@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.21

package/dist/supervisor/systemd.js

@@ -1,3 +1,4 @@
+import { clientConfigPath } from '../client-profile.js';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { userInfo } from 'node:os';
@@ -69,30 +70,10 @@ export function makeSystemdBackend(exec = realExec) {
                     dirname(process.execPath),
                     ...(process.env.PATH ?? '').split(delimiter),
                 ].filter(Boolean))].join(delimiter);
-            // Same reason as PATH, for the other thing a lingering unit cannot inherit:
-            // WHICH ours daemon this fleet was set up against.
-            //
-            // ours-fleet resolves its daemon from OURS_CONFIG / OURS_PORT / OURS_STATE_DIR
-            // and otherwise falls back to ~/.ours and port 3050 (src/monitor.ts). A host
-            // set up against a non-default daemon — the installer's multi-daemon profiles
-            // do exactly this — passes that selection to `ours-fleet init` in the
-            // environment, and it died there: nothing persisted it, so every runner
-            // systemd started at boot resolved the default daemon again, and on a host
-            // where only the non-default daemon exists that is a daemon that is not there.
-            //
-            // ONLY OURS_CONFIG is baked, deliberately. It names which daemon, and leaves
-            // that daemon's own config file authoritative for port and state directory, so
-            // a later edit to it still wins. Baking OURS_PORT/OURS_STATE_DIR would freeze
-            // those into a unit file that outranks the config for ever after — the failure
-            // mode @ours.network/cli avoids for the same reason (packages/cli/src/
-            // service.ts: "The port is deliberately NOT baked").
-            //
-            // Absent from init's environment ⇒ no line, and the unit is byte-for-byte what
-            // it has always been. This teaches fleet nothing about installer profiles; it
-            // persists the selection fleet was initialised with.
+            // Persist one profile path, never a URL or service port. Profile updates
+            // are picked up by every fresh process, including lingering user services.
             const unitEnv = ['PATH=' + servicePath];
-            if (process.env.OURS_CONFIG)
-                unitEnv.push('OURS_CONFIG=' + process.env.OURS_CONFIG);
+            unitEnv.push('OURS_CONFIG=' + clientConfigPath(process.env));
             const environmentLines = unitEnv
                 .map(value => `Environment="${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%')}"`)
                 .join('\n');
@@ -100,10 +81,15 @@ export function makeSystemdBackend(exec = realExec) {
             writeFileSync(join(unitDir, UNIT_TEMPLATE), `[Unit]
 Description=ours-fleet agent %i
 After=default.target
+StartLimitIntervalSec=0
 
 [Service]
 Type=simple
 ${environmentLines}
+# Wait outside the runner so boot-time daemon unavailability cannot consume
+# the agent crash budget. Selection comes from the same role and profile.
+ExecStartPre=${unitArg(process.execPath)} ${unitArg(binPath)} _wait-daemon %i
+TimeoutStartSec=270
 ExecStart=${unitArg(process.execPath)} ${unitArg(binPath)} _run %i
 # The RUNNER owns the child-session restart loop, with a counted, backed-off
 # circuit breaker. systemd must only recover the runner PROCESS crashing —

package/dist/temp-idle.d.ts

@@ -0,0 +1,17 @@
+import type { SessionSnapshot } from './session/types.js';
+export declare const TEMP_CHAT_IDLE_MS: number;
+export type ChatIdlePolicy = {
+    version: 1;
+    timeoutMs: number;
+    lastActivityAt: number;
+};
+export declare function readChatIdle(dir: string): ChatIdlePolicy | undefined;
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export declare class TemporaryChatIdle {
+    private dir;
+    private value;
+    private busy;
+    constructor(dir: string, now: number);
+    private save;
+    observe(snapshot: SessionSnapshot, queueDepth: number, now: number): boolean;
+}

