@ours.network/fleet 0.13.3 → 0.14.1

package/dist/owner-channel/channel.js

@@ -1,9 +1,11 @@
 import { spawn } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readdir, rm } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rm } from 'node:fs/promises';
 import { createInterface } from 'node:readline';
 import { join } from 'node:path';
 import { DEFAULT_OWNER_ATTACHMENT_MIME, canonicalCid, } from '../config.js';
+import { VERSION } from '../version.js';
+import { dispatchOwnerCommand, fleetCliOps, isOwnerCommandText, } from './commands.js';
 import { OursMcpClient } from './mcp.js';
 import { ownerNotices } from './notices.js';
 import { DuplicateSendError, OwnerAuthorizationState, OwnerChannelState, OwnerConversationState, } from './state.js';
@@ -49,9 +51,11 @@ export class OwnerChannel {
     activeRequests = new Map();
     managementTail = Promise.resolve();
     ready = false;
+    fleetOps;
     constructor(options) {
         this.options = options;
         this.client = options.client ?? new OursMcpClient(options.command, options.env, line => options.log(`[${options.role}] owner channel ${line}`));
+        this.fleetOps = options.fleet ?? fleetCliOps(options.role, options.configPath);
         this.state = new OwnerChannelState(join(options.stateDir, '.owner-channel-state.json'));
         this.authorizations = new OwnerAuthorizationState(join(options.stateDir, '.owner-channel-owners.json'), options.config.owners);
         this.conversations = new OwnerConversationState(join(options.stateDir, '.owner-channel-conversations.json'));
@@ -692,24 +696,8 @@ export class OwnerChannel {
             this.logError('owner conversation route update failed', error);
         }
         const text = String(message.text ?? '').trim();
-        if (text.toLowerCase() === '/status') {
-            const snapshot = this.options.session.snapshot();
-            await this.send(sender.id, ownerNotices.status(this.options.role, snapshot), wireId);
-            this.state.remember(wireId);
-            return true;
-        }
-        if (text.toLowerCase() === '/interrupt') {
-            try {
-                await this.options.session.interrupt('owner');
-            }
-            catch (error) {
-                this.logError('interrupt failed', error);
-                await this.send(sender.id, ownerNotices.interruptFailed(this.options.role), wireId);
-                this.state.remember(wireId);
-                return true;
-            }
-            await this.send(sender.id, ownerNotices.interrupted(this.options.role), wireId);
-            this.state.remember(wireId);
+        if (isOwnerCommandText(text)) {
+            await this.handleCommand(sender, text, wireId);
             return true;
         }
         const requestId = this.requestId(wireId);
@@ -760,6 +748,94 @@ export class OwnerChannel {
         this.completionTasks.add(task);
         return true;
     }
+    /**
+     * Deterministic command path: the message never becomes an agent prompt.
+     * Authorization already happened — the managed-agent relay branch and the
+     * owner-CID check in handle() both run before dispatch, so only an
+     * authenticated owner reaches this: neither ordinary peers nor the managed
+     * agent itself can execute /force-restart, /model, or any other command.
+     */
+    async handleCommand(sender, text, wireId) {
+        const ctx = {
+            role: this.options.role,
+            harness: this.options.harness,
+            version: VERSION,
+            snapshot: () => this.options.session.snapshot(),
+            interrupt: () => this.options.session.interrupt('owner'),
+            runHarnessCommand: command => this.runHarnessCommand(sender, command, wireId),
