@mmerterden/multi-agent-pipeline 20.30.0 → 20.33.0

package/pipeline/scripts/contract-server.mjs

@@ -20,13 +20,19 @@
  *   GET  /v1/issues          issues.mjs --json [--source S] [--project K]... [--max N]
  *   GET  /v1/worktrees       worktrees.mjs --json [--measure] [--redact]
  *   GET  /v1/launch-spec     launch-request.mjs spec
- *   GET  /v1/repos           launch-request.mjs repos [--redact]
+ *   GET  /v1/repos           launch-request.mjs repos [--redact]; ?all=1 adds
+ *                            the suggested and the missing registered ones
+ *   POST /v1/repos           launch-request.mjs register-repo (two steps)
+ *   DELETE /v1/repos/{id}    remove a registered repository (two steps)
  *   POST /v1/launch?repo=P   write a launch request, return launch-request.mjs plan
  *   POST /v1/runs/{id}/answer  answer-question.mjs --question Q --answer IDS
  *   GET  /v1/runs/{id}/log     run-log.mjs {id} --tail N
  *   POST /v1/runs/{id}/resume  launch-request.mjs resume: the plan that resumes it
  *   POST /v1/runs/{id}/kill    run-kill.mjs preview, then apply (two steps)
  *   POST /v1/gc                gc-plan.mjs preview, then apply (two steps)
+ *   POST /v1/prune-logs        office-prune.mjs preview, then apply the listed folders (two steps)
+ *   GET  /v1/settings          office-settings.mjs --json
+ *   POST /v1/settings          office-settings.mjs set S V, after a preview (two steps)
  *   GET  /v1/autopilot         autopilot-control.mjs status
  *   POST /v1/autopilot/off     autopilot-control.mjs off [--now]
  *   POST /v1/autopilot/on      autopilot-control.mjs on-preview, then on (two steps)
@@ -35,6 +41,9 @@
  *   GET  /v1/activity/stream   the same document as server-sent events, on change
  *   GET  /v1/agents/{sessionId}/{agentId}/chat   activity-snapshot.mjs chat
  *   GET  /v1/ledger            office-ledger.mjs --json
+ *   GET  /v1/system            system-status.mjs --json
+ *   GET  /v1/credentials       office-credentials.mjs --json [--probe]
+ *   GET  /v1/memory            office-memory.mjs --json
  *   GET  /v1/runs/{id}/results run-results.mjs: diff, findings, tests, evidence, analysis
  *   GET  /v1/runs/{id}/evidence/{name}  run-results.mjs --evidence: one screenshot
  *   POST /v1/runs/{id}/review-verdict   work-items.mjs verdict, then --post (two steps)
@@ -48,6 +57,8 @@
  *   DELETE /v1/routines/{name} routine-registry.mjs remove (two steps)
  *   GET  /v1/stack?repo=R      stack-toggle.mjs status
  *   POST /v1/stack             stack-toggle.mjs set (two steps)
+ *   GET  /v1/jobs              job-launch.mjs list: the jobs the office can start
+ *   POST /v1/jobs              start one in the background (two steps)
  *
  * Every route carries two tags for a remote carrier to enforce later, and
  * manifest.json repeats them: `remote` is the scope it would need (read,
@@ -60,7 +71,8 @@
  * prefs.global.office.page, else the installed copy (office/index.html next
  * to this scripts directory), and is 404 when none exists. The page carries
  * no token: it trades a one-time code from its URL fragment for one. It and
- * its sprites under /office/assets/ are the only routes that need none, and
+ * its sprites under /office/assets/ are the only routes that need none (with
+ * /favicon.ico, an empty 204, because a browser asks for it on its own), and
  * its response carries a per-response CSP nonce for its inline script and
  * style.
  *
@@ -72,12 +84,16 @@
  *   POST /v1/phone/runs/{id}/answer  scope answer
  *   POST /v1/phone/launch?repo=P     scope launch, and only after `phone-devices.mjs launch on`
  *
- * There is deliberately no route that merges, marks ready, runs a command or
- * starts a host. POST /v1/launch and POST /v1/runs/{id}/resume return the argv
- * and environment launch.json declares; the client starts the process, and
- * nothing here starts a session. The only `claude` this process runs is
- * `claude agents --json` (read, for processAlive) and `claude stop <session>`,
- * for a kill or `autopilot/off` with now.
