openmausbot 0.1.76 → 0.1.77

package/dist-server/server/fleet-cli.js

@@ -3,11 +3,124 @@
 // prints them for an operator to paste into a root shell, and never builds
 // a shell command from user input. The fleet agent (fleet-agent.ts) reuses
 // the same planner and executor over a Unix socket.
-import { spawn } from "node:child_process";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync, spawn } from "node:child_process";
+import { appendFileSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync } from "node:fs";
 import { posix } from "node:path";
+import { writeFileAtomic } from "./atomic.js";
 import { unstableInstallWarning } from "./service-unit.js";
-import { applySignIn, assertSlug, createPlan, deletePlan, describeSteps, fleetLayout, fleetUser, initPlan, parseRegistry, resumePlan, suspendPlan, upgradePlan, workspaceDataDir, } from "./fleet.js";
+import { applySignIn, assertManagedWorkspace, assertSlug, assertUnixUser, createPlan, deletePlan, describeSteps, fleetLayout, fleetUser, fenceRules, initPlan, MANAGED_OPENROUTER, managedOpenRouterModels, parseRegistry, resumePlan, suspendPlan, upgradePlan, workspaceDataDir, workspaceHome, } from "./fleet.js";
+// Tenant-controlled ancestors can be renamed between any two filesystem calls.
+// The boundary is dropping ALL root authority before I/O, not a preceding lstat.
+// The checks additionally reject visible symlinks, shared inodes and special files.
+const TENANT_IO = String.raw `
+const fs = require("node:fs");
+const path = require("node:path");
+const { randomUUID } = require("node:crypto");
+const request = JSON.parse(fs.readFileSync(0, "utf8"));
+const { uid, gid, home, file, action, content, mode } = request;
+if (process.getuid() === 0) {
+  process.setgroups([]);
+  process.setgid(gid);
+  process.setuid(uid);
+}
+if (process.getuid() !== uid || process.getgid() !== gid || uid === 0 || gid === 0) throw Error("could not drop fleet file privileges");
+const limit = 4 * 1024 * 1024;
+const check = (stat, directory) => {
+  if (stat.uid !== uid || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1)) throw Error("unsafe workspace file or directory");
+};
+const totals = { turns: 0, costUsd: null, billableUsd: null };
+let cursor = home;
+try {
+  check(fs.lstatSync(cursor), true);
+  for (const part of path.relative(home, path.dirname(file)).split(path.sep).filter(Boolean)) {
+    cursor = path.join(cursor, part);
+    check(fs.lstatSync(cursor), true);
+  }
+} catch (error) {
+  if (action !== "usage" || error.code !== "ENOENT") throw error;
+  process.stdout.write(JSON.stringify(totals));
+  process.exit(0);
+}
+let result = null;
+if (action === "mkdir") {
+  try { fs.mkdirSync(file, { mode }); } catch (error) { if (error.code !== "EEXIST") throw error; }
+  check(fs.lstatSync(file), true);
+} else if (action === "read" || action === "usage") {
+  let fd;
+  try { fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (fd !== undefined) {
+    try {
+      const stat = fs.fstatSync(fd);
+      check(stat, false);
+      if (stat.size > limit) throw Error("workspace file exceeds 4 MiB");
+      const data = Buffer.alloc(limit + 1);
+      let size = 0;
+      while (size < data.length) { const read = fs.readSync(fd, data, size, data.length - size, null); if (!read) break; size += read; }
+      if (size > limit) throw Error("workspace file exceeds 4 MiB");
+      result = data.subarray(0, size).toString("utf8");
+    } finally { fs.closeSync(fd); }
+  }
+  if (action === "usage") {
+    const to = Date.parse(content);
+    const date = new Date(to);
+    const from = Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1);
+    // Scan one bounded month's text without retaining rows or allocating groups.
