openmausbot 0.1.66 → 0.1.67

package/dist-server/proxy-paths.js

@@ -10,6 +10,7 @@ function resolveProxy(relative) {
 var SPAWNED_PROXIES = {
   browser: resolveProxy("browser-proxy"),
   computer: resolveProxy("computer-proxy"),
+  localComputer: resolveProxy("local-computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),
   vpsContainerMcp: resolveProxy("vps-container-mcp"),

package/dist-server/server/account-signin.js

@@ -0,0 +1,103 @@
+// Sign in with your email on a hosted server. The emailed code comes from the
+// OpenMausBot control plane (the account service the desktop companion and
+// `openmausbot login` already use), and this server decides who is welcome
+// with an allow-list its owner controls. The result is an ordinary local
+// session, the same thing a pairing code produces, so every gate applies.
+//
+// Why through the control plane rather than a mail provider per server: a
+// self-hoster then needs no email credentials at all; the code arrives from
+// accounts.openmausbot.com. The exchange happens server-side, so a browser
+// only ever talks to this server, and a server with an empty allow-list does
+// not expose the routes.
+import { resolveCompanionControlPlaneURL } from "../electron/companion-account-service.mjs";
+import { ControlPlaneError, createControlPlaneClient, normalizeAccountEmail } from "../electron/control-plane-client.mjs";
+export const ADMIN_EMAILS_ENV = "OMB_SIGNIN_EMAILS";
+export const MEMBER_EMAILS_ENV = "OMB_SIGNIN_MEMBER_EMAILS";
+/** Commas, spaces or newlines between entries; case does not matter. */
+export function parseAllowList(value) {
+    return (value ?? "")
+        .split(/[,\s]+/)
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean);
+}
+export function allowedScopes(rawEmail, list) {
+    const email = rawEmail.trim().toLowerCase();
+    if (!email.includes("@"))
+        return null;
+    const matches = (entry) => (entry.startsWith("@") ? email.endsWith(entry) && email.length > entry.length : entry === email);
+    if (list.admins.some(matches))
+        return ["admin", "client"];
+    if (list.members.some(matches))
+        return ["client"];
+    return null;
+}
+export function signInEnabled(list) {
+    return list.admins.length + list.members.length > 0;
+}
+const NOT_WELCOME = { ok: false, status: 403, error: "this email is not on this server's sign-in list; ask the server's owner to add it" };
+export function createEmailSignIn(options) {
+    const env = options.env ?? process.env;
+    const allow = () => (typeof options.allow === "function" ? options.allow() : options.allow);
+    let client = options.client ?? null;
+    const controlPlane = () => {
+        if (client)
+            return client;
+        const url = resolveCompanionControlPlaneURL({ isPackaged: true, environment: env });
+        if (!url)
+            throw new Error("OMB_CONTROL_PLANE_URL is set but is not an https address");
+        client = createControlPlaneClient({ baseURL: url, fetchImpl: options.fetchImpl });
+        return client;
+    };
+    return {
+        enabled: () => signInEnabled(allow()),
+        async start(rawEmail) {
+            const email = normalizeAccountEmail(rawEmail);
+            if (!email)
+                return { ok: false, status: 400, error: "enter a valid email address" };
+            if (!allowedScopes(email, allow()))
+                return NOT_WELCOME;
+            try {
+                await controlPlane().requestOTP(email);
+            }
+            catch (error) {
+                return unavailable(error);
+            }
+            return { ok: true };
+        },
+        async verify(rawEmail, code) {
+            const email = normalizeAccountEmail(rawEmail);
+            if (!email || !allowedScopes(email, allow()))
+                return NOT_WELCOME;
+            let verified;
+            try {
+                verified = await controlPlane().verifyOTP(email, code);
+            }
+            catch (error) {
+                // The client refuses a malformed code before any request (status 0);
+                // the control plane's own "invalid_otp" is a wrong or expired code.
