@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.51

package/dist/temp-idle.js

@@ -0,0 +1,42 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { replaceFileAtomically } from './atomic-file.js';
+export const TEMP_CHAT_IDLE_MS = 24 * 60 * 60_000;
+const FILE = 'chat-idle.json';
+export function readChatIdle(dir) {
+    if (!existsSync(join(dir, FILE)))
+        return undefined;
+    const value = JSON.parse(readFileSync(join(dir, FILE), 'utf8'));
+    if (value.version !== 1 || !Number.isSafeInteger(value.lastActivityAt) || value.timeoutMs !== TEMP_CHAT_IDLE_MS)
+        throw new Error('Invalid persisted chat idle policy');
+    return value;
+}
+/** Only a standalone temporary supervisor owns this clock; browser reads never touch it. */
+export class TemporaryChatIdle {
+    dir;
+    value;
+    busy = false;
+    constructor(dir, now) {
+        this.dir = dir;
+        this.value = readChatIdle(dir) ?? { version: 1, timeoutMs: TEMP_CHAT_IDLE_MS, lastActivityAt: now };
+        this.save();
+    }
+    save() { replaceFileAtomically(join(this.dir, FILE), JSON.stringify(this.value) + '\n', 0o600); }
+    observe(snapshot, queueDepth, now) {
+        // Unknown activity evidence never grants permission to retire a session.
+        const idle = snapshot.alive && snapshot.readiness === 'idle' && !snapshot.pendingPermissionId && queueDepth === 0 && snapshot.activity?.activeToolCalls === 0;
+        const update = Date.parse(snapshot.activity?.lastUpdateAt ?? '');
+        let next = this.value.lastActivityAt;
+        if (Number.isFinite(update) && update <= now)
+            next = Math.max(next, update);
+        if (!idle || this.busy)
+            next = Math.max(next, now);
+        this.busy = !idle;
+        // Active work checkpoints at most once a minute, with an immediate idle boundary write.
+        if (next > this.value.lastActivityAt && (idle || next - this.value.lastActivityAt >= 60_000)) {
+            this.value.lastActivityAt = next;
+            this.save();
+        }
+        return idle && now >= this.value.lastActivityAt && now - this.value.lastActivityAt >= this.value.timeoutMs;
+    }
+}

package/dist/temp-lifecycle.d.ts

@@ -5,7 +5,7 @@ export declare const TEMP_STOP_REQUEST_FILE = ".temp-stop-request.json";
 export declare const TEMP_RECLAIM_BATCH = 32;
 export declare const TEMP_LAUNCH_GRACE_MS = 60000;
 export type TempSupervisorKind = 'systemd-transient' | 'launchd-transient' | 'detached';
-export type TempTerminationReason = 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
+export type TempTerminationReason = 'idle-timeout' | 'identity-closed' | 'session-ended' | 'operator-stop' | 'supervisor-signal' | 'supervisor-recycle' | 'startup-failure' | 'stale-supervisor';
 export interface TempSupervisorRecord {
     version: 1;
     role: string;
@@ -44,6 +44,11 @@ export declare function makeTempSupervisorLauncher(options?: {
 }): SupervisorLauncher;
 export declare function markTempSupervisorActive(dir: string, pid?: number): Promise<void>;
 export declare function requestedTempStopReason(dir: string): 'operator-stop' | undefined;
+/** Explicit erasure removes only exact retired role/launch events. */
+export declare function eraseTerminationEvents(launches: ReadonlyArray<{
+    role: string;
+    launchId: string;
+}>): void;
 /** Move retired state out of the live roster without deleting any evidence. */
 export declare function archiveTempState(role: string, reason: TempTerminationReason, outcome: TempTerminationRecord['outcome'], detail: string, now?: Date): string | undefined;
 /** Resolve only an exact role+launch archive; names and timestamps are never proof. */

