@ours.network/install 1.2.1-nightly.33 → 1.2.1-nightly.35

package/README.md

@@ -8,6 +8,19 @@ This permanent command contains no tunnel credentials or enrollment expiry. On a
 
 `--disable-fleet-agents-setup` installs the Fleet CLI and saves the choice without opening its agent/model wizard or rewriting existing Fleet configuration. Configure agents in the App after device linking. Complete presets still work unattended; partial presets require a terminal and cannot use `OURS_ASSUME_YES`.
 
+### Fleet task commands from a harness command sandbox
+
+After Fleet configuration, and again on update, the installer asks the exact Fleet it installed to run `ours-fleet managed-cli setup`. Fleet owns that policy; the installer writes no Codex rule or Claude setting itself, and the step starts no agent session and no model. It runs only when the installed Fleet declares the `managed-cli.setup-v1` capability; the Fleet release this installer pins does. With an earlier Fleet (a retained or development installation) it is skipped (and `--fleet-task-workflow` reports that it was not applied), and it never fails an installation: an unsupported combination is printed with Fleet's reason and left exactly as sandboxed as before.
+
+Nothing is prepared unless an Agent declares `managed_cli: [task-workflow]`. To opt agents in from the installer, name them:
+
+```sh
+ours-install client --config /private/profile.json --integrations codex,fleet \
+  --fleet-settings /private/fleet-settings.json --fleet-task-workflow FleetCoordinator
+```
+
+`--fleet-task-workflow` takes a comma-separated list of Fleet agent names, requires the Fleet integration and conflicts with `--disable-fleet-agents-setup`. It adds that one key to each named Agent and changes no permission. The prepared scope is the packaged Coordinator task workflow (`task create|start|finish|block|unblock|review|list|show`, `room show|members`, template/plan/help inspection) for one pinned Fleet configuration; `task start` and `task finish` provision and retire rooms and agents, which is real authority, and the installer prints that scope. The result is generated configuration only. It is not evidence that a command reached a supervisor: `ours-fleet managed-cli status` and `ours-fleet doctor` report what running agents actually observed. Fleet's `docs/validation/managed-cli-permissions.md` lists the qualified harnesses and platforms.
+
 The separate `ours-fleet setup-tunnel <encoded-v2-grant>` step is supported by the pinned Fleet release. Its private App payload remains scoped, signed-root-bound and expiring. Fleet prints its QR and private single-use connection code immediately after successful setup; scan or paste it into the App. `ours-fleet link-device` remains available for additional devices or expired codes. Do not put the expiring tunnel payload in the permanent installer command.
 
 Native packages currently provide server-only installation; full Fleet/App onboarding requires the supported gateway (Docker or Podman). The installer refuses unsupported native full-stack setup before changing anything. This flow does not add a native gateway.
@@ -624,7 +637,7 @@ Existing installation records keep their ports and identities. A listener acquir
 by another process after preflight still causes startup to fail safely; no foreign
 process is stopped and no retained installation is silently moved.
 
-Workspace setup pins Fleet `1.2.0-nightly.44` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
+Workspace setup pins Fleet `1.2.0-nightly.46` with its recorded registry integrity. This release includes first-time Fleet setup through the host API for the account App, direct App access to the workspace services with the device credential, v2 positional one-use grants and automatic QR/connection-code output from `ours-fleet setup-tunnel`, optional private file/stdin inputs for legacy v1 payloads, a separate `ours-fleet link-device` command for additional devices, host prerequisite checks before the one-time workspace proof (`setup-tunnel --check`), `setup-tunnel --resume` to finish a setup that stopped after the host saved its private pending setup record (not when the proof's answer was lost, or after the setup window expired with an unconfirmed non-default port), and persists the available Fleet loopback port used by the workspace tunnel. It also accepts a setup-generated configuration left behind after the host enrollment state was removed, runs the host Codex when it is at least as new as the packaged one, offers only the Codex models the signed-in account can use, and removes the temporary setup contact after confirmation. Fleet serves no pages and opens no browser: every screen is in the App. Fleet also serves the workspace notification routes, produces notifications through the server gateway with the imported producer credential, accepts the App's device credential on the notification presence socket so an open App receives no push, and defaults agent wakes to `monitor.interrupt: after_tool` (Hermes: no interrupt; role snapshots saved before this default keep no interrupt). Existing installation identities and configured ports remain retained; a retained-port collision fails safely.
 