+                if (error instanceof ControlPlaneError && error.code === "invalid_otp" && !error.status) {
+                    return { ok: false, status: 400, error: "enter the 8-digit code from the email" };
+                }
+                if (error instanceof ControlPlaneError && error.status === 429) {
+                    return { ok: false, status: 429, error: "too many attempts; wait a minute and request a new code" };
+                }
+                if (error instanceof ControlPlaneError && (error.status === 400 || error.status === 401 || error.status === 403)) {
+                    return { ok: false, status: 401, error: "that code is wrong or has expired; request a new one" };
+                }
+                return unavailable(error);
+            }
+            // The account session on the control plane has done its job.
+            void controlPlane()
+                .signOut(verified.accountToken)
+                .catch(() => undefined);
+            const scopes = allowedScopes(verified.user.email, allow());
+            if (!scopes)
+                return NOT_WELCOME;
+            return { ok: true, email: verified.user.email, userId: verified.user.id, scopes };
+        },
+    };
+}
+function unavailable(error) {
+    const detail = error instanceof ControlPlaneError ? `${error.code}${error.status ? ` (${error.status})` : ""}` : error instanceof Error ? error.message : String(error);
+    return { ok: false, status: 502, error: `the sign-in service could not be reached (${detail}); try again in a moment` };
+}

package/dist-server/server/caddy.js

@@ -0,0 +1,203 @@
+// `openmausbot serve --domain maus.example.com`: HTTPS on your own domain
+// with nothing to configure. The server downloads a pinned Caddy once into
+// the data dir (the same way it fetches cloudflared and the browser engine),
+// writes the Caddyfile the Docker stack ships, and runs Caddy as its child:
+// Caddy gets and renews the certificate from Let's Encrypt and forwards to
+// the loopback server with the real Host and the forwarded headers the
+// server's remote-session rules expect. The loopback bind never changes.
+//
+// What the operator still owns: a DNS record for the domain pointing at this
+// machine, and ports 80 and 443 reachable. Binding those ports needs a
+// privilege on Linux; `serve` says exactly which command grants it to the
+// downloaded binary when Caddy reports the refusal.
+import { spawn, spawnSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, join, resolve } from "node:path";
+export const CADDY_VERSION = "2.11.4";
+/** Release assets by platform-arch, with the sha512 from the release's checksums file. */
+export const CADDY_ASSETS = Object.freeze({
+    "linux-x64": { name: `caddy_${CADDY_VERSION}_linux_amd64.tar.gz`, sha512: "8220d1f013b6f27510247b2360c9e0ca9f018feebd82515f07635318b34ff9777ccc8fd0b6e6f2486ce3a33fe389fbb7db12d05baa474f4587509fb4f5ebf1c9" },
+    "linux-arm64": { name: `caddy_${CADDY_VERSION}_linux_arm64.tar.gz`, sha512: "d5a7c423853c24a799765e0e8210d5c7c22a8f56ed37a3cae2fb9f58be138853c02b4efd6b59d576e6d8c7c0d30b9c1592deeaa6a536ff69bcca23b8c1ea709c" },
+    "darwin-x64": { name: `caddy_${CADDY_VERSION}_mac_amd64.tar.gz`, sha512: "e04eb10f9ce7e2e079bc9bff1bd5d3a3164888d1edbb1a49e5d15be4eab691b57e89ed36bb29c65ba43f1ba8d9279e0967b1003991c13fe4cb78384c3caf25de" },
+    "darwin-arm64": { name: `caddy_${CADDY_VERSION}_mac_arm64.tar.gz`, sha512: "3190ae0df98b59ab4b6021556fa35adc3c526a4f3e138776b0eaec8a037cc26121cbbb1ad53453f565551b47d37d5ba4755e2c2c3652256737fe2ce9e53c8ec0" },
+});
+const DOWNLOAD_TIMEOUT_MS = 180_000;
+export function caddyTarget(platform = process.platform, arch = process.arch) {
+    return `${platform}-${arch}`;
+}
+export function pinnedCaddyPath(dataDir, platform = process.platform, arch = process.arch) {
+    return join(dataDir, "caddy", `${CADDY_VERSION}-${caddyTarget(platform, arch)}`, platform === "win32" ? "caddy.exe" : "caddy");
+}
+/** OMB_CADDY_PATH, then the pinned download, then a `caddy` on PATH. */
+export function resolveCaddyBinary(options) {
+    const env = options.env ?? process.env;
+    const exists = options.exists ?? existsSync;
+    const platform = options.platform ?? process.platform;
+    const override = env.OMB_CADDY_PATH?.trim();
+    if (override)
+        return resolve(override) === override && exists(override) ? override : null;
+    const pinned = pinnedCaddyPath(options.dataDir, platform, options.arch);
+    if (exists(pinned))
