@ours.network/fleet 1.2.0-nightly.62 → 1.2.0-nightly.64

package/dist/subscriptions/login.js

@@ -73,13 +73,27 @@ export class ClaudeLogin extends BaseLogin {
     child;
     output = '';
     submitted = false;
+    continued = false;
     /** Resolves with the CLI exit status once it exits. */
     exited;
     constructor(owner, bins, home, profileId) {
         super('claude', owner, 'paste_code');
-        const child = spawn(bins.script, ['-qefc', `${shellQuote(bins.claude)} auth login`, '/dev/null'], {
-            env: profileEnv('CLAUDE_CONFIG_DIR', profileId, home), stdio: ['pipe', 'pipe', 'pipe'],
+        const darwin = process.platform === 'darwin';
+        const args = darwin
+            ? ['-q', '/dev/null', bins.claude, 'auth', 'login']
+            : ['-qefc', `${shellQuote(bins.claude)} auth login`, '/dev/null'];
+        // BSD script accepts a real pipe, but rejects Node's socket-backed stdin.
+        // Own the pipeline as one process group so cancellation also stops cat.
+        const child = spawn(darwin ? '/bin/sh' : bins.script, darwin
+            ? ['-c', '/bin/cat 3>&- | { "$@" 3>&-; result=$?; printf "%s\\n" "$result" >&3; exit "$result"; }', 'fleet-claude-login', bins.script, ...args] : args, {
+            detached: darwin,
+            env: profileEnv('CLAUDE_CONFIG_DIR', profileId, home),
+            stdio: darwin ? ['pipe', 'pipe', 'pipe', 'pipe'] : ['pipe', 'pipe', 'pipe'],
         });
+        // The terminal has exited; release cat's input so the shell can finish.
+        // Only the shell owns fd 3. Final close remains the authoritative status.
+        if (darwin)
+            child.stdio[3]?.once('data', () => child.stdin.end());
         this.child = child;
         child.stdin.on('error', () => { });
         const onData = (chunk) => {
@@ -98,14 +112,16 @@ export class ClaudeLogin extends BaseLogin {
                 }
             }
             // Claude asks for Enter after success; the answer carries no secret.
-            if (this.submitted && /press enter/i.test(this.output))
+            if (this.submitted && !this.continued && /press enter/i.test(this.output)) {
+                this.continued = true;
                 child.stdin.write('\r');
+            }
         };
         child.stdout.on('data', onData);
         child.stderr.on('data', onData);
         this.exited = new Promise(resolve => {
             child.once('error', () => { this.end('failed', 'could not start the sign-in'); resolve(null); });
-            child.once('close', code => resolve(code));
+            child.once('close', code => { this.child = undefined; resolve(code); });
         });
     }
     submitCode(code) {
@@ -118,7 +134,16 @@ export class ClaudeLogin extends BaseLogin {
         this.output = '';
         this.child?.stdin.write(`${code}\r`);
     }
-    stop() { this.child?.kill('SIGTERM'); }
+    stop() {
+        if (process.platform === 'darwin' && this.child?.pid) {
+            try {
+                process.kill(-this.child.pid, 'SIGTERM');
+            }
+            catch { /* already exited */ }
+        }
+        else
+            this.child?.kill('SIGTERM');
+    }
 }
 /** Codex device-code login through the app-server's supported account API. */
 export class CodexDeviceLogin extends BaseLogin {

package/dist/web/auth.d.ts

@@ -65,6 +65,8 @@ export declare class WebAuth {
     anonymous(request: FastifyRequest): BrowserSession;
     resume(request: FastifyRequest): AuthResult;
     authenticate(request: FastifyRequest, mutation?: boolean): BrowserSession;
+    /** Check a transport's opening lease without refreshing cookie idle activity. */
+    sessionValid(session: Pick<BrowserSession, 'id' | 'absoluteExpiresAt'>): boolean;
     logout(request: FastifyRequest): void;
     mintTicket(request: FastifyRequest, purpose: Ticket['purpose'], roleId?: string): {
         ticket: string;