 ### App tunnel setup prerelease sequencing
 
@@ -641,10 +654,17 @@ connection code automatically; the App checks readiness and opens the code field
 Private `--file`/`--stdin` transports remain optional and are the only transports
 for legacy v1 payloads with long-lived credentials.
 
-The nightly installer release manifest selects published Fleet `1.2.0-nightly.44`
+The nightly installer release manifest selects published Fleet `1.2.0-nightly.46`
 and its actual registry integrity through the normal release manifest/source-policy
 generators. This release includes v2 argument and private-input support. The former
 nightly.41 selection predates this capability. Merge and publish the repinned
 installer before deploying the App; the pin change alone is not an installer
 publication. Existing v1 private-file enrollment remains compatible. The legacy
 App wrapper refuses an older Fleet before reading or redeeming its grant.
+
+The notification gateway permits daemon-authenticated producer selection only on
+POST `/api/v1/send` and `/api/v1/delete-target`. The latter retires a removed
+conversation using the credential's fixed user/source scope. Browser inbox
+`/api/v1/delete` continues to require the user credential. The notification
+service must support the scoped lifecycle route; this change does not repin or
+publish an installer release.

package/assets/release-lock.json

@@ -13,10 +13,10 @@
         "@ours.network/codex": "1.2.0-nightly.10",
         "@ours.network/cowork": "1.3.3-nightly.20261001.6d49d3a",
         "@ours.network/daemon": "3.8.1-nightly.7",
-        "@ours.network/fleet": "1.2.0-nightly.44",
+        "@ours.network/fleet": "1.2.0-nightly.46",
         "@ours.network/mcp": "1.2.0-nightly.10",
-        "@ours.network/messenger-server": "1.0.31-nightly.14",
-        "@ours.network/notifications": "0.3.1-nightly.1",
+        "@ours.network/messenger-server": "1.0.31-nightly.15",
+        "@ours.network/notifications": "0.3.1-nightly.2",
         "@ours.network/sdk": "3.8.1-nightly.15",
         "@ours.network/tg-connector": "1.0.1-nightly.9"
       }
@@ -1001,9 +1001,9 @@
       }
     },
     "node_modules/@ours.network/fleet": {
-      "version": "1.2.0-nightly.44",
-      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.44.tgz",
-      "integrity": "sha512-kbtcb8cwqM4cIbEJyLAnG8sOxfrArtm676aex8IggYKQ+EqD487kp7IEJ3jGoVvEClJ8PE13cRolmyV9aSx7QA==",
+      "version": "1.2.0-nightly.46",
+      "resolved": "https://registry.npmjs.org/@ours.network/fleet/-/fleet-1.2.0-nightly.46.tgz",
+      "integrity": "sha512-k39gR9pKGPb6V4c2nhmfZAuHZmI9jgW+Hd1cTjDydJm7feRbnILTuEKxn5E+EUOxl/NwMIpWEJgCx99P+yQGtA==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@agentclientprotocol/sdk": "^1.3.0",
@@ -1047,9 +1047,9 @@
       }
     },
     "node_modules/@ours.network/messenger-server": {
-      "version": "1.0.31-nightly.14",
-      "resolved": "https://registry.npmjs.org/@ours.network/messenger-server/-/messenger-server-1.0.31-nightly.14.tgz",
-      "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg==",
+      "version": "1.0.31-nightly.15",
+      "resolved": "https://registry.npmjs.org/@ours.network/messenger-server/-/messenger-server-1.0.31-nightly.15.tgz",
+      "integrity": "sha512-NEpPsn3x4ZxYjhTo3c8JSYPKgfkhZ/W9s0u5Bd6OALWj40qc5ethui1uHfpw5Cu3+XHJz28WPh5e4RbjUMCmXQ==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "@eslint-community/regexpp": "4.12.2",
@@ -1066,9 +1066,9 @@
       }
     },
     "node_modules/@ours.network/notifications": {
-      "version": "0.3.1-nightly.1",
-      "resolved": "https://registry.npmjs.org/@ours.network/notifications/-/notifications-0.3.1-nightly.1.tgz",
-      "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA==",
+      "version": "0.3.1-nightly.2",
+      "resolved": "https://registry.npmjs.org/@ours.network/notifications/-/notifications-0.3.1-nightly.2.tgz",
+      "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A==",
       "license": "FSL-1.1-Apache-2.0",
       "dependencies": {
         "web-push": "3.6.7",

