openmausbot 0.1.75 → 0.1.77

package/dist-server/server/drivers/openai-chat.js

@@ -22,81 +22,104 @@ export function createOpenAIChatRuntime(options) {
         createdAt: new Date().toISOString(),
     });
     const complete = async (messages, model, stream, signal, onDelta) => {
-        const timeout = AbortSignal.timeout(options.timeoutMs);
-        const response = await fetch(`${options.apiUrl}/chat/completions`, {
-            method: "POST",
-            headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
-            body: JSON.stringify(options.requestBody(model, messages, stream)),
-            signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
-        });
-        if (!response.ok) {
-            const body = await response.text().catch(() => "");
-            throw new Error(`${options.httpErrorLabel} HTTP ${response.status}${body ? `: ${body.slice(0, 200)}` : ""}`);
-        }
-        if (!stream) {
-            const json = await response.json();
-            const message = json.choices?.[0]?.message;
-            return {
-                text: typeof message?.content === "string" ? message.content : "",
-                reasoning: options.reasoning && typeof message?.reasoning_content === "string"
-                    ? message.reasoning_content
-                    : "",
-                usage: usageFrom(json.usage),
-            };
-        }
-        if (!response.body) {
-            throw new Error(options.noBodyError ?? `${options.httpErrorLabel} returned no response body`);
-        }
-        let text = "";
-        let reasoning = "";
-        let usage = null;
-        const reader = response.body.getReader();
-        const decoder = new TextDecoder();
-        let buffer = "";
+        // Idle timer that is renewed on every received chunk during streaming
+        const timeoutController = new AbortController();
+        let idleTimer = null;
+        const resetIdleTimer = () => {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            idleTimer = setTimeout(() => {
+                timeoutController.abort(new DOMException("Streaming idle timeout elapsed", "AbortError"));
+            }, options.timeoutMs);
+        };
+        resetIdleTimer();
         try {
-            readLoop: for (;;) {
-                const { done, value } = await reader.read();
-                if (done)
-                    break;
-                buffer += decoder.decode(value, { stream: true });
-                let newline;
-                while ((newline = buffer.indexOf("\n")) !== -1) {
-                    const line = buffer.slice(0, newline).trim();
-                    buffer = buffer.slice(newline + 1);
-                    if (!line.startsWith("data:"))
-                        continue;
-                    const data = line.slice(5).trim();
-                    if (data === "[DONE]")
-                        break readLoop;
-                    let chunk;
-                    try {
-                        chunk = JSON.parse(data);
-                    }
-                    catch {
-                        continue;
-                    }
-                    const delta = chunk.choices?.[0]?.delta;
-                    const reasoningDelta = options.reasoning && typeof delta?.reasoning_content === "string"
-                        ? delta.reasoning_content
-                        : "";
-                    const contentDelta = typeof delta?.content === "string" ? delta.content : "";
-                    if (reasoningDelta) {
-                        reasoning += reasoningDelta;
-                        onDelta?.(reasoningDelta, "reasoning_text");
+            const activeSignal = signal
+                ? AbortSignal.any([signal, timeoutController.signal])
+                : timeoutController.signal;
+            const response = await fetch(`${options.apiUrl}/chat/completions`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+                body: JSON.stringify(options.requestBody(model, messages, stream)),
+                signal: activeSignal,
+            });
+            if (!response.ok) {
+                const body = await response.text().catch(() => "");
+                throw new Error(`${options.httpErrorLabel} HTTP ${response.status}${body ? `: ${body.slice(0, 200)}` : ""}`);
+            }
+            if (!stream) {
+                const json = await response.json();
+                const message = json.choices?.[0]?.message;
+                return {
+                    text: typeof message?.content === "string" ? message.content : "",
+                    reasoning: options.reasoning && typeof message?.reasoning_content === "string"
+                        ? message.reasoning_content
+                        : "",
+                    usage: usageFrom(json.usage),
+                };
+            }
+            if (!response.body) {
+                throw new Error(options.noBodyError ?? `${options.httpErrorLabel} returned no response body`);
+            }
+            let text = "";
+            let reasoning = "";
+            let usage = null;
+            const reader = response.body.getReader();
+            const decoder = new TextDecoder();
+            let buffer = "";
+            try {
+                readLoop: for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done) {
+                        if (buffer.trim() === "data: [DONE]")
+                            break;
+                        throw new DOMException("Stream ended before completion", "AbortError");
                     }
-                    if (contentDelta) {
-                        text += contentDelta;
-                        onDelta?.(contentDelta, "assistant_text");
+                    resetIdleTimer();
+                    buffer += decoder.decode(value, { stream: true });
+                    let newline;
+                    while ((newline = buffer.indexOf("\n")) !== -1) {
+                        const line = buffer.slice(0, newline).trim();
+                        buffer = buffer.slice(newline + 1);
+                        if (!line.startsWith("data:"))
+                            continue;
+                        const data = line.slice(5).trim();
+                        if (data === "[DONE]")
+                            break readLoop;
+                        let chunk;
+                        try {
+                            chunk = JSON.parse(data);
+                        }
+                        catch {
+                            continue;
+                        }
+                        const delta = chunk.choices?.[0]?.delta;
+                        const reasoningDelta = options.reasoning && typeof delta?.reasoning_content === "string"
+                            ? delta.reasoning_content
+                            : "";
+                        const contentDelta = typeof delta?.content === "string" ? delta.content : "";
+                        if (reasoningDelta) {
+                            reasoning += reasoningDelta;
+                            onDelta?.(reasoningDelta, "reasoning_text");
+                        }
+                        if (contentDelta) {
+                            text += contentDelta;
+                            onDelta?.(contentDelta, "assistant_text");
+                        }
+                        if (chunk.usage)
+                            usage = usageFrom(chunk.usage);
                     }
-                    if (chunk.usage)
-                        usage = usageFrom(chunk.usage);
                 }
             }
+            finally {
+                await reader.cancel().catch(() => { });
+            }
+            return { text, reasoning, usage };
         }
         finally {
-            await reader.cancel().catch(() => { });
+            if (idleTimer)
+                clearTimeout(idleTimer);
         }
-        return { text, reasoning, usage };
     };
     const messagesFor = (turn) => [
         ...(turn.system ? [{ role: "system", content: turn.system }] : []),

