@ours.network/fleet 1.2.0-nightly.19 → 1.2.0-nightly.20

package/dist/temp-idle.js

@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+export const TEMP_CHAT_IDLE_MS = 24 * 60 * 60_000;
+const FILE = 'chat-idle.json';
+export function readChatIdle(dir) {
+    if (!existsSync(join(dir, FILE)))
+        return undefined;
+    const value = JSON.parse(readFileSync(join(dir, FILE), 'utf8'));
+    if (value.version !== 1 || !Number.isSafeInteger(value.lastActivityAt) || value.timeoutMs !== TEMP_CHAT_IDLE_MS)
+        throw new Error('Invalid persisted chat idle policy');
+    return value;
+}
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export class TemporaryChatIdle {
+    dir;
+    value;
+    busy = false;
+    constructor(dir, now) {
+        this.dir = dir;
+        this.value = readChatIdle(dir) ?? { version: 1, timeoutMs: TEMP_CHAT_IDLE_MS, lastActivityAt: now };
+        this.save();
+    }
+    save() { replaceFileAtomically(join(this.dir, FILE), JSON.stringify(this.value) + '\n', 0o600); }
+    observe(snapshot, queueDepth, now) {
+        // Unknown activity evidence never grants permission to retire a session.
+        const idle = snapshot.alive && snapshot.readiness === 'idle' && !snapshot.pendingPermissionId && queueDepth === 0 && snapshot.activity?.activeToolCalls === 0;
+        const update = Date.parse(snapshot.activity?.lastUpdateAt ?? '');
+        let next = this.value.lastActivityAt;
+        if (Number.isFinite(update) && update <= now)
+            next = Math.max(next, update);
+        if (!idle || this.busy)
+            next = Math.max(next, now);
+        this.busy = !idle;
+        // Active work checkpoints at most once a minute, with an immediate idle boundary write.
+        if (next > this.value.lastActivityAt && (idle || next - this.value.lastActivityAt >= 60_000)) {
+            this.value.lastActivityAt = next;
+            this.save();
+        }
+        return idle && now >= this.value.lastActivityAt && now - this.value.lastActivityAt >= this.value.timeoutMs;
+    }
+}

package/dist/temp-lifecycle.d.ts

@@ -5,7 +5,7 @@ export declare const TEMP_STOP_REQUEST_FILE = ".temp-stop-request.json";
 export declare const TEMP_RECLAIM_BATCH = 32;
 export declare const TEMP_LAUNCH_GRACE_MS = 60000;
 export type TempSupervisorKind = 'systemd-transient' | 'launchd-transient' | 'detached';
-export type TempTerminationReason = 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
+export type TempTerminationReason = 'idle-timeout' | 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
 export interface TempSupervisorRecord {
     version: 1;
     role: string;

package/dist/temp-lifecycle.js

@@ -59,7 +59,7 @@ export function makeTempSupervisorLauncher(options = {}) {
     const supervisor = options.supervisor ?? process.env.OURS_FLEET_SUPERVISOR;
     return async (binPath, args, dir) => {
         const inherited = [
-            'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'CODEX_HOME',
+            'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_FLEET_SOCKET_ROOT', 'CODEX_HOME',
             // Preserve runtime selection across the service-manager boundary, including
             // an explicit empty value which selects the bundle over manager defaults.
             'CODEX_PATH',

package/dist/web/agent-attachments.d.ts

@@ -0,0 +1,29 @@
+export declare const MAX_ATTACHMENT_BYTES: number;
+export declare const MAX_ATTACHMENT_BODY: number;
+export interface AgentAttachment {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+    generation: string;
+}
+export declare function storeAgentAttachment(stateDir: string, generation: string, input: unknown): AgentAttachment;
+export declare function attachmentPrompt(stateDir: string, generation: string, ids: unknown, text: string): string;
+export declare function readAgentAttachment(stateDir: string, id: string): {
+    record: AgentAttachment;
+    bytes: Buffer;
+};
+interface AttachmentPresentation {
+    generation: string;
+    commandId: string;
+    text: string;
+    transportDigest: string;
+    ids: string[];
+}
+/** Written before admission so a lost HTTP response cannot lose the visible message. */
+export declare function storeAttachmentPresentation(stateDir: string, value: AttachmentPresentation): void;
+export declare function prepareAttachmentPresentation(stateDir: string, generation: string, commandId: string, ids: string[], text: string, transport: string): void;
+/** Never infer attachments by stripping user text or interpreting a marker. */
+export declare function presentAttachmentEvent<T>(stateDir: string | undefined, roleId: string, event: T): T;
+export {};