package/assets/release.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "channel": "nightly",
-  "installerVersion": "1.2.1-nightly.33",
+  "installerVersion": "1.2.1-nightly.35",
   "packages": {
     "@ours.network/sdk": {
       "version": "3.8.1-nightly.15",
@@ -20,16 +20,16 @@
       "integrity": "sha512-tqoLOWc4O8CGwLdO1j6ukm6Vn57EE0zbuxKo4BWd0QVwu9ObKgHCEMOKPgW2mXHeESXSv9m7edcIrnK8I5gD+w=="
     },
     "@ours.network/messenger-server": {
-      "version": "1.0.31-nightly.14",
-      "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
+      "version": "1.0.31-nightly.15",
+      "integrity": "sha512-NEpPsn3x4ZxYjhTo3c8JSYPKgfkhZ/W9s0u5Bd6OALWj40qc5ethui1uHfpw5Cu3+XHJz28WPh5e4RbjUMCmXQ=="
     },
     "@ours.network/notifications": {
-      "version": "0.3.1-nightly.1",
-      "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA=="
+      "version": "0.3.1-nightly.2",
+      "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
     },
     "@ours.network/fleet": {
-      "version": "1.2.0-nightly.44",
-      "integrity": "sha512-kbtcb8cwqM4cIbEJyLAnG8sOxfrArtm676aex8IggYKQ+EqD487kp7IEJ3jGoVvEClJ8PE13cRolmyV9aSx7QA=="
+      "version": "1.2.0-nightly.46",
+      "integrity": "sha512-k39gR9pKGPb6V4c2nhmfZAuHZmI9jgW+Hd1cTjDydJm7feRbnILTuEKxn5E+EUOxl/NwMIpWEJgCx99P+yQGtA=="
     },
     "@ours.network/mcp": {
       "version": "1.2.0-nightly.10",

package/assets/scripts/runtime/notifications-gateway.mjs

@@ -21,7 +21,7 @@ export function daemonCredentialCheck(daemonUrl) {
 /**
  * Front the notification service with the server's own authentication.
  * A request carrying a server API credential is checked with the daemon; only then
- * does it act as this installation's owner (or, for /api/v1/send, as the named
+ * does it act as this installation's owner (or, for producer lifecycle routes, as the named
  * producer). A request without one keeps its own Authorization, which the service
  * checks against its scoped tokens. Nothing is injected for an unauthenticated caller.
  */
@@ -33,7 +33,7 @@ export function createNotificationsAdapter({ service, userToken, verifyServerCre
     if (credential === undefined) return producer === undefined;
     if (typeof credential !== 'string' || !credential || !await verifyServerCredential(credential)) return false;
     const path = new URL(req.url ?? '/', 'http://localhost').pathname;
-    if (producer !== undefined && !(req.method === 'POST' && path === '/api/v1/send')) return false;
+    if (producer !== undefined && !(req.method === 'POST' && ['/api/v1/send', '/api/v1/delete-target'].includes(path))) return false;
     req.headers.authorization = `Bearer ${producer ?? userToken}`;
     return true;
   };