+            restart: mode => this.restartSelf(sender, mode, wireId),
+            fleetList: () => this.fleetOps.list(),
+            recentEvents: limit => this.options.session.eventsSince(0).slice(-limit),
+            readWorklogTail: maxChars => this.readWorklogTail(maxChars),
+            reply: async (replyText) => { await this.send(sender.id, replyText, wireId); },
+        };
+        try {
+            await dispatchOwnerCommand(text, ctx);
+        }
+        catch (error) {
+            this.logError(`owner command failed (${text.split(/\s+/, 1)[0]})`, error);
+        }
+        // Harness commands own their wire until the queued turn settles; everything
+        // else is complete now and must never replay.
+        if (!this.inFlight.has(wireId))
+            this.state.remember(wireId);
+    }
+    /** Queue raw slash text to the harness and report the turn's outcome. */
+    async runHarnessCommand(sender, command, wireId) {
+        const requestId = this.requestId(wireId);
+        const queued = await this.options.session.queuePrompt(command, {
+            origin: { kind: 'owner', requestId },
+        });
+        this.inFlight.add(wireId);
+        const receipt = this.send(sender.id, ownerNotices.commandStarted(command), wireId)
+            .then(() => undefined)
+            .catch(error => this.logError(`command ${command} acceptance notice failed`, error));
+        const task = queued.completion.then(async (result) => {
+            await receipt;
+            const output = result.succeeded ? this.commandOutput(result.output) : undefined;
+            await this.send(sender.id, ownerNotices.commandOutcome(command, result.outcome, output), wireId);
+            this.state.remember(wireId);
+        }).catch(error => this.logError(`command ${command} completion failed`, error))
+            .finally(() => {
+            this.inFlight.delete(wireId);
+            this.completionTasks.delete(task);
+            if (!this.stopping)
+                void this.drain().catch(error => this.logError('completion drain failed', error));
+        });
+        this.completionTasks.add(task);
+    }
+    /**
+     * Confirmation and the durable wire record must both land BEFORE the fleet
+     * CLI is asked to bounce this very process; neither can happen afterwards.
+     */
+    async restartSelf(sender, mode, wireId) {
+        const command = mode === 'fresh' ? '/force-restart' : '/restart';
+        await this.send(sender.id, ownerNotices.restarting(this.options.role, command, mode), wireId);
+        this.state.remember(wireId);
+        this.options.log(`[${this.options.role}] owner requested ${command}`);
+        await this.fleetOps.restart(mode);
+    }
+    /** Code-point-safe tail of the worklog, or undefined when there is none. */
+    async readWorklogTail(maxChars) {
+        try {
+            const content = (await readFile(join(this.options.stateDir, 'WORKLOG.md'), 'utf8')).trim();
+            if (!content)
+                return undefined;
+            const points = Array.from(content);
+            return points.length <= maxChars ? content : `…${points.slice(-maxChars).join('')}`;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Bound harness-command output to a single outbound message. */
+    commandOutput(output) {
+        const trimmed = output?.trim();
+        if (!trimmed)
+            return undefined;
+        const points = Array.from(trimmed);
+        return points.length <= 7_000 ? trimmed : `${points.slice(0, 7_000).join('')}…`;
+    }
     acceptedSender(cid) {
         return this.isAgentSender(cid) || this.isEffectiveOwner(cid);
     }