package/dist/web/auth.js

@@ -136,7 +136,7 @@ export class WebAuth {
         const id = parseCookies(request.headers.cookie ?? '').ofs_session;
         const session = id ? this.sessions.get(id) : undefined;
         const now = this.now();
-        if (!session || now > session.absoluteExpiresAt || now - session.lastSeenAt > 30 * 60_000) {
+        if (!session || !this.sessionValid(session)) {
             if (id)
                 this.removeSession(id);
             throw new FleetError('unauthorized', 'browser session is missing or expired');
@@ -150,6 +150,15 @@ export class WebAuth {
         session.lastSeenAt = now;
         return session;
     }
+    /** Check a transport's opening lease without refreshing cookie idle activity. */
+    sessionValid(session) {
+        const current = this.sessions.get(session.id), now = this.now();
+        if (!current || now >= session.absoluteExpiresAt)
+            return false;
+        if (session.id.startsWith('workspace:'))
+            return Boolean(this.workspaceDevices?.valid(session.id.slice(10)));
+        return now < current.absoluteExpiresAt && now - current.lastSeenAt < 30 * 60_000;
+    }
     logout(request) {
         const session = this.authenticate(request, true);
         const deviceId = this.sessionDevices.get(session.id);

package/dist/web/conversation-stream-codec.d.ts

@@ -0,0 +1,23 @@
+/** Public v1 wire contract. Kept free of Node APIs so browser consumers can share it. */
+export declare const MAX_FRAME_BYTES: number;
+export declare const MAX_ASSEMBLY_BYTES: number;
+export declare const MAX_PENDING_BYTES: number;
+export type ConversationRecordType = 'ready' | 'ledger' | 'state' | 'role' | 'resync' | 'keepalive';
+export interface ConversationStreamRecord {
+    version: 1;
+    type: ConversationRecordType;
+    payload: unknown;
+}
+/** A payload is the logical record; SSE/JSON envelopes do not consume its assembly budget. */
+export declare function encodeConversationRecord(type: ConversationRecordType, payload: unknown, id: string): Generator<string>;
+/** Strict incremental decoder: one assembly, no partial publication, UTF-8 split safe. */
+export declare class ConversationStreamDecoder {
+    private readonly publish;
+    private decoder;
+    private pending;
+    private assembly?;
+    constructor(publish: (record: ConversationStreamRecord) => void);
+    push(bytes: Uint8Array): void;
+    finish(): void;
+    private accept;
+}

