@netnodeag/kraftwerk 0.76.0 → 0.78.0

package/dist/core/routines.d.ts

@@ -18,7 +18,12 @@
  * runs_on is exactly this machine's identity. No runs_on, no runner — an
  * unassigned routine fires nowhere until someone adopts it ("run these
  * here"), which writes runs_on and commits routines.yml so the other clones
- * learn who runs it. `private:` is stored and round-tripped; nothing reads it yet.
+ * learn who runs it.
+ *
+ * `private: true` keeps a routine's runs to this machine: each run's chat is
+ * marked private when it is created (ChatMeta.private), and remote callers —
+ * member sessions and paired devices over the relay — never get it listed;
+ * the machine's cloud report (routineReport) leaves the routine out too.
  */
 export interface Routine {
     id: string;
@@ -29,7 +34,7 @@ export interface Routine {
     enabled: boolean;
     /** The one identity (`handle@machine`) that fires it. Absent: unassigned, fires nowhere. */
     runsOn?: string;
-    /** Stored as given; no behaviour yet. */
+    /** Its runs' chats stay off remote callers' listings, and out of the cloud's report. */
     private?: boolean;
 }
 /**
@@ -101,6 +106,21 @@ export declare function routineStatuses(slug: string): Promise<RoutineStatus[]>;
 export declare function runRoutineNow(slug: string, id: string): Promise<{
     chatId: string;
 }>;
+/** One routine that ran on this machine, as the machine's cloud heartbeat reports it (server/cloud.ts). */
+export interface RoutineRan {
+    /** `<agent>/<routine id>`: the key in routines-state.json. */
+    routineId: string;
+    name: string;
+    /** Null when it never started (only failed to). */
+    lastRunAt: string | null;
+    /** False when its last attempt could not start (lastError). */
+    ok: boolean;
+}
+/**
+ * The current workspace's routines that ran (or tried to) on this machine,
+ * from routines-state.json and the listings; private routines left out.
+ */
+export declare function routineReport(): Promise<RoutineRan[]>;
 /**
  * The routines due at `now` that fire on this machine: enabled, runs_on
  * exactly this identity, cron matching. Everything else — unassigned,

package/dist/core/routines.js

@@ -252,6 +252,7 @@ async function fireRoutine(slug, routine) {
         agent: def.harness,
         scope: { kind: "agent", slug: slug, routine: routine.id },
         title: `⏰ ${routine.name}`,
+        ...(routine.private ? { private: true } : {}),
     });
     const { error } = await postMessage(meta.id, routine.prompt);
     if (error)
@@ -288,6 +289,31 @@ export async function runRoutineNow(slug, id) {
         throw err;
     }
 }
+/**
+ * The current workspace's routines that ran (or tried to) on this machine,
+ * from routines-state.json and the listings; private routines left out.
+ */
+export async function routineReport() {
+    const state = await readState();
+    const out = [];
+    const bySlug = new Map();
+    for (const [key, s] of Object.entries(state)) {
+        if (!s.lastRunAt && !s.lastError)
+            continue;
+        const cut = key.indexOf("/");
+        if (cut <= 0)
+            continue;
+        const slug = key.slice(0, cut);
+        const id = key.slice(cut + 1);
+        if (!bySlug.has(slug))
+            bySlug.set(slug, await listRoutines(slug).catch(() => []));
+        const r = bySlug.get(slug).find((x) => x.id === id);
+        if (r?.private)
+            continue;
+        out.push({ routineId: key, name: r?.name ?? id, lastRunAt: s.lastRunAt ?? null, ok: !s.lastError });
+    }
+    return out.sort((a, b) => a.routineId.localeCompare(b.routineId));
+}
 /* ---------- scheduler ---------- */
 /** The scheduler's timer, one per workspace. */
 const scheduler = perWorkspace(() => ({ timer: null }));