+    const text = result || "";
+    for (let offset = 0; offset < text.length;) {
+      const end = text.indexOf("\n", offset);
+      const line = text.slice(offset, end < 0 ? text.length : end);
+      offset = end < 0 ? text.length : end + 1;
+      let row;
+      try { row = JSON.parse(line); } catch { continue; }
+      if (!row || typeof row !== "object" || typeof row.at !== "string" || typeof row.botId !== "string" || typeof row.model !== "string" || typeof row.input !== "number" || typeof row.output !== "number" || !row.trigger || typeof row.trigger !== "object" || typeof row.trigger.kind !== "string") continue;
+      const at = Date.parse(row.at);
+      if (!(at >= from && at <= to)) continue;
+      totals.turns++;
+      if (typeof row.costUsd === "number" && Number.isFinite(row.costUsd) && row.costUsd >= 0) {
+        const sum = (totals.costUsd || 0) + row.costUsd;
+        if (!Number.isFinite(sum)) throw Error("workspace usage total exceeds numeric range");
+        totals.costUsd = sum;
+      }
+    }
+    result = totals;
+  }
+} else if (action === "write") {
+  if (Buffer.byteLength(content) > limit) throw Error("workspace file exceeds 4 MiB");
+  try { check(fs.lstatSync(file), false); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  const temp = file + ".fleet-" + randomUUID();
+  let fd;
+  try {
+    fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, mode);
+    fs.writeFileSync(fd, content);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd); fd = undefined;
+    fs.renameSync(temp, file);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    try { fs.unlinkSync(temp); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+} else throw Error("unknown fleet file operation");
+process.stdout.write(JSON.stringify(result));
+`;
+function tenantIo(owner, file, action, content, mode) {
+    assertUnixUser(owner);
+    const options = { encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", cwd: "/", env: { PATH: "/usr/bin:/bin" }, stdio: ["pipe", "pipe", "pipe"] };
+    const account = execFileSync("/usr/bin/getent", ["passwd", owner], { ...options, maxBuffer: 8192 }).trim().split(":");
+    const uid = Number(account[2]);
+    const gid = Number(account[3]);
+    const home = account[5];
+    if (account.length !== 7 || account[0] !== owner || !Number.isSafeInteger(uid) || uid <= 0 || !Number.isSafeInteger(gid) || gid <= 0 || !home?.startsWith("/") || posix.normalize(home) !== home || !file.startsWith(`${home}/`) || posix.normalize(file) !== file) {
+        throw new Error(`unsafe filesystem identity or path for ${owner}`);
+    }
+    try {
+        return JSON.parse(execFileSync(process.execPath, ["--eval", TENANT_IO], { ...options, maxBuffer: action === "usage" ? 8192 : 32 * 1024 * 1024, input: JSON.stringify({ uid, gid, home, file, action, content, mode }) }));
+    }
+    catch {
+        // Do not repeat helper stderr: tenant-controlled file contents may be secret.
+        throw new Error(`could not ${action} workspace file as ${owner}: check ownership, links, file size and permissions`);
+    }
+}
 export function defaultFleetDeps() {
     return {
         isRoot: () => typeof process.getuid === "function" && process.getuid() === 0,
@@ -27,9 +140,39 @@ export function defaultFleetDeps() {
                 resolve({ code: null, output: error instanceof Error ? error.message : String(error) });
             }
         }),
-        readText: (path) => (existsSync(path) ? readFileSync(path, "utf8") : null),
-        writeText: (path, content, mode) => writeFileSync(path, content, { mode }),
-        mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
+        pathExists: (path) => { try {
+            lstatSync(path);
+            return true;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return false;
+            throw error;
+        } },
+        readText: (path, owner) => owner ? tenantIo(owner, path, "read") : (existsSync(path) ? readFileSync(path, "utf8") : null),
+        usage: (dataDir, owner, now) => {
+            const at = now.toISOString();
+            return tenantIo(owner, posix.join(dataDir, "usage", `${at.slice(0, 7)}.jsonl`), "usage", at);
+        },
+        writeText: (path, content, mode, owner) => {
+            if (owner) {
+                tenantIo(owner, path, "write", content, mode);
+                return;
+            }
+            writeFileAtomic(path, content, { mode });
+            // Persist the rename before the next external step (notably useradd).
+            const directory = openSync(posix.dirname(path), "r");
+            try {
+                fsyncSync(directory);
+            }
+            finally {
+                closeSync(directory);
+            }
+        },
+        mkdir: (path, mode, owner) => { if (owner)
+            tenantIo(owner, path, "mkdir", undefined, mode);
+        else
+            mkdirSync(path, { recursive: true, mode }); },
         appendOnce: (path, line) => {
             const current = existsSync(path) ? readFileSync(path, "utf8") : "";
             if (!current.split("\n").some((existing) => existing.trim() === line))
@@ -60,20 +203,10 @@ export async function executePlan(steps, deps, io) {
     for (const step of steps) {
         switch (step.kind) {
             case "mkdir":
-                deps.mkdir(step.path, step.mode);
-                if (step.owner) {
-                    const chown = await deps.run(["chown", `${step.owner}:${step.owner}`, step.path]);
-                    if (chown.code !== 0)
-                        return failed(io, `chown ${step.path}`, chown.output);
-                }
+                deps.mkdir(step.path, step.mode, step.owner);
                 break;
             case "write":
-                deps.writeText(step.path, step.content, step.mode);
-                if (step.owner) {
-                    const chown = await deps.run(["chown", `${step.owner}:${step.owner}`, step.path]);
-                    if (chown.code !== 0)
-                        return failed(io, `chown ${step.path}`, chown.output);
-                }
+                deps.writeText(step.path, step.content, step.mode, step.owner);
                 break;
             case "append-once":
                 deps.appendOnce(step.path, step.line);
@@ -125,20 +258,34 @@ export function planFleetAction(input, deps) {
             const existing = deps.readText(layout.registryFile);
             if (existing !== null && !input.yes)
                 throw new Error(`${layout.registryFile} exists; pass --yes to rewrite the template unit and fence (workspaces are kept)`);
-            const plan = initPlan({ domain: input.domain, node: input.node, script: input.script, operator: input.operator, layout });
-            if (existing) {
-                // Keep the workspaces already registered; only the domain and templates are rewritten.