package/assets/sources.json

@@ -2,7 +2,7 @@
   "release": {
     "schema": 1,
     "channel": "nightly",
-    "installerVersion": "1.2.1-nightly.33",
+    "installerVersion": "1.2.1-nightly.35",
     "packages": {
       "@ours.network/sdk": {
         "version": "3.8.1-nightly.15",
@@ -21,16 +21,16 @@
         "integrity": "sha512-tqoLOWc4O8CGwLdO1j6ukm6Vn57EE0zbuxKo4BWd0QVwu9ObKgHCEMOKPgW2mXHeESXSv9m7edcIrnK8I5gD+w=="
       },
       "@ours.network/messenger-server": {
-        "version": "1.0.31-nightly.14",
-        "integrity": "sha512-0lMoIadihMQqN0sdW20DF4a94Nc6bx0lnaCckSnn5VqOmvqELNdG3kRZ1Heh9VwkPEu6qNM27AR7tWpTbzvJCg=="
+        "version": "1.0.31-nightly.15",
+        "integrity": "sha512-NEpPsn3x4ZxYjhTo3c8JSYPKgfkhZ/W9s0u5Bd6OALWj40qc5ethui1uHfpw5Cu3+XHJz28WPh5e4RbjUMCmXQ=="
       },
       "@ours.network/notifications": {
-        "version": "0.3.1-nightly.1",
-        "integrity": "sha512-rIkrtixoHqBfgCKDDCEYFl4W2Zzh0hOw3axX2+GppQ9gYkujKrk9M2KLGoYhu8RwwTMRl497jgMcTBe7UAHCgA=="
+        "version": "0.3.1-nightly.2",
+        "integrity": "sha512-OjnrJ8ZuOfKYT4KAmiRLU7czfiuacs6rShwOvvqxqBaUKcs1UwjsYwHARNb6erMxG4am3xxcE0ItahL+d2vt4A=="
       },
       "@ours.network/fleet": {
-        "version": "1.2.0-nightly.44",
-        "integrity": "sha512-kbtcb8cwqM4cIbEJyLAnG8sOxfrArtm676aex8IggYKQ+EqD487kp7IEJ3jGoVvEClJ8PE13cRolmyV9aSx7QA=="
+        "version": "1.2.0-nightly.46",
+        "integrity": "sha512-k39gR9pKGPb6V4c2nhmfZAuHZmI9jgW+Hd1cTjDydJm7feRbnILTuEKxn5E+EUOxl/NwMIpWEJgCx99P+yQGtA=="
       },
       "@ours.network/mcp": {
         "version": "1.2.0-nightly.10",
@@ -79,15 +79,15 @@
     },
     "@ours.network/messenger-server": {
       "type": "npm",
-      "version": "1.0.31-nightly.14"
+      "version": "1.0.31-nightly.15"
     },
     "@ours.network/notifications": {
       "type": "npm",
-      "version": "0.3.1-nightly.1"
+      "version": "0.3.1-nightly.2"
     },
     "@ours.network/fleet": {
       "type": "npm",
-      "version": "1.2.0-nightly.44"
+      "version": "1.2.0-nightly.46"
     },
     "@ours.network/mcp": {
       "type": "npm",

package/lib/effects.mjs

@@ -1436,6 +1436,13 @@ export function networkEffects(effects) {
       const localPackages = Object.fromEntries(integrations.filter(n => n !== 'fleet').map(name => [name, join(root, 'node_modules', '@ours.network', name)]));
       return { localPackages, packages: {}, cliBin, fleetBin: integrations.includes('fleet') ? join(root, 'node_modules/.bin/ours-fleet') : null };
     },
+    /** Capability tokens the given Fleet executable reports for itself; [] when it reports none. */
+    async fleetCapabilities(fleetBin, env = null) {
+      try {
+        const capabilities = JSON.parse((await effects.run(fleetBin, ['version', '--json'], { env })).stdout).capabilities;
+        return Array.isArray(capabilities) ? capabilities.filter(item => typeof item === 'string') : [];
+      } catch { return []; }
+    },
     async prepareClientMarketplace(name, packagePath) {
       const acquisitionRoot = dirname(dirname(dirname(packagePath)));
       const sourcePath = join(acquisitionRoot, 'sources.json');

package/lib/orchestrate.mjs

@@ -993,6 +993,58 @@ export async function runHarnessPhase(args, effects, { target, isDefaultStateDir
   return rows;
 }
 