package/dist/owner-channel/commands.d.ts

@@ -0,0 +1,79 @@
+import type { SessionEvent, SessionSnapshot } from '../session/types.js';
+/**
+ * Fleet-level effects a deterministic owner command may trigger. Production
+ * uses the detached CLI (`fleetCliOps`); tests inject fakes so no command can
+ * ever bounce a real service from the suite.
+ */
+export interface OwnerFleetOps {
+    /** `ours-fleet restart` (keep) or `ours-fleet force-restart` (fresh) of this role. */
+    restart(mode: 'keep' | 'fresh'): Promise<void>;
+    /** `ours-fleet ls` output. */
+    list(): Promise<string>;
+}
+/**
+ * The narrow capability surface a command executor sees. Everything here is
+ * already scoped to the one role whose channel received the message; commands
+ * cannot name another agent or another recipient.
+ */
+export interface OwnerCommandContext {
+    role: string;
+    /** Harness id of the role (e.g. 'claude-code', 'codex'); gates forwarding. */
+    harness: string;
+    version: string;
+    snapshot(): SessionSnapshot;
+    interrupt(): Promise<void>;
+    /**
+     * Deliver raw slash text to the agent harness. Only commands the bundled
+     * ACP adapter for `harness` verifiably executes locally may be forwarded
+     * (see HARNESS_LOCAL_COMMANDS); anything else would reach the model as an
+     * ordinary prompt. The channel sends the acceptance and outcome notices
+     * itself.
+     */
+    runHarnessCommand(command: string): Promise<void>;
+    restart(mode: 'keep' | 'fresh'): Promise<void>;
+    fleetList(): Promise<string>;
+    recentEvents(limit: number): SessionEvent[];
+    readWorklogTail(maxChars: number): Promise<string | undefined>;
+    reply(text: string): Promise<void>;
+}
+export interface OwnerCommand {
+    /** Primary name without the leading slash. */
+    name: string;
+    aliases?: string[];
+    /** Shown in help; defaults to `/<name>`. */
+    usage?: string;
+    /** One-line description shown in help. */
+    summary: string;
+    execute(ctx: OwnerCommandContext, args: string): Promise<void>;
+}
+/**
+ * Commands each harness's bundled ACP adapter verifiably executes locally,
+ * pinned by test/acp-adapter-commands.test.ts against the shipped adapter
+ * artifacts. claude-agent-acp routes slash commands into the Claude SDK,
+ * which runs its builtins (/clear, /compact, /model) without a model turn;
+ * codex-acp intercepts only /compact — /clear and /model are not builtins
+ * and would fall through into sendPrompt, i.e. reach the model as an
+ * ordinary prompt. Unlisted harnesses forward nothing.
+ */
+export declare const HARNESS_LOCAL_COMMANDS: Record<string, readonly string[]>;
+/**
+ * The single source of truth for the deterministic owner-channel command set:
+ * /help renders exactly this table, so adding an entry here is the whole
+ * registration step for a new command.
+ */
+export declare const ownerCommands: OwnerCommand[];
+/** Trimmed slash-prefixed text is a command attempt and is never forwarded. */
+export declare const isOwnerCommandText: (text: string) => boolean;
+export declare function ownerCommandHelp(error?: string): string;
+/**
+ * Execute one authenticated owner command. `text` must already be trimmed,
+ * slash-prefixed, and from an authorized owner CID — the channel enforces the
+ * authority boundary before dispatch ever sees the message.
+ */
+export declare function dispatchOwnerCommand(text: string, ctx: OwnerCommandContext): Promise<void>;
+/**
+ * Production fleet effects: the detached ours-fleet CLI. The restart child is
+ * detached and unreferenced because a successful restart kills this very
+ * process; the reply and the durable wire record must already be on disk.
+ */
+export declare function fleetCliOps(role: string, configPath?: string): OwnerFleetOps;