package/dist/web/agent-attachments.js

@@ -0,0 +1,162 @@
+import { createHash } from 'node:crypto';
+import { constants, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FleetError } from '../application/errors.js';
+export const MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+export const MAX_ATTACHMENT_BODY = Math.ceil(MAX_ATTACHMENT_BYTES / 3) * 4 + 4096;
+function fail(message) { throw new FleetError('invalid_request', message); }
+const digest = (data) => createHash('sha256').update(data).digest('hex');
+function directory(path, create = false, privateStorage = true) {
+    if (create && !existsSync(path))
+        mkdirSync(path, { mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & (privateStorage ? 0o022 : 0o002)))
+        fail('Attachment directory is not a private owned directory');
+}
+function read(path, max) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+            fail('Attachment is not a bounded owned regular file');
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function immutable(path, bytes) {
+    try {
+        writeFileSync(path, bytes, { flag: 'wx', mode: 0o400 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        if (!read(path, bytes.length).equals(bytes))
+            fail('Attachment content changed');
+    }
+}
+function filename(name) {
+    const chars = Array.from(name.replace(/[^\p{L}\p{N}._-]/gu, '_').replace(/^\.+/, '_'));
+    while (Buffer.byteLength(chars.join('')) > 120)
+        chars.pop();
+    return chars.join('') || 'file';
+}
+export function storeAgentAttachment(stateDir, generation, input) {
+    if (!input || typeof input !== 'object')
+        fail('File data is required');
+    const body = input;
+    if (typeof body.name !== 'string' || !body.name.trim() || body.name.length > 240 || /[\x00-\x1f]/u.test(body.name))
+        fail('A file name of 1–240 characters is required');
+    if (typeof body.mimeType !== 'string' || !/^[a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+$/.test(body.mimeType))
+        fail('A valid media type is required');
+    if (typeof body.data !== 'string' || body.data.length > Math.ceil(MAX_ATTACHMENT_BYTES / 3) * 4 || /[^A-Za-z0-9+/=]/.test(body.data))
+        fail('Invalid base64 file data or file exceeds 20 MiB');
+    const bytes = Buffer.from(body.data, 'base64');
+    if (bytes.length > MAX_ATTACHMENT_BYTES || bytes.toString('base64') !== body.data)
+        fail('Invalid file data or file exceeds 20 MiB');
+    const sha256 = digest(bytes), name = body.name, mimeType = body.mimeType;
+    const id = digest(JSON.stringify({ generation, name, mimeType, sha256 }));
+    const record = { id, name, mimeType, size: bytes.length, sha256, generation };
+    // Fleet runtime state directories may use the account group (0775). Upload storage remains private.
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root, true);
+    const dir = join(root, id);
+    directory(dir, true);
+    immutable(join(dir, 'content-' + filename(name)), bytes);
+    immutable(join(dir, 'metadata.json'), Buffer.from(JSON.stringify(record)));
+    return record;
+}
+export function attachmentPrompt(stateDir, generation, ids, text) {
+    if (!Array.isArray(ids) || ids.length < 1 || ids.length > 5 || new Set(ids).size !== ids.length)
+        fail('Select between 1 and 5 distinct attachments');
+    // Fleet runtime state directories may use the account group (0775). Upload storage remains private.
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root);
+    const files = ids.map(id => {
+        if (typeof id !== 'string' || !/^[a-f0-9]{64}$/.test(id))
+            fail('Invalid attachment ID');
+        const dir = join(root, id);
+        directory(dir);
+        const record = JSON.parse(read(join(dir, 'metadata.json'), 4096).toString());
+        if (record.id !== id || record.generation !== generation)
+            throw new FleetError('stale_state', 'Attachment belongs to a different agent session');
+        const file = join(dir, 'content-' + filename(record.name)), bytes = read(file, MAX_ATTACHMENT_BYTES);