package/dist/temp-lifecycle.js

@@ -1,7 +1,7 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { basename, join } from 'node:path';
-import { replaceFileAtomically, withFileLock } from './atomic-file.js';
+import { replaceFileAtomically, withFileLock, withSynchronousFileLock } from './atomic-file.js';
 import { realExec } from './exec.js';
 import { stateRoot, tmpRoot } from './paths.js';
 export const TEMP_SUPERVISOR_FILE = '.temp-supervisor.json';
@@ -59,7 +59,7 @@ export function makeTempSupervisorLauncher(options = {}) {
     const supervisor = options.supervisor ?? process.env.OURS_FLEET_SUPERVISOR;
     return async (binPath, args, dir) => {
         const inherited = [
-            'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'CODEX_HOME',
+            'HOME', 'PATH', 'XDG_RUNTIME_DIR', 'OURS_FLEET_HOME', 'OURS_FLEET_SOCKET_ROOT', 'CODEX_HOME',
             // Preserve runtime selection across the service-manager boundary, including
             // an explicit empty value which selects the bundle over manager defaults.
             'CODEX_PATH',
@@ -133,18 +133,34 @@ function appendTermination(dir, record) {
     replaceFileAtomically(join(dir, TEMP_GLOBAL_TERMINATION_MARKER), line);
 }
 function appendGlobalTermination(line, checkExisting = false) {
-    mkdirSync(archiveRoot(), { recursive: true, mode: 0o700 });
-    const path = join(archiveRoot(), 'terminations.jsonl');
-    // Recovery may revisit a .retiring directory after a crash between the
-    // global append and final rename. Avoid duplicating that exact event.
-    if (checkExisting) {
-        try {
-            if (readFileSync(path, 'utf8').split('\n').includes(line.trimEnd()))
-                return;
+    withSynchronousFileLock(join(stateRoot(), 'locks', 'termination-journal'), () => {
+        mkdirSync(archiveRoot(), { recursive: true, mode: 0o700 });
+        const path = join(archiveRoot(), 'terminations.jsonl');
+        // Recovery may revisit a .retiring directory after a crash between the
+        // global append and final rename. Avoid duplicating that exact event.
+        if (checkExisting) {
+            try {
+                if (readFileSync(path, 'utf8').split('\n').includes(line.trimEnd()))
+                    return;
+            }
+            catch { /* the journal does not exist yet */ }
         }
-        catch { /* the journal does not exist yet */ }
-    }
-    appendFileSync(path, line, { mode: 0o600 });
+        appendFileSync(path, line, { mode: 0o600 });
+    });
+}
+/** Explicit erasure removes only exact retired role/launch events. */
+export function eraseTerminationEvents(launches) {
+    withSynchronousFileLock(join(stateRoot(), 'locks', 'termination-journal'), () => {
+        const path = join(archiveRoot(), 'terminations.jsonl');
+        if (!existsSync(path))
+            return;
+        const lines = readFileSync(path, 'utf8').split('\n').filter(Boolean);
+        const kept = lines.filter(line => {
+            const row = JSON.parse(line);
+            return !launches.some(launch => launch.role === row.role && launch.launchId === row.launchId);
+        });
+        replaceFileAtomically(path, kept.length ? kept.join('\n') + '\n' : '');
+    });
 }
 /** Pick a sibling path without overwriting evidence from an earlier attempt. */
 function collisionSafeArchivePaths(targetBase, retiringBase) {

package/dist/tunnel-setup-completion.d.ts

@@ -0,0 +1,7 @@
+/** Keep the resumable record until both the QR and ordinary connection code were emitted. */
+export declare function completeTunnelSetup(effects: {
+    link: () => Promise<unknown>;
+    qr: (code: string) => Promise<string>;
+    write: (text: string) => unknown;
+    clear: () => void;
+}): Promise<void>;

