+        return channels().list({ ...(query.cursor ? { cursor: String(query.cursor) } : {}), ...(query.q ? { q: String(query.q).slice(0, 200) } : {}), ...(query.root ? { root: channelCid(query.root) } : {}), ...(query.limit ? { limit: optionalInt(query.limit, 'limit', 200) } : {}) });
+    });
+    app.get('/api/v1/channels-status', async (request) => { auth.authenticate(request); return channels().status(); });
+    app.get('/api/v1/channels/:cid', async (request) => { auth.authenticate(request); return channels().get(channelCid(request.params.cid)); });
+    app.get('/api/v1/channels/:cid/perspectives/:source/messages', async (request) => {
+        auth.authenticate(request);
+        const before = optionalInt(request.query.before_seq, 'before_seq'), limit = optionalInt(request.query.limit, 'limit', 200);
+        return channels().history(channelCid(request.params.cid), channelCid(request.params.source), { ...(before !== undefined ? { before_seq: before } : {}), ...(limit !== undefined ? { limit } : {}) });
+    });
     app.get('/api/v1/directory', async (request) => { auth.authenticate(request); return project({ viewId: 'read', resource: 'directory' }, new AbortController().signal); });
     app.get('/api/v1/previews', async (request) => { auth.authenticate(request); const query = request.query, ids = String(query.ids ?? '').split(',').filter(Boolean); return project(canonicalResourceDescriptor({ viewId: 'read', resource: 'previews', ids, ...(query.activityOnly === 'true' ? { activityOnly: true } : {}) }), new AbortController().signal); });
     app.get('/api/v1/task-lists', async (request) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "2.3.3",
+  "version": "2.4.0-nightly.2",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, managed native/ACP sessions, supervision, and ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -49,9 +49,9 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.3.0",
     "@fastify/websocket": "^11.2.0",
-    "@ours.network/cli": "4.2.0",
-    "@ours.network/mcp": "2.0.3",
-    "@ours.network/sdk": "5.2.0",
+    "@ours.network/cli": "4.2.1-nightly.1",
+    "@ours.network/mcp": "2.1.0-nightly.1",
+    "@ours.network/sdk": "5.2.1-nightly.1",
     "commander": "^12.1.0",
     "fastify": "^5.4.0",
     "qrcode": "1.5.4",
@@ -65,7 +65,7 @@
     "@agentclientprotocol/codex-acp": "1.10.0"
   },
   "devDependencies": {
-    "@ours.network/daemon": "5.2.0",
+    "@ours.network/daemon": "5.2.1-nightly.1",
     "@types/node": "^22.20.4",
     "@types/qrcode": "^1.5.6",
     "@types/ws": "^8.18.1",