+        if (bytes.length !== record.size || digest(bytes) !== record.sha256 || digest(JSON.stringify({ generation, name: record.name, mimeType: record.mimeType, sha256: record.sha256 })) !== id)
+            fail('Attachment content changed');
+        return { name: record.name, mimeType: record.mimeType, size: record.size, sha256: record.sha256, path: file };
+    });
+    return `${text}${text ? '\n\n' : ''}Attached files (available on this host; open the files to inspect their contents, and use the image viewer for images):\n${JSON.stringify(files, null, 2)}`;
+}
+/** Authenticated content access reuses the same ownership and integrity checks as admission. */
+function attachmentMetadata(stateDir, id) {
+    if (!/^[a-f0-9]{64}$/.test(id))
+        fail('Invalid attachment ID');
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root);
+    const dir = join(root, id);
+    directory(dir);
+    const record = JSON.parse(read(join(dir, 'metadata.json'), 4096).toString());
+    if (record.id !== id || typeof record.name !== 'string' || typeof record.mimeType !== 'string')
+        fail('Invalid attachment metadata');
+    if (digest(JSON.stringify({ generation: record.generation, name: record.name, mimeType: record.mimeType, sha256: record.sha256 })) !== id)
+        fail('Attachment metadata changed');
+    return record;
+}
+export function readAgentAttachment(stateDir, id) {
+    let record;
+    try {
+        record = attachmentMetadata(stateDir, id);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new FleetError('resource_not_found', 'Attachment not found');
+        throw error;
+    }
+    const bytes = read(join(stateDir, 'web-attachments', id, 'content-' + filename(record.name)), MAX_ATTACHMENT_BYTES);
+    if (bytes.length !== record.size || digest(bytes) !== record.sha256)
+        fail('Attachment content changed');
+    return { record, bytes };
+}
+/** Written before admission so a lost HTTP response cannot lose the visible message. */
+export function storeAttachmentPresentation(stateDir, value) {
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachment-messages');
+    directory(root, true);
+    immutable(join(root, digest(JSON.stringify([value.generation, value.commandId])) + '.json'), Buffer.from(JSON.stringify(value)));
+}
+export function prepareAttachmentPresentation(stateDir, generation, commandId, ids, text, transport) {
+    storeAttachmentPresentation(stateDir, { generation, commandId, ids, text, transportDigest: digest(transport) });
+}
+/** Never infer attachments by stripping user text or interpreting a marker. */
+export function presentAttachmentEvent(stateDir, roleId, event) {
+    const e = event;
+    if (!stateDir || e.kind !== 'prompt.admitted' || e.source !== 'owner_admin_console' || !e.commandId || e.payload?.text?.redacted)
+        return event;
+    const root = join(stateDir, 'web-attachment-messages');
+    if (!existsSync(root))
+        return event;
+    const path = join(root, digest(JSON.stringify([e.sessionGeneration, e.commandId])) + '.json');
+    if (!existsSync(path))
+        return event;
+    try {
+        directory(stateDir, false, false);
+        directory(root);
+        const value = JSON.parse(read(path, 1024 * 1024).toString());
+        if (value.generation !== e.sessionGeneration || value.commandId !== e.commandId || value.transportDigest !== digest(e.payload.text.text))
+            return event;
+        const attachments = value.ids.map(id => {
+            const record = attachmentMetadata(stateDir, id);
+            if (record.generation !== value.generation)
+                fail('Attachment session changed');
+            return { id, name: record.name, mimeType: record.mimeType, size: record.size, url: `/api/v1/roles/${encodeURIComponent(roleId)}/attachments/${id}` };
+        });
+        return { ...e, payload: { ...e.payload, text: { type: 'text', text: value.text, bytes: Buffer.byteLength(value.text) }, displayText: { type: 'text', text: value.text, bytes: Buffer.byteLength(value.text) }, attachments } };
+    }
+    catch {
+        return event;
+    }
+}