package/dist/temp-idle.js

@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+export const TEMP_CHAT_IDLE_MS = 24 * 60 * 60_000;
+const FILE = 'chat-idle.json';
+export function readChatIdle(dir) {
+    if (!existsSync(join(dir, FILE)))
+        return undefined;
+    const value = JSON.parse(readFileSync(join(dir, FILE), 'utf8'));
+    if (value.version !== 1 || !Number.isSafeInteger(value.lastActivityAt) || value.timeoutMs !== TEMP_CHAT_IDLE_MS)
+        throw new Error('Invalid persisted chat idle policy');
+    return value;
+}
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export class TemporaryChatIdle {
+    dir;
+    value;
+    busy = false;
+    constructor(dir, now) {
+        this.dir = dir;
+        this.value = readChatIdle(dir) ?? { version: 1, timeoutMs: TEMP_CHAT_IDLE_MS, lastActivityAt: now };
+        this.save();
+    }
+    save() { replaceFileAtomically(join(this.dir, FILE), JSON.stringify(this.value) + '\n', 0o600); }
+    observe(snapshot, queueDepth, now) {
+        // Unknown activity evidence never grants permission to retire a session.
+        const idle = snapshot.alive && snapshot.readiness === 'idle' && !snapshot.pendingPermissionId && queueDepth === 0 && snapshot.activity?.activeToolCalls === 0;
+        const update = Date.parse(snapshot.activity?.lastUpdateAt ?? '');
+        let next = this.value.lastActivityAt;
+        if (Number.isFinite(update) && update <= now)
+            next = Math.max(next, update);
+        if (!idle || this.busy)
+            next = Math.max(next, now);
+        this.busy = !idle;
+        // Active work checkpoints at most once a minute, with an immediate idle boundary write.
+        if (next > this.value.lastActivityAt && (idle || next - this.value.lastActivityAt >= 60_000)) {
+            this.value.lastActivityAt = next;
+            this.save();
+        }
+        return idle && now >= this.value.lastActivityAt && now - this.value.lastActivityAt >= this.value.timeoutMs;
+    }
+}

package/dist/temp-lifecycle.d.ts

@@ -5,7 +5,7 @@ export declare const TEMP_STOP_REQUEST_FILE = ".temp-stop-request.json";
 export declare const TEMP_RECLAIM_BATCH = 32;
 export declare const TEMP_LAUNCH_GRACE_MS = 60000;
 export type TempSupervisorKind = 'systemd-transient' | 'launchd-transient' | 'detached';
-export type TempTerminationReason = 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
+export type TempTerminationReason = 'idle-timeout' | 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
 export interface TempSupervisorRecord {
     version: 1;
     role: string;
@@ -44,6 +44,11 @@ export declare function makeTempSupervisorLauncher(options?: {
 }): SupervisorLauncher;
 export declare function markTempSupervisorActive(dir: string, pid?: number): Promise<void>;
 export declare function requestedTempStopReason(dir: string): 'operator-stop' | undefined;
+/** Explicit erasure removes only exact retired role/launch events. */
+export declare function eraseTerminationEvents(launches: ReadonlyArray<{
+    role: string;
+    launchId: string;
+}>): void;
 /** Move retired state out of the live roster without deleting any evidence. */
 export declare function archiveTempState(role: string, reason: TempTerminationReason, outcome: TempTerminationRecord['outcome'], detail: string, now?: Date): string | undefined;
 /** Resolve only an exact role+launch archive; names and timestamps are never proof. */