+        return pinned;
+    const executable = platform === "win32" ? "caddy.exe" : "caddy";
+    for (const part of (env.PATH ?? "").split(delimiter)) {
+        const dir = part.trim();
+        if (!dir)
+            continue;
+        const candidate = join(dir, executable);
+        if (exists(candidate))
+            return candidate;
+    }
+    return null;
+}
+/** Download the pinned release once, verify its digest, extract the binary. */
+export async function ensureCaddy(options) {
+    const platform = options.platform ?? process.platform;
+    const found = resolveCaddyBinary({ dataDir: options.dataDir, env: options.env, platform, arch: options.arch });
+    if (found)
+        return found;
+    if (platform === "win32")
+        throw new Error("--domain is not available on Windows yet; put your own HTTPS proxy in front (docs/self-hosting.md)");
+    const target = caddyTarget(platform, options.arch);
+    const asset = options.asset ?? CADDY_ASSETS[target];
+    if (!asset)
+        throw new Error(`Caddy publishes no build for ${target}`);
+    const destination = pinnedCaddyPath(options.dataDir, platform, options.arch);
+    const directory = join(destination, "..");
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const url = asset.url ?? `https://github.com/caddyserver/caddy/releases/download/v${CADDY_VERSION}/${asset.name}`;
+    options.log?.(`downloading Caddy ${CADDY_VERSION} once (about 15 MB, digest pinned) into ${directory}`);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DOWNLOAD_TIMEOUT_MS);
+    timer.unref?.();
+    let body;
+    try {
+        const response = await (options.fetchImpl ?? fetch)(url, { redirect: "follow", signal: controller.signal });
+        if (!response.ok)
+            throw new Error(`the Caddy download failed (HTTP ${response.status})`);
+        body = Buffer.from(await response.arrayBuffer());
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    const digest = createHash("sha512").update(body).digest("hex");
+    if (digest !== asset.sha512)
+        throw new Error("the Caddy download failed its SHA-512 check; nothing was installed");
+    const scratch = mkdtempSync(join(tmpdir(), "openmaus-caddy-"));
+    try {
+        const archive = join(scratch, asset.name);
+        writeFileSync(archive, body, { mode: 0o600 });
+        const extracted = spawnSync("tar", ["-xzf", archive, "-C", scratch, "caddy"], { stdio: "ignore" });
+        if (extracted.status !== 0)
+            throw new Error("the Caddy archive could not be extracted (is `tar` installed?)");
+        const staging = `${destination}.${randomBytes(6).toString("hex")}.part`;
+        renameSync(join(scratch, "caddy"), staging);
+        chmodSync(staging, 0o755);
+        renameSync(staging, destination);
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+    return destination;
+}
+/** The Docker stack's Caddyfile with this server's ports; certificates and
+ * state live under the data dir so they survive restarts and upgrades. */
+export function caddyfileFor(input) {
+    return [
+        "# Written by openmausbot serve --domain. Edit the command, not this file.",
+        "{",
+        "\tadmin off",
+        "\tlog {",
+        "\t\tlevel WARN",
+        "\t}",
+        "}",
+        "",
+        `${input.domain} {`,
+        "\tencode zstd gzip",
+        "",
+        "\t# Webhook ingress has its own per-hook secrets and is meant for third parties.",
+        "\thandle /hooks/* {",
+        `\t\treverse_proxy 127.0.0.1:${input.webhookPort}`,
+        "\t}",
+        "",
+        "\thandle {",
+        `\t\treverse_proxy 127.0.0.1:${input.appPort} {`,
+        "\t\t\t# SSE: stream events as they arrive",
+        "\t\t\tflush_interval -1",
+        "\t\t}",
+        "\t}",
+        "}",
+        "",
+    ].join("\n");
+}
+/** Whether a Caddy exit was the ports refusing to bind (a privilege problem, not a config one). */
+export function portPermissionRefused(output) {
+    return /permission denied|bind: operation not permitted|EACCES/i.test(output) && /:80|:443|listen/i.test(output);
+}
+export function portPermissionHint(binary) {
+    return process.platform === "linux"
+        ? `Caddy may not bind ports 80 and 443 as this user. Grant it once with:\n  sudo setcap 'cap_net_bind_service=+ep' ${binary}\nthen run the same command again. (A service unit can grant the same capability.)`
+        : "Caddy may not bind ports 80 and 443 as this user. Run the server as an administrator, or put your own HTTPS proxy in front.";