package/dist/owner-channel/commands.js

@@ -0,0 +1,183 @@
+import { execFile, spawn } from 'node:child_process';
+import { ownerNotices } from './notices.js';
+/** A malformed invocation; the dispatcher answers it with annotated help. */
+class OwnerCommandUsageError extends Error {
+}
+const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const REPLY_MAX_CHARS = 3_500;
+const strip = (value, max) => String(value).replace(/[\u0000-\u001f\u007f]/g, ' ').slice(0, max);
+/** Like `strip`, but keeps newlines so multi-line listings stay readable. */
+const stripMultiline = (value, max) => String(value).replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, ' ').slice(0, max);
+/**
+ * Commands each harness's bundled ACP adapter verifiably executes locally,
+ * pinned by test/acp-adapter-commands.test.ts against the shipped adapter
+ * artifacts. claude-agent-acp routes slash commands into the Claude SDK,
+ * which runs its builtins (/clear, /compact, /model) without a model turn;
+ * codex-acp intercepts only /compact — /clear and /model are not builtins
+ * and would fall through into sendPrompt, i.e. reach the model as an
+ * ordinary prompt. Unlisted harnesses forward nothing.
+ */
+export const HARNESS_LOCAL_COMMANDS = {
+    'claude-code': ['clear', 'compact', 'model'],
+    codex: ['compact'],
+};
+/**
+ * Forward raw slash text to the harness only when the bundled adapter for
+ * this role's harness verifiably executes it locally; otherwise answer with
+ * a truthful refusal so the text can never reach the model as a prompt.
+ */
+const forwardHarnessCommand = (ctx, raw) => {
+    const name = raw.slice(1).split(/\s+/, 1)[0];
+    if (!(HARNESS_LOCAL_COMMANDS[ctx.harness] ?? []).includes(name))
+        return ctx.reply(ownerNotices.commandUnsupported(`/${name}`, ctx.harness));
+    return ctx.runHarnessCommand(raw);
+};
+/** Keep the LAST characters — tails are more useful than heads for logs. */
+const tail = (value, max) => {
+    const points = Array.from(value);
+    return points.length <= max ? value : `…${points.slice(-max).join('')}`;
+};
+const noArgs = (usage, run) => async (ctx, args) => {
+    if (args)
+        throw new OwnerCommandUsageError(`${usage} takes no arguments`);
+    await run(ctx);
+};
+/**
+ * The single source of truth for the deterministic owner-channel command set:
+ * /help renders exactly this table, so adding an entry here is the whole
+ * registration step for a new command.
+ */
+export const ownerCommands = [
+    {
+        name: 'help', aliases: ['commands'],
+        summary: 'list all deterministic owner-channel commands (alias: /commands)',
+        execute: async (ctx) => ctx.reply(ownerCommandHelp()),
+    },
+    {
+        name: 'status', summary: "report the agent's session state",
+        execute: noArgs('/status', async (ctx) => ctx.reply(ownerNotices.status(ctx.role, ctx.snapshot()))),
+    },
+    {
+        name: 'interrupt', summary: "cancel the agent's active turn",
+        execute: noArgs('/interrupt', async (ctx) => {
+            try {
+                await ctx.interrupt();
+            }
+            catch {
+                return ctx.reply(ownerNotices.interruptFailed(ctx.role));
+            }
+            await ctx.reply(ownerNotices.interrupted(ctx.role));
+        }),
+    },
+    {
+        name: 'clear', summary: "clear the agent's session context",
+        execute: noArgs('/clear', ctx => forwardHarnessCommand(ctx, '/clear')),
+    },
+    {
+        name: 'compact', summary: "compact the agent's session context",
+        execute: noArgs('/compact', ctx => forwardHarnessCommand(ctx, '/compact')),
+    },
+    {
+        name: 'model', usage: '/model <model-id>',
+        summary: 'switch the model the agent runs on',
+        execute: async (ctx, args) => {
+            if (!args)
+                throw new OwnerCommandUsageError('usage: /model <model-id>');
+            if (!MODEL_ID.test(args))
+                throw new OwnerCommandUsageError('model id must be alphanumeric with . _ : - only');
+            await forwardHarnessCommand(ctx, `/model ${args}`);
+        },
+    },
+    {
+        name: 'restart', summary: 'restart the agent, resuming its context',
+        execute: noArgs('/restart', ctx => ctx.restart('keep')),
+    },
+    {
+        name: 'force-restart', summary: 'restart the agent FRESH (context wiped)',