package/dist/tunnel-setup-completion.js

@@ -0,0 +1,13 @@
+/** Keep the resumable record until both the QR and ordinary connection code were emitted. */
+export async function completeTunnelSetup(effects) {
+    try {
+        const link = await effects.link();
+        const code = Buffer.from(JSON.stringify(link)).toString('base64url');
+        const qr = await effects.qr(code);
+        await effects.write('Tunnel configured. Scan the QR or paste this private single-use connection code into the App.\n' + qr + '\n' + code + '\n');
+        effects.clear();
+    }
+    catch {
+        throw Error('Tunnel is configured but its connection code could not be printed. Run ours-fleet setup-tunnel --resume to retry.');
+    }
+}

package/dist/tunnel-setup-input.d.ts

@@ -0,0 +1,19 @@
+import { type WorkspacePayload } from './workspace-enrollment.js';
+/** Read the same private-file transport as enrollment, without consuming the grant. */
+export declare function readTunnelSetupFile(file: string): string;
+export declare function readTunnelSetupStdin(input?: AsyncIterable<Buffer | string>): Promise<string>;
+/** Only a minimal one-use v2 grant is allowed in shell arguments. */
+export declare function readTunnelSetupArgument(input: string): string;
+/** Redeem the grant by HTTPS POST; long-lived connector credentials remain off argv and URLs. */
+export declare function redeemTunnelSetup(input: string, request?: typeof fetch): Promise<WorkspacePayload>;
+/** Inspect only public destination metadata; this never consumes a one-use grant. */
+export declare function inspectTunnelSetup(input: string, request?: typeof fetch): Promise<{
+    workspaceId: string;
+    serverCid: string;
+    appOrigin: string;
+} | undefined>;
+export declare function verifyTunnelSetupTarget(target: {
+    workspaceId: string;
+    serverCid: string;
+    appOrigin: string;
+} | undefined, payload: WorkspacePayload): void;