-                const kept = parseRegistry(existing);
-                plan.registry.workspaces = kept.workspaces;
-                plan.registry.nextPort = kept.nextPort;
-                return plan.steps.map((step) => (step.kind === "write" && step.path === layout.registryFile ? { ...step, content: `${JSON.stringify(plan.registry, null, 2)}\n` } : step));
+            const kept = existing !== null ? parseRegistry(existing) : undefined;
+            const plan = initPlan({ domain: input.domain, node: input.node, script: input.script, operator: input.operator ?? kept?.operator, layout });
+            if (kept) {
+                // Reinitializing templates must not erase reservations or open sibling ports.
+                const registry = { ...kept, ...plan.registry, workspaces: kept.workspaces, nextPort: kept.nextPort };
+                return plan.steps.flatMap((step) => {
+                    if (step.kind === "write" && step.path === layout.registryFile)
+                        return [{ ...step, content: `${JSON.stringify(registry, null, 2)}\n` }];
+                    if (step.kind === "write" && step.path === layout.fenceFile)
+                        return [{ ...step, content: fenceRules(Object.values(registry.workspaces)) }];
+                    if (step.kind === "run" && step.argv.join(" ") === "systemctl enable --now openmausbot-fence.service")
+                        return [step, { kind: "run", argv: ["nft", "-f", layout.fenceFile], why: "reapply the preserved workspace fence" }];
+                    return [step];
+                });
             }
             return plan.steps;
         }
         case "create": {
             if (!input.slug)
                 throw new Error("fleet create needs a workspace name");
+            assertSlug(input.slug);
             const registry = loadRegistry(layout, deps);
+            if (registry.workspaces[input.slug])
+                throw new Error(`workspace "${input.slug}" already exists`);
+            for (const path of [workspaceHome(layout, input.slug), posix.join(layout.instancesDir, `${input.slug}.env`), posix.join(layout.caddyDir, `${input.slug}.caddy`), posix.join(posix.dirname(layout.unitFile), `openmausbot@${input.slug}.service.d`)]) {
+                if (deps.pathExists(path))
+                    throw new Error(`workspace path already exists: ${path}; recover or remove it explicitly before provisioning a fresh workspace`);
+            }
             const brandJson = input.brandJson ?? (input.brandFile ? deps.readText(input.brandFile) : undefined);
             if (input.brandFile && brandJson === null)
                 throw new Error(`${input.brandFile} not found`);
@@ -150,12 +297,58 @@ export function planFleetAction(input, deps) {
             return createPlan({
                 registry,
                 slug: input.slug,
-                seed: { admins: input.admins, members: input.members, ...(anthropicKey ? { anthropicKey } : {}), ...(input.cap !== undefined ? { monthlyCapUsd: input.cap } : {}), ...(brandJson ? { brandJson } : {}) },
+                seed: { admins: input.admins, members: input.members, ...(anthropicKey ? { anthropicKey } : {}), ...(input.anthropicUrl ? { anthropicUrl: input.anthropicUrl } : {}), ...(input.portalUrl ? { portalUrl: input.portalUrl } : {}), ...(input.cap !== undefined ? { monthlyCapUsd: input.cap } : {}), ...(brandJson ? { brandJson } : {}), openrouterKey: input.openrouterKey, openrouterUrl: input.openrouterUrl, openrouterModels: input.openrouterModels, openrouterDefault: input.openrouterDefault },
                 ...(input.licenseKey ? { licenseKey: input.licenseKey } : {}),
                 ...(input.memory ? { memoryMax: input.memory } : {}),
                 layout,
             }).steps;
         }
+        case "providers": {
+            if (!input.slug)
+                throw new Error("fleet providers needs a workspace name");
+            assertSlug(input.slug);
+            const workspace = loadRegistry(layout, deps).workspaces[input.slug];
+            if (!workspace)
+                throw new Error(`no workspace "${input.slug}"`);
+            assertManagedWorkspace(workspace);
+            const models = managedOpenRouterModels(input.openrouterModels);
+            const env = deps.readText(posix.join(layout.instancesDir, `${input.slug}.env`)) ?? "";
+            const portal = /^OMB_ADMIN_URL=(.+)$/m.exec(env)?.[1];
