@ours.network/fleet 1.2.0-nightly.2 → 1.2.0-nightly.21

package/dist/web/server.js

@@ -1,3 +1,7 @@
+import { storeAgentAttachment, attachmentPrompt, MAX_ATTACHMENT_BODY, readAgentAttachment, prepareAttachmentPresentation, presentAttachmentEvent } from './agent-attachments.js';
+import { readChatIdle } from '../temp-idle.js';
+import { agentDir } from '../paths.js';
+import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -33,15 +37,15 @@ export async function buildWebServer(services, boundary, options = {}) {
     app.addHook('onRequest', async (request, reply) => {
         reply.header('X-Content-Type-Options', 'nosniff');
         reply.header('Referrer-Policy', 'no-referrer');
-        reply.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
+        reply.header('Permissions-Policy', 'camera=(), microphone=(self), geolocation=(), payment=()');
         reply.header('X-Frame-Options', 'DENY');
-        reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; ` +
+        reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; frame-src 'self' blob:; ` +
             `connect-src 'self' ${auth.secureCookies ? 'wss' : 'ws'}://${auth.host}; object-src 'none'; base-uri 'none'; ` +
             `frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'`);
         if (request.url.startsWith('/api/'))
             reply.header('Cache-Control', 'no-store');
         try {
-            auth.validateBoundary(request, false);
+            auth.validateBoundary(request, false, !request.url.startsWith('/api/'));
         }
         catch (error) {
             if (request.url.startsWith('/api/'))
@@ -51,7 +55,11 @@ export async function buildWebServer(services, boundary, options = {}) {
         }
     });
     app.setErrorHandler(async (error, request, reply) => {
-        const fleetError = normalizeError(error, request.id);
+        const privateToolParseError = request.routeOptions.url === '/api/v1/roles/:id/ours/call'
+            && error instanceof Error && 'code' in error
+            && typeof error.code === 'string' && error.code.startsWith('FST_ERR_CTP_');
+        const fleetError = normalizeError(privateToolParseError
+            ? new FleetError('invalid_request', 'expected a valid JSON tool request') : error, request.id);
         await audit.record({
             requestId: request.id, action: `${request.method} ${request.routeOptions.url ?? request.url}`,
             result: 'rejected', errorCode: fleetError.code,
@@ -128,7 +136,8 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.get('/api/v1/roles', async (request) => {
         auth.authenticate(request);
-        return { roles: await services.query.list() };
+        const query = request.query;
+        return { roles: await services.query.list(query.includeTemporary === 'true') };
     });
     const taskApi = async (fn) => {
         try {
@@ -141,6 +150,8 @@ export async function buildWebServer(services, boundary, options = {}) {
                         ? 'conflict' : 'invalid_request';
                 throw new FleetError(code, error.message);
             }
+            if (error instanceof TaskStateError && 'accepted' in error && error.accepted === false)
+                return Promise.reject(Object.assign(new FleetError('invalid_request', error.message), { memberNotAccepted: true }));
             if (error instanceof TaskStateError) {
                 throw new FleetError(error.message.startsWith('task not found:') ? 'resource_not_found' : 'conflict', error.message);
             }
@@ -188,9 +199,10 @@ export async function buildWebServer(services, boundary, options = {}) {
         const state = query.state && query.state !== 'all' ? query.state : undefined;
         const filter = { ...(state ? { state } : {}), ...(query.list ? { list: query.list } : {}),
             ...(query.includeDeleting === 'true' ? { includeDeleting: true } : {}) };
+        const api = requireTaskRooms();
         return taskApi(() => query.groupByList === 'true'
-            ? { groups: requireTaskRooms().groupedTasks(filter) }
-            : { tasks: requireTaskRooms().listTasks(filter) });
+            ? { groups: api.groupedTasks(filter).map(group => ({ ...group, tasks: group.tasks.map(task => api.withLayoutRooms(task)) })) }
+            : { tasks: api.listTasks(filter).map(task => api.withLayoutRooms(task)) });
     });
     app.delete('/api/v1/tasks/:id', async (request, reply) => {
         auth.authenticate(request, true);
@@ -221,12 +233,17 @@ export async function buildWebServer(services, boundary, options = {}) {
         const body = request.body;
         if (typeof body?.title !== 'string' || !body.title)
             throw new FleetError('invalid_request', 'title is required');
+        // Every task runs a saved Room Layout; rooms are never defined inline or from room templates here.