+}
+/** Run Caddy as a child with the Caddyfile for this domain. Resolves once
+ * Caddy has stayed up for a moment; rejects with its output if it exits first. */
+export async function startCaddy(options) {
+    const home = join(options.dataDir, "caddy");
+    mkdirSync(join(home, "data"), { recursive: true, mode: 0o700 });
+    mkdirSync(join(home, "config"), { recursive: true, mode: 0o700 });
+    const configFile = join(home, "Caddyfile");
+    writeFileSync(configFile, caddyfileFor(options), { mode: 0o600 });
+    const child = spawn(options.binary, ["run", "--config", configFile, "--adapter", "caddyfile"], {
+        env: { ...(options.env ?? process.env), XDG_DATA_HOME: join(home, "data"), XDG_CONFIG_HOME: join(home, "config") },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    let output = "";
+    const receive = (chunk) => {
+        const text = chunk.toString("utf8");
+        if (output.length < 16_384)
+            output += text;
+        for (const line of text.split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            // Caddy logs JSON; surface warnings and errors, keep the rest quiet.
+            if (/"level":"(warn|error)"/.test(line) || /^\S+\s+(WARN|ERROR)/.test(line) || !line.startsWith("{"))
+                options.log?.(`caddy: ${line.slice(0, 400)}`);
+        }
+    };
+    child.stdout?.on("data", receive);
+    child.stderr?.on("data", receive);
+    const exited = new Promise((done) => {
+        child.once("error", () => done(1));
+        child.once("exit", (code) => done(code));
+    });
+    const settled = await Promise.race([exited.then((code) => ({ code })), new Promise((r) => setTimeout(() => r({ code: undefined }), options.settleMs ?? 1500))]);
+    if (settled.code !== undefined) {
+        const reason = portPermissionRefused(output) ? portPermissionHint(options.binary) : output.trim().split("\n").slice(-3).join("\n");
+        throw new Error(`Caddy stopped right after starting (exit ${settled.code}).\n${reason}`);
+    }
+    return {
+        configFile,
+        exited,
+        stop: async () => {
+            if (child.exitCode !== null || child.signalCode !== null)
+                return;
+            child.kill("SIGTERM");
+            await Promise.race([exited, new Promise((r) => setTimeout(r, 5_000))]);
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill("SIGKILL");
+        },
+    };
+}
+/** `--domain` takes a bare hostname; the same shape Settings → Custom domain accepts. */
+export function normalizeDomainOption(raw) {
+    const value = raw.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/+$/, "");
+    const label = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    if (!value || value.length > 253 || !value.includes(".") || /[\s/:@?#]/.test(value) || !value.split(".").every((part) => label.test(part))) {
+        return { error: "--domain takes a bare hostname such as maus.example.com" };
+    }
+    if (/(?:^|\.)(?:localhost|local|internal|invalid)$/.test(value))
+        return { error: "--domain needs a public domain name that resolves to this machine" };
+    return value;
+}

package/dist-server/server/cli.js

@@ -7,7 +7,7 @@
 //   openmausbot setup [--data-dir ~/.openmausbot]
 //   openmausbot start [serve options]
 //   openmausbot serve [--port 8799] [--data-dir ~/.openmausbot] [--label "cab mini"]
-//                     [--public-url https://host] [--tailscale | --tunnel] [--no-pair]
+//                     [--public-url https://host] [--tailscale | --tunnel | --domain HOST] [--no-pair]
 //   openmausbot pair  [--label "My MacBook"] [--client] [--public-url https://host]
 //   openmausbot sessions [revoke <id>]
 //   openmausbot status
@@ -29,12 +29,15 @@ import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
+import { parseAllowList } from "./account-signin.js";
+import { writeFileAtomic } from "./atomic.js";
+import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
 import { explainTailscaleFailure, tailscaleServe, tailscaleServeOff, tailscaleStatus } from "./tailscale.js";
 import { defaultSetupIo, SetupCancelled } from "./cli-prompts.js";
 import { normalizePhoneOrigin, phonePairingInstructions, runPhoneSetup } from "./cli-phone-setup.js";
-import { cleanupTunnelOrigin, createTunnelAccount, createTunnelOrigin, describeTunnelAccount, describeTunnelState, ensureCloudflared, guardianEntry, startTunnel, tunnelAccess, } from "./tunnel.js";