+ * There is deliberately no route that merges, marks ready, runs a shell
+ * command or takes a prompt. POST /v1/launch and POST /v1/runs/{id}/resume
+ * return the argv and environment launch.json declares for a client to start.
+ * POST /v1/jobs is the one route that starts a session itself, for the office:
+ * a job from schemas/office-jobs.json with typed arguments, two requests, the
+ * unattended profile, workspace trust and the autopilot runner's sandbox check
+ * first, then `claude --bg` without a shell (lib/bg-launch.mjs), never from a
+ * phone. Besides that the only `claude` this process runs is `claude agents
+ * --json` (read, for processAlive) and `claude stop <session>`, for a kill or
+ * `autopilot/off` with now.
  *
  * Kill, gc, autopilot on, stack and routine removal change what this machine
  * keeps or runs, so each takes two requests. The first returns a
@@ -124,16 +140,20 @@
  * body or a token) to ~/.claude/logs/multi-agent/office-actions.jsonl.
  *
  * Lifetime. The server exits after --idle-minutes without a request (15 by
- * default), after --max-hours however busy it is (8 by default; an open event
- * stream does not extend it), and on SIGTERM, SIGINT or SIGHUP, removing its
- * token file either way.
+ * default, 0 never), after --max-hours however busy it is (8 by default, 0 no
+ * limit; an open event stream does not extend it), and on SIGTERM, SIGINT or
+ * SIGHUP, removing its token file either way. office-on starts it with both at
+ * 0, so the panel runs until office-off.
  *
  * Panel bootstrap. `POST /office/code` (bearer, no Origin) mints a code that
  * is valid for 10 seconds and one use; office-control.mjs opens the browser
  * with it in the URL fragment. The page trades it for the token with
  * `POST /office/exchange` (no bearer, own Origin only); a second use, an
  * expired code or an unknown one is 401. The token itself never appears in a
- * URL. It is started on demand by `/multi-agent:serve` or by a client, and is
+ * URL. `GET /office/version` gives the installed page's build id and whether
+ * this server's code changed on disk since it started; `POST /office/reload`
+ * mints a fresh code for the page itself, so it can reload onto a newly
+ * installed page. It is started on demand by `/multi-agent:serve` or by a client, and is
  * never installed as a service.
  *
  * Zero runtime dependencies (ADR-0004): node:http, node:crypto and the
@@ -164,7 +184,7 @@ import {
 } from "node:fs";
 import { createServer } from "node:http";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { clearInterval, clearTimeout, setInterval, setTimeout } from "node:timers";
 import { answerStateFile } from "./answer-question.mjs";
@@ -185,6 +205,17 @@ import {
 } from "./stack-toggle.mjs";
 import { CONTRACT_VERSION as STEER_VERSION, SteerError, queueSteer } from "./steer-run.mjs";
 import { officeLedger } from "./office-ledger.mjs";
+import { systemStatus } from "./system-status.mjs";
+import { officeCredentials } from "./office-credentials.mjs";
+import { officeMemory } from "./office-memory.mjs";
+import { AGES as PRUNE_AGES, pruneApply, prunePreview } from "./office-prune.mjs";
+import {
+  CHOICES,
+  SettingsError,
+  applySetting,
+  freeChainOf,
+  readSettings,
+} from "./office-settings.mjs";
 import { EVIDENCE_NAME, ResultsError, runEvidence, runResults } from "./run-results.mjs";
 import {
   WorkError,
@@ -195,6 +226,7 @@ import {
 } from "./work-items.mjs";
 import {
   CONTRACT_VERSION as TOOLS_VERSION,
+  activeToolkitVersion,
   TOOL_NAME,
   ToolError,
   createToolkitClient,
@@ -224,12 +256,26 @@ import {
   planLaunch,
   planResume,
   questionsDocument,