+        if (typeof body.layout !== 'string' || !body.layout)
+            throw new FleetError('invalid_request', 'layout is required: choose a room layout from Settings › Room layouts');
+        if (body.template !== undefined || body.noRoom !== undefined)
+            throw new FleetError('invalid_request', 'tasks use room layouts; template and noRoom are not accepted');
         const task = await taskApi(() => requireTaskRooms().createTask({
             actor: { kind: 'local_control', surface: 'web' }, title: body.title,
             brief: typeof body.brief === 'string' ? body.brief : undefined,
-            template: typeof body.template === 'string' ? body.template : undefined,
-            backlog: body.backlog === true, noRoom: body.noRoom === true,
+            backlog: body.backlog === true,
             list: typeof body.list === 'string' ? body.list : undefined,
+            layout: body.layout,
             idempotencyKey: typeof request.headers['idempotency-key'] === 'string'
                 ? request.headers['idempotency-key'] : undefined,
             origin: { type: 'web' },
@@ -240,11 +257,162 @@ export async function buildWebServer(services, boundary, options = {}) {
         const list = String(request.body?.list ?? '');
         return { task: await taskApi(() => requireTaskRooms().moveTask({ actor: { kind: 'local_control', surface: 'web' }, taskId, list })) };
     });
+    app.patch('/api/v1/tasks/:id/description', async (request) => {
+        auth.authenticate(request, true);
+        const body = request.body;
+        if (typeof body?.brief !== 'string' || typeof body.expectedBrief !== 'string' || body.brief.length > 100_000)
+            throw new FleetError('invalid_request', 'brief and expectedBrief must be strings; brief maximum is 100000 characters');
+        return { task: await taskApi(() => requireTaskRooms().editTaskDescription({
+                actor: { kind: 'local_control', surface: 'web' }, taskId: request.params.id,
+                brief: body.brief, expectedBrief: body.expectedBrief,
+            })) };
+    });
+    app.get('/api/v1/tasks/:id', async (request) => {
+        auth.authenticate(request);
+        return taskApi(() => requireTaskRooms().getTask(request.params.id));
+    });
+    app.post('/api/v1/tasks/:id/members', async (request, reply) => {
+        auth.authenticate(request, true);
+        const body = request.body;
+        try {
+            const result = await taskApi(() => requireTaskRooms().addMember(request.params.id, body));
+            reply.code(result.state === 'running' ? 202 : 200);
+            return result;
+        }
+        catch (error) {
+            if (error instanceof Error && 'memberNotAccepted' in error)
+                return reply.code(409).send({ error: { code: 'member_not_accepted', message: error.message }, accepted: false });
+            throw error;
+        }
+    });
+    app.get('/api/v1/tasks/:id/member-additions/:requestId', async (request) => {
+        auth.authenticate(request);
+        const { id, requestId } = request.params;
+        return taskApi(() => requireTaskRooms().memberAddition(id, requestId));
+    });
+    app.patch('/api/v1/tasks/:id/layout', async (request) => {
+        const session = auth.authenticate(request, true);
+        const body = request.body;
+        const name = (v) => typeof v === 'string' && v.length > 0;
+        if (!name(body?.layout) || !(body.expectedLayout === null || name(body.expectedLayout)))
+            throw new FleetError('invalid_request', 'layout must be a layout name; expectedLayout a layout name or null');
+        const task = await taskApi(() => requireTaskRooms().setTaskLayout({ actor: { kind: 'local_control', surface: 'web' },
+            taskId: request.params.id, layout: body.layout, expectedLayout: body.expectedLayout }));
+        await audit.record({ requestId: request.id, browser: session.id, action: 'task.layout.set', result: 'succeeded' });
+        return { task: requireTaskRooms().withLayoutRooms(task) };
+    });
+    app.get('/api/v1/tasks/:id/layout', async (request) => {