+import { cleanupTunnelOrigin, createTunnelAccount, createTunnelOrigin, describeTunnelAccount, describeTunnelState, ensureCloudflared, FLEET_CREDENTIAL_ENV, fleetAccess, fleetCredential, guardianEntry, startTunnel, tunnelAccess, } from "./tunnel.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
-const COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "browser", "help", "--help", "-h"];
+const COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "access", "browser", "help", "--help", "-h"];
 export function parseArgs(argv, env = process.env) {
     const implicitStart = !argv.length || (argv[0].startsWith("--") && argv[0] !== "--help");
     const [command = "start", ...rest] = implicitStart ? ["start", ...argv] : argv;
@@ -51,6 +54,7 @@ export function parseArgs(argv, env = process.env) {
         pair: true,
         withDeps: false,
         json: false,
+        chatOnly: false,
     };
     for (let i = 0; i < rest.length; i += 1) {
         const arg = rest[i];
@@ -72,6 +76,12 @@ export function parseArgs(argv, env = process.env) {
                 options.publicUrl = value().replace(/\/+$/, "");
             else if (arg === "--tailscale")
                 options.tailscale = true;
+            else if (arg === "--domain") {
+                const domain = normalizeDomainOption(value());
+                if (typeof domain !== "string")
+                    return domain;
+                options.domain = domain;
+            }
             else if (arg === "--tunnel")
                 options.tunnel = true;
             else if (arg === "--client")
@@ -88,6 +98,13 @@ export function parseArgs(argv, env = process.env) {
                 options.email = value();
             else if (options.command === "sessions" && arg === "revoke")
                 options.revoke = value();
+            else if (options.command === "access" && !options.accessAction && (arg === "list" || arg === "add" || arg === "remove")) {
+                options.accessAction = arg;
+                if (arg !== "list")
+                    options.email = value();
+            }
+            else if (options.command === "access" && arg === "--chat-only")
+                options.chatOnly = true;
             else if (options.command === "browser" && (arg === "install" || arg === "status"))
                 options.browserAction = arg;
             else if (options.command === "browser" && arg === "--with-deps")
@@ -105,6 +122,10 @@ export function parseArgs(argv, env = process.env) {
         return { error: "--public-url must start with http:// or https://" };
     if (options.tailscale && options.tunnel)
         return { error: "choose one of --tailscale (your tailnet) and --tunnel (a public address)" };
+    if (options.command === "access" && !options.accessAction)
+        return { error: "access needs one of: list, add EMAIL [--chat-only], remove EMAIL" };
+    if (options.domain && (options.tailscale || options.tunnel || options.publicUrl))
+        return { error: "--domain already gives the server its address; drop --tailscale, --tunnel and --public-url" };
     if (options.local && (options.tailscale || options.tunnel || options.publicUrl))
         return { error: "--local cannot be combined with a remote-access option" };
     if (options.command === "browser" && !options.browserAction)
@@ -117,12 +138,13 @@ export const USAGE = `openmausbot — your team of AI bots, ready in a few steps
   openmausbot setup [--data-dir DIR]
   openmausbot start [the same options as serve]
   openmausbot serve [--port 8799] [--data-dir DIR] [--label NAME]
-                    [--public-url https://host] [--tailscale | --tunnel] [--no-pair]
+                    [--public-url https://host] [--tailscale | --tunnel | --domain HOST] [--no-pair]
   openmausbot pair  [--label NAME] [--client] [--public-url https://host]
   openmausbot sessions [revoke ID]
   openmausbot status
   openmausbot login [--email you@example.com]
   openmausbot logout
+  openmausbot access list | add EMAIL [--chat-only] | remove EMAIL
   openmausbot browser install [--with-deps] | status
 
 setup   choose AI access and optional phone access; keep existing bots and chats
@@ -134,6 +156,9 @@ status  what the server says about itself
 login   signs this machine in to an OpenMausBot account (an emailed code)
         and reserves its public address for --tunnel
 logout  releases that address and signs out
+access  who may sign in with an emailed code at /pair: an address or
+        @domain; --chat-only gives chat and approvals without settings.