+  registerRepo,
   reposDocument,
+  repoId,
   requestsDir,
+  suggestedRepos,
+  unregisterRepo,
+  missingRepos,
   workingTreeState,
   writeRequestFile,
 } from "./launch-request.mjs";
 import { GROUP_NAMES, envelope, selectRuns } from "./runs-index.mjs";
+import {
+  CONTRACT_VERSION as JOBS_VERSION,
+  JobError,
+  jobsDocument,
+  previewJob,
+  startJob,
+} from "./job-launch.mjs";
+import { guardRegistration, sandboxPrecondition } from "./autopilot-runner.mjs";
+import { codeDigest } from "../lib/code-digest.mjs";
 import { CONTRACT_VERSION as KILL_VERSION, KillError, killPreview, killRun } from "./run-kill.mjs";
 import {
   CONTRACT_VERSION as LOG_VERSION,
@@ -259,7 +305,7 @@ import { runMain } from "../lib/fatal.mjs";
 import { invokedDirectly } from "../lib/invoked-directly.mjs";
 
 /** The contract as a whole; pipeline/contract/manifest.json carries the same. */
-export const CONTRACT_VERSION = "1.4.0";
+export const CONTRACT_VERSION = "1.6.0";
 /** The majors `?v=` accepts. A new major keeps the previous one here for one minor. */
 export const SUPPORTED_MAJORS = [1];
 export const BIND_HOST = "127.0.0.1";
@@ -290,6 +336,7 @@ const SESSION_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 const AGENT_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const ROUTINE_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
 const REPO_NAME = /^[A-Za-z0-9._-]{1,100}(?:\/[A-Za-z0-9._-]{1,100})?$/;
+const REPO_ID = /^[0-9a-f]{16}$/;
 /** Server-sent event streams open at once; one more is refused. */
 export const MAX_STREAMS = 4;
 const STREAM_POLL_MS = 2000;
@@ -344,6 +391,7 @@ const Q = {
   redact: { check: (v) => v === "0" || v === "1" },
   group: { check: (v) => GROUP_NAMES.includes(v) },
   measure: { check: (v) => v === "0" || v === "1" },
+  all: { check: (v) => v === "0" || v === "1" },
   source: { check: (v) => ["jira", "github", "all"].includes(v) },
   project: { repeat: true, check: (v) => PROJECT_KEY.test(v) },
   max: { check: (v) => /^[0-9]{1,3}$/.test(v) && Number(v) >= 1 && Number(v) <= 200 },
@@ -716,6 +764,87 @@ async function killRoute({ params, body, redact }) {
   }
 }
 
+/**
+ * POST /v1/prune-logs: what prune-logs.sh would remove for an age, and a token
+ * bound to that age and folder list; then a prune of exactly that list
+ * (pruneApply), refused with 409 changed when the folders moved. The age is
+ * one of a fixed set.
+ */
+async function pruneRoute({ body }) {
+  requireBody(
+    body,
+    { confirmToken: isToken, olderThanDays: (v) => PRUNE_AGES.includes(v) },
+    "prune-logs-request.schema.json",
+  );
+  if (body.confirmToken === undefined) {
+    if (body.olderThanDays === undefined)
+      throw new HttpError(400, "invalid-body", "olderThanDays is required for the preview");
+    const { all, ...doc } = await prunePreview(body.olderThanDays, process.env, {
+      keepAll: true,
+    });
+    return {
+      ...doc,
+      ...mintConfirm("prune-logs", "", { days: body.olderThanDays, all, count: doc.count }),
+    };
+  }
+  if (body.olderThanDays !== undefined)
+    throw new HttpError(
+      400,
+      "invalid-body",
+      "olderThanDays belongs to the preview, not the confirmation",
+    );
+  const { days, all, count } = redeemConfirm(body.confirmToken, "prune-logs", "");
+  try {
+    return await pruneApply(days, process.env, { all, count });
+  } catch (e) {
+    if (e.code === "changed") throw new HttpError(409, "changed", e.message);
+    throw e;
+  }
+}
+
+/**
+ * POST /v1/settings: the change a setting would make and a token, then the
+ * same script the terminal command runs. The token is bound to that setting
+ * and value.