+        auth.authenticate(request);
+        return { layout: await taskApi(async () => requireTaskRooms().taskLayout(request.params.id)) };
+    });
+    for (const operation of ['open', 'close']) {
+        app.post(`/api/v1/tasks/:id/layout/rooms/:room/${operation}`, async (request, reply) => {
+            const session = auth.authenticate(request, true);
+            const { id, room } = request.params;
+            const accepted = await taskApi(() => requireTaskRooms().launchTaskLayoutOperation({
+                actor: { kind: 'local_control', surface: 'web' }, taskId: id, room,
+                operation: operation === 'open' ? 'open' : 'close-room',
+            }));
+            await audit.record({ requestId: request.id, browser: session.id, action: `task.layout.${operation}`, result: 'succeeded' });
+            reply.code(202);
+            return { operation: accepted };
+        });
+    }
+    app.post('/api/v1/tasks/:id/layout/cleanup', async (request, reply) => {
+        auth.authenticate(request, true);
+        const accepted = await taskApi(() => requireTaskRooms().retryTaskLayoutCleanup({
+            actor: { kind: 'local_control', surface: 'web' }, taskId: request.params.id,
+        }));
+        reply.code(202);
+        return { operation: accepted };
+    });
+    app.get('/api/v1/task-templates', async (request) => {
+        auth.authenticate(request);
+        return { templates: requireTaskRooms().listTemplates() };
+    });
+    const layouts = () => {
+        if (!services.roomLayouts)
+            throw new FleetError('capability_unavailable', 'room layout editing is unavailable');
+        return services.roomLayouts;
+    };
+    app.get('/api/v1/room-layouts', async (request) => {
+        auth.authenticate(request);
+        const list = layouts().list(), defaultLayout = layouts().defaultLayout(list);
+        return { layouts: list, ...(defaultLayout ? { default_layout: defaultLayout } : {}) };
+    });
+    app.post('/api/v1/room-layouts/validate', async (request) => {
+        auth.authenticate(request, true);
+        return layouts().validate(request.body?.definition);
+    });
+    app.put('/api/v1/room-layouts/:name', async (request) => {
+        const session = auth.authenticate(request, true);
+        const body = request.body;
+        if (typeof body?.revision !== 'string')
+            throw new FleetError('invalid_request', 'revision is required');
+        const result = await layouts().save(request.params.name, body.revision, body.definition);
+        events.publish('room_layouts.changed', { name: result.name, revision: result.revision });
+        await audit.record({ requestId: request.id, browser: session.id, action: 'room_layout.save', result: 'succeeded' });
+        return result;
+    });
+    app.delete('/api/v1/room-layouts/:name', async (request) => {
+        const session = auth.authenticate(request, true);
+        const revision = request.query.revision;
+        if (typeof revision !== 'string' || !revision)
+            throw new FleetError('invalid_request', 'revision is required');
+        const result = await layouts().remove(request.params.name, revision);
+        events.publish('room_layouts.changed', { name: result.name });
+        await audit.record({ requestId: request.id, browser: session.id, action: 'room_layout.delete', result: 'succeeded' });
+        return result;
+    });
+    for (const action of ['start', 'block', 'unblock', 'review', 'finish', 'cancel']) {
+        app.post(`/api/v1/tasks/:id/${action}`, async (request, reply) => {
+            auth.authenticate(request, true);
+            const taskId = request.params.id;
+            const body = (request.body ?? {});
+            const input = { actor: { kind: 'local_control', surface: 'web' }, taskId };
+            const api = requireTaskRooms();
+            return taskApi(async () => {
+                switch (action) {
+                    case 'start': {
+                        // A task's layout can be chosen or changed but never removed, so this check cannot go stale.
