openmausbot 0.1.76 → 0.1.78

package/dist-server/server/drivers/claude.js

@@ -21,7 +21,7 @@ import { ClaudeLoginController } from "./claude-login-auth.js";
 import { computerProxyEnv } from "../container-computer.js";
 import { gateServer, resultBudget } from "../mcp-gate-config.js";
 import { newEventId, newId } from "../contracts.js";
-import { askInputSummary, commandSummary } from "../tool-summary.js";
+import { askInputSummary, commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
@@ -1396,6 +1396,7 @@ export const ClaudeDriver = {
                                     itemId: b.id,
                                     title: b.name,
                                     summary: commandSummary(b.input),
+                                    input: toolDetailPreview(b.input),
                                 });
                             }
                         }
@@ -1415,7 +1416,7 @@ export const ClaudeDriver = {
                     case "user":
                         for (const b of Array.isArray(o.message?.content) ? o.message.content : []) {
                             if (b.type === "tool_result") {
-                                emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "tool", itemId: b.tool_use_id, ok: !b.is_error });
+                                emit({ ...base(threadId, currentTurnId()), type: "item.completed", itemType: "tool", itemId: b.tool_use_id, ok: !b.is_error, output: toolDetailPreview(b.content) });
                             }
                         }
                         break;

package/dist-server/server/drivers/codex.js

@@ -22,7 +22,7 @@ import { codexLocalProviderArgs } from "./local-inject.js";
 import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, RETRY_MAX_ATTEMPTS } from "./retry.js";
 import { appendNative } from "./native.js";
-import { commandSummary } from "../tool-summary.js";
+import { commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
 import { codexAccountEmail } from "./codex-identity.js";
@@ -799,6 +799,7 @@ export const CodexDriver = {
                                     itemId: item.id,
                                     title,
                                     summary: item.type === "commandExecution" ? commandSummary({ command: item.command }) : undefined,
+                                    input: toolDetailPreview(item.type === "commandExecution" ? { command: item.command, cwd: item.cwd } : item.type === "mcpToolCall" ? item.arguments : item.type === "fileChange" ? item.changes : item.query),
                                 });
                             }
                             break;
@@ -839,6 +840,7 @@ export const CodexDriver = {
                                     itemType: "tool",
                                     itemId: item.id,
                                     ok: item.status !== "failed" && item.status !== "declined",
+                                    output: toolDetailPreview(item.type === "commandExecution" ? { output: item.aggregatedOutput, exitCode: item.exitCode } : item.type === "mcpToolCall" ? item.error ?? item.result : item.type === "fileChange" ? item.changes : item.action),
                                 });
                             }
                             else if (item.type === "reasoning") {

package/dist-server/server/drivers/pi.js

@@ -28,6 +28,7 @@ import { computerProxyEnv } from "../container-computer.js";
 import { augmentedPath } from "../env-path.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { EFFORT_LEVELS, newEventId, newId } from "../contracts.js";
 import { decodeInjectId, encodeInjectId, hostApiKey, localHost, mergeLocalInject, } from "./local-inject.js";
 import { appendNative } from "./native.js";
@@ -610,6 +611,8 @@ export const PiDriver = {
                             itemType: "tool",
                             itemId: evt.toolCallId,
                             title: String(evt.toolName ?? "tool").slice(0, 80),
+                            summary: commandSummary(evt.args),
+                            input: toolDetailPreview(evt.args),
                         });
                         return;
                     }
@@ -620,6 +623,7 @@ export const PiDriver = {
                             itemType: "tool",
                             itemId: evt.toolCallId,
                             ok: !evt.isError,
+                            output: toolDetailPreview(evt.result),
                         });
                         return;
                     }