+ */
+async function settingsRoute({ body }) {
+  requireBody(
+    body,
+    {
+      confirmToken: isToken,
+      setting: (v) => Object.hasOwn(CHOICES, v),
+      value: (v) => typeof v === "string",
+    },
+    "office-settings-request.schema.json",
+  );
+  if (body.confirmToken === undefined) {
+    if (!body.setting || !CHOICES[body.setting].includes(body.value))
+      throw new HttpError(400, "invalid-body", "setting and one of its values are required");
+    const now = readSettings();
+    return {
+      ...now,
+      change: {
+        setting: body.setting,
+        from: now[body.setting],
+        to: body.value,
+        ...(body.setting === "route" && body.value === "on" && freeChainOf()
+          ? { freeChain: freeChainOf() }
+          : {}),
+      },
+      ...mintConfirm("settings", "", { setting: body.setting, value: body.value }),
+    };
+  }
+  if (body.setting !== undefined || body.value !== undefined)
+    throw new HttpError(400, "invalid-body", "the confirmation carries only its token");
+  const { setting, value } = redeemConfirm(body.confirmToken, "settings", "");
+  try {
+    return await applySetting(setting, value);
+  } catch (e) {
+    if (e instanceof SettingsError) throw new HttpError(409, "not-applied", e.message);
+    throw e;
+  }
+}
+
 function gcRoute({ body, redact }) {
   requireBody(
     body,
@@ -775,6 +904,24 @@ async function control(args) {
   return doc;
 }
 
+/**
+ * For a read whose answer is the same for every caller: a request that
+ * arrives while one runs gets that one's answer instead of starting another.
+ */
+const inFlight = new Map();
+const shared = (keyOf, fn) => (ctx) => {
+  const key = keyOf(ctx);
+  if (!inFlight.has(key)) {
+    inFlight.set(
+      key,
+      Promise.resolve()
+        .then(() => fn(ctx))
+        .finally(() => inFlight.delete(key)),
+    );
+  }
+  return inFlight.get(key);
+};
+
 /** One request at a time per key; a second one while the first runs is 429. */
 const running = new Set();
 const oneAtATime = (key, fn) => async (ctx) => {
@@ -1033,6 +1180,252 @@ function resolveRepo(ref) {
   return hits[0].path;
 }
 
+/**
+ * POST /v1/repos: add a checkout launch accepts. The first request names a
+ * suggestion (an id from GET /v1/repos?all=1) or an absolute path; the
+ * preview says what would be stored and mints a token; the second request
+ * sends only the token. Only a git checkout is accepted from here.
+ */
+function repoAddRoute({ body }) {
+  requireBody(
+    body,
+    {
+      confirmToken: isToken,
+      suggestion: (v) => typeof v === "string" && REPO_ID.test(v),
+      path: (v) => typeof v === "string" && v.length <= 4096 && isAbsolute(v),
+    },
+    "repo-request.schema.json",
+  );
+  if (body.confirmToken === undefined) {
+    let path;
+    if (body.suggestion !== undefined && body.path !== undefined) {
+      throw new HttpError(400, "invalid-body", "name a suggestion or a path, not both");
+    }
+    if (body.suggestion !== undefined) {
+      const hit = suggestedRepos().find((r) => r.id === body.suggestion);
+      if (!hit) throw new HttpError(404, "not-found", "no such suggestion");
+      path = hit.path;
+    } else if (body.path !== undefined) {
+      path = realOr(body.path);
+    } else {
+      throw new HttpError(400, "invalid-body", "suggestion or path is required");
+    }
+    if (launchRepoAllowed(path)) {
+      throw new HttpError(409, "already-registered", "launch already accepts that repository");
+    }
+    let real;
+    try {
+      real = registerRepoCheck(path);
+    } catch (err) {
+      throw new HttpError(400, "invalid-body", err.message);
+    }
+    // The page picks a repository by folder name; a second one with the same
+    // name could never be told apart there.