+export const FLEET_MANAGED_CLI_CAPABILITY = 'managed-cli.setup-v1';
+
+/**
+ * Ask the Fleet release that was just installed to prepare and validate its own
+ * managed CLI policy. Fleet owns the commands, paths and harness rules; nothing
+ * about them is duplicated here. The command is static: it starts no agent
+ * session and no model. Its findings are reported, never turned into an
+ * installation failure, and never widened on the operator's behalf.
+ */
+export async function runFleetManagedCliSetup(args, effects, plan, target) {
+  const fleet = args.acquiredFleet || plan.init[0];
+  const env = target.mode === 'host-profile' ? profileEnv(target) : daemonEnv(target.stateDir, target.port);
+  const requested = args.fleetTaskWorkflowAgents ?? [];
+  const manual = `${fleet === plan.init[0] ? fleet : shellQuote(fleet)} managed-cli setup --configuration ${shellQuote(plan.configPath)}`;
+  // Version-matched: the capability is asked of the exact Fleet that was installed.
+  const capabilities = await effects.fleetCapabilities(fleet, env);
+  if (!capabilities.includes(FLEET_MANAGED_CLI_CAPABILITY)) {
+    if (requested.length) effects.out(warn(`The installed Fleet does not provide managed CLI setup (${FLEET_MANAGED_CLI_CAPABILITY}); --fleet-task-workflow was not applied to ${requested.join(', ')} and nothing was changed.`));
+    return { state: 'unavailable' };
+  }
+  let report;
+  try {
+    const result = await effects.run(fleet, ['managed-cli', 'setup', '--configuration', plan.configPath, '--json',
+      ...requested.flatMap(agent => ['--enable', agent])], { env, allowCodes: [0, 1] });
+    report = JSON.parse(result.stdout ?? '');
+    if (report?.version !== 1 || !Array.isArray(report.roles)) throw new Error('unrecognised report');
+  } catch (error) {
+    effects.out(warn(`Fleet managed CLI setup did not complete (${installerFailure(error)}). Nothing else was changed; retry: ${manual}`));
+    return { state: 'failed' };
+  }
+  for (const item of report.enabled ?? [])
+    effects.out(ok(`${item.changed ? 'Enabled' : 'Already enabled:'} Fleet task commands for ${item.agent} (${item.file}). Its permissions were not changed.`));
+  const declared = report.roles.filter(role => role.setup?.state !== 'not-declared');
+  if (!declared.length) {
+    effects.out(info('No Fleet agent is set up to run Fleet task commands from a command sandbox; nothing was generated and no permission changed.'));
+    effects.out(info(`To allow it for one agent, re-run with --fleet-task-workflow <Agent> or run: ${manual} --enable <Agent>`));
+    return { state: 'none', report };
+  }
+  const good = ['prepared', 'generated-at-launch', 'not-required'];
+  for (const role of declared) {
+    const line = `${role.role} (${role.harness}/${role.session}): ${role.setup.state} — ${role.setup.detail}`;
+    effects.out((good.includes(role.setup.state) ? ok : warn)(`Fleet task commands, ${line}`));
+    for (const scope of role.scope ?? []) effects.out(info(`  ${scope}`));
+    for (const note of role.warnings ?? []) effects.out(info(`  note: ${note}`));
+    if (role.session_policy === 'restart-required')
+      effects.out(warn(`  ${role.role} is still running the previous policy; restart it (ours-fleet restart ${role.role}) to load this one.`));