package/dist-server/server/drivers/openai-compat.js

@@ -1,5 +1,13 @@
 import { createOpenAIChatRuntime } from "./openai-chat.js";
 const DRIVER_KIND = "openai-compat";
+const DEFAULT_IDLE_TIMEOUT_MS = 180_000;
+const idleTimeoutMs = () => {
+    const raw = process.env.OPENMAUS_OPENAI_COMPAT_IDLE_TIMEOUT_MS;
+    if (!raw)
+        return DEFAULT_IDLE_TIMEOUT_MS;
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value >= 1_000 && value <= 2_147_483_647 ? value : DEFAULT_IDLE_TIMEOUT_MS;
+};
 const DEFAULT_MODELS = {
     default: "meta-llama/llama-3.3-70b-instruct",
     options: [
@@ -127,7 +135,7 @@ export const OpenAICompatDriver = {
             httpErrorLabel: "upstream",
             missingKeyError: `no API key — set ${config.apiKeyEnv} or add it to the instance config`,
             unavailableReason: `no API key — set ${config.apiKeyEnv} or add it to the instance config`,
-            timeoutMs: 120_000,
+            timeoutMs: idleTimeoutMs(),
             reasoning: true,
             billing: "metered",
             includeUsageInCompleted: true,

package/dist-server/server/drivers/pi.js

@@ -26,13 +26,15 @@ import { join } from "node:path";
 import { PROVIDER_CREDENTIAL_ENV, stripWorkspaceCredentialEnv } from "../config.js";
 import { computerProxyEnv } from "../container-computer.js";
 import { augmentedPath } from "../env-path.js";
-import { describeSpawnFailure, killCliTree, spawnCli } from "../procs.js";
+import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { EFFORT_LEVELS, newEventId, newId } from "../contracts.js";
 import { decodeInjectId, encodeInjectId, hostApiKey, localHost, mergeLocalInject, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 const DRIVER_KIND = "piAgent";
 const PI_ARGS = ["--mode", "rpc", "--no-session"];
+const PI_MODEL_UPDATE_ARGS = ["update", "--models", "--no-approve"];
 const NODE_ENV_FLAG = { ELECTRON_RUN_AS_NODE: "1" };
 function readPiPromptImages(turn) {
     return (turn.images ?? []).map((image) => ({
@@ -317,6 +319,14 @@ export async function fetchPiModels(cli, env) {
         }
     });
 }
+/** Refresh pi's provider-owned catalog cache. This is deliberately called
+ * only by the explicit model-picker refresh action, never during app startup.
+ * Failure is non-fatal: the caller still probes the last usable cache. */
+export async function updatePiModelCatalog(cli, env) {
+    return new Promise((resolve) => {
+        execCli(cli, PI_MODEL_UPDATE_ARGS, { env, timeout: 60_000, maxBuffer: 1024 * 1024 }, (error) => resolve(!error));
+    });
+}
 function decodeConfig(raw) {
     if (raw === null || raw === undefined)
         return { cli: "pi", fullAuto: false };
@@ -364,7 +374,7 @@ export const PiDriver = {
         const { instanceId, config } = input;
         const catalogEnv = piEnvironment({ ...process.env, ...input.environment });
         let models = EMPTY;
-        const refreshModels = async () => {
+        const readModels = async () => {
             let base = models;
             try {
                 const resolved = await fetchPiModels(config.cli, catalogEnv);
@@ -384,7 +394,13 @@ export const PiDriver = {
                     models = base;
             }
         };
-        await refreshModels();
+        const refreshModels = async () => {
+            await updatePiModelCatalog(config.cli, catalogEnv);
+            await readModels();
+        };
+        // Startup stays local and fast. Only the explicit Refresh button crosses
+        // pi's model-catalog network boundary.
+        await readModels();
         const listeners = new Set();
         // one active turn per thread
         const active = new Map();
@@ -595,6 +611,8 @@ export const PiDriver = {
                             itemType: "tool",