+    if (launchRepos().some((r) => r.name.split("/").pop() === basename(real))) {
+      throw new HttpError(
+        409,
+        "name-taken",
+        "a repository with that folder name is already on the list",
+      );
+    }
+    return {
+      contractVersion: ACTIVITY_VERSION,
+      preview: { name: basename(real) },
+      ...mintConfirm("repo-add", "", { path: real }),
+    };
+  }
+  if (body.suggestion !== undefined || body.path !== undefined) {
+    throw new HttpError(
+      400,
+      "invalid-body",
+      "the selection belongs to the preview, not the confirmation",
+    );
+  }
+  const { path } = redeemConfirm(body.confirmToken, "repo-add", "");
+  try {
+    const stored = registerRepo(path, process.env, { requireCheckout: true });
+    return { contractVersion: ACTIVITY_VERSION, registered: { name: basename(stored) } };
+  } catch (err) {
+    // registerRepo's own refusals name no path; anything else (a lock timeout,
+    // a disk error) can, so it stays in the server's log.
+    if (REGISTER_REFUSALS.has(err.message)) throw new HttpError(409, "not-registered", err.message);
+    process.stderr.write(`contract-server: repo-add: ${err.message}\n`);
+    throw new HttpError(409, "not-registered", "the repository could not be stored");
+  }
+}
+const REGISTER_REFUSALS = new Set([
+  "the path must be absolute",
+  "the path is not a directory",
+  "the home directory or the root is not a repository",
+  "the path is not a git checkout",
+]);
+
+// What registerRepo would refuse, checked without writing.
+function registerRepoCheck(path) {
+  const real = realOr(path);
+  let st;
+  try {
+    st = statSync(real);
+  } catch {
+    throw new Error("the path is not a directory");
+  }
+  if (!st.isDirectory()) throw new Error("the path is not a directory");
+  if (real === "/" || real === realOr(homedir())) {
+    throw new Error("the home directory or the root is not a repository");
+  }
+  if (!existsSync(join(real, ".git"))) throw new Error("the path is not a git checkout");
+  return real;
+}
+
+/** DELETE /v1/repos/{id}: a registered entry, preview then ?confirm=<token>. */
+function repoRemoveRoute({ params, q }) {
+  const id = params.id;
+  if (!REPO_ID.test(id)) throw new HttpError(404, "not-found", "no such repository");
+  const entry = [
+    ...launchRepos()
+      .filter((r) => r.source === "registered")
+      .map((r) => ({ id: repoId(r.path), name: r.name })),
+    ...missingRepos().map((r) => ({ id: r.id, name: r.name })),
+  ].find((r) => r.id === id);
+  const token = one(q, "confirm");
+  if (token === null) {
+    if (!entry) throw new HttpError(404, "not-found", "no registered repository has that id");
+    return {
+      contractVersion: ACTIVITY_VERSION,
+      preview: { name: entry.name },
+      ...mintConfirm("repo-remove", id, null),
+    };
+  }
+  redeemConfirm(token, "repo-remove", id);
+  const removed = unregisterRepo(id);
+  if (!removed) throw new HttpError(404, "not-found", "no registered repository has that id");
+  return { contractVersion: ACTIVITY_VERSION, removed: { name: basename(removed) } };
+}
+
+const JOB_STATUS = {
+  "unknown-job": 404,
+  "command-not-installed": 409,
+  "invalid-repo": 400,
+  "invalid-args": 400,
+  "invalid-request": 400,
+  "no-launch-shape": 422,
+  "room-busy": 409,
+  "sandbox-unavailable": 409,
+  "launch-failed": 502,
+};
+
+function jobError(err) {
+  if (!(err instanceof JobError)) return err;
+  return new HttpError(JOB_STATUS[err.code] ?? 400, err.code, err.message, {
+    ...(err.extra.errors ? { errors: err.extra.errors } : {}),
+  });
+}
+
+const knownRun = (id) => selectRuns({ taskId: id }).found;
+
+/** A session started without agent-guard has no second layer; the office starts none. */
+function requireGuard(repoPath) {
+  if (guardRegistration({ cwd: repoPath }).ok) return;
+  throw new HttpError(
+    409,
+    "guard-missing",
+    "agent-guard.sh is not registered for every tool, so nothing starts unattended",
+  );
+}
+
+/**
+ * POST /v1/jobs: hand a job to someone in the office. The first request names
+ * jobId, repo and args (and answers for a pipeline run); the preview says
+ * which command starts, with what, and what it writes outside this machine,
+ * and mints a token. The second request sends only the token: the server then
+ * checks the unattended profile, the workspace trust and the unattended
+ * sandbox, starts the session in the background and records it for the floor.