+        execute: noArgs('/force-restart', ctx => ctx.restart('fresh')),
+    },
+    {
+        name: 'ls', summary: 'list running fleet sessions',
+        execute: noArgs('/ls', async (ctx) => ctx.reply(`📊 Fleet sessions:\n${tail(stripMultiline(await ctx.fleetList(), 10_000), REPLY_MAX_CHARS)}`)),
+    },
+    {
+        name: 'peek', summary: 'summarize recent session activity (event shapes only, no content)',
+        execute: noArgs('/peek', async (ctx) => {
+            const lines = ctx.recentEvents(20).map(event => ['·', event.kind,
+                ...(event.title !== undefined ? [strip(event.title, 80)] : []),
+                ...(event.status !== undefined ? [`(${strip(event.status, 40)})`] : []),
+                ...(event.stopReason !== undefined ? [`(${strip(event.stopReason, 40)})`] : []),
+            ].join(' '));
+            await ctx.reply(lines.length
+                ? tail(`📊 Recent activity for ${ctx.role}:\n${lines.join('\n')}`, REPLY_MAX_CHARS)
+                : `📊 No recent session activity recorded for ${ctx.role}.`);
+        }),
+    },
+    {
+        name: 'worklog', summary: "tail the agent's worklog",
+        execute: noArgs('/worklog', async (ctx) => {
+            const worklog = await ctx.readWorklogTail(REPLY_MAX_CHARS);
+            await ctx.reply(worklog
+                ? `📊 Worklog tail for ${ctx.role}:\n${worklog}`
+                : `ℹ️ No worklog found for ${ctx.role}.`);
+        }),
+    },
+    {
+        name: 'version', summary: 'report the fleet version',
+        execute: noArgs('/version', async (ctx) => ctx.reply(`ℹ️ ours-fleet ${ctx.version}`)),
+    },
+];
+/** Trimmed slash-prefixed text is a command attempt and is never forwarded. */
+export const isOwnerCommandText = (text) => text.trim().startsWith('/');
+export function ownerCommandHelp(error) {
+    const table = ownerCommands
+        .map(command => `${command.usage ?? `/${command.name}`} — ${command.summary}`)
+        .join('\n');
+    return `${error ? `⚠️ ${error}\n\n` : ''}🧭 Deterministic owner-channel commands `
+        + '(handled by fleet; never sent to the agent as a prompt):\n'
+        + `${table}\n`
+        + 'Messages without a leading "/" reach the agent unchanged. '
+        + 'Unknown or malformed commands return this help.';
+}
+/**
+ * Execute one authenticated owner command. `text` must already be trimmed,
+ * slash-prefixed, and from an authorized owner CID — the channel enforces the
+ * authority boundary before dispatch ever sees the message.
+ */
+export async function dispatchOwnerCommand(text, ctx) {
+    const trimmed = text.trim();
+    const token = trimmed.split(/\s+/, 1)[0];
+    const name = token.slice(1).toLowerCase();
+    const args = trimmed.slice(token.length).trim();
+    const command = ownerCommands.find(entry => entry.name === name || entry.aliases?.includes(name));
+    if (!command)
+        return ctx.reply(ownerCommandHelp(`unknown command ${strip(token, 60)}`));
+    try {
+        await command.execute(ctx, args);
+    }
+    catch (error) {
+        if (error instanceof OwnerCommandUsageError)
+            return ctx.reply(ownerCommandHelp(error.message));
+        // The failure notice carries no internal detail; the channel logs it.
+        await ctx.reply(ownerNotices.commandFailed(command.usage ?? `/${command.name}`));
+        throw error;
+    }
+}
+/**
+ * Production fleet effects: the detached ours-fleet CLI. The restart child is
+ * detached and unreferenced because a successful restart kills this very
+ * process; the reply and the durable wire record must already be on disk.
+ */
+export function fleetCliOps(role, configPath) {
+    const cli = (args) => [process.argv[1], ...args, ...(configPath ? ['-c', configPath] : [])];
+    return {
+        restart: mode => new Promise((resolve, reject) => {
+            const child = spawn(process.execPath, cli([mode === 'fresh' ? 'force-restart' : 'restart', role]), { detached: true, stdio: 'ignore' });
+            child.once('error', reject);
+            child.once('spawn', () => { child.unref(); resolve(); });
+        }),
+        list: () => new Promise((resolve, reject) => {
+            execFile(process.execPath, [process.argv[1], 'ls'], { timeout: 15_000, maxBuffer: 256 * 1024 }, (error, stdout) => error ? reject(error) : resolve(String(stdout).trim()));
+        }),
+    };
+}