package/dist/server/api/chats.js

@@ -2,8 +2,9 @@ import { promises as fs } from "node:fs";
 import path from "node:path";
 import * as z from "zod";
 import { getAgent } from "../../core/agents.js";
-import { answerElicitation, cancelChat, createChat, deleteChat, forkChat, getChat, listAgentSessionsFor, listChats, postMessage, renameChat, resetSession, resolvePermission, setChatConfig, setChatProject, setChatVibeable, steerChat, stopChatTask, subscribeChat, } from "../../core/chat/sessions.js";
-import { attachmentPath, saveAttachment } from "../../core/chat/store.js";
+import { answerElicitation, cancelChat, createChat, deleteChat, forkChat, getChat, listAgentSessionsFor, listChats, localPerson, postMessage, renameChat, resetSession, resolvePermission, setChatConfig, setChatProject, setChatVibeable, steerChat, stopChatTask, subscribeChat, } from "../../core/chat/sessions.js";
+import { attachmentPath, readMeta, saveAttachment } from "../../core/chat/store.js";
+import { remoteCaller } from "../trust.js";
 import { getProject } from "../../core/projects.js";
 import { MIME } from "./mime.js";
 import { projectErrors } from "./projects.js";
@@ -75,9 +76,39 @@ async function projectSlug(slug) {
         fail(404, "project not found");
     return found.slug;
 }
+/** Who a chat or message is signed with: a member session's member, else this machine's person. */
+const personOf = async (trust) => trust.kind === "member" ? { handle: trust.member.handle, email: trust.member.email } : localPerson();
+/**
+ * A private routine's run (meta.private) is not there for a remote caller
+ * (trust.ts remoteCaller): a 404, as if it did not exist. This machine and
+ * the LAN see it.
+ */
+async function hiddenFrom(trust, id) {
+    if (!remoteCaller(trust))
+        return;
+    const meta = await readMeta(id).catch(() => null);
+    if (meta?.private)
+        fail(404, "not found");
+}
+/** Every route on one chat (`:id`) checks hiddenFrom first. */
+function guarded(r) {
+    if (!r.path.includes("/:id"))
+        return r;
+    const handle = r.handle;
+    return {
+        ...r,
+        handle: async (c) => {
+            await hiddenFrom(c.trust, c.params.id);
+            return handle(c);
+        },
+    };
+}
 /** Chats: ACP sessions with a coding agent, their event stream, and what a person does in them. */
 export const chatRoutes = [
-    route({ name: "chats.list", method: "GET", path: "/api/chats", summary: "every chat with its live state" }, async () => ({ chats: await listChats() })),
+    route({ name: "chats.list", method: "GET", path: "/api/chats", summary: "every chat with its live state; a remote caller's list leaves private routines' runs out" }, async (c) => {
+        const chats = await listChats();
+        return { chats: remoteCaller(c.trust) ? chats.filter((x) => !x.private) : chats };
+    }),
     route({ name: "chats.create", method: "POST", path: "/api/chats", summary: "start a chat {agent, scope, resume?, project?}", body: NewChat }, async (c) => {
         // `resume` continues one of the agent's own sessions (see agents.sessions).
         const body = await c.body();
@@ -88,7 +119,13 @@ export const chatRoutes = [
             fail(400, "only an agent's chat takes a project");
         const project = body.project ? await projectSlug(body.project) : undefined;
         try {
-            return await createChat({ agent: agent, scope, ...(project ? { project } : {}), ...(body.resume ? { resume: body.resume } : {}) });
+            return await createChat({
+                agent: agent,
+                scope,
+                author: await personOf(c.trust),