+  }
+  for (const item of report.removed ?? []) effects.out(info(`Removed obsolete Fleet-generated policy ${item.path} (${item.detail ?? 'no longer needed'}).`));
+  effects.out(info('This is generated configuration only. It was not executed: no agent session or model was started, and it is not evidence that a command reached a supervisor. Check with: ours-fleet doctor'));
+  return { state: declared.every(role => good.includes(role.setup.state)) ? 'prepared' : 'attention', report };
+}
+
 /** Install Fleet and let its interactive wizard publish the owned configuration. */
 export async function runFleetPhase(args, effects, { target, isDefaultStateDir }) {
   effects.out(heading('ours-fleet (your always-online agent team)'));
@@ -1012,6 +1064,8 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
   if (args.disableFleetAgentsSetup) {
     if (!install.ok) return { key: 'fleet', label: plan.label, state: 'failed', note: 'Fleet installation failed' };
     effects.out(ok('Fleet CLI installed; agent and model setup deferred to the App. Existing Fleet configuration was retained.'));
+    // A retained configuration may already declare the workflow; its generated policy names the package path this run just replaced.
+    if (!args.dryRun && effects.readText(plan.configPath) !== null) await runFleetManagedCliSetup(args, effects, plan, target);
     return { key: 'fleet', label: plan.label, state: 'installed', note: 'agents setup deferred' };
   }
   // Fleet owns its v2 manifest, roles, models and permissions. With no prepared
@@ -1037,6 +1091,7 @@ export async function runFleetPhase(args, effects, { target, isDefaultStateDir }
     return { key: 'fleet', label: plan.label, state: 'failed', note: 'Fleet configuration was not published' };
   }
   effects.out(ok('ours-fleet installed and initialized; no fleet roles were started.'));
+  if (!args.dryRun) await runFleetManagedCliSetup(args, effects, plan, target);
   if (plan.instruction) effects.out(info(plan.instruction));
   return { key: 'fleet', label: plan.label, state: 'installed', note: `configured at ${plan.configPath}; stopped` };
 }
@@ -1517,7 +1572,8 @@ export async function runClientCommand(command, effects) {
     phase = 'Acquire client packages';
     const exactSuite = await effects.acquireClientPackages(imported.configPath, imported.settings.sourcesPath, integrations, { refresh: !!command.preset });
     const args = { assumeYes: true, dryRun: false, channel: 'latest', clientIntegrations: integrations,
-      acquiredFleet: exactSuite.fleetBin, fleetSettingsPath: imported.settings.fleetSettingsPath, disableFleetAgentsSetup: imported.settings.disableFleetAgentsSetup };
+      acquiredFleet: exactSuite.fleetBin, fleetSettingsPath: imported.settings.fleetSettingsPath, disableFleetAgentsSetup: imported.settings.disableFleetAgentsSetup,
+      fleetTaskWorkflowAgents: command.fleetTaskWorkflowAgents };
     const target = { mode: 'host-profile', managed: true, configPath: imported.configPath, profile: imported.profile, endpoint: imported.profile.endpoint };
     effects.out(progress(2, 4, 'Client integrations', 'Register the selected agent integrations.'));
     phase = 'Register client integrations';