+            if (!portal || !env.split("\n").includes(`OMB_ADMIN_WORKSPACE=${input.slug}`))
+                throw new Error("workspace has no trusted portal configuration; operator recovery is required");
+            try {
+                const url = new URL(portal);
+                if (url.protocol !== "https:" || url.origin !== portal)
+                    throw new Error();
+            }
+            catch {
+                throw new Error("workspace portal configuration is invalid; operator recovery is required");
+            }
+            const file = posix.join(workspaceHome(layout, input.slug), ".config", "opencode", "opencode.json");
+            const raw = deps.readText(file, fleetUser(input.slug));
+            const object = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+            let config;
+            try {
+                const parsed = JSON.parse(raw ?? "null");
+                if (!object(parsed))
+                    throw new Error();
+                config = parsed;
+            }
+            catch {
+                throw new Error("managed OpenRouter configuration is missing or invalid; operator recovery is required");
+            }
+            const providers = config.provider;
+            const managed = object(providers) ? providers[MANAGED_OPENROUTER] : undefined;
+            const options = object(managed) ? managed.options : undefined;
+            if (!object(managed) || managed.npm !== "@ai-sdk/openai-compatible" || !object(options) || options.baseURL !== `${portal}/api/gateway/${input.slug}/openrouter/v1` || typeof options.apiKey !== "string" || !/^[!-~]+$/.test(options.apiKey)) {
+                throw new Error("managed OpenRouter configuration does not match the workspace portal; operator recovery is required");
+            }
+            managed.models = models;
+            return [
+                { kind: "write", path: file, content: `${JSON.stringify(config, null, 2)}\n`, mode: 0o600, owner: fleetUser(input.slug) },
+                { kind: "note", text: "managed OpenRouter models updated; refresh the workspace model picker to load its catalog" },
+            ];
+        }
         case "users": {
             if (!input.slug || !input.userAction || !input.email)
                 throw new Error("fleet users needs: NAME add|remove EMAIL [--chat-only]");
@@ -163,8 +356,9 @@ export function planFleetAction(input, deps) {
             const registry = loadRegistry(layout, deps);
             if (!registry.workspaces[input.slug])
                 throw new Error(`no workspace "${input.slug}"`);
+            assertManagedWorkspace(registry.workspaces[input.slug]);
             const file = posix.join(workspaceDataDir(layout, input.slug), "config.json");
-            const next = applySignIn(deps.readText(file) ?? "{}", input.userAction, input.email, Boolean(input.chatOnly));
+            const next = applySignIn(deps.readText(file, fleetUser(input.slug)) ?? "{}", input.userAction, input.email, Boolean(input.chatOnly));
             return [
                 { kind: "write", path: file, content: next.config, mode: 0o600, owner: fleetUser(input.slug) },
                 { kind: "note", text: next.summary },
@@ -181,7 +375,7 @@ export function planFleetAction(input, deps) {
             if (!input.slug)
                 throw new Error("fleet delete needs a workspace name");
             if (!input.yes)
-                throw new Error(`fleet delete removes the workspace's account${input.keepData ? "" : " and all of its data"}; pass --yes to confirm${input.keepData ? "" : ", or --keep-data to keep the home folder"}`);
+                throw new Error(`fleet delete ${input.keepData ? "retires the workspace, keeping its data and reserved Unix account" : "removes the workspace's account and all of its data"}; pass --yes to confirm${input.keepData ? "" : ", or --keep-data to keep the home folder and account reserved"}`);
             const registry = loadRegistry(layout, deps);
             return deletePlan({ registry, slug: input.slug, keepData: input.keepData, layout }).steps;
         }
@@ -191,8 +385,20 @@ export function planFleetAction(input, deps) {
             return [];
     }
 }
+/** Preserve the reservation and any account checkpoint after a failed create. */
+export function markProvisioningFailed(input, deps) {
+    if (input.action !== "create" || !input.slug)
+        return;