+                ...(project ? { project } : {}),
+                ...(body.resume ? { resume: body.resume } : {}),
+            });
         }
         catch (err) {
             throw new ApiError(400, err.message);
@@ -146,7 +183,7 @@ export const chatRoutes = [
         const { slug } = await c.body();
         return metaOf(await setChatVibeable(c.params.id, slug || null));
     }),
-    route({ name: "chats.fork", method: "POST", path: "/api/chats/:id/fork", summary: "a new chat continuing a copy of this one's session", errors: 400 }, async (c) => metaOf(await forkChat(c.params.id))),
+    route({ name: "chats.fork", method: "POST", path: "/api/chats/:id/fork", summary: "a new chat continuing a copy of this one's session", errors: 400 }, async (c) => metaOf(await forkChat(c.params.id, await personOf(c.trust)))),
     route({ name: "chats.resetSession", method: "POST", path: "/api/chats/:id/reset-session", summary: "forget the agent's session; the next message starts fresh", errors: 400 }, async (c) => metaOf(await resetSession(c.params.id))),
     // The body is the file itself; x-file-name names it, content-type types it.
     route({ name: "chats.attach", method: "POST", path: "/api/chats/:id/attachments", summary: "upload an attachment for the next message", errors: 400, upload: true }, async (c) => {
@@ -178,8 +215,8 @@ export const chatRoutes = [
         res.end(data);
     }),
     // Channels: `from` is the poster's display name, which signs the message.
-    act("chats.message", "/api/chats/:id/message", "send a message {text, attachments?, from?}", Said.extend({ from: z.string().optional() }), (c, body) => postMessage(c.params.id, textOf(body), { from: body.from, attachments: body.attachments })),
-    act("chats.steer", "/api/chats/:id/steer", "add to the running turn {text, attachments?}", Said, (c, body) => steerChat(c.params.id, textOf(body), body.attachments)),
+    act("chats.message", "/api/chats/:id/message", "send a message {text, attachments?, from?}", Said.extend({ from: z.string().optional() }), async (c, body) => postMessage(c.params.id, textOf(body), { from: body.from, attachments: body.attachments, by: await personOf(c.trust) })),
+    act("chats.steer", "/api/chats/:id/steer", "add to the running turn {text, attachments?}", Said, async (c, body) => steerChat(c.params.id, textOf(body), body.attachments, await personOf(c.trust))),
     act("chats.permission", "/api/chats/:id/permission", "answer a permission request {requestId, optionId | null}", z.object({ requestId: z.string().default(""), optionId: z.string().nullable().default(null) }), (c, body) => resolvePermission(c.params.id, body.requestId, body.optionId)),
     // Channels: `agent` stops one member; without it every agent in the chat.
     act("chats.cancel", "/api/chats/:id/cancel", "stop the running turn {agent?}", z.object({ agent: z.string().optional() }), (c, body) => cancelChat(c.params.id, body.agent || undefined)),
@@ -190,4 +227,4 @@ export const chatRoutes = [
     }), (c, { requestId, action, content }) => answerElicitation(c.params.id, requestId, action === "accept" ? { action, content } : { action })),
     act("chats.stopTask", "/api/chats/:id/task-stop", "stop one background task {taskId}", z.object({ taskId: z.string().default("") }), (c, body) => stopChatTask(c.params.id, body.taskId)),
     act("chats.config", "/api/chats/:id/config", "set a session option {configId, value}", z.object({ configId: z.string().default(""), value: z.union([z.string(), z.boolean()]).default("") }), (c, body) => setChatConfig(c.params.id, body.configId, body.value)),
-];
+].map(guarded);