package/dist/temp-lifecycle.js

@@ -1,7 +1,7 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { basename, join } from 'node:path';
-import { replaceFileAtomically, withFileLock } from './atomic-file.js';
+import { replaceFileAtomically, withFileLock, withSynchronousFileLock } from './atomic-file.js';
 import { realExec } from './exec.js';
 import { stateRoot, tmpRoot } from './paths.js';
 export const TEMP_SUPERVISOR_FILE = '.temp-supervisor.json';
@@ -59,7 +59,7 @@ export function makeTempSupervisorLauncher(options = {}) {
     const supervisor = options.supervisor ?? process.env.OURS_FLEET_SUPERVISOR;
     return async (binPath, args, dir) => {
         const inherited = [
-            'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'CODEX_HOME',
+            'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_FLEET_SOCKET_ROOT', 'CODEX_HOME',
             // Preserve runtime selection across the service-manager boundary, including
             // an explicit empty value which selects the bundle over manager defaults.
             'CODEX_PATH',
@@ -133,18 +133,34 @@ function appendTermination(dir, record) {
     replaceFileAtomically(join(dir, TEMP_GLOBAL_TERMINATION_MARKER), line);
 }
 function appendGlobalTermination(line, checkExisting = false) {
-    mkdirSync(archiveRoot(), { recursive: true, mode: 0o700 });
-    const path = join(archiveRoot(), 'terminations.jsonl');
-    // Recovery may revisit a .retiring directory after a crash between the
-    // global append and final rename. Avoid duplicating that exact event.
-    if (checkExisting) {
-        try {
-            if (readFileSync(path, 'utf8').split('\n').includes(line.trimEnd()))
-                return;
+    withSynchronousFileLock(join(stateRoot(), 'locks', 'termination-journal'), () => {
+        mkdirSync(archiveRoot(), { recursive: true, mode: 0o700 });
+        const path = join(archiveRoot(), 'terminations.jsonl');
+        // Recovery may revisit a .retiring directory after a crash between the
+        // global append and final rename. Avoid duplicating that exact event.
+        if (checkExisting) {
+            try {
+                if (readFileSync(path, 'utf8').split('\n').includes(line.trimEnd()))
+                    return;
+            }
+            catch { /* the journal does not exist yet */ }
         }
-        catch { /* the journal does not exist yet */ }
-    }
-    appendFileSync(path, line, { mode: 0o600 });
+        appendFileSync(path, line, { mode: 0o600 });
+    });
+}
+/** Explicit erasure removes only exact retired role/launch events. */
+export function eraseTerminationEvents(launches) {
+    withSynchronousFileLock(join(stateRoot(), 'locks', 'termination-journal'), () => {
+        const path = join(archiveRoot(), 'terminations.jsonl');
+        if (!existsSync(path))
+            return;
+        const lines = readFileSync(path, 'utf8').split('\n').filter(Boolean);
+        const kept = lines.filter(line => {
+            const row = JSON.parse(line);
+            return !launches.some(launch => launch.role === row.role && launch.launchId === row.launchId);
+        });
+        replaceFileAtomically(path, kept.length ? kept.join('\n') + '\n' : '');
+    });
 }
 /** Pick a sibling path without overwriting evidence from an earlier attempt. */
 function collisionSafeArchivePaths(targetBase, retiringBase) {

package/dist/temp-supervisor-recovery.d.ts

@@ -0,0 +1,3 @@
+export declare const TEMP_RECYCLE_EXIT = 75;
+/** Keep the service's main process alive while replacing a PID-scoped worker. */
+export declare function runTempSupervisor(name: string, entrypoint: string, initial?: () => Promise<void>): Promise<void>;

package/dist/temp-supervisor-recovery.js

@@ -0,0 +1,46 @@
+import { spawn } from 'node:child_process';
+import { runTemp, SupervisorRecycleRequiredError } from './runner.js';
+export const TEMP_RECYCLE_EXIT = 75;
+/** Keep the service's main process alive while replacing a PID-scoped worker. */
+export async function runTempSupervisor(name, entrypoint, initial = () => runTemp(name)) {
+    try {
+        await initial();
+        return;
+    }
+    catch (error) {
+        if (!(error instanceof SupervisorRecycleRequiredError))
+            throw error;
+    }
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const child = spawn(process.execPath, [entrypoint, '_run-temp-worker', name], {
+            stdio: 'inherit',
+            env: process.env,
+        });
+        let stopping = false;
+        const term = () => {
+            stopping = true;
+            child.kill('SIGTERM');
+        }, interrupt = () => {
+            stopping = true;
+            child.kill('SIGINT');
+        };
+        process.on('SIGTERM', term);
+        process.on('SIGINT', interrupt);
+        let code;
+        try {
+            code = await new Promise((resolve, reject) => {
+                child.once('error', reject);
+                child.once('exit', resolve);
+            });
+        }
+        finally {
+            process.off('SIGTERM', term);
+            process.off('SIGINT', interrupt);
+        }
+        if (code === 0 || stopping)
+            return;
+        if (code !== TEMP_RECYCLE_EXIT)
+            throw Error(`Temporary supervisor replacement exited with ${code}`);
+    }
+    throw Error('Temporary supervisor recycle limit reached; identity retained for explicit recovery');
+}