+    const layout = fleetLayout(input.root ?? "/");
+    const registry = loadRegistry(layout, deps);
+    const workspace = registry.workspaces[input.slug];
+    if (workspace?.status !== "provisioning")
+        return;
+    registry.workspaces[input.slug] = { ...workspace, status: "error" };
+    deps.writeText(layout.registryFile, `${JSON.stringify(registry, null, 2)}\n`, 0o600);
+}
 function printPlan(steps, io, reason) {
-    io.log(`${reason}; run these as root:`);
+    io.log(`${reason}; inspect this plan, then rerun the fleet command as root without --dry-run (with --yes where required):`);
     io.log("");
     for (const line of describeSteps(steps))
         io.log(line);
@@ -210,13 +416,24 @@ export async function runFleetCommand(input, io, deps = defaultFleetDeps()) {
                 return 0;
             }
             for (const workspace of rows) {
-                const live = asRoot ? (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() : workspace.status;
+                const live = asRoot && (workspace.status === "running" || workspace.status === "suspended") ? (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() : workspace.status;
                 io.log(`${workspace.slug.padEnd(24)} https://${workspace.host.padEnd(40)} :${String(workspace.port).padEnd(6)} ${live}`);
             }
             return 0;
         }
         const steps = planFleetAction(input, deps);
-        return asRoot ? await executePlan(steps, deps, io) : printPlan(steps, io, input.dryRun ? "dry run" : "not running as root");
+        if (!asRoot)
+            return printPlan(steps, io, input.dryRun ? "dry run" : "not running as root");
+        try {
+            const code = await executePlan(steps, deps, io);
+            if (code !== 0)
+                markProvisioningFailed(input, deps);
+            return code;
+        }
+        catch (error) {
+            markProvisioningFailed(input, deps);
+            throw error;
+        }
     }
     catch (error) {
         io.error(`fleet: ${error instanceof Error ? error.message : String(error)}`);

package/dist-server/server/fleet.js

@@ -98,8 +98,9 @@ export function templateUnit(spec) {
         "# Written by `openmausbot fleet init`. One unit for every workspace: %i is the slug.",
         "[Unit]",
         "Description=OpenMausBot workspace %i",
-        "After=network-online.target",
+        "After=network-online.target openmausbot-fence.service",
         "Wants=network-online.target",
+        "Requires=openmausbot-fence.service",
         "",
         "[Service]",
         "Type=simple",
@@ -131,7 +132,6 @@ export function fenceUnit(layout = fleetLayout()) {
         "# Written by `openmausbot fleet init`: keeps each workspace's loopback ports to its own user.",
         "[Unit]",
         "Description=OpenMausBot per-workspace loopback fence",
-        "Before=openmausbot@.service",
         "",
         "[Service]",
         "Type=oneshot",
@@ -149,14 +149,17 @@ export function fenceUnit(layout = fleetLayout()) {
 export function fenceRules(workspaces) {
     const lines = ["#!/usr/sbin/nft -f", "# Written by `openmausbot fleet`; regenerated on every create, suspend, resume and delete.", "add table inet openmausbot", "flush table inet openmausbot", "table inet openmausbot {", "\tchain output {", "\t\ttype filter hook output priority 0; policy accept;"];
     for (const workspace of [...workspaces].sort((a, b) => a.slug.localeCompare(b.slug))) {
+        if (workspace.status !== "running" && workspace.status !== "suspended" && workspace.status !== "retained" && !workspace.accountCreated)
+            continue;
         lines.push(`\t\toif lo tcp dport { ${workspace.port}, ${workspace.webhookPort} } meta skuid != { ${fleetUser(workspace.slug)}, caddy, root } reject`);
     }
     lines.push("\t}", "}", "");
     return lines.join("\n");
 }
 export function caddySite(workspace) {
-    if (workspace.status === "suspended") {
-        return [`${workspace.host} {`, "\trespond \"This workspace is suspended.\" 503", "}", ""].join("\n");
+    if (workspace.status !== "running") {
+        const message = workspace.status === "suspended" ? "This workspace is suspended." : "This workspace is not available.";
+        return [`${workspace.host} {`, `\trespond "${message}" 503`, "}", ""].join("\n");
     }
     return [
         `${workspace.host} {`,
@@ -185,14 +188,29 @@ export function instanceEnv(input) {