+                        if (!api.getTask(taskId).task.layout)
+                            throw new FleetError('conflict', 'choose a room layout for this task before starting it');
+                        const task = await api.startTask(input);
+                        const provisioning = await api.launchTaskProvisioning(taskId);
+                        if (provisioning.kind !== 'ready')
+                            reply.code(202);
+                        return { task, provisioning };
+                    }
+                    case 'block':
+                        if (typeof body.reason !== 'string' || !body.reason.trim())
+                            throw new FleetError('invalid_request', 'reason is required');
+                        return { task: api.blockTask({ ...input, reason: body.reason }) };
+                    case 'unblock': return { task: api.unblockTask(input) };
+                    case 'review': return { task: api.reviewTask(input) };
+                    case 'finish':
+                    case 'cancel': {
+                        const plan = action === 'finish' ? await api.finishTask(input) : await api.cancelTask(input);
+                        const task = plan.settlementRequired ? await api.launchTaskSettlement(taskId) : plan.task;
+                        const pending = task.terminal_intent?.status === 'pending';
+                        if (pending)
+                            reply.code(202);
+                        return { task, pending };
+                    }
+                }
+            });
+        });
+    }
+    app.get('/api/v1/configuration/provenance', async (request) => {
+        auth.authenticate(request);
+        if (!services.presetProvenance)
+            throw new FleetError('capability_unavailable', 'preset provenance is unavailable');
+        return { provenance: services.presetProvenance.read() };
+    });
     app.get('/api/v1/configuration', async (request) => {
         auth.authenticate(request);
         if (!services.configuration)
             throw new FleetError('capability_unavailable', 'fleet configuration editing is unavailable');
-        return services.configuration.read();
+        return services.configuration.read(request.query.includeDefinitions === 'true');
     });
     app.post('/api/v1/configuration/preview', async (request) => {
         auth.authenticate(request, true);
@@ -311,9 +479,36 @@ export async function buildWebServer(services, boundary, options = {}) {
         });
         return result;
     });
+    const oursTools = services.oursTools ?? new SupervisorOursTools();
+    app.get('/api/v1/roles/:id/contacts', async (request) => {
+        auth.authenticate(request);
+        const control = await services.session(request.params.id);
+        if (!control.agentContacts)
+            throw new FleetError('capability_unavailable', 'Supervisor contacts API is unavailable');
+        return control.agentContacts();
+    });
+    app.get('/api/v1/roles/:id/messages', async (request) => {
+        auth.authenticate(request);
+        const control = await services.session(request.params.id);
+        if (!control.agentHistory)
+            throw new FleetError('capability_unavailable', 'Supervisor history API is unavailable');
+        return control.agentHistory({ peer_cid: request.query.peer_cid, ...(request.query.limit !== undefined ? { limit: Number(request.query.limit) } : {}), ...(request.query.before_seq !== undefined ? { before_seq: Number(request.query.before_seq) } : {}) });
+    });
+    app.get('/api/v1/roles/:id/ours/tools', async (request) => {
+        auth.authenticate(request);
+        return oursTools.list(request.params.id);
+    });
+    app.post('/api/v1/roles/:id/ours/call', async (request) => {
+        const session = auth.authenticate(request, true);
+        const result = await oursTools.call(request.params.id, request.body);
+        await audit.record({ requestId: request.id, browser: session.id,
+            action: 'ours.call', result: result.result.isError === true ? 'tool_error' : 'succeeded' });
+        return result;
+    });
     app.get('/api/v1/roles/:id', async (request) => {
         auth.authenticate(request);
-        return services.query.detail(request.params.id);
+        const detail = await services.query.detail(request.params.id);
+        return { ...detail, chatIdle: detail.role.lifetime === 'temporary' ? readChatIdle(agentDir(request.params.id, true)) ?? null : null };
     });
     app.get('/api/v1/roles/:id/removal-preview', async (request) => {
         auth.authenticate(request);
@@ -348,15 +543,70 @@ export async function buildWebServer(services, boundary, options = {}) {
         const control = await services.session(request.params.id);
         if (!control.conversationPage)
             throw new FleetError('capability_unavailable', 'this role has no conversation ledger');
-        return control.conversationPage({
+        const page = await control.conversationPage({
             after: request.query.after,
             limit: request.query.limit ? Number(request.query.limit) : undefined,
         });
+        const role = await services.repository.get(request.params.id);
+        const stateDir = role ? services.repository.stateDir(role) : undefined;
+        return { ...page, events: page.events.map(event => presentAttachmentEvent(stateDir, request.params.id, event)) };
+    });
+    app.get('/api/v1/roles/:id/attachments/:attachmentId', async (request, reply) => {
+        auth.authenticate(request);
+        const role = await services.repository.get(request.params.id);
+        if (!role)
+            throw new FleetError('role_not_found', 'Agent not found');
+        const stateDir = services.repository.stateDir(role);
+        if (!stateDir)
+            throw new FleetError('capability_unavailable', 'Agent file storage is unavailable');