package/dist/watchdog/briefing.js

@@ -5,22 +5,9 @@ import { formatDuration } from '../duration.js';
  * wasn't verified when configured, fall back to createTool on first run.
  */
 function bindSection(heading, wd, v, guarantee) {
-    const L = ['', heading];
-    L.push(`Call the **${v.bindTool}** tool with name "${wd.identity}" force=true (search the`);
-    L.push('deferred tool registry first if needed).');
-    if (guarantee === 'unverified') {
-        L.push(`- This identity was NOT verified when this watchdog was configured, so it may not`);
-        L.push(`  exist yet. If binding reports no such identity, call **${v.createTool}** name`);
-        L.push(`  "${wd.identity}" once to mint it on this first run, then you are bound. Re-binding`);
-        L.push('  your OWN identity is always allowed.');
-    }
-    else {
-        L.push(`- It was ${guarantee === 'created' ? 'created' : 'verified to exist'} when this`);
-        L.push('  watchdog was configured, so binding should succeed. If it unexpectedly reports no');
-        L.push(`  such identity, call **${v.createTool}** name "${wd.identity}" once and report the`);
-        L.push('  discrepancy — something removed it since.');
-    }
-    return L;
+    return ['', '## Assigned identity',
+        `Your supervisor has bound your identity **${wd.identity}**. The ours tools are ready.`,
+        'No identity setup or skill reading is required.'];
 }
 /**
  * Render a watchdog run's fixed contract (briefing.md-equivalent for a one-shot clean-context

package/dist/watchdog/run.js

@@ -1,3 +1,4 @@
+import { preparePermanentAssignment, releaseManagedAgent } from '../agent-ours/service.js';
 import { closeSync, existsSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { spawn as spawnChild } from 'node:child_process';
 import { join } from 'node:path';
@@ -7,8 +8,7 @@ import { acquireRunLock, formatRunId, pruneReports, releaseRunLock, writeReport
 import { generateNotifierBriefing, generateWatchdogBriefing } from './briefing.js';
 import { computeDigest, reconcileLedger, readLedger, writeLedger } from './alerts.js';
 import { applyRole } from '../ops.js';
-import { daemonIdentityInventoryProvisioner, ensureIdentity, } from '../creation.js';
-import { runOnce, START_STAGGER_FILE } from '../runner.js';
+import { runOnce, loadTempRole, START_STAGGER_FILE } from '../runner.js';
 import { agentDir, tmpRoot } from '../paths.js';
 import { loadConfig, ROLE_NAME_RE, } from '../config.js';
 import { getAdapter } from '../harness/registry.js';
@@ -53,6 +53,7 @@ async function killIfNeeded(reason, child, roleName, sleep) {
         if (reason === 'stable')
             await sleep(HARVEST_GRACE_MS);
         child.kill();
+        await child.exited;
     }
 }
 function defaultLaunchChild(binPath, roleName, runDir) {
@@ -139,7 +140,7 @@ export async function executeWatchdogRun(wd, deps) {
         rmSync(runDir, { recursive: true, force: true });
     let report;
     try {
-        const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityInventoryProvisioner(), deps.log);
+        const guarantee = { state: 'unverified' }; // The child supervisor provisions before its harness starts.
         const cfg = deps.cfg ?? loadConfig();
         const discovered = wd.watchExplicit
             ? []
@@ -272,7 +273,7 @@ export async function executeNotifierRun(wd, text, deps) {
         // A crashed previous run can leave the temp dir behind; start clean.
         if (existsSync(runDir))
             rmSync(runDir, { recursive: true, force: true });
-        const guarantee = await ensureIdentity(wd.identity, {}, deps.identityProvisioner ?? daemonIdentityInventoryProvisioner(), deps.log);
+        const guarantee = { state: 'unverified' }; // The child supervisor provisions before its harness starts.
         const cfg = deps.cfg ?? loadConfig();
         const role = buildWatchdogRole(wd, cfg);
         const dir = applyRole(role, { temp: true, identityGuarantee: guarantee.state });
@@ -317,5 +318,18 @@ export async function executeNotifierRun(wd, text, deps) {
 }
 /** What `_run-watchdog` calls: one supervised session, no cleanup — the parent harvests. */
 export async function runWatchdogAgent(name) {
-    await runOnce(name, { temp: true });
+    const role = loadTempRole(name);
+    await preparePermanentAssignment(role);
+    let stopping = false;
+    const stop = () => { stopping = true; };
+    process.on('SIGTERM', stop);
+    process.on('SIGINT', stop);
+    try {
+        await runOnce(name, { temp: true, identityLifetime: 'permanent' }, { shouldStop: () => stopping });
+    }
+    finally {
+        process.off('SIGTERM', stop);
+        process.off('SIGINT', stop);
+        await releaseManagedAgent(role);
+    }
 }