+ */
+async function jobsPost({ body }) {
+  requireBody(
+    body,
+    {
+      confirmToken: isToken,
+      jobId: (v) => typeof v === "string" && /^[a-z][a-z0-9-]{1,40}$/.test(v),
+      repo: (v) =>
+        typeof v === "string" && v.length <= 4096 && (isAbsolute(v) || REPO_NAME.test(v)),
+      args: (v) => v !== null && typeof v === "object" && !Array.isArray(v),
+      answers: (v) => v !== null && typeof v === "object" && !Array.isArray(v),
+    },
+    "job-request.schema.json",
+  );
+  try {
+    if (body.confirmToken === undefined) {
+      if (!body.jobId || !body.repo) {
+        throw new HttpError(400, "invalid-body", "jobId and repo are required");
+      }
+      const repoPath = resolveRepo(body.repo);
+      requireUnattendedProfile();
+      requireGuard(repoPath);
+      const sessions = cachedSessions();
+      const { job, prompt } = previewJob({
+        jobId: body.jobId,
+        args: body.args ?? {},
+        answers: body.answers,
+        repoPath,
+        knownRun,
+        sessions,
+      });
+      return {
+        contractVersion: JOBS_VERSION,
+        preview: {
+          jobId: job.id,
+          role: job.role,
+          team: job.team,
+          repo: basename(repoPath),
+          prompt,
+          writes: job.writes,
+        },
+        ...mintConfirm("job", "", {
+          jobId: job.id,
+          args: body.args ?? {},
+          answers: body.answers,
+          repoPath,
+        }),
+      };
+    }
+    if (["jobId", "repo", "args", "answers"].some((k) => body[k] !== undefined)) {
+      throw new HttpError(
+        400,
+        "invalid-body",
+        "the job belongs to the preview, not the confirmation",
+      );
+    }
+    const p = redeemConfirm(body.confirmToken, "job", "");
+    if (!launchRepoAllowed(p.repoPath)) throw notAllowed();
+    requireUnattendedProfile();
+    requireWorkspaceTrust(p.repoPath, true);
+    requireGuard(p.repoPath);
+    const record = await startJob({
+      jobId: p.jobId,
+      args: p.args,
+      answers: p.answers,
+      repoPath: p.repoPath,
+      repoName: basename(p.repoPath),
+      knownRun,
+      sessions: cachedSessions(),
+      precondition: sandboxPrecondition,
+    });
+    return {
+      contractVersion: JOBS_VERSION,
+      started: {
+        sessionId: record.sessionId,
+        jobId: record.jobId,
+        role: record.role,
+        team: record.team,
+        repo: record.repo,
+      },
+    };
+  } catch (err) {
+    throw jobError(err);
+  }
+}
+
 function stackError(err) {
   if (!(err instanceof StackError)) return err;
   if (err.code === "unreadable-settings") {
@@ -1187,7 +1580,8 @@ function toolError(err) {
 
 async function toolsRoute() {
   try {
-    return { contractVersion: TOOLS_VERSION, tools: await toolkitClient().listTools() };
+    const tools = await toolkitClient().listTools();
+    return { contractVersion: TOOLS_VERSION, version: activeToolkitVersion(), tools };
   } catch (err) {
     throw toolError(err);
   }
@@ -1292,8 +1686,25 @@ export const ROUTES = [
   {
     method: "GET",
     path: "/v1/repos",
+    query: ["all"],
+    handle: ({ q, redact }) => reposDocument({ redact, extras: flag(one(q, "all")) }),
+  },
+  {
+    method: "POST",
+    path: "/v1/repos",
     query: [],
-    handle: ({ redact }) => reposDocument({ redact }),
+    body: true,
+    remote: "local-only",
+    risk: "high",
+    handle: repoAddRoute,
+  },
+  {
+    method: "DELETE",
+    path: "/v1/repos/{id}",
+    query: ["confirm"],
+    remote: "local-only",