package/dist/tunnel-setup-input.js

@@ -0,0 +1,124 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { decodeWorkspacePayload } from './workspace-enrollment.js';
+/** Read the same private-file transport as enrollment, without consuming the grant. */
+export function readTunnelSetupFile(file) {
+    const stat = lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0 || stat.size > 32768)
+        throw Error('Setup payload requires an owned private regular file (chmod 600)');
+    return readFileSync(file, 'utf8');
+}
+export async function readTunnelSetupStdin(input = process.stdin) {
+    let value = '';
+    for await (const chunk of input) {
+        value += chunk.toString();
+        if (Buffer.byteLength(value) > 32768)
+            throw Error('Tunnel setup payload is too large');
+    }
+    return value;
+}
+/** Only a minimal one-use v2 grant is allowed in shell arguments. */
+export function readTunnelSetupArgument(input) {
+    decodeTunnelSetupGrant(input);
+    return input;
+}
+function decodeTunnelSetupGrant(input) {
+    if (!/^[A-Za-z0-9_-]{1,32768}$/.test(input.trim()))
+        throw Error('Invalid tunnel setup payload');
+    let grant;
+    try {
+        grant = JSON.parse(Buffer.from(input.trim(), 'base64url').toString());
+    }
+    catch {
+        throw Error('Invalid tunnel setup payload');
+    }
+    if (grant?.version !== 2 || Object.keys(grant).sort().join(',') !== 'appOrigin,code,expiresAt,version'
+        || !['https://app.ours.network', 'https://app.ours-tunnel.com'].includes(grant.appOrigin)
+        || !/^[A-Za-z0-9_-]{43}$/.test(grant.code) || !Number.isSafeInteger(grant.expiresAt)
+        || grant.expiresAt <= Date.now() || grant.expiresAt > Date.now() + 16 * 60000)
+        throw Error('Tunnel setup grant is invalid or expired; get a fresh command from the App');
+    return grant;
+}
+/** Redeem the grant by HTTPS POST; long-lived connector credentials remain off argv and URLs. */
+export async function redeemTunnelSetup(input, request = fetch) {
+    if (!/^[A-Za-z0-9_-]{1,32768}$/.test(input.trim()))
+        throw Error('Invalid tunnel setup payload');
+    // v1 remains supported exclusively by the private file/stdin CLI transports.
+    let version;
+    try {
+        version = JSON.parse(Buffer.from(input.trim(), 'base64url').toString())?.version;
+    }
+    catch { }
+    if (version === 1)
+        return decodeWorkspacePayload(input);
+    const grant = decodeTunnelSetupGrant(input);
+    let response;
+    try {
+        response = await request(grant.appOrigin + '/account-api/workspace-install-redeem', {
+            method: 'POST', redirect: 'error', credentials: 'omit', signal: AbortSignal.timeout(30000),
+            headers: { 'Content-Type': 'application/json', Origin: grant.appOrigin }, body: JSON.stringify({ code: grant.code }),
+        });
+    }
+    catch {
+        throw Error('Could not reach the account service; setup grant redemption may be unconfirmed. Check the App before requesting a fresh command');
+    }
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw Error(response.status === 410 ? 'Tunnel setup grant expired or was already used; get a fresh command from the App'
+            : `Tunnel setup grant redemption failed (HTTP ${response.status}); check the App before retrying`);
+    }
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw Error('Invalid tunnel setup response');
+    }
+    if (typeof result?.payload !== 'string' || !/^[A-Za-z0-9_-]{1,32768}$/.test(result.payload))
+        throw Error('Invalid tunnel setup response');
+    const payload = decodeWorkspacePayload(result.payload);
+    if (payload.appOrigin !== grant.appOrigin)
+        throw Error('Tunnel setup response origin mismatch');
+    return payload;
+}
+/** Inspect only public destination metadata; this never consumes a one-use grant. */
+export async function inspectTunnelSetup(input, request = fetch) {
+    let version;
+    try {
+        version = JSON.parse(Buffer.from(input.trim(), 'base64url').toString()).version;
+    }
+    catch { }
+    if (version === 1) {
+        const p = decodeWorkspacePayload(input);
+        return { workspaceId: p.challenge.workspaceId, serverCid: p.serverCid, appOrigin: p.appOrigin };
+    }
+    const grant = decodeTunnelSetupGrant(input);
+    let response;
+    try {
+        response = await request(grant.appOrigin + '/account-api/workspace-install-inspect', { method: 'POST', redirect: 'error', credentials: 'omit', signal: AbortSignal.timeout(15000), headers: { Origin: grant.appOrigin, 'Content-Type': 'application/json' }, body: JSON.stringify({ code: grant.code }) });
+    }
+    catch {
+        throw Error('Could not inspect the account setup command; existing setup and grant preserved');
+    }
+    if (response.status === 404 || response.status === 405) {
+        await response.body?.cancel();
+        return;
+    }
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw Error('Setup command inspection failed; existing setup and grant preserved');
+    }
+    let target;
+    try {
+        target = await response.json();
+    }
+    catch {
+        throw Error('Invalid setup command inspection response');
+    }
+    if (!target || Object.keys(target).sort().join(',') !== 'serverCid,workspaceId' || typeof target.workspaceId !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(target.workspaceId) || typeof target.serverCid !== 'string' || !/^[a-f0-9]{64}$/i.test(target.serverCid))
+        throw Error('Invalid setup command inspection response');
+    return { ...target, appOrigin: grant.appOrigin };
+}
+export function verifyTunnelSetupTarget(target, payload) {
+    if (target && (target.workspaceId !== payload.challenge.workspaceId || target.serverCid.toUpperCase() !== payload.serverCid.toUpperCase() || target.appOrigin !== payload.appOrigin))
+        throw Error('Redeemed setup command differs from inspected destination; existing setup preserved');
+}