                             itemId: evt.toolCallId,
                             title: String(evt.toolName ?? "tool").slice(0, 80),
+                            summary: commandSummary(evt.args),
+                            input: toolDetailPreview(evt.args),
                         });
                         return;
                     }
@@ -605,6 +623,7 @@ export const PiDriver = {
                             itemType: "tool",
                             itemId: evt.toolCallId,
                             ok: !evt.isError,
+                            output: toolDetailPreview(evt.result),
                         });
                         return;
                     }

package/dist-server/server/enterprise.js

@@ -27,6 +27,40 @@ const layerSchema = z.object({
 });
 const DEFAULT_DIR = join(SERVER_ROOT, "..", "enterprise");
 let current = { edition: "oss", features: [] };
+let workspaceAccessFactory;
+export function hostedWorkspaceConfigured(env = process.env) {
+    return env.OMB_ADMIN_URL !== undefined || env.OMB_ADMIN_WORKSPACE !== undefined || env.OMB_ADMIN_MEMBERSHIP !== undefined;
+}
+/** Validate the operator's complete hosted configuration before any session
+ * can delegate membership authority. A partial setting is never standalone. */
+export function hostedWorkspaceConfiguration(env = process.env) {
+    try {
+        const origin = (raw) => {
+            if (!raw || raw !== raw.trim())
+                throw new Error("missing origin");
+            const url = new URL(raw);
+            if (url.protocol !== "https:" || (raw !== url.origin && raw !== `${url.origin}/`))
+                throw new Error("invalid origin");
+            return url;
+        };
+        if (!/^[a-z][a-z0-9-]{1,30}$/.test(env.OMB_ADMIN_WORKSPACE ?? ""))
+            return null;
+        if (env.OMB_ADMIN_MEMBERSHIP !== undefined && !["local", "portal"].includes(env.OMB_ADMIN_MEMBERSHIP))
+            return null;
+        return { admin: origin(env.OMB_ADMIN_URL), tenant: origin(env.OMB_PUBLIC_URL), workspace: env.OMB_ADMIN_WORKSPACE, portalMembership: env.OMB_ADMIN_MEMBERSHIP === "portal" };
+    }
+    catch {
+        return null;
+    }
+}
+/** No enterprise import or portal dependency enters the core bundle. A
+ * configured server without this hook must refuse hosted access, not fall
+ * back to legacy email or QR credentials. */
+export function createWorkspaceAccess(options) {
+    if (!hostedWorkspaceConfigured(options.env))
+        return null;
+    return workspaceAccessFactory?.({ ...options, entitled: () => entitled("admin") }) ?? null;
+}
 function oss(notice) {
     current = notice ? { edition: "oss", features: [], notice } : { edition: "oss", features: [] };
     return current;
@@ -34,6 +68,7 @@ function oss(notice) {
 /** Resolve the edition once at startup. Never throws: a broken layer or key
  * degrades to the open-source edition with a notice that says what to fix. */
 export async function loadEnterpriseLayer(options = {}) {
+    workspaceAccessFactory = undefined;
     const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
     const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
     // Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts.
@@ -43,6 +78,9 @@ export async function loadEnterpriseLayer(options = {}) {
     }
     try {
         const loaded = await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
+        const access = Reflect.get(Object(loaded), "createWorkspaceAccess");
+        if (typeof access === "function")
+            workspaceAccessFactory = access;
         const register = Reflect.get(Object(loaded), "register");
         if (typeof register !== "function")
             throw new Error(`${entry} does not export register()`);