package/lib/setup-options.mjs

@@ -7,7 +7,7 @@ const integrations = ['codex', 'claude-code', 'fleet'];
 const valueFlags = new Map(Object.entries({
   '--container-engine': 'containerEngine', '--server-url': 'serverUrl', '--scope': 'scope', '--action': 'operation', '--mode': 'mode', '--state-dir': 'stateDir',
   '--username': 'localUsername', '--name': 'name', '--surname': 'surname', '--hostname': 'hostname',
-  '--identity-name': 'identityName', '--integrations': 'integrations', '--fleet-settings': 'fleetSettingsPath',
+  '--identity-name': 'identityName', '--integrations': 'integrations', '--fleet-settings': 'fleetSettingsPath', '--fleet-task-workflow': 'fleetTaskWorkflowAgents',
   '--config': 'config', '--sources': 'sources', '--migrate-from': 'migrateFrom', '--port': 'port', '--cowork-port': 'coworkPort', '--messenger-port': 'messengerPort',
 }));
 const boolFlags = new Map([['--compatible', 'compatible'], ['--dry-run', 'dryRun'], ['--migrate', 'migrate'], ['--disable-fleet-agents-setup', 'disableFleetAgentsSetup']]);
@@ -54,6 +54,15 @@ export function validateSetupOptions(input, { interactive = input?.interactive =
   } else if (options.hostname !== undefined) throw new Error('--hostname requires username, name and surname');
   if (options.disableFleetAgentsSetup !== undefined && typeof options.disableFleetAgentsSetup !== 'boolean') throw new Error('disableFleetAgentsSetup must be a boolean');
   if (options.disableFleetAgentsSetup && options.fleetSettingsPath) throw new Error('--disable-fleet-agents-setup conflicts with --fleet-settings');
+  if (options.fleetTaskWorkflowAgents !== undefined) {
+    // Fleet owns what the workflow is; the installer only carries which agents the operator named.
+    const agents = options.fleetTaskWorkflowAgents;
+    if (!Array.isArray(agents) || !agents.length || agents.some(name => typeof name !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name)) || new Set(agents).size !== agents.length)
+      throw new Error('--fleet-task-workflow requires unique Fleet agent names separated by commas');
+    if (!options.integrations?.includes?.('fleet')) throw new Error('--fleet-task-workflow requires the fleet integration');
+    if (options.disableFleetAgentsSetup) throw new Error('--fleet-task-workflow conflicts with --disable-fleet-agents-setup: no agents are configured by this run');
+    options.fleetTaskWorkflowAgents = [...agents];
+  }
   const missing = [];
   if (server) for (const [key, flag] of [['mode', '--mode'], ['stateDir', '--state-dir'], ...(options.migrateFrom === undefined ? [['identityName', '--identity-name']] : [])]) if (!nonempty(options[key])) missing.push(flag);
   if (client && options.integrations === undefined) missing.push('--integrations (use none to skip)');
@@ -135,6 +144,7 @@ export function parseSetupArgs(argv, { home, validate = true } = {}) {
     if (!nonempty(value) || value.startsWith('--')) throw new Error(`${flag} requires a value`);
     const key = valueFlags.get(flag);
     if (key === 'integrations') put(key, value === 'none' ? [] : value.split(',').map(item => item.trim()));
+    else if (key === 'fleetTaskWorkflowAgents') put(key, value.split(',').map(item => item.trim()));
     else if (Object.hasOwn(defaults, key)) {
       if (!/^[1-9]\d*$/.test(value)) throw new Error(`${flag} requires an integer port`);
       put(key, Number(value)); options.explicitPorts.push(key);

package/lib/setup.mjs

@@ -136,7 +136,8 @@ export async function executeSetupPlan(plan, effects, { server = runServerComman
   if (plan.scope !== 'server') {
     const result = await client({ role: 'client', operation: 'install', config: clientConfig,
       integrations: plan.integrations, fleetSettingsPath: plan.fleetSettingsPath, sourcePolicy: clientPolicy,
-      disableFleetAgentsSetup: plan.disableFleetAgentsSetup, preset: true, nonInteractive: !plan.interactive }, effects);
+      disableFleetAgentsSetup: plan.disableFleetAgentsSetup, fleetTaskWorkflowAgents: plan.fleetTaskWorkflowAgents,
+      preset: true, nonInteractive: !plan.interactive }, effects);
     if (result !== 0) return result;
   }
   if (plan.disableFleetAgentsSetup && plan.integrations?.includes('fleet')) effects.out(info('Fleet is installed. Run ours-fleet setup-tunnel with the expiring one-use payload from the App command; a compatible Fleet prints the QR and connection code automatically. Configure agents and models in the App after linking.'));

package/lib/usage.mjs

@@ -37,6 +37,7 @@ export const USAGE = `ours-install — interactive setup with optional CLI prese
   --identity-name NAME      desired Human name for a fresh server; existing root is retained
   --integrations LIST       codex,claude-code,fleet; use none to skip clients explicitly
   --fleet-settings PATH     JSON settings for Fleet; required unless Fleet agents setup is disabled
+  --fleet-task-workflow A[,B]  let these Fleet agents run Fleet task commands outside their command sandbox
   --config PATH             complete connection profile for client-only setup
   --sources PATH            explicit full development source policy override
   --port N                  public gateway port for Docker (default 3050; e.g. 4050)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/install",
-  "version": "1.2.1-nightly.33",
+  "version": "1.2.1-nightly.35",
   "private": false,
   "description": "The all-in-one ours.network installer: one shared daemon, MCP, cowork, Telegram, Fleet initialization, harness plugins, Human identity, progress UI, and guided next steps.",
   "type": "module",