package/dist/web/agent-attachments.d.ts

@@ -0,0 +1,29 @@
+export declare const MAX_ATTACHMENT_BYTES: number;
+export declare const MAX_ATTACHMENT_BODY: number;
+export interface AgentAttachment {
+    id: string;
+    name: string;
+    mimeType: string;
+    size: number;
+    sha256: string;
+    generation: string;
+}
+export declare function storeAgentAttachment(stateDir: string, generation: string, input: unknown): AgentAttachment;
+export declare function attachmentPrompt(stateDir: string, generation: string, ids: unknown, text: string): string;
+export declare function readAgentAttachment(stateDir: string, id: string): {
+    record: AgentAttachment;
+    bytes: Buffer;
+};
+interface AttachmentPresentation {
+    generation: string;
+    commandId: string;
+    text: string;
+    transportDigest: string;
+    ids: string[];
+}
+/** Written before admission so a lost HTTP response cannot lose the visible message. */
+export declare function storeAttachmentPresentation(stateDir: string, value: AttachmentPresentation): void;
+export declare function prepareAttachmentPresentation(stateDir: string, generation: string, commandId: string, ids: string[], text: string, transport: string): void;
+/** Never infer attachments by stripping user text or interpreting a marker. */
+export declare function presentAttachmentEvent<T>(stateDir: string | undefined, roleId: string, event: T): T;
+export {};