package/dist-server/server/env-path.js

@@ -207,8 +207,8 @@ function isFile(p) {
     }
 }
 /** PATHEXT-aware `which`. A path-ish cli is probed where it points. */
-function whichWin(cli) {
-    const exts = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+function whichWin(cli, env) {
+    const exts = ((env ?? process.env).PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
     // an extensionless name is not runnable on Windows, so PATHEXT wins over
     // the bare file — npm installs both `claude` (a sh script) and `claude.cmd`
     const probe = (base) => {
@@ -217,7 +217,8 @@ function whichWin(cli) {
     };
     if (/[\\/]/.test(cli) || /^[a-zA-Z]:/.test(cli))
         return probe(cli);
-    for (const dir of augmentedPath().split(delimiter)) {
+    const path = env ? (env.PATH ?? env.Path ?? "") : augmentedPath();
+    for (const dir of path.split(delimiter)) {
         if (!dir)
             continue;
         const hit = probe(join(dir, cli));
@@ -229,20 +230,20 @@ function whichWin(cli) {
 /** node.exe to run a script with: the one npm's shim would pick, else PATH,
  * else this executable only when it really is Node. In a packaged app,
  * process.execPath is Electron and must never be mistaken for node.exe. */
-function nodeExe(near) {
+function nodeExe(near, env) {
     const local = join(near, "node.exe");
     if (isFile(local))
         return local;
     // Ask for the executable explicitly so a custom PATHEXT ordering cannot
     // make a stray node.cmd hide the real node.exe beside it.
-    const onPath = whichWin("node.exe");
+    const onPath = whichWin("node.exe", env);
     if (onPath && extname(onPath).toLowerCase() === ".exe")
         return onPath;
     return process.versions.electron ? null : process.execPath;
 }
 /** npm/pnpm .cmd shims all spell their target as "%dp0%\..." (or
  * "%~dp0\..."). Whatever of those exists on disk is what the shim runs. */
-function parseCmdShim(shim) {
+function parseCmdShim(shim, env) {
     let text;
     try {
         text = readFileSync(shim, "utf8");
@@ -256,7 +257,7 @@ function parseCmdShim(shim) {
         .filter((p) => isFile(p) && basename(p).toLowerCase() !== "node.exe");
     const script = targets.find((p) => /\.[cm]?js$/i.test(p));
     if (script) {
-        const node = nodeExe(dir);
+        const node = nodeExe(dir, env);
         if (node)
             return { command: node, args: [script] };
     }
@@ -265,7 +266,7 @@ function parseCmdShim(shim) {
 }
 /** `#!/usr/bin/env node` → `node <script>`. Only node: nothing else has a
  * meaningful Windows equivalent worth guessing at. */
-function parseNodeShebang(file) {
+function parseNodeShebang(file, env) {
     let head = "";
     let fd = null;
     try {
@@ -289,7 +290,7 @@ function parseNodeShebang(file) {
     }
     if (!/^#!.*\bnode(\.exe)?\b/.test(head))
         return null;
-    const node = nodeExe(dirname(file));
+    const node = nodeExe(dirname(file), env);
     return node ? { command: node, args: [file] } : null;
 }
 /**
@@ -297,31 +298,31 @@ function parseNodeShebang(file) {
  * everywhere but win32 — POSIX already resolves PATH and #! itself.
  */
 /** Resolve a single command word (no tokenizer) — the platform spawn rules. */
-function resolveWord(cli, args) {
+function resolveWord(cli, args, env) {
     if (process.platform !== "win32")
         return { command: cli, args };
-    const file = whichWin(cli);
+    const file = whichWin(cli, env);
     // not found: hand back the name so spawn reports its own ENOENT
     if (!file)
         return { command: cli, args };
     const ext = extname(file).toLowerCase();
     if (ext === ".cmd" || ext === ".bat") {
-        const direct = parseCmdShim(file);
+        const direct = parseCmdShim(file, env);
         return direct ? { command: direct.command, args: [...direct.args, ...args] } : { command: file, args };
     }
     if (ext === ".exe" || ext === ".com")
         return { command: file, args };
-    const viaNode = parseNodeShebang(file);
+    const viaNode = parseNodeShebang(file, env);
     return viaNode ? { command: viaNode.command, args: [...viaNode.args, ...args] } : { command: file, args };
 }
-export function resolveCliSpawn(cli, args) {
+export function resolveCliSpawn(cli, args, env) {
     // An EXISTING FILE wins over the tokenizer: paths with spaces come from
     // our own candidate list unquoted ("/Applications/My Tools/claude"), and
     // splitting those would shred them. Only a bare word (no spaces) or an
     // explicitly-quoted/wrapper string reaches the split below.
     const trimmed = cli.trim();
     if (trimmed.includes(" ") && existsSync(trimmed))
-        return resolveWord(trimmed, args);
+        return resolveWord(trimmed, args, env);
     // A `cli` value may carry fixed leading arguments — wrapper scripts like
     // `/usr/local/bin/ag claude agp` are one string in the Engines panel. ONE
     // tokenizer pass, then resolve the head directly (never re-tokenized: a
@@ -335,7 +336,7 @@ export function resolveCliSpawn(cli, args) {
         // empty input → hand the raw string to spawn so IT reports the ENOENT
         if (!head)
             return { command: cli, args };
-        return resolveWord(head, [...fixed, ...args]);
+        return resolveWord(head, [...fixed, ...args], env);
     }
-    return resolveWord(cli, args);
+    return resolveWord(cli, args, env);
 }