+        Takes effect at once, no restart.
 browser install: the bots' browser engine (agent-browser, pinned) into the
         data dir, and Chrome for Testing into the user's browser cache.
         --with-deps also installs
@@ -147,6 +172,10 @@ browser install: the bots' browser engine (agent-browser, pinned) into the
 --tunnel     serve at a public https://….openmausbot.com address through a
              Cloudflare tunnel: no domain, no proxy, no open port. Run
              \`openmausbot login\` once on this machine first.
+--domain     serve at https://HOST on your own domain: a pinned Caddy is
+             downloaded once and run alongside the server, and gets the
+             certificate itself. Point the domain's DNS at this machine and
+             open ports 80 and 443.
 
 --no-open   do not open a browser window
 --no-pair   skip phone setup and do not print a pairing code
@@ -418,13 +447,80 @@ export async function runStatus(options, io = defaultIo()) {
     }
     if (!options.json) {
         const account = describeTunnelAccount(createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() }).credentials.read());
-        if (account.address)
+        if (fleetCredential())
+            io.log(`public address: managed by the fleet (${FLEET_CREDENTIAL_ENV} is set; the address is fetched when serve --tunnel starts)`);
+        else if (account.address)
             io.log(`public address: ${account.address} (signed in as ${account.email ?? "?"}; serve it with --tunnel)`);
     }
     return code;
 }
+/** The sign-in allow-list, edited straight in config.json: the server reads
+ * it per request, so this works with the server running or stopped and
+ * needs no restart. Environment variables (OMB_SIGNIN_EMAILS) win when set.
+ * Written the way the server writes it (atomic, 0600), touching only the
+ * one key, so nothing else in the file moves. */
+export async function runAccess(options, io = defaultIo()) {
+    const file = join(options.dataDir, "config.json");
+    let raw = {};
+    if (existsSync(file)) {
+        try {
+            const parsed = JSON.parse(readFileSync(file, "utf8"));
+            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+                throw new Error("not an object");
+            raw = Object.fromEntries(Object.entries(parsed));
+        }
+        catch (error) {
+            io.error(`${file} could not be read (${message(error)}); fix it before changing who can sign in`);
+            return 1;
+        }
+    }
+    const current = typeof raw.signIn === "object" && raw.signIn !== null ? Object(raw.signIn) : {};
+    const list = (value) => parseAllowList(Array.isArray(value) ? value.map(String).join(",") : "");
+    const admins = list(Reflect.get(current, "admins"));
+    const members = list(Reflect.get(current, "members"));
+    const overridden = process.env.OMB_SIGNIN_EMAILS !== undefined || process.env.OMB_SIGNIN_MEMBER_EMAILS !== undefined;
+    const write = (next) => {
+        mkdirSync(options.dataDir, { recursive: true, mode: 0o700 });
+        writeFileAtomic(file, `${JSON.stringify({ ...raw, signIn: next }, null, 2)}\n`, { mode: 0o600 });
+    };
+    if (options.accessAction === "list") {
+        if (!admins.length && !members.length) {
+            io.log("nobody can sign in with an email yet; pairing codes only. Add someone with: openmausbot access add you@example.com");
+            return 0;
+        }
+        for (const entry of admins)
+            io.log(`${entry.padEnd(40)} full access`);
+        for (const entry of members)
+            io.log(`${entry.padEnd(40)} chat and approvals`);
+        if (overridden)
+            io.log("(OMB_SIGNIN_EMAILS / OMB_SIGNIN_MEMBER_EMAILS are set in the environment and win over this list while the server runs)");
+        return 0;
+    }
+    const entry = (options.email ?? "").trim().toLowerCase();
+    if (!entry || (!entry.startsWith("@") && !entry.includes("@")) || /\s/.test(entry)) {
+        io.error("give an email address, or @domain for everyone at that domain");
+        return 2;
+    }
+    const without = (items) => items.filter((item) => item !== entry);
+    if (options.accessAction === "remove") {
+        if (!admins.includes(entry) && !members.includes(entry)) {
+            io.error(`${entry} is not on the list`);
+            return 1;
+        }
+        write({ admins: without(admins), members: without(members) });
+        io.log(`${entry} can no longer sign in (existing sessions stay until they expire or are revoked with \`openmausbot sessions revoke\`)`);
+        return 0;
+    }
+    write(options.chatOnly ? { admins: without(admins), members: [...without(members), entry] } : { admins: [...without(admins), entry], members: without(members) });
+    io.log(`${entry} can sign in at /pair with an emailed code (${options.chatOnly ? "chat and approvals" : "full access"})`);