package/dist/web/auth.d.ts

@@ -33,6 +33,7 @@ export declare class WebAuth {
     private readonly sessionDevices;
     private readonly tickets;
     private readonly rates;
+    private readonly transports;
     private readonly sockets;
     constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig);
     get bootstrapSecret(): string;
@@ -48,7 +49,7 @@ export declare class WebAuth {
     }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
-    validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
+    validateBoundary(request: FastifyRequest, requireOrigin: boolean, allowPageNavigation?: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;
     anonymous(request: FastifyRequest): BrowserSession;
@@ -61,6 +62,8 @@ export declare class WebAuth {
     };
     consumeTicket(request: FastifyRequest, value: string, purpose: Ticket['purpose'], roleId?: string): BrowserSession;
     bindSocket(sessionId: string, socket: WebSocket): void;
+    /** Raw service streams share the same logout/revocation boundary as native sockets. */
+    bindTransport(sessionId: string, close: () => void): () => void;
     clearSessions(): void;
     revokeAllTrustedDevices(): number;
     shutdown(): void;

package/dist/web/auth.js

@@ -21,6 +21,7 @@ export class WebAuth {
     sessionDevices = new Map();
     tickets = new Map();
     rates = new Map();
+    transports = new Map();
     sockets = new Map();
     constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }) {
         this._origin = _origin;
@@ -49,7 +50,7 @@ export class WebAuth {
         this.bootstrapUsed = false;
         return this._bootstrapSecret;
     }
-    validateBoundary(request, requireOrigin) {
+    validateBoundary(request, requireOrigin, allowPageNavigation = false) {
         const host = request.headers.host;
         const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);
         const origins = this.allowedOrigins.size ? this.allowedOrigins : new Set([this.origin]);
@@ -58,7 +59,9 @@ export class WebAuth {
         if (requireOrigin && (!request.headers.origin || !origins.has(request.headers.origin)))
             throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
         const fetchSite = request.headers['sec-fetch-site'];
-        if (fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
+        const pageNavigation = allowPageNavigation && !requireOrigin && request.method === 'GET'
+            && request.headers['sec-fetch-mode'] === 'navigate' && request.headers['sec-fetch-dest'] === 'document';
+        if (!pageNavigation && fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
             throw new FleetError('forbidden', 'cross-site request rejected');
     }
     exchange(request) {
@@ -156,7 +159,22 @@ export class WebAuth {
         sockets.add(socket);
         socket.once('close', () => sockets?.delete(socket));
     }
+    /** Raw service streams share the same logout/revocation boundary as native sockets. */
+    bindTransport(sessionId, close) {
+        let transports = this.transports.get(sessionId);
+        if (!transports) {
+            transports = new Set();
+            this.transports.set(sessionId, transports);
+        }
+        transports.add(close);
+        return () => { transports.delete(close); if (!transports.size)
+            this.transports.delete(sessionId); };
+    }
     clearSessions() {
+        for (const transports of this.transports.values())
+            for (const close of transports)
+                close();
+        this.transports.clear();
         for (const sockets of this.sockets.values())
             for (const socket of sockets)
                 socket.close(4401, 'authentication revoked');
@@ -182,6 +200,9 @@ export class WebAuth {
         return session;
     }
     removeSession(id) {
+        for (const close of this.transports.get(id) ?? [])
+            close();
+        this.transports.delete(id);
         this.sessions.delete(id);
         this.sessionDevices.delete(id);
         for (const [ticket, value] of this.tickets)

package/dist/web/control.js

@@ -1,9 +1,10 @@
+import { socketPath as privateSocketPath } from '../socket-path.js';
 import { chmodSync, mkdirSync, rmSync } from 'node:fs';
 import { createConnection, createServer } from 'node:net';
 import { join } from 'node:path';
 import { FleetError, safeLine } from '../application/errors.js';
 import { stateRoot } from '../paths.js';
-export const webControlPath = (dir = join(stateRoot(), 'web')) => join(dir, 'control.sock');
+export const webControlPath = (dir = join(stateRoot(), 'web')) => privateSocketPath(join(dir, 'control.sock'));
 export async function startWebControlServer(options) {
     const dir = options.dir ?? join(stateRoot(), 'web');
     const path = webControlPath(dir);

package/dist/web/fleet-config-service.d.ts

@@ -4,6 +4,9 @@ export interface EditableFleetModel {
     manifest: Record<string, unknown>;
     agents: Record<string, Record<string, unknown>>;
     agent_templates: Record<string, Record<string, unknown>>;
+    roles?: Record<string, Record<string, unknown>>;
+    brains?: Record<string, Record<string, unknown>>;
+    room_templates?: Record<string, Record<string, unknown>>;
 }
 export interface ConfigReadResult {
     path: string;
@@ -45,7 +48,7 @@ export declare class FleetConfigService {
     private readonly preflight;
     private readonly beforeMutation?;
     constructor(options?: FleetConfigServiceOptions);
-    read(): ConfigReadResult;
+    read(includeDefinitions?: boolean): ConfigReadResult;
     preview(baseRevision: string, input: unknown): Promise<ConfigPreviewResult>;
     write(baseRevision: string, input: unknown): Promise<ConfigWriteResult>;
 }