+        const { record, bytes } = readAgentAttachment(stateDir, request.params.attachmentId);
+        const image = /^image\/(png|jpeg|gif|webp|avif)$/.test(record.mimeType);
+        reply.header('Cache-Control', 'private, no-store');
+        reply.header('X-Content-Type-Options', 'nosniff');
+        reply.header('Content-Security-Policy', "default-src 'none'; sandbox");
+        reply.header('Content-Disposition', `${image ? 'inline' : 'attachment'}; filename*=UTF-8''${encodeURIComponent(record.name).replace(/'/g, '%27')}`);
+        return reply.type(image ? record.mimeType : 'application/octet-stream').send(bytes);
+    });
+    app.post('/api/v1/roles/:id/attachments', { bodyLimit: MAX_ATTACHMENT_BODY }, async (request) => {
+        auth.authenticate(request, true);
+        const role = await services.repository.get(request.params.id);
+        if (!role)
+            throw new FleetError('role_not_found', 'Agent not found');
+        const stateDir = services.repository.stateDir(role);
+        if (!stateDir)
+            throw new FleetError('capability_unavailable', 'Agent file storage is unavailable');
+        const body = request.body;
+        if (typeof body?.expectedSessionGeneration !== 'string' || !body.expectedSessionGeneration.trim())
+            throw new FleetError('invalid_request', 'expectedSessionGeneration is required for attachments');
+        const control = await services.session(request.params.id);
+        if (!control.conversationPage || !control.submitPromptV2)
+            throw new FleetError('capability_unavailable', 'Session-bound attachments are unavailable');
+        const page = await control.conversationPage({ limit: 1 });
+        if (page.snapshot.sessionGeneration !== body.expectedSessionGeneration)
+            throw new FleetError('stale_state', 'Agent session changed. Select the files again.');
+        return storeAgentAttachment(stateDir, body.expectedSessionGeneration, request.body);
     });
     app.post('/api/v1/roles/:id/input', async (request, reply) => {
         const session = auth.authenticate(request, true);
         const body = request.body;
-        const text = String(body?.text ?? '');
+        if (body?.expectedSessionGeneration !== undefined && (typeof body.expectedSessionGeneration !== 'string' || !body.expectedSessionGeneration.trim()))
+            throw new FleetError('invalid_request', 'expectedSessionGeneration must be a nonempty string');
+        let text = String(body?.text ?? '');
+        if (body?.attachments !== undefined) {
+            if (typeof body.commandId !== 'string' || !body.commandId.trim())
+                throw new FleetError('invalid_request', 'commandId is required for attachments');
+            if (typeof body.expectedSessionGeneration !== 'string' || !body.expectedSessionGeneration.trim())
+                throw new FleetError('invalid_request', 'expectedSessionGeneration is required for attachments');
+            const role = await services.repository.get(request.params.id);
+            if (!role)
+                throw new FleetError('role_not_found', 'Agent not found');
+            const stateDir = services.repository.stateDir(role);
+            if (!stateDir)
+                throw new FleetError('capability_unavailable', 'Agent file storage is unavailable');
+            const originalText = text;
+            text = attachmentPrompt(stateDir, body.expectedSessionGeneration, body.attachments, text);
+            prepareAttachmentPresentation(stateDir, body.expectedSessionGeneration, body.commandId, body.attachments, originalText, text);
+        }
         const commandId = typeof body?.commandId === 'string' && body.commandId.trim()
             ? body.commandId : undefined;
         const control = await services.session(request.params.id);
@@ -367,6 +617,7 @@ export async function buildWebServer(services, boundary, options = {}) {
             const admittedCommandId = commandId ?? randomBytes(16).toString('hex');
             const receipt = await control.submitPromptV2({
                 commandId: admittedCommandId, text, source: 'owner_admin_console',
+                expectedSessionGeneration: body.expectedSessionGeneration,
                 actorBrowserSession: createHmac('sha256', digestKey).update(session.id).digest('hex').slice(0, 24),
             });
             await audit.record({
@@ -378,6 +629,8 @@ export async function buildWebServer(services, boundary, options = {}) {
             reply.code(202);
             return receipt;
         }
+        if (body.expectedSessionGeneration !== undefined)
+            throw new FleetError('capability_unavailable', 'session-bound voice input is unavailable for this role');
         const receipt = await control.sendText(text);
         await audit.record({
             requestId: request.id, browser: session.id, roleId: request.params.id,
@@ -443,10 +696,22 @@ export async function buildWebServer(services, boundary, options = {}) {
         const body = request.body;
         if (!body.action || !['start', 'stop', 'restart_resume', 'restart_fresh'].includes(body.action))
             throw new FleetError('invalid_request', 'invalid lifecycle action');
-        const receipt = await services.commands.execute({
-            roleId: request.params.id, action: body.action,
-            actionId: body.actionId, confirmation: body.confirmation,
-        });
+        let receipt;
+        try {
+            receipt = await services.commands.execute({
+                roleId: request.params.id, action: body.action,
+                actionId: body.actionId, confirmation: body.confirmation,
+            });
+        }
+        catch (error) {
+            // An existing receipt always wins: a conflicting/repeated action is not a
+            // proof that the original operation was never admitted.