package/dist/web/conversation-stream-codec.js

@@ -0,0 +1,110 @@
+/** Public v1 wire contract. Kept free of Node APIs so browser consumers can share it. */
+export const MAX_FRAME_BYTES = 512 * 1024;
+export const MAX_ASSEMBLY_BYTES = 16 * 1024 * 1024;
+export const MAX_PENDING_BYTES = 8 * 1024 * 1024;
+const utf8 = new TextEncoder();
+const types = new Set(['ready', 'ledger', 'state', 'role', 'resync', 'keepalive']);
+const frame = (value) => `event: conversation\ndata: ${JSON.stringify(value)}\n\n`;
+const identity = (payload) => ({ generation: payload?.sessionGeneration ?? payload?.snapshot?.sessionGeneration,
+    revision: payload?.stateRevision ?? payload?.snapshot?.stateRevision ?? payload?.roleRevision });
+/** A payload is the logical record; SSE/JSON envelopes do not consume its assembly budget. */
+export function* encodeConversationRecord(type, payload, id) {
+    const json = JSON.stringify(payload), totalBytes = utf8.encode(json).byteLength;
+    if (totalBytes > MAX_ASSEMBLY_BYTES)
+        throw new Error('conversation record exceeds assembly limit');
+    const direct = frame({ version: 1, type, payload });
+    if (utf8.encode(direct).byteLength <= MAX_FRAME_BYTES) {
+        yield direct;
+        return;
+    }
+    const position = identity(payload);
+    yield frame({ version: 1, type: 'start', id, recordType: type, totalBytes, ...position });
+    // At most 48K UTF-16 units: even worst-case JSON escapes fit a 512 KiB frame.
+    let index = 0;
+    for (let offset = 0; offset < json.length;) {
+        let end = Math.min(json.length, offset + 48 * 1024);
+        if (end < json.length && /[\uD800-\uDBFF]/.test(json[end - 1]))
+            end--;
+        yield frame({ version: 1, type: 'chunk', id, index: index++, data: json.slice(offset, end) });
+        offset = end;
+    }
+    yield frame({ version: 1, type: 'commit', id, totalBytes, ...position });
+}
+/** Strict incremental decoder: one assembly, no partial publication, UTF-8 split safe. */
+export class ConversationStreamDecoder {
+    publish;
+    decoder = new TextDecoder('utf-8', { fatal: true });
+    pending = '';
+    assembly;
+    constructor(publish) {
+        this.publish = publish;
+    }
+    push(bytes) {
+        try {
+            this.pending += this.decoder.decode(bytes, { stream: true });
+            for (;;) {
+                const end = this.pending.indexOf('\n\n');
+                if (end < 0)
+                    break;
+                const text = this.pending.slice(0, end + 2);
+                this.pending = this.pending.slice(end + 2);
+                if (utf8.encode(text).byteLength > MAX_FRAME_BYTES)
+                    throw new Error('frame limit exceeded');
+                if (!text.startsWith('event: conversation\ndata: '))
+                    throw new Error('invalid conversation frame');
+                this.accept(JSON.parse(text.slice(26, -2)));
+            }
+            if (utf8.encode(this.pending).byteLength > MAX_FRAME_BYTES)
+                throw new Error('frame limit exceeded');
+        }
+        catch (error) {
+            this.pending = '';
+            this.assembly = undefined;
+            throw error;
+        }
+    }
+    finish() {
+        const rest = this.decoder.decode();
+        if (rest || this.pending || this.assembly)
+            throw new Error('incomplete conversation stream');
+    }
+    accept(value) {
+        if (value?.version !== 1)
+            throw new Error('unsupported conversation version');
+        if (types.has(value.type)) {
+            if (this.assembly)
+                throw new Error('overlapping assembly');
+            this.publish(value);
+            return;
+        }
+        if (value.type === 'start') {
+            if (this.assembly)
+                throw new Error('overlapping assembly');
+            if (typeof value.id !== 'string' || !types.has(value.recordType) || !Number.isSafeInteger(value.totalBytes) || value.totalBytes < 1 || value.totalBytes > MAX_ASSEMBLY_BYTES)
+                throw new Error('invalid assembly length/type');
+            this.assembly = { id: value.id, type: value.recordType, total: value.totalBytes, bytes: 0, index: 0, parts: [], generation: value.generation, revision: value.revision };
+            return;
+        }
+        const assembly = this.assembly;
+        if (!assembly || value.id !== assembly.id)
+            throw new Error('assembly identity mismatch');
+        if (value.type === 'chunk') {
+            if (value.index !== assembly.index++ || typeof value.data !== 'string')
+                throw new Error('assembly chunk order');
+            if (!value.data.length)
+                throw new Error('assembly empty chunk');
+            assembly.bytes += utf8.encode(value.data).byteLength;
+            if (assembly.bytes > assembly.total)
+                throw new Error('assembly length exceeded');
+            assembly.parts.push(value.data);
+            return;
+        }
+        if (value.type !== 'commit' || value.totalBytes !== assembly.total || assembly.bytes !== assembly.total)
+            throw new Error('assembly length mismatch');
+        const payload = JSON.parse(assembly.parts.join('')), position = identity(payload);
+        if (value.generation !== assembly.generation || value.revision !== assembly.revision || position.generation !== assembly.generation || position.revision !== assembly.revision)
+            throw new Error('assembly revision mismatch');
+        this.assembly = undefined;
+        this.publish({ version: 1, type: assembly.type, payload });
+    }
+}

package/dist/web/conversation-stream.d.ts

@@ -0,0 +1,25 @@
+import type { Writable } from 'node:stream';
+import { type ConversationRecordType } from './conversation-stream-codec.js';
+/** One active logical record; only waiting encoded output consumes the pending budget. */
+export declare class ConversationStreamWriter {
+    private readonly output;
+    private readonly failed;
+    private queue;
+    private active?;
+    private waiting;
+    private ended;
+    private sequence;
+    pendingBytes: number;
+    get busy(): boolean;
+    constructor(output: Writable, failed: (reason: string) => void);
+    private error;
+    private drain;
+    send(type: ConversationRecordType, payload: unknown): boolean;
+    private flush;
+    private fail;
+    close(): void;
+}
+import type { FastifyInstance } from 'fastify';
+import type { WebServices } from './server.js';
+import type { WebAuth } from './auth.js';
+export declare function registerConversationStream(app: FastifyInstance, services: WebServices, auth: WebAuth): void;