package/dist/web/fleet-config-service.js

@@ -23,7 +23,7 @@ export class FleetConfigService {
         this.preflight = options.preflight ?? (async () => emptyReport());
         this.beforeMutation = options.beforeMutation;
     }
-    read() {
+    read(includeDefinitions = false) {
         const sources = readSources(this.path);
         try {
             loadConfig(this.path, { yamlMode: 'strict' });
@@ -31,7 +31,7 @@ export class FleetConfigService {
         catch (error) {
             throw safeError(error, sourceSensitiveValues(sources));
         }
-        const raw = modelFrom(sources);
+        const raw = modelFrom(sources, includeDefinitions);
         const redacted = redactModel(raw);
         return {
             path: basename(this.path), exists: true, firstRun: false,
@@ -41,7 +41,7 @@ export class FleetConfigService {
     async preview(baseRevision, input) {
         const current = readSources(this.path);
         assertRevision(baseRevision, current);
-        const currentModel = modelFrom(current);
+        const currentModel = modelFrom(current, !!input && typeof input === 'object' && 'roles' in input);
         const next = restoreRedactions(assertModel(input), currentModel, new Set(redactModel(currentModel).paths));
         const proposal = renderProposal(current, next);
         const staged = stageProposal(this.path, current, proposal);
@@ -63,7 +63,7 @@ export class FleetConfigService {
         return withFileLock(`${splitRootFor(this.path)}.web-edit.lock`, async () => {
             const current = readSources(this.path);
             assertRevision(baseRevision, current);
-            const currentModel = modelFrom(current);
+            const currentModel = modelFrom(current, !!input && typeof input === 'object' && 'roles' in input);
             const next = restoreRedactions(assertModel(input), currentModel, new Set(redactModel(currentModel).paths));
             const proposal = renderProposal(current, next);
             const changed = changedDocuments(current, proposal);
@@ -105,6 +105,8 @@ export class FleetConfigService {
                         rmSync(target, { force: true });
                     else {
                         assertWritableTarget(target, current.documents.has(rel));
+                        mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
+                        trustedDirectory(dirname(target));
                         replaceFileAtomically(target, contents, 0o600);
                         chmodSync(target, 0o600);
                     }
@@ -184,7 +186,7 @@ function readSources(manifest) {
     }
     return { manifest, root, documents };
 }
-function modelFrom(sources) {
+function modelFrom(sources, includeDefinitions = false) {
     const manifestKey = basename(sources.manifest);
     const manifest = parseFleetDocument(sources.manifest, sources.documents.get(manifestKey), 'strict').value;
     const agents = {};
@@ -199,15 +201,24 @@ function modelFrom(sources) {
             const id = basename(rel, extname(rel));
             agent_templates[id] = parseFleetDocument(absoluteFor(sources.manifest, rel), source, 'strict').value;
         }
-    return { manifest, agents, agent_templates };
+    const model = { manifest, agents, agent_templates };
+    if (includeDefinitions)
+        for (const kind of ['roles', 'brains', 'room_templates']) {
+            model[kind] = {};
+            for (const [rel, source] of sources.documents)
+                if (rel.startsWith(kind + '/') && ['.yaml', '.yml'].includes(extname(rel))) {
+                    model[kind][basename(rel, extname(rel))] = parseFleetDocument(absoluteFor(sources.manifest, rel), source, 'strict').value;
+                }
+        }
+    return model;
 }
 function assertModel(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         throw new FleetError('invalid_request', 'model must be an object');
     const input = value;
-    if (Object.keys(input).sort().join(',') !== 'agent_templates,agents,manifest')
-        throw new FleetError('invalid_request', 'model allows exactly manifest, agents, and agent_templates');
-    for (const key of ['manifest', 'agents', 'agent_templates'])
+    if (!['agent_templates,agents,manifest', 'agent_templates,agents,brains,manifest,roles,room_templates'].includes(Object.keys(input).sort().join(',')))
+        throw new FleetError('invalid_request', 'model requires manifest, agents, agent_templates and optionally all definition collections');
+    for (const key of Object.keys(input))
         if (!input[key] || typeof input[key] !== 'object' || Array.isArray(input[key]))
             throw new FleetError('invalid_request', `${key} must be an object`);
     for (const [id, doc] of Object.entries(input.agents)) {