package/dist/web/agent-attachments.d.ts

@@ -0,0 +1,29 @@
+export declare const MAX_ATTACHMENT_BYTES: number;
+export declare const MAX_ATTACHMENT_BODY: number;
+export interface AgentAttachment {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+    generation: string;
+}
+export declare function storeAgentAttachment(stateDir: string, generation: string, input: unknown): AgentAttachment;
+export declare function attachmentPrompt(stateDir: string, generation: string, ids: unknown, text: string): string;
+export declare function readAgentAttachment(stateDir: string, id: string): {
+    record: AgentAttachment;
+    bytes: Buffer;
+};
+interface AttachmentPresentation {
+    generation: string;
+    commandId: string;
+    text: string;
+    transportDigest: string;
+    ids: string[];
+}
+/** Written before admission so a lost HTTP response cannot lose the visible message. */
+export declare function storeAttachmentPresentation(stateDir: string, value: AttachmentPresentation): void;
+export declare function prepareAttachmentPresentation(stateDir: string, generation: string, commandId: string, ids: string[], text: string, transport: string): void;
+/** Never infer attachments by stripping user text or interpreting a marker. */
+export declare function presentAttachmentEvent<T>(stateDir: string | undefined, roleId: string, event: T): T;
+export {};

package/dist/web/agent-attachments.js

@@ -0,0 +1,162 @@
+import { createHash } from 'node:crypto';
+import { constants, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FleetError } from '../application/errors.js';
+export const MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+export const MAX_ATTACHMENT_BODY = Math.ceil(MAX_ATTACHMENT_BYTES / 3) * 4 + 4096;
+function fail(message) { throw new FleetError('invalid_request', message); }
+const digest = (data) => createHash('sha256').update(data).digest('hex');
+function directory(path, create = false, privateStorage = true) {
+    if (create && !existsSync(path))
+        mkdirSync(path, { mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & (privateStorage ? 0o022 : 0o002)))
+        fail('Attachment directory is not a private owned directory');
+}
+function read(path, max) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+            fail('Attachment is not a bounded owned regular file');
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function immutable(path, bytes) {
+    try {
+        writeFileSync(path, bytes, { flag: 'wx', mode: 0o400 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        if (!read(path, bytes.length).equals(bytes))
+            fail('Attachment content changed');
+    }
+}
+function filename(name) {
+    const chars = Array.from(name.replace(/[^\p{L}\p{N}._-]/gu, '_').replace(/^\.+/, '_'));
+    while (Buffer.byteLength(chars.join('')) > 120)
+        chars.pop();
+    return chars.join('') || 'file';
+}
+export function storeAgentAttachment(stateDir, generation, input) {
+    if (!input || typeof input !== 'object')
+        fail('File data is required');
+    const body = input;
+    if (typeof body.name !== 'string' || !body.name.trim() || body.name.length > 240 || /[\x00-\x1f]/u.test(body.name))
+        fail('A file name of 1–240 characters is required');
+    if (typeof body.mimeType !== 'string' || !/^[a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+$/.test(body.mimeType))
+        fail('A valid media type is required');
+    if (typeof body.data !== 'string' || body.data.length > Math.ceil(MAX_ATTACHMENT_BYTES / 3) * 4 || /[^A-Za-z0-9+/=]/.test(body.data))
+        fail('Invalid base64 file data or file exceeds 20 MiB');
+    const bytes = Buffer.from(body.data, 'base64');
+    if (bytes.length > MAX_ATTACHMENT_BYTES || bytes.toString('base64') !== body.data)
+        fail('Invalid file data or file exceeds 20 MiB');
+    const sha256 = digest(bytes), name = body.name, mimeType = body.mimeType;
+    const id = digest(JSON.stringify({ generation, name, mimeType, sha256 }));
+    const record = { id, name, mimeType, size: bytes.length, sha256, generation };
+    // Fleet runtime state directories may use the account group (0775). Upload storage remains private.
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root, true);
+    const dir = join(root, id);
+    directory(dir, true);
+    immutable(join(dir, 'content-' + filename(name)), bytes);
+    immutable(join(dir, 'metadata.json'), Buffer.from(JSON.stringify(record)));
+    return record;
+}
+export function attachmentPrompt(stateDir, generation, ids, text) {
+    if (!Array.isArray(ids) || ids.length < 1 || ids.length > 5 || new Set(ids).size !== ids.length)
+        fail('Select between 1 and 5 distinct attachments');
+    // Fleet runtime state directories may use the account group (0775). Upload storage remains private.