package/dist-server/server/environment.js

@@ -99,6 +99,9 @@ export function environmentDescriptor(input) {
         version: serverVersion(),
         capabilities: {
             remoteSessions: true,
+            // Never advertise a protocol this server would refuse: the routes are
+            // gone unless features.sharedComputers is on, so the capability is too.
+            ...(input.sharedComputers === true ? { sharedComputers: true } : {}),
             selfUpdate: input.desktopManaged ? "desktop-managed" : "operator",
             emailSignIn: input.emailSignIn === true,
         },

package/dist-server/server/fleet-agent.js

@@ -6,9 +6,8 @@
 import { appendFileSync, chmodSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import { createServer } from "node:http";
 import { dirname } from "node:path";
-import { defaultFleetDeps, executePlan, loadRegistry, planFleetAction } from "./fleet-cli.js";
-import { assertSlug, fleetLayout, workspaceDataDir } from "./fleet.js";
-import { readUsage, summarizeUsage } from "./usage-ledger.js";
+import { defaultFleetDeps, executePlan, loadRegistry, markProvisioningFailed, planFleetAction } from "./fleet-cli.js";
+import { assertSlug, fleetLayout, fleetUser, openRouterModelIds, workspaceDataDir } from "./fleet.js";
 const MAX_BODY = 256 * 1024;
 function readBody(req) {
     return new Promise((resolve, reject) => {
@@ -35,11 +34,23 @@ function readBody(req) {
 const strings = (value) => (Array.isArray(value) ? value.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean) : []);
 const text = (value) => (typeof value === "string" && value.trim() ? value.trim() : undefined);
 const number = (value) => (typeof value === "number" && Number.isFinite(value) ? value : undefined);
-/** This month's totals from a workspace's own ledger, read as root. */
-export function workspaceUsage(layout, slug, now) {
-    const from = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
-    const total = summarizeUsage(readUsage(workspaceDataDir(layout, slug), { from, to: now }), "bot").total;
-    return { month: now.toISOString().slice(0, 7), turns: total.turns, costUsd: total.costUsd, billableUsd: total.billableUsd };
+const models = (value) => {
+    try {
+        return openRouterModelIds(value);
+    }
+    catch (error) {
+        throw Object.assign(error, { status: 400 });
+    }
+};
+/** Only bounded, unprivileged aggregates cross back into the root process. */
+export function workspaceUsage(layout, slug, now, deps) {
+    const month = now.toISOString().slice(0, 7);
+    try {
+        return { month, ...deps.usage(workspaceDataDir(layout, slug), fleetUser(slug), now) };
+    }
+    catch {
+        return { month, turns: null, costUsd: null, billableUsd: null, unavailable: true };
+    }
 }
 export function createFleetAgent(options) {
     const deps = options.deps ?? defaultFleetDeps();
@@ -59,7 +70,7 @@ export function createFleetAgent(options) {
             /* the audit line must never fail the action it records */
         }
     };
-    const act = async (input) => {
+    const runAction = async (input) => {
         const log = [];
         const errors = [];
         const io = { log: (line) => log.push(line), error: (line) => errors.push(line) };
@@ -71,10 +82,32 @@ export function createFleetAgent(options) {
             audit({ action: input.action, slug: input.slug, ok: false, error: error instanceof Error ? error.message : String(error) });
             return { status: 400, body: { error: error instanceof Error ? error.message : String(error) } };
         }
-        const code = await executePlan(steps, deps, io);
+        let code = 1;
+        try {
+            code = await executePlan(steps, deps, io);
+        }
+        catch (error) {
+            errors.push(error instanceof Error ? error.message : String(error));
+        }
+        if (code !== 0) {
+            try {
+                markProvisioningFailed(input, deps);
+            }
+            catch {
+                errors.push("could not record the failed provisioning; inspect the reserved workspace before recovery");