package/dist-server/server/enterprise.js

@@ -27,6 +27,40 @@ const layerSchema = z.object({
 });
 const DEFAULT_DIR = join(SERVER_ROOT, "..", "enterprise");
 let current = { edition: "oss", features: [] };
+let workspaceAccessFactory;
+export function hostedWorkspaceConfigured(env = process.env) {
+    return env.OMB_ADMIN_URL !== undefined || env.OMB_ADMIN_WORKSPACE !== undefined || env.OMB_ADMIN_MEMBERSHIP !== undefined;
+}
+/** Validate the operator's complete hosted configuration before any session
+ * can delegate membership authority. A partial setting is never standalone. */
+export function hostedWorkspaceConfiguration(env = process.env) {
+    try {
+        const origin = (raw) => {
+            if (!raw || raw !== raw.trim())
+                throw new Error("missing origin");
+            const url = new URL(raw);
+            if (url.protocol !== "https:" || (raw !== url.origin && raw !== `${url.origin}/`))
+                throw new Error("invalid origin");
+            return url;
+        };
+        if (!/^[a-z][a-z0-9-]{1,30}$/.test(env.OMB_ADMIN_WORKSPACE ?? ""))
+            return null;
+        if (env.OMB_ADMIN_MEMBERSHIP !== undefined && !["local", "portal"].includes(env.OMB_ADMIN_MEMBERSHIP))
+            return null;
+        return { admin: origin(env.OMB_ADMIN_URL), tenant: origin(env.OMB_PUBLIC_URL), workspace: env.OMB_ADMIN_WORKSPACE, portalMembership: env.OMB_ADMIN_MEMBERSHIP === "portal" };
+    }
+    catch {
+        return null;
+    }
+}
+/** No enterprise import or portal dependency enters the core bundle. A
+ * configured server without this hook must refuse hosted access, not fall
+ * back to legacy email or QR credentials. */
+export function createWorkspaceAccess(options) {
+    if (!hostedWorkspaceConfigured(options.env))
+        return null;
+    return workspaceAccessFactory?.({ ...options, entitled: () => entitled("admin") }) ?? null;
+}
 function oss(notice) {
     current = notice ? { edition: "oss", features: [], notice } : { edition: "oss", features: [] };
     return current;
@@ -34,6 +68,7 @@ function oss(notice) {
 /** Resolve the edition once at startup. Never throws: a broken layer or key
  * degrades to the open-source edition with a notice that says what to fix. */
 export async function loadEnterpriseLayer(options = {}) {
+    workspaceAccessFactory = undefined;
     const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
     const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
     // Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts.
@@ -43,6 +78,9 @@ export async function loadEnterpriseLayer(options = {}) {
     }
     try {
         const loaded = await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
+        const access = Reflect.get(Object(loaded), "createWorkspaceAccess");
+        if (typeof access === "function")
+            workspaceAccessFactory = access;
         const register = Reflect.get(Object(loaded), "register");
         if (typeof register !== "function")
             throw new Error(`${entry} does not export register()`);

package/dist-server/server/environment.js

@@ -99,6 +99,9 @@ export function environmentDescriptor(input) {
         version: serverVersion(),
         capabilities: {
             remoteSessions: true,
+            // Never advertise a protocol this server would refuse: the routes are
+            // gone unless features.sharedComputers is on, so the capability is too.
+            ...(input.sharedComputers === true ? { sharedComputers: true } : {}),
             selfUpdate: input.desktopManaged ? "desktop-managed" : "operator",
             emailSignIn: input.emailSignIn === true,
         },