package/dist/server/api/cloud.d.ts

@@ -0,0 +1,86 @@
+import * as z from "zod";
+/**
+ * The machine in the kraftwerk cloud (server/cloud.ts): its record, turning
+ * it on or off, a round now, releasing the claim. What `kraftwerk cloud`,
+ * `login` and `logout` ask the running daemon; a standalone server answers
+ * "off" (only the daemon registers). This machine only: the claim code
+ * claims the machine. And an invite to one served workspace (`kraftwerk
+ * invite`): someone joins it as a remote member, without a clone.
+ */
+export declare const cloudRoutes: (import("./router.js").Route<"cloud.invite", import("../../core/cloud.js").InviteResponse & {
+    workspace: {
+        id: string;
+        slug: string;
+        name: string;
+    };
+}, "/api/cloud/invite", z.ZodObject<{
+    slug: z.ZodOptional<z.ZodString>;
+    root: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodEnum<{
+        member: "member";
+        owner: "owner";
+    }>>;
+}, z.core.$strip>> | import("./router.js").Route<"cloud.set", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud", z.ZodObject<{
+    enabled: z.ZodBoolean;
+    url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>> | import("./router.js").Route<"cloud.status", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud", undefined> | import("./router.js").Route<"cloud.sync", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud/sync", undefined> | import("./router.js").Route<"cloud.unlink", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud/unlink", undefined>)[];

package/dist/server/api/cloud.js

@@ -0,0 +1,51 @@
+import * as z from "zod";
+import { writeCloudFile } from "../../core/cloud.js";
+import { applyMachineCloud, cloudStatus, createWorkspaceInvite, syncMachineCloud, unlinkMachineCloud } from "../cloud.js";
+import { currentHub } from "../hub-context.js";
+import { route } from "./router.js";
+/**
+ * The machine in the kraftwerk cloud (server/cloud.ts): its record, turning
+ * it on or off, a round now, releasing the claim. What `kraftwerk cloud`,
+ * `login` and `logout` ask the running daemon; a standalone server answers
+ * "off" (only the daemon registers). This machine only: the claim code
+ * claims the machine. And an invite to one served workspace (`kraftwerk
+ * invite`): someone joins it as a remote member, without a clone.
+ */
+export const cloudRoutes = [
+    route({ name: "cloud.status", method: "GET", path: "/api/cloud", summary: "the machine's cloud record: state, claim code, account, last heartbeat", access: "local" }, async () => ({
+        daemon: currentHub().daemon === true,
+        ...cloudStatus(),
+    })),
+    route({
+        name: "cloud.set",
+        method: "POST",
+        path: "/api/cloud",
+        summary: "turn the machine's cloud on or off {enabled, url?} (~/.kraftwerk/cloud.json); off says goodbye",
+        access: "local",
+        body: z.object({ enabled: z.boolean(), url: z.string().url().optional() }),
+    }, async (c) => {
+        const { enabled, url } = await c.body();
+        await writeCloudFile({ enabled, url });
+        return { daemon: currentHub().daemon === true, ...(await applyMachineCloud()) };
+    }),
+    route({ name: "cloud.sync", method: "POST", path: "/api/cloud/sync", summary: "register or heartbeat now; answers the record (a claim made in the cloud shows here)", access: "local" }, async () => ({
+        daemon: currentHub().daemon === true,
+        ...(await syncMachineCloud()),
+    })),
+    route({
+        name: "cloud.invite",
+        method: "POST",
+        path: "/api/cloud/invite",
+        summary: "an invite to a served workspace {slug | root, role?}: the cloud's join code and link (a claimed machine only)",
+        access: "local",
+        errors: 409,
+        body: z.object({ slug: z.string().optional(), root: z.string().optional(), role: z.enum(["owner", "member"]).optional() }).refine((b) => b.slug || b.root, "name the workspace: slug or root"),
+    }, async (c) => {
+        const { slug, root, role } = await c.body();
+        return createWorkspaceInvite({ slug, root }, role);
+    }),
+    route({ name: "cloud.unlink", method: "POST", path: "/api/cloud/unlink", summary: "release the machine from its account; the cloud hands out a fresh claim code", access: "local", errors: 400 }, async () => ({
+        daemon: currentHub().daemon === true,
+        ...(await unlinkMachineCloud()),
+    })),
+];