package/dist/web/conversation-stream.js

@@ -0,0 +1,231 @@
+import { encodeConversationRecord, MAX_PENDING_BYTES } from './conversation-stream-codec.js';
+/** One active logical record; only waiting encoded output consumes the pending budget. */
+export class ConversationStreamWriter {
+    output;
+    failed;
+    queue = [];
+    active;
+    waiting = false;
+    ended = false;
+    sequence = 0;
+    pendingBytes = 0;
+    get busy() { return Boolean(this.active); }
+    constructor(output, failed) {
+        this.output = output;
+        this.failed = failed;
+        output.on('drain', this.drain);
+        output.once('error', this.error);
+    }
+    error = () => this.fail('transport-error');
+    drain = () => { this.waiting = false; this.flush(); };
+    send(type, payload) {
+        if (this.ended)
+            return false;
+        const id = String(++this.sequence);
+        try {
+            if (!this.active) {
+                this.active = encodeConversationRecord(type, payload, id);
+                this.flush();
+            }
+            else {
+                let bytes = 0;
+                for (const frame of encodeConversationRecord(type, payload, id))
+                    bytes += Buffer.byteLength(frame);
+                if (this.pendingBytes + bytes > MAX_PENDING_BYTES) {
+                    this.fail('output-overflow');
+                    return false;
+                }
+                this.queue.push({ type, payload, id, bytes });
+                this.pendingBytes += bytes;
+            }
+            return !this.ended;
+        }
+        catch {
+            this.fail('record-too-large');
+            return false;
+        }
+    }
+    flush() {
+        if (this.ended || this.waiting)
+            return;
+        try {
+            while (this.active) {
+                const next = this.active.next();
+                if (!next.done) {
+                    if (!this.output.write(next.value)) {
+                        this.waiting = true;
+                        return;
+                    }
+                }
+                else {
+                    const queued = this.queue.shift();
+                    this.active = queued ? encodeConversationRecord(queued.type, queued.payload, queued.id) : undefined;
+                    if (queued)
+                        this.pendingBytes -= queued.bytes;
+                }
+            }
+        }
+        catch {
+            this.fail('record-too-large');
+        }
+    }
+    fail(reason) {
+        if (this.ended)
+            return;
+        // A resync is only useful at a frame boundary with writable capacity.
+        if (!this.waiting && !this.output.destroyed) {
+            const frame = encodeConversationRecord('resync', { reason, capability: 'degraded', retry: reason !== 'record-too-large' }, 'terminal').next().value;
+            if (frame)
+                this.output.write(frame);
+        }
+        const blocked = this.waiting;
+        this.close();
+        this.failed(reason);
+        if (blocked)
+            this.output.destroy();
+    }
+    close() {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.active = undefined;
+        this.queue = [];
+        this.pendingBytes = 0;
+        this.output.off('drain', this.drain);
+        this.output.off('error', this.error);
+    }
+}
+import { FleetError } from '../application/errors.js';
+export function registerConversationStream(app, services, auth) {
+    const connections = new Set();
+    app.addHook('preClose', async () => { for (const close of connections)
+        close(); });
+    app.get('/api/v1/roles/:id/conversation/events', async (request, reply) => {
+        const browser = auth.authenticate(request);
+        const generation = request.query.expectedGeneration, rawAfter = request.query.after ?? '0', after = Number(rawAfter);
+        if (typeof generation !== 'string' || !generation.trim() || generation.length > 512 || !/^\d+$/.test(rawAfter) || !Number.isSafeInteger(after))
+            throw new FleetError('invalid_request', 'expectedGeneration and a nonnegative integer after cursor are required');
+        if (!services.observeRole)
+            throw new FleetError('capability_unavailable', 'Complete conversation observation is unavailable');
+        let ended = false, owner, follow;
+        let binding, timer;
+        let epoch = 0, revision = -1, lifetime, available = false;
+        let abort = new AbortController();
+        const close = () => {
+            if (ended)
+                return;
+            ended = true;
+            epoch++;
+            abort.abort();
+            if (timer)
+                clearInterval(timer);
+            binding?.();
+            writer.close();
+            follow?.close();
+            follow = undefined;
+            owner?.dispose();
+            connections.delete(close);
+            reply.raw.end();
+        };
+        const writer = new ConversationStreamWriter(reply.raw, close);
+        const resync = (reason, retry = true) => writer.send('resync', { reason, retry, capability: 'degraded' });
+        const valid = () => { if (auth.sessionValid(browser))