package/dist/web/agent-attachments.js

@@ -0,0 +1,162 @@
+import { createHash } from 'node:crypto';
+import { constants, closeSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FleetError } from '../application/errors.js';
+export const MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024;
+export const MAX_ATTACHMENT_BODY = Math.ceil(MAX_ATTACHMENT_BYTES / 3) * 4 + 4096;
+function fail(message) { throw new FleetError('invalid_request', message); }
+const digest = (data) => createHash('sha256').update(data).digest('hex');
+function directory(path, create = false, privateStorage = true) {
+    if (create && !existsSync(path))
+        mkdirSync(path, { mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & (privateStorage ? 0o022 : 0o002)))
+        fail('Attachment directory is not a private owned directory');
+}
+function read(path, max) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.size > max)
+            fail('Attachment is not a bounded owned regular file');
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function immutable(path, bytes) {
+    try {
+        writeFileSync(path, bytes, { flag: 'wx', mode: 0o400 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        if (!read(path, bytes.length).equals(bytes))
+            fail('Attachment content changed');
+    }
+}
+function filename(name) {
+    const chars = Array.from(name.replace(/[^\p{L}\p{N}._-]/gu, '_').replace(/^\.+/, '_'));
+    while (Buffer.byteLength(chars.join('')) > 120)
+        chars.pop();
+    return chars.join('') || 'file';
+}
+export function storeAgentAttachment(stateDir, generation, input) {
+    if (!input || typeof input !== 'object')
+        fail('File data is required');
+    const body = input;
+    if (typeof body.name !== 'string' || !body.name.trim() || body.name.length > 240 || /[\x00-\x1f]/u.test(body.name))
+        fail('A file name of 1–240 characters is required');
+    if (typeof body.mimeType !== 'string' || !/^[a-zA-Z0-9.+-]+\/[a-zA-Z0-9.+-]+$/.test(body.mimeType))
+        fail('A valid media type is required');
+    if (typeof body.data !== 'string' || body.data.length > Math.ceil(MAX_ATTACHMENT_BYTES / 3) * 4 || /[^A-Za-z0-9+/=]/.test(body.data))
+        fail('Invalid base64 file data or file exceeds 20 MiB');
+    const bytes = Buffer.from(body.data, 'base64');
+    if (bytes.length > MAX_ATTACHMENT_BYTES || bytes.toString('base64') !== body.data)
+        fail('Invalid file data or file exceeds 20 MiB');
+    const sha256 = digest(bytes), name = body.name, mimeType = body.mimeType;
+    const id = digest(JSON.stringify({ generation, name, mimeType, sha256 }));
+    const record = { id, name, mimeType, size: bytes.length, sha256, generation };
+    // Fleet runtime state directories may use the account group (0775). Upload storage remains private.
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root, true);
+    const dir = join(root, id);
+    directory(dir, true);
+    immutable(join(dir, 'content-' + filename(name)), bytes);
+    immutable(join(dir, 'metadata.json'), Buffer.from(JSON.stringify(record)));
+    return record;
+}
+export function attachmentPrompt(stateDir, generation, ids, text) {
+    if (!Array.isArray(ids) || ids.length < 1 || ids.length > 5 || new Set(ids).size !== ids.length)
+        fail('Select between 1 and 5 distinct attachments');
+    // Fleet runtime state directories may use the account group (0775). Upload storage remains private.
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root);
+    const files = ids.map(id => {
+        if (typeof id !== 'string' || !/^[a-f0-9]{64}$/.test(id))
+            fail('Invalid attachment ID');
+        const dir = join(root, id);
+        directory(dir);
+        const record = JSON.parse(read(join(dir, 'metadata.json'), 4096).toString());
+        if (record.id !== id || record.generation !== generation)
+            throw new FleetError('stale_state', 'Attachment belongs to a different agent session');
+        const file = join(dir, 'content-' + filename(record.name)), bytes = read(file, MAX_ATTACHMENT_BYTES);
+        if (bytes.length !== record.size || digest(bytes) !== record.sha256 || digest(JSON.stringify({ generation, name: record.name, mimeType: record.mimeType, sha256: record.sha256 })) !== id)
+            fail('Attachment content changed');
+        return { name: record.name, mimeType: record.mimeType, size: record.size, sha256: record.sha256, path: file };
+    });
+    return `${text}${text ? '\n\n' : ''}Attached files (available on this host; open the files to inspect their contents, and use the image viewer for images):\n${JSON.stringify(files, null, 2)}`;
+}
+/** Authenticated content access reuses the same ownership and integrity checks as admission. */
+function attachmentMetadata(stateDir, id) {
+    if (!/^[a-f0-9]{64}$/.test(id))
+        fail('Invalid attachment ID');
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachments');
+    directory(root);
+    const dir = join(root, id);
+    directory(dir);
+    const record = JSON.parse(read(join(dir, 'metadata.json'), 4096).toString());
+    if (record.id !== id || typeof record.name !== 'string' || typeof record.mimeType !== 'string')
+        fail('Invalid attachment metadata');
+    if (digest(JSON.stringify({ generation: record.generation, name: record.name, mimeType: record.mimeType, sha256: record.sha256 })) !== id)
+        fail('Attachment metadata changed');
+    return record;
+}
+export function readAgentAttachment(stateDir, id) {
+    let record;
+    try {
+        record = attachmentMetadata(stateDir, id);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new FleetError('resource_not_found', 'Attachment not found');
+        throw error;
+    }
+    const bytes = read(join(stateDir, 'web-attachments', id, 'content-' + filename(record.name)), MAX_ATTACHMENT_BYTES);
+    if (bytes.length !== record.size || digest(bytes) !== record.sha256)
+        fail('Attachment content changed');
+    return { record, bytes };
+}
+/** Written before admission so a lost HTTP response cannot lose the visible message. */
+export function storeAttachmentPresentation(stateDir, value) {
+    directory(stateDir, false, false);
+    const root = join(stateDir, 'web-attachment-messages');
+    directory(root, true);
+    immutable(join(root, digest(JSON.stringify([value.generation, value.commandId])) + '.json'), Buffer.from(JSON.stringify(value)));
+}
+export function prepareAttachmentPresentation(stateDir, generation, commandId, ids, text, transport) {
+    storeAttachmentPresentation(stateDir, { generation, commandId, ids, text, transportDigest: digest(transport) });
+}
+/** Never infer attachments by stripping user text or interpreting a marker. */
+export function presentAttachmentEvent(stateDir, roleId, event) {
+    const e = event;
+    if (!stateDir || e.kind !== 'prompt.admitted' || e.source !== 'owner_admin_console' || !e.commandId || e.payload?.text?.redacted)
+        return event;
+    const root = join(stateDir, 'web-attachment-messages');
+    if (!existsSync(root))
+        return event;
+    const path = join(root, digest(JSON.stringify([e.sessionGeneration, e.commandId])) + '.json');
+    if (!existsSync(path))
+        return event;
+    try {
+        directory(stateDir, false, false);
+        directory(root);
+        const value = JSON.parse(read(path, 1024 * 1024).toString());
+        if (value.generation !== e.sessionGeneration || value.commandId !== e.commandId || value.transportDigest !== digest(e.payload.text.text))
+            return event;
+        const attachments = value.ids.map(id => {
+            const record = attachmentMetadata(stateDir, id);
+            if (record.generation !== value.generation)
+                fail('Attachment session changed');
+            return { id, name: record.name, mimeType: record.mimeType, size: record.size, url: `/api/v1/roles/${encodeURIComponent(roleId)}/attachments/${id}` };
+        });
+        return { ...e, payload: { ...e.payload, text: { type: 'text', text: value.text, bytes: Buffer.byteLength(value.text) }, displayText: { type: 'text', text: value.text, bytes: Buffer.byteLength(value.text) }, attachments } };
+    }
+    catch {
+        return event;
+    }
+}