+    risk: "high",
+    handle: repoRemoveRoute,
   },
   {
     method: "POST",
@@ -1350,6 +1761,31 @@ export const ROUTES = [
     risk: "high",
     handle: gcRoute,
   },
+  {
+    method: "POST",
+    path: "/v1/prune-logs",
+    query: [],
+    body: true,
+    remote: "local-only",
+    risk: "high",
+    handle: oneAtATime("prune-logs", pruneRoute),
+  },
+  {
+    method: "GET",
+    path: "/v1/settings",
+    query: [],
+    remote: "local-only",
+    handle: () => readSettings(),
+  },
+  {
+    method: "POST",
+    path: "/v1/settings",
+    query: [],
+    body: true,
+    remote: "local-only",
+    risk: "high",
+    handle: oneAtATime("settings", settingsRoute),
+  },
   {
     method: "GET",
     path: "/v1/autopilot",
@@ -1390,6 +1826,35 @@ export const ROUTES = [
     handle: chatRoute,
   },
   { method: "GET", path: "/v1/ledger", query: [], handle: () => officeLedger() },
+  {
+    method: "GET",
+    path: "/v1/system",
+    query: [],
+    handle: shared(
+      () => "system",
+      () => systemStatus(),
+    ),
+  },
+  {
+    method: "GET",
+    path: "/v1/credentials",
+    query: ["probe"],
+    remote: "local-only",
+    handle: shared(
+      ({ q }) => "credentials:" + (one(q, "probe") === "1"),
+      ({ q }) => officeCredentials({ probe: one(q, "probe") === "1" }),
+    ),
+  },
+  {
+    method: "GET",
+    path: "/v1/memory",
+    query: [],
+    remote: "local-only",
+    handle: shared(
+      () => "memory",
+      () => officeMemory(),
+    ),
+  },
   { method: "GET", path: "/v1/runs/{id}/results", query: [], handle: resultsRoute },
   { method: "GET", path: "/v1/runs/{id}/evidence/{name}", query: [], handle: evidenceRoute },
   {
@@ -1463,6 +1928,16 @@ export const ROUTES = [
     handle: routineDeleteRoute,
   },
   { method: "GET", path: "/v1/stack", query: ["repo"], handle: stackGet },
+  { method: "GET", path: "/v1/jobs", query: [], handle: () => jobsDocument() },
+  {
+    method: "POST",
+    path: "/v1/jobs",
+    query: [],
+    body: true,
+    remote: "local-only",
+    risk: "high",
+    handle: jobsPost,
+  },
   {
     method: "POST",
     path: "/v1/stack",
@@ -1665,14 +2140,14 @@ function parseArgs(argv) {
       opts.port = Number(p);
     } else if (a === "--idle-minutes") {
       const n = Number(value());
-      if (!Number.isFinite(n) || n <= 0 || n > MAX_IDLE_MINUTES) {
-        throw new Error(`--idle-minutes is more than 0 and at most ${MAX_IDLE_MINUTES}`);
+      if (!Number.isFinite(n) || n < 0 || n > MAX_IDLE_MINUTES) {
+        throw new Error(`--idle-minutes is 0 (never) to ${MAX_IDLE_MINUTES}`);
       }
       opts.idleMinutes = n;
     } else if (a === "--max-hours") {
       const n = Number(value());
-      if (!Number.isFinite(n) || n <= 0 || n > MAX_HOURS) {
-        throw new Error(`--max-hours is more than 0 and at most ${MAX_HOURS}`);
+      if (!Number.isFinite(n) || n < 0 || n > MAX_HOURS) {
+        throw new Error(`--max-hours is 0 (no limit) to ${MAX_HOURS}`);
       }
       opts.maxHours = n;
     } else if (a === "--allow-origin") {
@@ -1717,6 +2192,25 @@ export const OFFICE_PATH = "/office";
 export const OFFICE_CODE_PATH = "/office/code";
 /** No bearer, own Origin only: trades a panel code for the token, once. */
 export const OFFICE_EXCHANGE_PATH = "/office/exchange";
+/** Bearer, own Origin or none: the installed page's build and whether this server is stale. */
+export const OFFICE_VERSION_PATH = "/office/version";
+/** Bearer, own Origin or none: a fresh panel code, so the page can reload itself. */