package/dist/server/api/devices.d.ts

@@ -16,21 +16,27 @@ export declare const deviceRoutes: (import("./router.js").Route<"devices.code",
     code: z.ZodString;
     name: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>> | import("./router.js").Route<"devices.relay", {
+    enabled: boolean;
+    url: string | null;
+    fingerprint: string | null;
+    daemon: boolean;
     state: import("../relay.js").RelayState;
     id?: string;
     key?: string;
     error?: string;
     clients: number;
     since?: string;
-    enabled: boolean;
-    url: string | null;
-    fingerprint: string | null;
-    daemon: boolean;
 }, "/api/devices/relay", undefined> | import("./router.js").Route<"devices.revoke", {
     ok: boolean;
 }, "/api/devices/:id", undefined> | import("./router.js").Route<"devices.self", {
-    trust: "device" | "local" | "none";
+    trust: "device" | "local" | "member" | "none";
     device?: import("../../core/devices.js").Device | undefined;
+    relay?: boolean | undefined;
+    member?: import("../../core/cloud.js").MemberVerdict | undefined;
+    workspace?: {
+        id: string;
+        slug: string;
+    } | undefined;
 }, "/api/devices/self", undefined> | import("./router.js").Route<"devices.setPush", {
     ok: boolean;
 }, "/api/devices/push", z.ZodObject<{
@@ -41,16 +47,16 @@ export declare const deviceRoutes: (import("./router.js").Route<"devices.code",
     }>;
     key: z.ZodString;
 }, z.core.$strip>> | import("./router.js").Route<"devices.setRelay", {
+    enabled: boolean;
+    url: string;
+    fingerprint: string;
+    daemon: boolean;
     state: import("../relay.js").RelayState;
     id?: string;
     key?: string;
     error?: string;
     clients: number;
     since?: string;
-    enabled: boolean;
-    url: string;
-    fingerprint: string;
-    daemon: boolean;
 }, "/api/devices/relay", z.ZodObject<{
     enabled: z.ZodBoolean;
     url: z.ZodOptional<z.ZodString>;

package/dist/server/api/devices.js

@@ -44,9 +44,10 @@ export const deviceRoutes = [
             throw new ApiError(400, err.message);
         }
     }),
-    route({ name: "devices.self", method: "GET", path: "/api/devices/self", summary: "how this caller is trusted: this machine or a paired device" }, async (c) => ({
+    route({ name: "devices.self", method: "GET", path: "/api/devices/self", summary: "how this caller is trusted: this machine, a paired device, or a workspace's member" }, async (c) => ({
         trust: c.trust.kind,
-        ...(c.trust.kind === "device" ? { device: c.trust.device } : {}),
+        ...(c.trust.kind === "device" ? { device: c.trust.device, ...(c.trust.relay ? { relay: true } : {}) } : {}),
+        ...(c.trust.kind === "member" ? { member: c.trust.member, workspace: { id: c.trust.workspaceId, slug: c.trust.slug } } : {}),
     })),
     // A paired device's app says where its push notifications go (and the key it seals them with); see server/push.ts.
     route({