     ];
     if (input.licenseKey)
         lines.push(`OMB_LICENSE_KEY=${input.licenseKey}`);
+    if (input.portalUrl)
+        lines.push(`OMB_ADMIN_URL=${input.portalUrl}`, `OMB_ADMIN_WORKSPACE=${input.workspace.slug}`);
     return lines.join("\n") + "\n";
 }
+export const MANAGED_OPENROUTER = "omb-managed-openrouter";
+/** The gateway validates assignments too; keep filesystem seeds bounded and literal. */
+export function openRouterModelIds(value) {
+    if (!Array.isArray(value) || value.length > 100 || value.some((id) => typeof id !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._:/+-]{0,159}$/.test(id))) {
+        throw new Error("OpenRouter models must be an array of at most 100 valid model IDs");
+    }
+    return [...new Set(value)];
+}
+export function managedOpenRouterModels(models) {
+    return Object.fromEntries(openRouterModelIds(models).map((id) => [id, { name: id }]));
+}
 /** The workspace's first config.json: who may sign in, the key it runs on,
  * and its cap. Everything else stays the server's defaults. */
 export function initialConfig(seed) {
     const config = { signIn: { admins: seed.admins, members: seed.members } };
     if (seed.anthropicKey)
-        config.anthropic = { key: seed.anthropicKey };
+        config.anthropic = { key: seed.anthropicKey, ...(seed.anthropicUrl ? { url: seed.anthropicUrl } : {}) };
+    if (seed.openrouterDefault && seed.openrouterModels?.length)
+        config.defaultModelSelection = { instanceId: "opencodeGo", model: `${MANAGED_OPENROUTER}/${seed.openrouterModels[0]}` };
     if (seed.monthlyCapUsd !== undefined)
         config.budgets = { monthlyUsd: seed.monthlyCapUsd };
     return `${JSON.stringify(config, null, 2)}\n`;
@@ -238,6 +256,26 @@ export function initPlan(input) {
 }
 export function createPlan(input) {
     assertSlug(input.slug);
+    if (input.seed.portalUrl) {
+        const portal = new URL(input.seed.portalUrl);
+        if (portal.protocol !== "https:" || portal.origin !== input.seed.portalUrl)
+            throw new Error("portalUrl must be an HTTPS origin without a path or credentials");
+        if (portal.hostname === `${input.slug}.${input.registry.domain}`)
+            throw new Error("this workspace name is reserved for the admin portal");
+        if (input.seed.anthropicUrl && input.seed.anthropicUrl !== `${portal.origin}/api/gateway/${input.slug}/anthropic`)
+            throw new Error("managed provider URL must belong to this workspace's portal gateway");
+    }
+    else if (input.seed.anthropicUrl)
+        throw new Error("a managed provider URL requires portalUrl");
+    if (input.seed.openrouterKey !== undefined || input.seed.openrouterUrl !== undefined || input.seed.openrouterModels !== undefined || input.seed.openrouterDefault) {
+        if (!input.seed.portalUrl || input.seed.openrouterUrl !== `${input.seed.portalUrl}/api/gateway/${input.slug}/openrouter/v1`)
+            throw new Error("managed OpenRouter URL must belong to this workspace's portal gateway");
+        if (!input.seed.openrouterKey || !/^[!-~]+$/.test(input.seed.openrouterKey))
+            throw new Error("managed OpenRouter requires a non-empty workspace credential without whitespace");
+        const models = openRouterModelIds(input.seed.openrouterModels ?? []);
+        if (input.seed.openrouterDefault && !models.length)
+            throw new Error("a default OpenRouter model requires a model assignment");
+    }
     if (input.registry.workspaces[input.slug])
         throw new Error(`workspace "${input.slug}" already exists`);
     if (!input.seed.admins.length)
@@ -257,15 +295,32 @@ export function createPlan(input) {
         createdAt: (input.now ?? new Date()).toISOString(),
     };
     const registry = { ...input.registry, nextPort: next, workspaces: { ...input.registry.workspaces, [workspace.slug]: workspace } };
+    const reserved = (accountCreated) => ({
+        ...registry,
+        workspaces: { ...registry.workspaces, [workspace.slug]: { ...workspace, status: "provisioning", accountCreated } },
+    });
     const user = fleetUser(workspace.slug);
     const home = workspaceHome(layout, workspace.slug);
     const dataDir = workspaceDataDir(layout, workspace.slug);
     const steps = [
+        // Reserve the identity and ports before any external resource is created.
+        // A crash leaves an inspectable reservation, never a silently reusable home.