+export const OFFICE_RELOAD_PATH = "/office/reload";
+
+const serverDigest = () => codeDigest(dirname(fileURLToPath(import.meta.url)));
+/** The server's code (scripts/ and lib/) as it was at start; a reinstall changes the files, not the process. */
+const SERVER_DIGEST = serverDigest();
+
+/** The build id office-build.mjs stamps into the installed page, or null. */
+export function officeBuild(env = process.env) {
+  const file = officePage(env);
+  if (!file) return null;
+  try {
+    return /const BUILD = "([0-9a-f]{12})";/.exec(readFileSync(file, "utf8"))?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
 
 function readPrefs(env) {
   try {
@@ -1949,7 +2443,7 @@ export function serve(opts) {
   };
   const arm = () => {
     clearTimeout(idleTimer);
-    idleTimer = setTimeout(() => stop("idle"), idleMs);
+    if (idleMs > 0) idleTimer = setTimeout(() => stop("idle"), idleMs);
   };
 
   /**
@@ -2049,6 +2543,15 @@ export function serve(opts) {
         serveOffice(res, req.method === "HEAD");
         return;
       }
+      if (url.pathname === "/favicon.ico" && (req.method === "GET" || req.method === "HEAD")) {
+        drain(req);
+        res.writeHead(204, {
+          "Cache-Control": "max-age=86400",
+          "X-Content-Type-Options": "nosniff",
+        });
+        res.end();
+        return;
+      }
       if (url.pathname.startsWith(OFFICE_ASSET_PREFIX)) {
         drain(req);
         if (req.method !== "GET" && req.method !== "HEAD") {
@@ -2095,6 +2598,30 @@ export function serve(opts) {
       if (!authorized(req.headers.authorization, tokenDigest)) {
         throw new HttpError(401, "unauthorized", "a bearer token is required");
       }
+      if (url.pathname === OFFICE_VERSION_PATH || url.pathname === OFFICE_RELOAD_PATH) {
+        drain(req);
+        if (origin !== undefined && !own) {
+          throw new HttpError(403, "forbidden-origin", "only the panel page asks this");
+        }
+        if (url.pathname === OFFICE_VERSION_PATH) {
+          if (req.method !== "GET") {
+            throw new HttpError(405, "method-not-allowed", "use GET", { allow: "GET" });
+          }
+          send(res, 200, {
+            contractVersion: CONTRACT_VERSION,
+            build: officeBuild(),
+            serverStale: serverDigest() !== SERVER_DIGEST,
+          });
+          return;
+        }
+        if (req.method !== "POST") {
+          throw new HttpError(405, "method-not-allowed", "use POST", { allow: "POST" });
+        }
+        // The page already holds the token; a code lets it reload itself onto
+        // the page now installed without the token ever entering a URL.
+        send(res, 200, { contractVersion: CONTRACT_VERSION, ...mintCode() });
+        return;
+      }
       if (url.pathname === OFFICE_CODE_PATH) {
         drain(req);
         if (req.method !== "POST") {
@@ -2227,10 +2754,9 @@ export function serve(opts) {
       tokenFile = writeTokenFile({ ...record, token, startedAt: started.toISOString() });
       for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(sig, () => stop(sig));
       arm();
-      lifeTimer = setTimeout(
-        () => stop("lifetime"),
-        Math.round((opts.maxHours ?? DEFAULT_MAX_HOURS) * 3600000),
-      );
+      const maxHours = opts.maxHours ?? DEFAULT_MAX_HOURS;
+      if (maxHours > 0)
+        lifeTimer = setTimeout(() => stop("lifetime"), Math.round(maxHours * 3600000));
       resolve({ ...record, tokenFile, ...(opts.printToken ? { token } : {}) });
     });
   });