package/dist-server/server/fleet-agent.js

@@ -6,9 +6,8 @@
 import { appendFileSync, chmodSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import { createServer } from "node:http";
 import { dirname } from "node:path";
-import { defaultFleetDeps, executePlan, loadRegistry, planFleetAction } from "./fleet-cli.js";
-import { assertSlug, fleetLayout, workspaceDataDir } from "./fleet.js";
-import { readUsage, summarizeUsage } from "./usage-ledger.js";
+import { defaultFleetDeps, executePlan, loadRegistry, markProvisioningFailed, planFleetAction } from "./fleet-cli.js";
+import { assertSlug, fleetLayout, fleetUser, openRouterModelIds, workspaceDataDir } from "./fleet.js";
 const MAX_BODY = 256 * 1024;
 function readBody(req) {
     return new Promise((resolve, reject) => {
@@ -35,11 +34,23 @@ function readBody(req) {
 const strings = (value) => (Array.isArray(value) ? value.filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean) : []);
 const text = (value) => (typeof value === "string" && value.trim() ? value.trim() : undefined);
 const number = (value) => (typeof value === "number" && Number.isFinite(value) ? value : undefined);
-/** This month's totals from a workspace's own ledger, read as root. */
-export function workspaceUsage(layout, slug, now) {
-    const from = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
-    const total = summarizeUsage(readUsage(workspaceDataDir(layout, slug), { from, to: now }), "bot").total;
-    return { month: now.toISOString().slice(0, 7), turns: total.turns, costUsd: total.costUsd, billableUsd: total.billableUsd };
+const models = (value) => {
+    try {
+        return openRouterModelIds(value);
+    }
+    catch (error) {
+        throw Object.assign(error, { status: 400 });
+    }
+};
+/** Only bounded, unprivileged aggregates cross back into the root process. */
+export function workspaceUsage(layout, slug, now, deps) {
+    const month = now.toISOString().slice(0, 7);
+    try {
+        return { month, ...deps.usage(workspaceDataDir(layout, slug), fleetUser(slug), now) };
+    }
+    catch {
+        return { month, turns: null, costUsd: null, billableUsd: null, unavailable: true };
+    }
 }
 export function createFleetAgent(options) {
     const deps = options.deps ?? defaultFleetDeps();
@@ -59,7 +70,7 @@ export function createFleetAgent(options) {
             /* the audit line must never fail the action it records */
         }
     };
-    const act = async (input) => {
+    const runAction = async (input) => {
         const log = [];
         const errors = [];
         const io = { log: (line) => log.push(line), error: (line) => errors.push(line) };
@@ -71,10 +82,32 @@ export function createFleetAgent(options) {
             audit({ action: input.action, slug: input.slug, ok: false, error: error instanceof Error ? error.message : String(error) });
             return { status: 400, body: { error: error instanceof Error ? error.message : String(error) } };
         }
-        const code = await executePlan(steps, deps, io);
+        let code = 1;
+        try {
+            code = await executePlan(steps, deps, io);
+        }
+        catch (error) {
+            errors.push(error instanceof Error ? error.message : String(error));
+        }
+        if (code !== 0) {
+            try {
+                markProvisioningFailed(input, deps);
+            }
+            catch {
+                errors.push("could not record the failed provisioning; inspect the reserved workspace before recovery");
+            }
+        }
         audit({ action: input.action, slug: input.slug, ok: code === 0, ...(input.email ? { email: input.email } : {}) });
         return code === 0 ? { status: 200, body: { ok: true, log } } : { status: 500, body: { error: errors[0] ?? "the step failed", log: [...log, ...errors] } };