+    if (overridden)
+        io.log("note: OMB_SIGNIN_EMAILS / OMB_SIGNIN_MEMBER_EMAILS are set in the environment and win over this list while the server runs");
+    return 0;
+}
 export async function runLogin(options, io = defaultIo()) {
     const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+    if (fleetCredential())
+        io.log(`note: ${FLEET_CREDENTIAL_ENV} is set, so serve --tunnel will use that credential rather than this account`);
     if (account.credentials.status === "unavailable") {
         io.error(`${account.credentials.file} exists but could not be read; fix or remove it, then try again`);
         return 1;
@@ -549,24 +645,38 @@ export function serverEntry(here = HERE) {
 /** Everything `--tunnel` needs before the server starts, or the one reason
  * it cannot have it. Fails closed: no silent fallback to a local-only server. */
 async function planTunnel(options, log) {
-    const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
-    if (account.credentials.status === "unavailable")
-        return { error: `${account.credentials.file} exists but could not be read; fix or remove it` };
-    if (!describeTunnelAccount(account.credentials.read()).email) {
-        return { error: "no account on this machine yet: run `openmausbot login` first, then `openmausbot serve --tunnel`" };
-    }
-    // A fresh connector token when the control plane answers; the saved one otherwise.
-    try {
-        const state = await account.service.retry();
-        if (state.message && !tunnelAccess(account.credentials.read()))
-            log(`tunnel: ${state.message}`);
+    let access = null;
+    const credential = fleetCredential();
+    if (credential) {
+        // A fleet-started container: the credential is the whole identity.
+        log(`tunnel: using the installation credential from ${FLEET_CREDENTIAL_ENV}`);
+        try {
+            access = await fleetAccess({ credential });
+        }
+        catch (error) {
+            return { error: `--tunnel: ${message(error)}` };
+        }
     }
-    catch (error) {
-        log(`tunnel: control plane not reachable right now (${message(error)}); using the saved address`);
+    else {
+        const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+        if (account.credentials.status === "unavailable")
+            return { error: `${account.credentials.file} exists but could not be read; fix or remove it` };
+        if (!describeTunnelAccount(account.credentials.read()).email) {
+            return { error: "no account on this machine yet: run `openmausbot login` first, then `openmausbot serve --tunnel`" };
+        }
+        // A fresh connector token when the control plane answers; the saved one otherwise.
+        try {
+            const state = await account.service.retry();
+            if (state.message && !tunnelAccess(account.credentials.read()))
+                log(`tunnel: ${state.message}`);
+        }
+        catch (error) {
+            log(`tunnel: control plane not reachable right now (${message(error)}); using the saved address`);
+        }
+        access = tunnelAccess(account.credentials.read());
+        if (!access)
+            return { error: "this machine has no public address; run `openmausbot login` again" };
     }
-    const access = tunnelAccess(account.credentials.read());
-    if (!access)
-        return { error: "this machine has no public address; run `openmausbot login` again" };
     let binary;
     try {
         binary = await ensureCloudflared({ dataDir: options.dataDir, log });
@@ -607,6 +717,17 @@ export async function runServe(options, log = console.log) {
             log(`note: --public-url is ignored with --tunnel; the address is ${plan.access.endpoint}`);
         publicUrl = plan.access.endpoint;
     }
+    let caddyBinary = null;
+    if (options.domain) {
+        try {
+            caddyBinary = await ensureCaddy({ dataDir: options.dataDir, log });
+        }
+        catch (error) {
+            console.error(`--domain: ${message(error)}`);
+            return 1;
+        }
+        publicUrl = `https://${options.domain}`;
+    }
     const entry = serverEntry();
     if (!entry.staticDir)
         log("note: no built UI found next to the server; the API runs but browsers get no page (build with `pnpm exec vite build`)");
@@ -685,12 +806,15 @@ export async function runServe(options, log = console.log) {
         child.once("exit", (code, signal) => { exited = code ?? (signal === "SIGTERM" || signal === "SIGINT" ? 0 : 1); done(exited); });
     });
     let tunnel = null;
+    let caddy = null;
     let stopping = null;
     const stop = () => {
         stopping ??= (async () => {
-            // The gateway stops accepting before the server it forwards to goes away.