@@ -222,6 +233,14 @@ function assertModel(value) {
         if (!doc || typeof doc !== 'object' || Array.isArray(doc))
             throw new FleetError('invalid_request', `Agent Template '${id}' must be an object`);
     }
+    for (const kind of ['roles', 'brains', 'room_templates']) {
+        for (const [id, doc] of Object.entries((input[kind] ?? {}))) {
+            if (!ROLE_NAME_RE.test(id))
+                throw new FleetError('invalid_request', `invalid definition ID '${id}'`);
+            if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+                throw new FleetError('invalid_request', `definition '${id}' must be an object`);
+        }
+    }
     return structuredClone(input);
 }
 function renderProposal(current, model) {
@@ -240,9 +259,21 @@ function renderProposal(current, model) {
         next.set(oldRel ?? join('agent_templates', `${id}.yaml`), oldRel
             ? render(current.documents.get(oldRel), doc) : stringify(doc));
     }
-    for (const [rel, source] of current.documents)
-        if (rel.startsWith('roles/') || rel.startsWith('brains/') || rel.startsWith('room_templates/'))
-            next.set(rel, source);
+    for (const kind of ['roles', 'brains', 'room_templates']) {
+        if (model[kind] === undefined) {
+            for (const [rel, source] of current.documents)
+                if (rel.startsWith(kind + '/'))
+                    next.set(rel, source);
+            continue;
+        }
+        for (const [rel, source] of current.documents)
+            if (rel.startsWith(kind + '/') && !['.yaml', '.yml'].includes(extname(rel)))
+                next.set(rel, source);
+        for (const [id, doc] of Object.entries(model[kind])) {
+            const oldRel = [...current.documents.keys()].find(rel => rel.startsWith(kind + '/') && ['.yaml', '.yml'].includes(extname(rel)) && basename(rel, extname(rel)) === id);
+            next.set(oldRel ?? join(kind, `${id}.yaml`), oldRel ? render(current.documents.get(oldRel), doc) : stringify(doc));
+        }
+    }
     return next;
 }
 function render(source, model) {
@@ -395,9 +426,9 @@ function sourceDiff(before, after, label, secrets) {
         ...left.slice(left.length - tail, left.length - tail + trailing).map(x => ` ${x}`), ''].join('\n');
 }
 function proposalDiff(current, proposal) {
-    const secrets = sensitiveValues(modelFrom(current));
+    const secrets = sensitiveValues(modelFrom(current, true));
     try {
-        secrets.push(...sensitiveValues(modelFrom({ ...current, documents: proposal })));
+        secrets.push(...sensitiveValues(modelFrom({ ...current, documents: proposal }, true)));
     }
     catch { /* validation reports later */ }
     return [...new Set([...current.documents.keys(), ...proposal.keys()])].sort().map(rel => sourceDiff(current.documents.get(rel) ?? '', proposal.get(rel) ?? '', rel, secrets)).filter(Boolean).join('\n');
@@ -405,7 +436,7 @@ function proposalDiff(current, proposal) {
 function splitLines(source) { return source.replace(/\n$/, '').split('\n'); }
 function restartImpact(before, after) {
     const roles = [...new Set([...Object.keys(before.agents), ...Object.keys(after.agents)])]
-        .filter(id => JSON.stringify(before.agents[id]) !== JSON.stringify(after.agents[id])).sort();
+        .filter(id => JSON.stringify(before.agents[id]) !== JSON.stringify(after.agents[id]) || JSON.stringify(before.roles) !== JSON.stringify(after.roles) || JSON.stringify(before.brains) !== JSON.stringify(after.brains)).sort();
     const watchdogScheduler = JSON.stringify(before.manifest.watchdogs) !== JSON.stringify(after.manifest.watchdogs);
     const scheduledLoops = JSON.stringify(before.manifest.loops) !== JSON.stringify(after.manifest.loops);
     const required = roles.length > 0 || watchdogScheduler || scheduledLoops;

package/dist/web/prefix-gateway.d.ts

@@ -0,0 +1,20 @@
+import { type IncomingMessage } from 'node:http';
+import type { WebAuth } from './auth.js';
+/** Each entry exposes one dedicated backend listener. Endpoint dispatch stays upstream. */
+export interface ServiceTarget {
+    prefix: string;
+    origin: string;
+    /** Server-side service credentials; never taken from browser headers. */
+    headers?: Record<string, string>;
+}
+export interface GatewayOptions {
+    /** Backend mode is for a separate loopback machine-client listener; browsers are rejected. */
+    auth: WebAuth | 'backend';
+    fleetOrigin: string;
+    services: ServiceTarget[];
+}
+/** Raw transport deliberately runs outside Fastify's JSON parser and body limits. */
+export declare function createPrefixGateway(options: GatewayOptions): {
+    server: import("http").Server<typeof IncomingMessage, typeof import("http").ServerResponse>;
+    close(): Promise<void>;
+};