+            if (typeof body.actionId === 'string' && !services.commands.get(body.actionId)) {
+                const normalized = normalizeError(error);
+                return reply.code(409).send({ error: { code: 'action_not_accepted', message: normalized.message }, accepted: false });
+            }
+            throw error;
+        }
         events.publish('action.changed', receipt, request.params.id);
         reply.code(202);
         return receipt;
@@ -534,6 +799,9 @@ export async function buildWebServer(services, boundary, options = {}) {
                 }
                 socket.send(JSON.stringify(payload));
             };
+            const role = await services.repository.get(request.params.id);
+            const stateDir = role ? services.repository.stateDir(role) : undefined;
+            const present = (event) => presentAttachmentEvent(stateDir, request.params.id, event);
             const follow = await control.followConversation({
                 after,
                 onPage: page => {
@@ -544,11 +812,11 @@ export async function buildWebServer(services, boundary, options = {}) {
                         lastCursor: page.nextCursor ?? after,
                     });
                     if (page.events.length)
-                        guardedSend({ type: 'events', events: page.events });
+                        guardedSend({ type: 'events', events: page.events.map(present) });
                     if (page.hasMore)
                         guardedSend({ type: 'resync.required' });
                 },
-                onEvent: event => guardedSend({ type: 'events', events: [event] }),
+                onEvent: event => guardedSend({ type: 'events', events: [present(event)] }),
                 onClose: reason => {
                     if (socket.readyState === socket.OPEN)
                         socket.close(4409, (reason ?? 'conversation stream ended').slice(0, 120));
@@ -561,7 +829,7 @@ export async function buildWebServer(services, boundary, options = {}) {
             socket.on('close', () => { clearInterval(heartbeat); follow.close(); });
         });
     });
-    const staticRoot = join(dirname(fileURLToPath(import.meta.url)), '..', 'web-app');
+    const staticRoot = options.staticRoot ?? join(dirname(fileURLToPath(import.meta.url)), '..', 'web-app');
     if (existsSync(staticRoot)) {
         await app.register(fastifyStatic, { root: staticRoot, prefix: '/' });
         app.setNotFoundHandler((request, reply) => {
@@ -582,17 +850,17 @@ export async function buildWebServer(services, boundary, options = {}) {
 function setAuthCookies(reply, session, device, secure = false) {
     const suffix = secure ? '; Secure' : '';
     reply.header('Set-Cookie', [
-        `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=28800${suffix}`,
-        `ofs_device=${encodeURIComponent(device)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=2592000${suffix}`,
+        `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=28800${suffix}`,
+        `ofs_device=${encodeURIComponent(device)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=2592000${suffix}`,
     ]);
 }
 function setSessionCookie(reply, session, secure = false) {
-    reply.header('Set-Cookie', `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=28800${secure ? '; Secure' : ''}`);
+    reply.header('Set-Cookie', `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/; Max-Age=28800${secure ? '; Secure' : ''}`);
 }
 function clearAuthCookies(reply) {
     reply.header('Set-Cookie', [
-        'ofs_session=; HttpOnly; SameSite=Strict; Path=/api; Max-Age=0',
-        'ofs_device=; HttpOnly; SameSite=Strict; Path=/api; Max-Age=0',
+        'ofs_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0',
+        'ofs_device=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0',
     ]);
 }
 function promoteRequest(body) {

package/docs/room-layouts.md

@@ -0,0 +1,92 @@
+# YAML Room Layouts
+
+Room Layout describes room goals, participants and their shared or independent
+sessions. Rooms and agents have independent lifecycles.