+            // The gateway and the edge stop accepting before the server they forward to goes away.
             if (tunnel)
                 await tunnel.stop().catch(() => undefined);
+            if (caddy)
+                await caddy.stop().catch(() => undefined);
             if (tailscaleServing && tailscale)
                 await tailscaleServeOff(tailscale).catch(() => undefined);
             if (exited === null) {
@@ -729,6 +853,21 @@ export async function runServe(options, log = console.log) {
         }
         if (stopping || exited !== null)
             return await childExit;
+        if (options.domain && caddyBinary) {
+            try {
+                caddy = await startCaddy({ binary: caddyBinary, dataDir: options.dataDir, domain: options.domain, appPort: options.port, webhookPort: Number(env.OMB_WEBHOOK_PORT), log });
+                log(`https: Caddy serves ${publicUrl} → http://127.0.0.1:${options.port}; it gets the certificate from Let's Encrypt once DNS for ${options.domain} points at this machine`);
+                void caddy.exited.then((code) => {
+                    if (!stopping)
+                        log(`caddy: stopped (exit ${code ?? "signal"}); ${publicUrl} is no longer served. Stop and start the server again.`);
+                });
+            }
+            catch (error) {
+                console.error(`--domain: ${message(error)}`);
+                await stop();
+                return 1;
+            }
+        }
         if (plan && child.pid) {
             tunnel = startTunnel({
                 dataDir: options.dataDir,
@@ -872,6 +1011,8 @@ export async function main(argv = process.argv.slice(2)) {
             return runStatus(options);
         case "login":
             return runLogin(options);
+        case "access":
+            return runAccess(options);
         case "logout":
             return runLogout(options);
         case "browser":

package/dist-server/server/computer-proxy.js

@@ -734,14 +734,18 @@ async function semanticActAndObserve(id, action, ref, value, args) {
  * told when they finish, and the two that read nothing from the screen. */
 const OPEN_WHILE_DRIVEN = new Set(["computer_request_help", "computer_status", "observation_metrics"]);
 async function call(id, name, args) {
-    if (!OPEN_WHILE_DRIVEN.has(name) && (await control.state(true)).held) {
-        return text(id, CONTROL_REFUSAL, true);
+    if (!OPEN_WHILE_DRIVEN.has(name)) {
+        const state = await control.state(true);
+        if (state.held)
+            return text(id, state.blockedReason ?? CONTROL_REFUSAL, true);
     }
     if (name === "computer_request_help") {
         if (!control.configured) {
             return text(id, "nobody can be paged for this computer right now — carry on carefully", true);
         }
         const initial = await control.state(true);
+        if (initial.held && initial.blockedReason)
+            return text(id, initial.blockedReason, true);
         // If the person is already driving, don't clobber whatever plea they
         // are reading — just wait for the hand-back.
         const requestId = initial.held ? null : await control.requestHelp(String(args?.reason ?? ""));
@@ -753,6 +757,11 @@ async function call(id, name, args) {
         while (Date.now() < deadline) {
             await new Promise((resolve) => setTimeout(resolve, CONTROL_POLL_MS));
             const state = await control.state(true);
+            if (state.held && state.blockedReason) {
+                if (requestId)
+                    await control.expireHelp(requestId);
+                return text(id, state.blockedReason, true);
+            }
             if (state.held)
                 sawHold = true;
             if (!state.held && !state.helpOpen) {