+        { kind: "write", path: layout.registryFile, content: `${JSON.stringify(reserved(false), null, 2)}\n`, mode: 0o600 },
         { kind: "run", argv: ["useradd", "--system", "--create-home", "--home-dir", home, "--shell", "/usr/sbin/nologin", "--user-group", user], why: `the workspace's own account` },
+        { kind: "write", path: layout.registryFile, content: `${JSON.stringify(reserved(true), null, 2)}\n`, mode: 0o600 },
         { kind: "mkdir", path: dataDir, mode: 0o700, owner: user },
         { kind: "write", path: join(dataDir, "config.json"), content: initialConfig(input.seed), mode: 0o600, owner: user },
+        ...(input.seed.openrouterKey ? [
+            { kind: "mkdir", path: join(home, ".config"), mode: 0o700, owner: user },
+            { kind: "mkdir", path: join(home, ".config", "opencode"), mode: 0o700, owner: user },
+            { kind: "write", path: join(home, ".config", "opencode", "opencode.json"), mode: 0o600, owner: user, content: `${JSON.stringify({ provider: { [MANAGED_OPENROUTER]: {
+                            npm: "@ai-sdk/openai-compatible", name: "Managed OpenRouter",
+                            options: { baseURL: input.seed.openrouterUrl, apiKey: input.seed.openrouterKey },
+                            models: managedOpenRouterModels(input.seed.openrouterModels ?? []),
+                        } } }, null, 2)}\n` },
+        ] : []),
         ...(input.seed.brandJson ? [{ kind: "write", path: join(dataDir, "brand.json"), content: input.seed.brandJson, mode: 0o600, owner: user }] : []),
-        { kind: "write", path: join(layout.instancesDir, `${workspace.slug}.env`), content: instanceEnv({ workspace, dataDir, licenseKey: input.licenseKey }), mode: 0o600 },
+        { kind: "write", path: join(layout.instancesDir, `${workspace.slug}.env`), content: instanceEnv({ workspace, dataDir, licenseKey: input.licenseKey, portalUrl: input.seed.portalUrl }), mode: 0o600 },
         ...(input.memoryMax
             ? [
                 { kind: "mkdir", path: join(layout.unitFile.replace(/openmausbot@\.service$/, ""), `openmausbot@${workspace.slug}.service.d`), mode: 0o755 },
@@ -284,11 +339,17 @@ export function createPlan(input) {
     ];
     return { steps, registry, workspace };
 }
+/** Incomplete provisioning and retained homes need explicit operator recovery. */
+export function assertManagedWorkspace(workspace) {
+    if (workspace.status !== "running" && workspace.status !== "suspended")
+        throw new Error(`workspace "${workspace.slug}" is ${workspace.status} and requires operator recovery`);
+}
 function withStatus(registry, slug, status) {
     assertSlug(slug);
     const current = registry.workspaces[slug];
     if (!current)
         throw new Error(`no workspace "${slug}"`);
+    assertManagedWorkspace(current);
     const workspace = { ...current, status };
     return { registry: { ...registry, workspaces: { ...registry.workspaces, [slug]: workspace } }, workspace };
 }
@@ -325,8 +386,9 @@ export function deletePlan(input) {
     const workspace = input.registry.workspaces[input.slug];
     if (!workspace)
         throw new Error(`no workspace "${input.slug}"`);
+    assertManagedWorkspace(workspace);
     const { [input.slug]: _gone, ...rest } = input.registry.workspaces;
-    const registry = { ...input.registry, workspaces: rest };
+    const registry = { ...input.registry, workspaces: input.keepData ? { ...rest, [input.slug]: { ...workspace, status: "retained" } } : rest };
     const unitsDir = layout.unitFile.replace(/openmausbot@\.service$/, "");
     return {
         registry,
@@ -337,8 +399,12 @@ export function deletePlan(input) {
             { kind: "remove", path: join(layout.instancesDir, `${workspace.slug}.env`) },
             { kind: "remove", path: join(unitsDir, `openmausbot@${workspace.slug}.service.d`, "limits.conf") },
             { kind: "write", path: layout.fenceFile, content: fenceRules(Object.values(registry.workspaces)), mode: 0o600 },
-            { kind: "run", argv: ["nft", "-f", layout.fenceFile], why: "drop its fence rule" },
-            { kind: "run", argv: input.keepData ? ["userdel", fleetUser(workspace.slug)] : ["userdel", "--remove", fleetUser(workspace.slug)], why: input.keepData ? "remove the account, keep its home and data" : "remove the account and everything it owned" },
+            { kind: "run", argv: ["nft", "-f", layout.fenceFile], why: input.keepData ? "keep the retained account's fence" : "drop its fence rule" },
+            // Retain the nologin account too: recycling its UID would give a new
+            // workspace ownership of the preserved home, even under a different slug.