package/dist/owner-channel/notices.d.ts

@@ -9,6 +9,11 @@ export declare const ownerNotices: {
     status: (role: string, snapshot: SessionSnapshot) => string;
     interrupted: (role: string) => string;
     interruptFailed: (role: string) => string;
+    commandStarted: (command: string) => string;
+    commandOutcome: (command: string, outcome: TurnOutcome, output?: string) => string;
+    commandFailed: (command: string) => string;
+    commandUnsupported: (command: string, harness: string) => string;
+    restarting: (role: string, command: string, mode: "keep" | "fresh") => string;
     attachmentRejected: (reason: string) => string;
     attachmentFailed: () => string;
     deliveryFailed: (role: string) => string;

package/dist/owner-channel/notices.js

@@ -22,6 +22,23 @@ export const ownerNotices = {
     status: (role, snapshot) => `📊 ${role} status: ${snapshot.readiness}; session is ${snapshot.alive ? 'online' : 'offline'}.`,
     interrupted: (role) => `🛑 Interrupt sent to ${role}'s active turn.`,
     interruptFailed: (role) => `⚠️ Could not interrupt ${role}'s active turn.`,
+    commandStarted: (command) => `⏳ Running ${command} — the result will follow in this channel.`,
+    commandOutcome: (command, outcome, output) => {
+        switch (outcome) {
+            case 'completed': return `✅ ${command} completed.${output ? `\n${output}` : ''}`;
+            case 'cancelled': return `🛑 ${command} was cancelled before completion.`;
+            case 'refused': return `⚠️ ${command} was declined by the agent harness.`;
+            case 'failed': return `⚠️ ${command} failed before completion.`;
+            case 'inconclusive': return `⚠️ ${command} ended without a confirmed completion.`;
+        }
+    },
+    commandFailed: (command) => `⚠️ ${command} could not be executed.`,
+    commandUnsupported: (command, harness) => `⚠️ ${command} is not supported on the '${harness}' harness: its bundled ACP `
+        + 'adapter does not execute it locally, so forwarding it would deliver the '
+        + 'text to the model as an ordinary prompt. Nothing was forwarded.',
+    restarting: (role, command, mode) => `ℹ️ ${command} accepted — restarting ${role} ${mode === 'fresh'
+        ? 'FRESH (context wiped)' : '(context resumes)'}. `
+        + 'The channel goes quiet during the restart and resumes when the agent is back.',
     attachmentRejected: (reason) => `⚠️ Attachment rejected: ${reason}.`,
     attachmentFailed: () => '⚠️ Could not securely retrieve or admit this attachment request.',
     deliveryFailed: (role) => `⚠️ Could not deliver this request to ${role}.`,

package/dist/runner.js

@@ -520,11 +520,13 @@ export async function runOnce(name, opts = {}, partialDeps = {}) {
         if (role.owner_channel) {
             ownerChannel = deps.createOwnerChannel({
                 role: name,
+                harness: role.harness,
                 config: role.owner_channel,
                 session: arbiter,
                 stateDir: dir,
                 env: role.env,
                 log: deps.log,
+                ...(configPath ? { configPath } : {}),
             });
             try {
                 await ownerChannel.start();

package/dist/web/access.d.ts

@@ -0,0 +1,19 @@
+export type WebAccessMode = 'pairing' | 'password' | 'none';
+export interface WebAccessConfig {
+    version: 1;
+    mode: WebAccessMode;
+    password?: {
+        salt: string;
+        hash: string;
+    };
+}
+export declare function passwordAccess(password: string): WebAccessConfig;
+export declare function verifyPassword(config: WebAccessConfig, supplied: string): boolean;
+export declare class WebAccessStore {
+    private readonly dir;
+    readonly path: string;
+    constructor(dir?: string);
+    read(): WebAccessConfig;
+    write(config: WebAccessConfig): void;
+}
+export declare function validatePublicOrigin(value: string): URL;