+            return true; writer.send('resync', { reason: 'auth-expired', retry: browser.rotating ? 'authenticate' : 'reauthenticate', capability: 'auth-expired' }); close(); return false; };
+        const stopFollow = () => { epoch++; abort.abort(); abort = new AbortController(); follow?.close(); follow = undefined; };
+        const open = async () => {
+            const current = ++epoch, signal = abort.signal;
+            const active = () => !ended && current === epoch && !signal.aborted;
+            try {
+                const control = await services.session(request.params.id);
+                if (!active() || !valid())
+                    return;
+                const descriptor = await control.describe(owner);
+                if (!active() || !valid())
+                    return;
+                if (!control.followConversation || !descriptor.features.includes('conversation_live_complete')) {
+                    resync('capability-unavailable', false);
+                    return;
+                }
+                const handle = await control.followConversation({ controller: false, expectedGeneration: generation, after, signal, roleObservation: owner,
+                    onReplay: page => { if (active() && valid()) {
+                        for (const event of page.events)
+                            writer.send('ledger', event);
+                        writer.send('ledger', { coveredThrough: page.coveredThrough });
+                    } },
+                    onReady: ready => {
+                        if (active() && valid()) {
+                            writer.send('state', ready.snapshot);
+                            writer.send('ready', { sessionGeneration: ready.snapshot.sessionGeneration, stateRevision: ready.snapshot.stateRevision,
+                                ledgerBarrier: ready.snapshot.ledgerBarrier, coveredThrough: ready.coveredThrough, capability: 'complete', authorizedUntil: browser.absoluteExpiresAt });
+                        }
+                    },
+                    onEvent: event => { if (active() && valid()) {
+                        writer.send('ledger', event);
+                        writer.send('ledger', { coveredThrough: event.seq });
+                    } },
+                    onState: state => { if (active() && valid())
+                        writer.send('state', state); },
+                    onClose: reason => { if (active()) {
+                        epoch++;
+                        abort.abort();
+                        follow = undefined;
+                        resync(reason ?? 'control-closed', !reason?.includes('assembly limit'));
+                    } },
+                });
+                if (!active())
+                    handle.close();
+                else
+                    follow = handle;
+            }
+            catch {
+                if (active())
+                    resync('observation-unavailable');
+            }
+        };
+        const changed = (state) => {
+            if (ended || state.roleRevision <= revision)
+                return;
+            revision = state.roleRevision;
+            const { stateDir: _private, ...publicState } = state;
+            writer.send('role', publicState);
+            const replaced = lifetime !== undefined && lifetime !== state.roleLifetime;
+            const nextAvailable = state.availability === 'available' && state.health === 'healthy';
+            if (replaced || !nextAvailable)
+                stopFollow();
+            if (state.health !== 'healthy')
+                resync(state.failure ?? 'role-observation-unavailable', false);
+            else if (replaced)
+                resync('role-replaced');
+            const shouldOpen = nextAvailable && (!available || replaced);
+            lifetime = state.roleLifetime;
+            available = nextAvailable;
+            if (shouldOpen)
+                void open();
+        };
+        reply.hijack();
+        for (const [name, value] of Object.entries(reply.getHeaders()))
+            if (value !== undefined)
+                reply.raw.setHeader(name, Array.isArray(value) ? value : String(value));
+        reply.raw.writeHead(200, { 'Content-Type': 'text/event-stream; charset=utf-8', 'Cache-Control': 'no-store', 'X-Accel-Buffering': 'no' });
+        reply.raw.flushHeaders();
+        reply.raw.once('close', close);
+        connections.add(close);
+        binding = auth.bindTransport(browser, () => { writer.send('resync', { reason: 'auth-expired', capability: 'auth-expired', retry: browser.rotating ? 'authenticate' : 'reauthenticate' }); close(); });
+        try {
+            // Factory callbacks can be synchronous; defer handling until the owner can be borrowed.
+            owner = services.observeRole(request.params.id, state => queueMicrotask(() => changed(state)));
+            if (ended) {
+                owner.dispose();
+                return;
+            }
+            changed(owner.snapshot());
+            timer = setInterval(() => { if (valid())
+                writer.send('keepalive', { at: Date.now() }); }, 1_000);
+            timer.unref();
+        }
+        catch {
+            resync('role-observation-unavailable', false);
+            close();
+        }
+    });
+}