package/dist/server/api/index.d.ts

@@ -291,7 +291,83 @@ export declare const routes: (Route<"agents.addJournal", {
     ok: true;
 }, "/api/chats/:id/task-stop", z.ZodObject<{
     taskId: z.ZodDefault<z.ZodString>;
-}, z.core.$strip>> | Route<"devices.code", {
+}, z.core.$strip>> | Route<"cloud.invite", import("../../core/cloud.js").InviteResponse & {
+    workspace: {
+        id: string;
+        slug: string;
+        name: string;
+    };
+}, "/api/cloud/invite", z.ZodObject<{
+    slug: z.ZodOptional<z.ZodString>;
+    root: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodEnum<{
+        member: "member";
+        owner: "owner";
+    }>>;
+}, z.core.$strip>> | Route<"cloud.set", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud", z.ZodObject<{
+    enabled: z.ZodBoolean;
+    url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>> | Route<"cloud.status", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud", undefined> | Route<"cloud.sync", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud/sync", undefined> | Route<"cloud.unlink", {
+    daemon: boolean;
+    url: string;
+    state: import("../cloud.js").CloudState;
+    reason?: string;
+    source?: import("../../core/cloud.js").CloudUrlSource;
+    error?: string;
+    id?: string;
+    machine?: string;
+    account?: string | null;
+    interval?: number;
+    lastSeen?: string;
+    claimCode?: string | null;
+    claimUrl?: string | null;
+    workspaces?: number;
+}, "/api/cloud/unlink", undefined> | Route<"devices.code", {
     code: string;
     expiresAt: string;
     urls: string[];
@@ -307,21 +383,27 @@ export declare const routes: (Route<"agents.addJournal", {
     code: z.ZodString;
     name: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>> | Route<"devices.relay", {
+    enabled: boolean;
+    url: string | null;
+    fingerprint: string | null;
+    daemon: boolean;
     state: import("../relay.js").RelayState;
     id?: string;
     key?: string;
     error?: string;
     clients: number;
     since?: string;
-    enabled: boolean;
-    url: string | null;
-    fingerprint: string | null;
-    daemon: boolean;
 }, "/api/devices/relay", undefined> | Route<"devices.revoke", {
     ok: boolean;
 }, "/api/devices/:id", undefined> | Route<"devices.self", {
-    trust: "device" | "local" | "none";
+    trust: "device" | "local" | "member" | "none";
     device?: import("../../core/devices.js").Device | undefined;
+    relay?: boolean | undefined;
+    member?: import("../../core/cloud.js").MemberVerdict | undefined;
+    workspace?: {
+        id: string;
+        slug: string;
+    } | undefined;
 }, "/api/devices/self", undefined> | Route<"devices.setPush", {
     ok: boolean;
 }, "/api/devices/push", z.ZodObject<{
@@ -332,16 +414,16 @@ export declare const routes: (Route<"agents.addJournal", {
     }>;
     key: z.ZodString;
 }, z.core.$strip>> | Route<"devices.setRelay", {
+    enabled: boolean;
+    url: string;
+    fingerprint: string;
+    daemon: boolean;
     state: import("../relay.js").RelayState;
     id?: string;
     key?: string;
     error?: string;
     clients: number;
     since?: string;
-    enabled: boolean;
-    url: string;
-    fingerprint: string;
-    daemon: boolean;
 }, "/api/devices/relay", z.ZodObject<{
     enabled: z.ZodBoolean;
     url: z.ZodOptional<z.ZodString>;
@@ -439,7 +521,22 @@ export declare const routes: (Route<"agents.addJournal", {
     vibeables: boolean;
     projects: boolean;
     publicUrl: string;
-    cloud: import("../cloud.js").CloudStatus;
+    cloud: {
+        included: boolean;
+        url: string;
+        state: import("../cloud.js").CloudState;
+        reason?: string;
+        source?: import("../../core/cloud.js").CloudUrlSource;
+        error?: string;
+        id?: string;
+        machine?: string;
+        account?: string | null;
+        interval?: number;
+        lastSeen?: string;
+        claimCode?: string | null;
+        claimUrl?: string | null;
+        workspaces?: number;
+    };
     switcher: import("../../config.js").SwitcherEntry[];
 }, "/api/meta", undefined> | Route<"notifications.clear", {
     ok: boolean;

package/dist/server/api/index.js

@@ -3,6 +3,7 @@ import { agentRoutes } from "./agents.js";
 import { attentionRoutes } from "./attention.js";
 import { channelRoutes } from "./channels.js";
 import { chatRoutes } from "./chats.js";
+import { cloudRoutes } from "./cloud.js";
 import { deviceRoutes } from "./devices.js";
 import { hubRoutes } from "./hub.js";
 import { fileRoutes } from "./files.js";
@@ -35,6 +36,7 @@ const domainRoutes = [
     ...gitRoutes,
     ...vibeableRoutes,
     ...deviceRoutes,
+    ...cloudRoutes,
     ...hubRoutes,
 ];
 const protocolRoute = route({ name: "protocol.get", method: "GET", path: "/api/protocol", summary: "the protocol version and every route", access: "public" }, async () => ({