+            ...(input.keepData
+                ? [{ kind: "note", text: "keeping the disabled workspace's account, home and name reserved; operator recovery is required before reuse" }]
+                : [{ kind: "run", argv: ["userdel", "--remove", fleetUser(workspace.slug)], why: "remove the account and everything it owned" }]),
             { kind: "write", path: layout.registryFile, content: `${JSON.stringify(registry, null, 2)}\n`, mode: 0o600 },
         ],
     };
@@ -368,26 +434,34 @@ export function applySignIn(configText, action, email, chatOnly) {
     if (action === "remove") {
         if (admins.length + members.length === list(current.admins).length + list(current.members).length)
             throw new Error(`${entry} is not on the list`);
-        return { config: `${JSON.stringify({ ...raw, signIn: { admins, members } }, null, 2)}\n`, summary: `${entry} can no longer sign in; existing sessions stay until they expire or are revoked` };
+        if (!admins.length)
+            throw new Error("a workspace needs at least one admin; add another admin first");
+        return { config: `${JSON.stringify({ ...raw, signIn: { admins, members } }, null, 2)}\n`, summary: `${entry} was removed from the allow-list; existing email sessions are rechecked against the remaining entries` };
     }
     const next = chatOnly ? { admins, members: [...members, entry] } : { admins: [...admins, entry], members };
+    if (!next.admins.length)
+        throw new Error("a workspace needs at least one admin; add another admin first");
     return { config: `${JSON.stringify({ ...raw, signIn: next }, null, 2)}\n`, summary: `${entry} can sign in with an emailed code (${chatOnly ? "chat and approvals" : "full access"})` };
 }
 function shellQuote(value) {
     return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
 }
-/** The plan as lines an operator can read or paste into a root shell. */
+/** Inspectable plan. Tenant I/O must use the executor's privilege drop. */
 export function describeSteps(steps) {
     const lines = [];
     for (const step of steps) {
         switch (step.kind) {
             case "mkdir":
-                lines.push(`install -d -m ${step.mode.toString(8)}${step.owner ? ` -o ${step.owner} -g ${step.owner}` : ""} ${shellQuote(step.path)}`);
+                lines.push(step.owner
+                    ? `# Create ${shellQuote(step.path)} mode ${step.mode.toString(8)} as ${step.owner} (use fleet --yes; never root chown on tenant paths)`
+                    : `install -d -m ${step.mode.toString(8)} ${shellQuote(step.path)}`);
                 break;
             case "write":
+                if (step.owner) {
+                    lines.push(`# Write ${shellQuote(step.path)} mode ${step.mode.toString(8)} as ${step.owner} (use fleet --yes; tenant content omitted)`);
+                    break;
+                }
                 lines.push(`cat > ${shellQuote(step.path)} <<'OMB_EOF'`, step.content.replace(/\n$/, ""), "OMB_EOF", `chmod ${step.mode.toString(8)} ${shellQuote(step.path)}`);
-                if (step.owner)
-                    lines.push(`chown ${step.owner}:${step.owner} ${shellQuote(step.path)}`);
                 break;
             case "append-once":
                 lines.push(`grep -qxF ${shellQuote(step.line)} ${shellQuote(step.path)} || printf '\\n%s\\n' ${shellQuote(step.line)} >> ${shellQuote(step.path)}`);

package/dist-server/server/hosted-contract.js

@@ -0,0 +1,16 @@
+// This versions only the hosted consume/check wire contract, not the app release.
+export const HOSTED_CONTRACT_VERSION = 1;
+export const HOSTED_CONTRACT_HEADER = "x-omb-hosted-contract-version";
+export const HOSTED_CONTRACT_METADATA = Object.freeze({
+    contractVersion: HOSTED_CONTRACT_VERSION,
+    supportedContractVersions: Object.freeze([HOSTED_CONTRACT_VERSION]),
+    legacyPolicy: "legacy-v1",
+});
+export const HOSTED_CONTRACT_MISMATCH = "HOSTED_CONTRACT_MISMATCH";
+export const HOSTED_CONTRACT_ERROR = "Admin and workspace runtime versions are incompatible. Ask your administrator to update the deployment.";
+/** legacy-v1 accepts an omitted version only for the existing v1 payload.
+ * Remove this transition at protocol v2; never retry an unsupported explicit
+ * version without its version field or infer compatibility from app versions. */
+export function hostedContractCompatible(version) {
+    return version === undefined ? HOSTED_CONTRACT_VERSION === 1 : version === HOSTED_CONTRACT_VERSION;
+}