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root);
+    const files = ids.map(id => {
+        if (typeof id !== 'string' || !/^[a-f0-9]{64}$/.test(id))
+            fail('Invalid attachment ID');
+        const dir = join(root, id);
+        directory(dir);
+        const record = JSON.parse(read(join(dir, 'metadata.json'), 4096).toString());
+        if (record.id !== id || record.generation !== generation)
+            throw new FleetError('stale_state', 'Attachment belongs to a different agent session');
+        const file = join(dir, 'content-' + filename(record.name)), bytes = read(file, MAX_ATTACHMENT_BYTES);
+        if (bytes.length !== record.size || digest(bytes) !== record.sha256 || digest(JSON.stringify({ generation, name: record.name, mimeType: record.mimeType, sha256: record.sha256 })) !== id)
+            fail('Attachment content changed');
+        return { name: record.name, mimeType: record.mimeType, size: record.size, sha256: record.sha256, path: file };
+    });
+    return `${text}${text ? '\n\n' : ''}Attached files (available on this host; open the files to inspect their contents, and use the image viewer for images):\n${JSON.stringify(files, null, 2)}`;
+}
+/** Authenticated content access reuses the same ownership and integrity checks as admission. */
+function attachmentMetadata(stateDir, id) {
+    if (!/^[a-f0-9]{64}$/.test(id))
+        fail('Invalid attachment ID');
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root);
+    const dir = join(root, id);
+    directory(dir);
+    const record = JSON.parse(read(join(dir, 'metadata.json'), 4096).toString());
+    if (record.id !== id || typeof record.name !== 'string' || typeof record.mimeType !== 'string')
+        fail('Invalid attachment metadata');
+    if (digest(JSON.stringify({ generation: record.generation, name: record.name, mimeType: record.mimeType, sha256: record.sha256 })) !== id)
+        fail('Attachment metadata changed');
+    return record;
+}
+export function readAgentAttachment(stateDir, id) {
+    let record;
+    try {
+        record = attachmentMetadata(stateDir, id);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new FleetError('resource_not_found', 'Attachment not found');
+        throw error;
+    }
+    const bytes = read(join(stateDir, 'web-attachments', id, 'content-' + filename(record.name)), MAX_ATTACHMENT_BYTES);
+    if (bytes.length !== record.size || digest(bytes) !== record.sha256)
+        fail('Attachment content changed');
+    return { record, bytes };
+}
+/** Written before admission so a lost HTTP response cannot lose the visible message. */
+export function storeAttachmentPresentation(stateDir, value) {
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachment-messages');
+    directory(root, true);
+    immutable(join(root, digest(JSON.stringify([value.generation, value.commandId])) + '.json'), Buffer.from(JSON.stringify(value)));
+}
+export function prepareAttachmentPresentation(stateDir, generation, commandId, ids, text, transport) {
+    storeAttachmentPresentation(stateDir, { generation, commandId, ids, text, transportDigest: digest(transport) });
+}
+/** Never infer attachments by stripping user text or interpreting a marker. */
+export function presentAttachmentEvent(stateDir, roleId, event) {
+    const e = event;
+    if (!stateDir || e.kind !== 'prompt.admitted' || e.source !== 'owner_admin_console' || !e.commandId || e.payload?.text?.redacted)
+        return event;
+    const root = join(stateDir, 'web-attachment-messages');
+    if (!existsSync(root))
+        return event;
+    const path = join(root, digest(JSON.stringify([e.sessionGeneration, e.commandId])) + '.json');
+    if (!existsSync(path))
+        return event;
+    try {
+        directory(stateDir, false, false);
+        directory(root);
+        const value = JSON.parse(read(path, 1024 * 1024).toString());
+        if (value.generation !== e.sessionGeneration || value.commandId !== e.commandId || value.transportDigest !== digest(e.payload.text.text))
+            return event;
+        const attachments = value.ids.map(id => {
+            const record = attachmentMetadata(stateDir, id);
+            if (record.generation !== value.generation)
+                fail('Attachment session changed');
+            return { id, name: record.name, mimeType: record.mimeType, size: record.size, url: `/api/v1/roles/${encodeURIComponent(roleId)}/attachments/${id}` };
+        });
+        return { ...e, payload: { ...e.payload, text: { type: 'text', text: value.text, bytes: Buffer.byteLength(value.text) }, displayText: { type: 'text', text: value.text, bytes: Buffer.byteLength(value.text) }, attachments } };
+    }
+    catch {
+        return event;
+    }
+}