     };
+    // Planning reads the registry too: serialize the entire read/modify/execute
+    // sequence, not just the subprocesses, so ports and updates cannot collide.
+    let mutationTail = Promise.resolve();
+    const act = (input) => {
+        const result = mutationTail.then(() => runAction(input));
+        mutationTail = result.catch(() => { });
+        return result;
+    };
     const handle = async (req, res) => {
         const url = new URL(req.url ?? "/", "http://fleet");
         const method = req.method ?? "GET";
@@ -87,10 +120,13 @@ export function createFleetAgent(options) {
                 return send(200, { ok: true });
             if (method === "GET" && url.pathname === "/workspaces") {
                 const registry = loadRegistry(layout, deps);
+                const statusOnly = url.searchParams.get("statusOnly") === "true";
                 const workspaces = [];
                 for (const workspace of Object.values(registry.workspaces).sort((a, b) => a.slug.localeCompare(b.slug))) {
-                    const live = (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() || "unknown";
-                    workspaces.push({ ...workspace, live, usage: workspaceUsage(layout, workspace.slug, now()) });
+                    const live = workspace.status === "running" || workspace.status === "suspended"
+                        ? (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() || "unknown"
+                        : workspace.status;
+                    workspaces.push(statusOnly ? { slug: workspace.slug, live } : { ...workspace, live, usage: workspaceUsage(layout, workspace.slug, now(), deps) });
                 }
                 return send(200, { domain: registry.domain, operator: registry.operator ?? null, workspaces });
             }
@@ -99,6 +135,9 @@ export function createFleetAgent(options) {
                 const result = await act({
                     ...base(), action: "create", slug: text(body.slug), admins: strings(body.admins), members: strings(body.members),
                     cap: number(body.cap), memory: text(body.memory), brandJson: text(body.brandJson), anthropicKey: text(body.anthropicKey),
+                    portalUrl: text(body.portalUrl), anthropicUrl: text(body.anthropicUrl),
+                    openrouterKey: text(body.openrouterKey), openrouterUrl: text(body.openrouterUrl),
+                    openrouterModels: body.openrouterModels === undefined ? undefined : models(body.openrouterModels), openrouterDefault: body.openrouterDefault === true,
                 });
                 return send(result.status, result.body);
             }
@@ -106,11 +145,16 @@ export function createFleetAgent(options) {
                 const result = await act({ ...base(), action: "upgrade" });
                 return send(result.status, result.body);
             }
-            const match = /^\/workspaces\/([a-z0-9-]+)(?:\/(users|suspend|resume))?$/.exec(url.pathname);
+            const match = /^\/workspaces\/([a-z0-9-]+)(?:\/(users|providers|suspend|resume))?$/.exec(url.pathname);
             if (match) {
                 const slug = match[1];
                 assertSlug(slug);
                 const sub = match[2];
+                if (method === "POST" && sub === "providers") {
+                    const body = await readBody(req);
+                    const result = await act({ ...base(), action: "providers", slug, openrouterModels: models(body.models) });
+                    return send(result.status, result.body);
+                }
                 if (method === "POST" && sub === "users") {
                     const body = await readBody(req);
                     const action = body.action === "remove" ? "remove" : body.action === "add" ? "add" : undefined;