package/dist/web/access.js

@@ -0,0 +1,70 @@
+import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+import { chmodSync, lstatSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { FleetError } from '../application/errors.js';
+import { stateRoot } from '../paths.js';
+const DEFAULT = { version: 1, mode: 'pairing' };
+const b64 = /^[A-Za-z0-9_-]{20,128}$/;
+export function passwordAccess(password) {
+    if (password.length < 12 || Buffer.byteLength(password) > 1024)
+        throw new FleetError('invalid_request', 'control-panel password must be 12–1024 bytes');
+    const salt = randomBytes(16).toString('base64url');
+    return { version: 1, mode: 'password', password: {
+            salt, hash: scryptSync(password, salt, 32).toString('base64url'),
+        } };
+}
+export function verifyPassword(config, supplied) {
+    if (config.mode !== 'password' || !config.password || Buffer.byteLength(supplied) > 1024)
+        return false;
+    const actual = scryptSync(supplied, config.password.salt, 32);
+    const expected = Buffer.from(config.password.hash, 'base64url');
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+export class WebAccessStore {
+    dir;
+    path;
+    constructor(dir = join(stateRoot(), 'web')) {
+        this.dir = dir;
+        this.path = join(dir, 'access.json');
+    }
+    read() {
+        try {
+            const stat = lstatSync(this.path);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16 * 1024)
+                throw new FleetError('forbidden', 'web access configuration is not a safe regular file');
+            chmodSync(this.path, 0o600);
+            const value = JSON.parse(readFileSync(this.path, 'utf8'));
+            if (value.version !== 1 || !['pairing', 'password', 'none'].includes(value.mode ?? ''))
+                throw new FleetError('forbidden', 'web access configuration is invalid');
+            if (value.mode === 'password' && (!value.password || !b64.test(value.password.salt)
+                || !b64.test(value.password.hash)))
+                throw new FleetError('forbidden', 'web password configuration is invalid');
+            return value;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return DEFAULT;
+            throw error;
+        }
+    }
+    write(config) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        chmodSync(this.dir, 0o700);
+        replaceFileAtomically(this.path, JSON.stringify(config, null, 2) + '\n', 0o600);
+        chmodSync(this.path, 0o600);
+    }
+}
+export function validatePublicOrigin(value) {
+    let origin;
+    try {
+        origin = new URL(value);
+    }
+    catch {
+        throw new FleetError('invalid_request', 'public origin must be an absolute http(s) URL');
+    }
+    if (!['http:', 'https:'].includes(origin.protocol) || origin.username || origin.password
+        || origin.pathname !== '/' || origin.search || origin.hash)
+        throw new FleetError('invalid_request', 'public origin must contain only scheme, host, and optional port');
+    return origin;
+}

package/dist/web/auth.d.ts

@@ -1,6 +1,7 @@
 import type { FastifyRequest } from 'fastify';
 import type { WebSocket } from 'ws';
 import { TrustedDeviceStore, type TrustedDeviceIssue } from './device-store.js';
+import { type WebAccessConfig } from './access.js';
 export interface BrowserSession {
     id: string;
     csrf: string;
@@ -24,6 +25,7 @@ export declare class WebAuth {
     private _host;
     private readonly now;
     private readonly devices;
+    private readonly access;
     private _bootstrapSecret;
     private bootstrapExpiresAt;
     private bootstrapUsed;
@@ -32,15 +34,24 @@ export declare class WebAuth {
     private readonly tickets;
     private readonly rates;
     private readonly sockets;
-    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore);
+    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig);
     get bootstrapSecret(): string;
     get origin(): string;
     get host(): string;
-    setBoundary(origin: string, host: string): void;
+    get mode(): WebAccessConfig['mode'];
+    get secureCookies(): boolean;
+    private allowedOrigins;
+    private allowedHosts;
+    setBoundary(origin: string, host: string, aliases?: {
+        origins?: string[];
+        hosts?: string[];
+    }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
     validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
+    login(request: FastifyRequest, password: string): AuthResult;
+    anonymous(request: FastifyRequest): BrowserSession;
     resume(request: FastifyRequest): AuthResult;
     authenticate(request: FastifyRequest, mutation?: boolean): BrowserSession;
     logout(request: FastifyRequest): void;