package/dist/web/runtime.js

@@ -1,3 +1,4 @@
+import { ConversationRoleObserver } from '../application/conversation-role-observer.js';
 import { replaceFileAtomically } from '../atomic-file.js';
 import { validateAccountOrigin } from '../account-origin.js';
 import { startWorkspaceTunnel } from './workspace-tunnel.js';
@@ -110,6 +111,13 @@ export async function startWebConsole(options) {
         },
     });
     const events = new FleetEventBus();
+    const roleMutations = new Set();
+    const signalRoleMutation = () => { for (const listener of roleMutations)
+        listener(); };
+    const observeRole = (roleId, listener) => new ConversationRoleObserver({
+        roleId, configPath: options.configPath,
+        subscribeMutations: changed => { roleMutations.add(changed); return () => { roleMutations.delete(changed); }; },
+    }, listener);
     const audit = new AuditSink();
     const watchdogConfigProvider = cachedConfigProvider(options.configPath);
     const log = options.log ?? (() => { });
@@ -149,6 +157,7 @@ export async function startWebConsole(options) {
                 ? 'ready' : detail?.status.overall === 'attention' ? 'attention' : 'unknown';
         },
         onProgress: action => {
+            signalRoleMutation();
             events.publish('creation.changed', action, action.roleId);
             void audit.record({
                 roleId: action.roleId, action: `creation.${action.state}`,
@@ -164,6 +173,7 @@ export async function startWebConsole(options) {
         repository, ops, configPath: options.configPath,
         status: async (roleId) => (await query.detail(roleId)).status,
         onProgress: receipt => {
+            signalRoleMutation();
             events.publish('action.changed', receipt, receipt.roleId);
             void audit.record({
                 roleId: receipt.roleId, action: `lifecycle.${receipt.action}`,
@@ -185,7 +195,7 @@ export async function startWebConsole(options) {
     let server;
     try {
         server = await buildWebServer({
-            query, repository, logs, commands, creation, removal, audit, events, watchdogs, configuration,
+            query, repository, logs, commands, creation, removal, audit, events, watchdogs, configuration, observeRole,
             taskRooms: new TaskRoomApplicationService(options.configPath, { binPath: () => options.binPath }),
             roomLayouts: new RoomLayoutDefinitions(options.configPath),
             layoutBindings: new LayoutBindingGrants(new RoomLayoutService(options.configPath).supervisor()),
@@ -218,7 +228,7 @@ export async function startWebConsole(options) {
                     const dir = repository.stateDir(role);
                     if (!dir)
                         throw new FleetError('control_unavailable', 'role state directory is unavailable');
-                    return new RoleSessionControlAdapter(dir);
+                    return new RoleSessionControlAdapter(dir, undefined, undefined, listener => observeRole(roleId, listener));
                 }
                 throw new FleetError('capability_unavailable', 'role session backend is unavailable');
             },

package/dist/web/server.d.ts

@@ -1,3 +1,4 @@
+import type { ConversationRoleObservation, ConversationRoleState } from '../application/conversation-role-observer.js';
 import { type InitAnswers } from '../init-wizard.js';
 import { SupervisorOursTools } from '../application/supervisor-ours-tools.js';
 import { type FastifyInstance } from 'fastify';
@@ -23,6 +24,7 @@ import type { OfferedModels } from '../subscriptions/cli.js';
 import type { SubscriptionService } from '../subscriptions/service.js';
 import type { LayoutBindingGrants } from '../rooms-tasks/layout-binding-grants.js';
 export interface WebServices {
+    observeRole?(roleId: string, listener: (state: ConversationRoleState) => void): ConversationRoleObservation;
     layoutBindings?: Pick<LayoutBindingGrants, 'control'>;
     query: FleetQueryService;
     repository: RoleRepository;

package/dist/web/server.js

@@ -1,3 +1,4 @@
+import { registerConversationStream } from './conversation-stream.js';
 import { conversationHasAttachment } from '../application/conversation-history.js';
 import { readDeliveredFile } from '../file-delivery/store.js';
 import { WorkspaceDeviceAuthError } from './workspace-devices.js';
@@ -88,6 +89,7 @@ export async function buildWebServer(services, boundary, options = {}) {
             reply.header('X-Ours-Request-Id', request.id);
         reply.code(statusFor(fleetError.code)).send({ error: fleetError.toJSON() });
     });
+    registerConversationStream(app, services, auth);
     app.post('/api/v1/auth/exchange', async (request, reply) => {
         const { session, device } = auth.exchange(request);
         setAuthCookies(reply, session.id, device.token, auth.secureCookies);