package/dist/web/auth.d.ts

@@ -1,3 +1,4 @@
+import { WorkspaceDeviceStore } from './workspace-devices.js';
 import type { FastifyRequest } from 'fastify';
 import type { WebSocket } from 'ws';
 import { TrustedDeviceStore, type TrustedDeviceIssue } from './device-store.js';
@@ -26,6 +27,8 @@ export declare class WebAuth {
     private readonly now;
     private readonly devices;
     private readonly access;
+    private readonly workspaceDevices?;
+    readonly appOrigin: string;
     private _bootstrapSecret;
     private bootstrapExpiresAt;
     private bootstrapUsed;
@@ -33,8 +36,9 @@ export declare class WebAuth {
     private readonly sessionDevices;
     private readonly tickets;
     private readonly rates;
+    private readonly transports;
     private readonly sockets;
-    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig);
+    constructor(_origin: string, _host: string, now?: () => number, devices?: TrustedDeviceStore, access?: WebAccessConfig, workspaceDevices?: WorkspaceDeviceStore | undefined, appOrigin?: string);
     get bootstrapSecret(): string;
     get origin(): string;
     get host(): string;
@@ -48,6 +52,8 @@ export declare class WebAuth {
     }): void;
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap(): string;
+    /** The configured account origin, when this request comes from it and workspace devices are enabled. */
+    accountOrigin(request: Pick<FastifyRequest, 'headers'>): string | undefined;
     validateBoundary(request: FastifyRequest, requireOrigin: boolean): void;
     exchange(request: FastifyRequest): AuthResult;
     login(request: FastifyRequest, password: string): AuthResult;
@@ -61,8 +67,30 @@ export declare class WebAuth {
     };
     consumeTicket(request: FastifyRequest, value: string, purpose: Ticket['purpose'], roleId?: string): BrowserSession;
     bindSocket(sessionId: string, socket: WebSocket): void;
+    /** Raw service streams share the same logout/revocation boundary as native sockets. */
+    bindTransport(sessionId: string, close: () => void): () => void;
     clearSessions(): void;
     revokeAllTrustedDevices(): number;
+    workspaceIdentity(): {
+        workspaceId: string;
+    };
+    workspaceEnrollment(issuer?: string | null): {
+        enrollment: string;
+        workspaceId: string;
+        expiresAt: number;
+    };
+    enrollWorkspace(request: FastifyRequest, input: {
+        enrollment: string;
+        workspaceId: string;
+        label: string;
+    }): {
+        token: string;
+        device: import("./workspace-devices.js").WorkspaceDevice;
+        workspaceId: string;
+    };
+    listWorkspaceDevices(): import("./workspace-devices.js").WorkspaceDevice[];
+    revokeWorkspaceDevice(id: string): void;
+    private requireWorkspaceDevices;
     shutdown(): void;
     private createSession;
     private removeSession;