package/dist/server/api/router.d.ts

@@ -59,8 +59,9 @@ export interface RouteDef<N extends string, P extends string = string, S extends
     body?: S;
     /**
      * Who may call it. Default: anyone trusted (this machine, a paired
-     * device). `public`: also unpaired callers (pairing, the protocol).
-     * `local`: this machine only (managing devices).
+     * device, a workspace's member — except the machine-level routes
+     * MEMBER_DENIED names). `public`: also unpaired callers (pairing, the
+     * protocol). `local`: this machine only (managing devices).
      */
     access?: "public" | "local";
 }

package/dist/server/api/router.js

@@ -39,12 +39,24 @@ function validate(route, raw) {
 }
 /** Maps an error message to a status by the usual wording: "no <thing>" is 404, "… are off" 409, else 400. */
 export const statusByMessage = (missing) => (message) => missing.test(message) ? 404 : /are off/.test(message) ? 409 : 400;
+/**
+ * What a member session (one workspace, over the relay; see members.ts) may
+ * not call: the machine's own business — its workspaces, devices, cloud
+ * record, settings, updates, restarts, identity, trash. server.ts already
+ * keeps the session inside its workspace; this keeps it out of the machine.
+ */
+const MEMBER_DENIED = /^(hub|devices|cloud|settings|server|update|workspaces|identity|trash)\./;
+/** …except asking who it is. */
+const MEMBER_ALLOWED = new Set(["devices.self"]);
 /** Why a caller may not use a route, or undefined when it may. */
 function refusal(route, trust) {
     if (route.access === "public")
         return undefined;
     if (trust.kind === "none")
         return new ApiError(401, "pair this device first", { error: "pair this device first", pair: true });
+    if (trust.kind === "member" && (route.access === "local" || (MEMBER_DENIED.test(route.name) && !MEMBER_ALLOWED.has(route.name)))) {
+        return new ApiError(403, `${route.name} is not open to a workspace member — only to the machine kraftwerk runs on`);
+    }
     if (route.access === "local" && trust.kind !== "local")
         return new ApiError(403, "only on the machine kraftwerk runs on");
     return undefined;

package/dist/server/api/workspace.d.ts

@@ -35,7 +35,22 @@ export declare const workspaceRoutes: (import("./router.js").Route<"identity.get
     projects: boolean;
     /** @deprecated Always "": the Cloudflare Tunnel that set it was removed in 0.65. Removed with protocol 2. */
     publicUrl: string;
-    cloud: import("../cloud.js").CloudStatus;
+    cloud: {
+        included: boolean;
+        url: string;
+        state: import("../cloud.js").CloudState;
+        reason?: string;
+        source?: import("../../core/cloud.js").CloudUrlSource;
+        error?: string;
+        id?: string;
+        machine?: string;
+        account?: string | null;
+        interval?: number;
+        lastSeen?: string;
+        claimCode?: string | null;
+        claimUrl?: string | null;
+        workspaces?: number;
+    };
     switcher: import("../../config.js").SwitcherEntry[];
 }, "/api/meta", undefined> | import("./router.js").Route<"search.agents", {
     workspaces: (import("../../core/search.js").WorkspaceAgents & {

package/dist/server/api/workspace.js

@@ -105,7 +105,8 @@ export const workspaceRoutes = [
             projects: (ws?.config.projects && ws.config.projects.enabled !== false) === true,
             /** @deprecated Always "": the Cloudflare Tunnel that set it was removed in 0.65. Removed with protocol 2. */
             publicUrl: "",
-            cloud: cloudStatus(),
+            // The machine's cloud record (only the daemon registers one); `included`: this workspace rides along (no cloud.enabled: false veto).
+            cloud: { ...cloudStatus(), included: ws?.config.cloud?.enabled !== false },
             switcher,
         };
     }),