+
+Place a layout at `fleet/room_layouts/<name>.yaml` beside the split configuration
+for `fleet.yaml`. Agent Templates remain in `fleet/agent_templates/`.
+
+```yaml
+version: 1
+participants:
+  product: {agent_template: Product}
+  developer: {agent_template: Developer}
+  qa: {agent_template: QA}
+rooms:
+  discovery:
+    goal: Clarify the problem and acceptance criteria
+    members: [product, developer, qa]
+  design:
+    goal: Review implementation choices
+    members: [developer, qa]
+  amigos:
+    goal: Resolve a concrete acceptance question
+    members: [product, developer, qa]
+    roles: {product: product, developer: developer, qa: qa}
+```
+
+Repeating a participant key reuses its exact running instance and session.
+Different keys using the same Agent Template create independent instances.
+See the [shared](../examples/room-layouts/shared.yaml) and
+[fresh](../examples/room-layouts/fresh.yaml) examples. Both choices can coexist.
+Fresh agents receive their room context. Supply relevant evidence through ordinary
+room messages or existing project documents when needed.
+
+A participant without `agent_template` requires a binding. `layout instance`
+returns a local exact reference (supervisor, agent, launch, CID and session).
+Pass participant-to-reference YAML to `create --bindings`. A stopped, replaced
+or remote instance is rejected.
+
+```sh
+ours-fleet layout validate work
+ours-fleet layout create work --id example
+ours-fleet layout open example design
+ours-fleet layout open example discovery
+ours-fleet layout open example amigos
+ours-fleet layout close-room example amigos
+ours-fleet layout status example
+ours-fleet layout close example
+```
+
+Any declared room may open first. `create` only saves the definition and resolved
+Agent Templates; `open` lazily starts missing participants and admits all members
+before sending their room context. The membership notification is informational. Existing room rules govern when
+an agent contributes. Each room opens through an explicit command.
+
+`close-room` archives a room and keeps agents available to other rooms. `close`
+archives opened rooms and stops only temporary participants created by this layout
+instance. Explicitly bound participants survive. Cleanup processes existing resources. A 3-Amigos room is an ordinary room with
+complementary members.
+
+Supported room fields: `goal`, `members`, optional `roles`, `contract`,
+`quiet_membership`, `anonymous`. `contract` is briefing text.
+Top-level fields: `version: 1`, optional `description`, `participants`, `rooms`.
+Unknown fields, ambiguous YAML and invalid member references are rejected.
+Existing templates and tasks keep their behavior.
+
+Only local Fleet control is supported. The existing authenticated control socket,
+agent runtime, `spawnTemp` and session queue perform operations. Private state
+snapshots template definitions; public status hides their environment values.
+Existing owner settings apply; owner CID/invite fingerprint are pinned. Unknown
+mutation outcomes stop new work for inspection rather than blindly replaying a
+spawn or room creation. `close` and `close-room` can still clean known resources.
+Cleanup continues after individual errors and does not stop replacement or borrowed
+instances. Confirmed stopped workers need no live control socket. An unknown
+original outcome remains recorded, and cleanup reports incomplete until inspected;
+it never claims that unknown resources were found or removed. Retrying cleanup
+checks known resources and skips completed cleanup. Reopening an active layout room
+checks its native state, CID and required seats and reports drift without repairing it.
+
+
+Shared sessions retain available conversation context, not guaranteed perfect
+recall or isolation between rooms. Compaction and model judgment still matter.
+Rooms keep their existing turn scheduling.
+
+Each layout instance creates distinct native room names, so several instances can
+open the same declared room key. Participant roles must differ from the attached
+owner role; a collision is rejected before creating resources.
+
+Definitions are loaded for authoring commands. Retained instances use their saved
+layout and Agent Templates. Status and cleanup operate on saved resources even
+when the source YAML is broken or removed. New agent launches continue to use
+Fleet's normal configuration and launch checks.