package/dist/web/auth.d.ts

@@ -33,6 +33,7 @@ export declare class WebAuth {
     private readonly sessionDevices;
     private readonly tickets;
     private readonly rates;
+    private readonly transports;
     private readonly sockets;
     constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig);
     get bootstrapSecret(): string;
@@ -48,7 +49,7 @@ export declare class WebAuth {
     }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
-    validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
+    validateBoundary(request: FastifyRequest, requireOrigin: boolean, allowPageNavigation?: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;
     anonymous(request: FastifyRequest): BrowserSession;
@@ -61,6 +62,8 @@ export declare class WebAuth {
     };
     consumeTicket(request: FastifyRequest, value: string, purpose: Ticket['purpose'], roleId?: string): BrowserSession;
     bindSocket(sessionId: string, socket: WebSocket): void;
+    /** Raw service streams share the same logout/revocation boundary as native sockets. */
+    bindTransport(sessionId: string, close: () => void): () => void;
     clearSessions(): void;
     revokeAllTrustedDevices(): number;
     shutdown(): void;

package/dist/web/auth.js

@@ -21,6 +21,7 @@ export class WebAuth {
     sessionDevices = new Map();
     tickets = new Map();
     rates = new Map();
+    transports = new Map();
     sockets = new Map();
     constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }) {
         this._origin = _origin;
@@ -49,7 +50,7 @@ export class WebAuth {
         this.bootstrapUsed = false;
         return this._bootstrapSecret;
     }
-    validateBoundary(request, requireOrigin) {
+    validateBoundary(request, requireOrigin, allowPageNavigation = false) {
         const host = request.headers.host;
         const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);
         const origins = this.allowedOrigins.size ? this.allowedOrigins : new Set([this.origin]);
@@ -58,7 +59,9 @@ export class WebAuth {
         if (requireOrigin && (!request.headers.origin || !origins.has(request.headers.origin)))
             throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
         const fetchSite = request.headers['sec-fetch-site'];
-        if (fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
+        const pageNavigation = allowPageNavigation && !requireOrigin && request.method === 'GET'
+            && request.headers['sec-fetch-mode'] === 'navigate' && request.headers['sec-fetch-dest'] === 'document';
+        if (!pageNavigation && fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
             throw new FleetError('forbidden', 'cross-site request rejected');
     }
     exchange(request) {
@@ -156,7 +159,22 @@ export class WebAuth {
         sockets.add(socket);
         socket.once('close', () => sockets?.delete(socket));
     }
+    /** Raw service streams share the same logout/revocation boundary as native sockets. */
+    bindTransport(sessionId, close) {
+        let transports = this.transports.get(sessionId);
+        if (!transports) {
+            transports = new Set();
+            this.transports.set(sessionId, transports);
+        }
+        transports.add(close);
+        return () => { transports.delete(close); if (!transports.size)
+            this.transports.delete(sessionId); };
+    }
     clearSessions() {
+        for (const transports of this.transports.values())
+            for (const close of transports)
+                close();
+        this.transports.clear();
         for (const sockets of this.sockets.values())
             for (const socket of sockets)
                 socket.close(4401, 'authentication revoked');
@@ -182,6 +200,9 @@ export class WebAuth {
         return session;
     }
     removeSession(id) {
+        for (const close of this.transports.get(id) ?? [])
+            close();
+        this.transports.delete(id);
         this.sessions.delete(id);
         this.sessionDevices.delete(id);
         for (const [ticket, value] of this.tickets)

package/dist/web/control.js

@@ -1,9 +1,10 @@
+import { socketPath as privateSocketPath } from '../socket-path.js';
 import { chmodSync, mkdirSync, rmSync } from 'node:fs';
 import { createConnection, createServer } from 'node:net';
 import { join } from 'node:path';
 import { FleetError, safeLine } from '../application/errors.js';
 import { stateRoot } from '../paths.js';
-export const webControlPath = (dir = join(stateRoot(), 'web')) => join(dir, 'control.sock');
+export const webControlPath = (dir = join(stateRoot(), 'web')) => privateSocketPath(join(dir, 'control.sock'));
 export async function startWebControlServer(options) {
     const dir = options.dir ?? join(stateRoot(), 'web');
     const path = webControlPath(dir);