+            }
+        }
         audit({ action: input.action, slug: input.slug, ok: code === 0, ...(input.email ? { email: input.email } : {}) });
         return code === 0 ? { status: 200, body: { ok: true, log } } : { status: 500, body: { error: errors[0] ?? "the step failed", log: [...log, ...errors] } };
     };
+    // Planning reads the registry too: serialize the entire read/modify/execute
+    // sequence, not just the subprocesses, so ports and updates cannot collide.
+    let mutationTail = Promise.resolve();
+    const act = (input) => {
+        const result = mutationTail.then(() => runAction(input));
+        mutationTail = result.catch(() => { });
+        return result;
+    };
     const handle = async (req, res) => {
         const url = new URL(req.url ?? "/", "http://fleet");
         const method = req.method ?? "GET";
@@ -87,10 +120,13 @@ export function createFleetAgent(options) {
                 return send(200, { ok: true });
             if (method === "GET" && url.pathname === "/workspaces") {
                 const registry = loadRegistry(layout, deps);
+                const statusOnly = url.searchParams.get("statusOnly") === "true";
                 const workspaces = [];
                 for (const workspace of Object.values(registry.workspaces).sort((a, b) => a.slug.localeCompare(b.slug))) {
-                    const live = (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() || "unknown";
-                    workspaces.push({ ...workspace, live, usage: workspaceUsage(layout, workspace.slug, now()) });
+                    const live = workspace.status === "running" || workspace.status === "suspended"
+                        ? (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() || "unknown"
+                        : workspace.status;
+                    workspaces.push(statusOnly ? { slug: workspace.slug, live } : { ...workspace, live, usage: workspaceUsage(layout, workspace.slug, now(), deps) });
                 }
                 return send(200, { domain: registry.domain, operator: registry.operator ?? null, workspaces });
             }
@@ -99,6 +135,9 @@ export function createFleetAgent(options) {
                 const result = await act({
                     ...base(), action: "create", slug: text(body.slug), admins: strings(body.admins), members: strings(body.members),
                     cap: number(body.cap), memory: text(body.memory), brandJson: text(body.brandJson), anthropicKey: text(body.anthropicKey),
+                    portalUrl: text(body.portalUrl), anthropicUrl: text(body.anthropicUrl),
+                    openrouterKey: text(body.openrouterKey), openrouterUrl: text(body.openrouterUrl),
+                    openrouterModels: body.openrouterModels === undefined ? undefined : models(body.openrouterModels), openrouterDefault: body.openrouterDefault === true,
                 });
                 return send(result.status, result.body);
             }
@@ -106,11 +145,16 @@ export function createFleetAgent(options) {
                 const result = await act({ ...base(), action: "upgrade" });
                 return send(result.status, result.body);
             }
-            const match = /^\/workspaces\/([a-z0-9-]+)(?:\/(users|suspend|resume))?$/.exec(url.pathname);
+            const match = /^\/workspaces\/([a-z0-9-]+)(?:\/(users|providers|suspend|resume))?$/.exec(url.pathname);
             if (match) {
                 const slug = match[1];
                 assertSlug(slug);
                 const sub = match[2];
+                if (method === "POST" && sub === "providers") {
+                    const body = await readBody(req);
+                    const result = await act({ ...base(), action: "providers", slug, openrouterModels: models(body.models) });
+                    return send(result.status, result.body);
+                }
                 if (method === "POST" && sub === "users") {
                     const body = await readBody(req);
                     const action = body.action === "remove" ? "remove" : body.action === "add" ? "add" : undefined;