package/dist-server/server/fleet-cli.js

@@ -3,11 +3,124 @@
 // prints them for an operator to paste into a root shell, and never builds
 // a shell command from user input. The fleet agent (fleet-agent.ts) reuses
 // the same planner and executor over a Unix socket.
-import { spawn } from "node:child_process";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { execFileSync, spawn } from "node:child_process";
+import { appendFileSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, rmSync } from "node:fs";
 import { posix } from "node:path";
+import { writeFileAtomic } from "./atomic.js";
 import { unstableInstallWarning } from "./service-unit.js";
-import { applySignIn, assertSlug, createPlan, deletePlan, describeSteps, fleetLayout, fleetUser, initPlan, parseRegistry, resumePlan, suspendPlan, upgradePlan, workspaceDataDir, } from "./fleet.js";
+import { applySignIn, assertManagedWorkspace, assertSlug, assertUnixUser, createPlan, deletePlan, describeSteps, fleetLayout, fleetUser, fenceRules, initPlan, MANAGED_OPENROUTER, managedOpenRouterModels, parseRegistry, resumePlan, suspendPlan, upgradePlan, workspaceDataDir, workspaceHome, } from "./fleet.js";
+// Tenant-controlled ancestors can be renamed between any two filesystem calls.
+// The boundary is dropping ALL root authority before I/O, not a preceding lstat.
+// The checks additionally reject visible symlinks, shared inodes and special files.
+const TENANT_IO = String.raw `
+const fs = require("node:fs");
+const path = require("node:path");
+const { randomUUID } = require("node:crypto");
+const request = JSON.parse(fs.readFileSync(0, "utf8"));
+const { uid, gid, home, file, action, content, mode } = request;
+if (process.getuid() === 0) {
+  process.setgroups([]);
+  process.setgid(gid);
+  process.setuid(uid);
+}
+if (process.getuid() !== uid || process.getgid() !== gid || uid === 0 || gid === 0) throw Error("could not drop fleet file privileges");
+const limit = 4 * 1024 * 1024;
+const check = (stat, directory) => {
+  if (stat.uid !== uid || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1)) throw Error("unsafe workspace file or directory");
+};
+const totals = { turns: 0, costUsd: null, billableUsd: null };
+let cursor = home;
+try {
+  check(fs.lstatSync(cursor), true);
+  for (const part of path.relative(home, path.dirname(file)).split(path.sep).filter(Boolean)) {
+    cursor = path.join(cursor, part);
+    check(fs.lstatSync(cursor), true);
+  }
+} catch (error) {
+  if (action !== "usage" || error.code !== "ENOENT") throw error;
+  process.stdout.write(JSON.stringify(totals));
+  process.exit(0);
+}
+let result = null;
+if (action === "mkdir") {
+  try { fs.mkdirSync(file, { mode }); } catch (error) { if (error.code !== "EEXIST") throw error; }
+  check(fs.lstatSync(file), true);
+} else if (action === "read" || action === "usage") {
+  let fd;
+  try { fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (fd !== undefined) {
+    try {
+      const stat = fs.fstatSync(fd);
+      check(stat, false);
+      if (stat.size > limit) throw Error("workspace file exceeds 4 MiB");
+      const data = Buffer.alloc(limit + 1);
+      let size = 0;
+      while (size < data.length) { const read = fs.readSync(fd, data, size, data.length - size, null); if (!read) break; size += read; }
+      if (size > limit) throw Error("workspace file exceeds 4 MiB");
+      result = data.subarray(0, size).toString("utf8");
+    } finally { fs.closeSync(fd); }
+  }
+  if (action === "usage") {
+    const to = Date.parse(content);
+    const date = new Date(to);
+    const from = Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1);
+    // Scan one bounded month's text without retaining rows or allocating groups.
+    const text = result || "";
+    for (let offset = 0; offset < text.length;) {
+      const end = text.indexOf("\n", offset);
+      const line = text.slice(offset, end < 0 ? text.length : end);
+      offset = end < 0 ? text.length : end + 1;
+      let row;
+      try { row = JSON.parse(line); } catch { continue; }
+      if (!row || typeof row !== "object" || typeof row.at !== "string" || typeof row.botId !== "string" || typeof row.model !== "string" || typeof row.input !== "number" || typeof row.output !== "number" || !row.trigger || typeof row.trigger !== "object" || typeof row.trigger.kind !== "string") continue;
+      const at = Date.parse(row.at);
+      if (!(at >= from && at <= to)) continue;
+      totals.turns++;
+      if (typeof row.costUsd === "number" && Number.isFinite(row.costUsd) && row.costUsd >= 0) {
+        const sum = (totals.costUsd || 0) + row.costUsd;
+        if (!Number.isFinite(sum)) throw Error("workspace usage total exceeds numeric range");
+        totals.costUsd = sum;
+      }
+    }
+    result = totals;
+  }
+} else if (action === "write") {
+  if (Buffer.byteLength(content) > limit) throw Error("workspace file exceeds 4 MiB");
+  try { check(fs.lstatSync(file), false); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  const temp = file + ".fleet-" + randomUUID();
+  let fd;
+  try {
+    fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, mode);
+    fs.writeFileSync(fd, content);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd); fd = undefined;
+    fs.renameSync(temp, file);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    try { fs.unlinkSync(temp); } catch (error) { if (error.code !== "ENOENT") throw error; }
+  }
+} else throw Error("unknown fleet file operation");
+process.stdout.write(JSON.stringify(result));
+`;
+function tenantIo(owner, file, action, content, mode) {
+    assertUnixUser(owner);
+    const options = { encoding: "utf8", timeout: 5_000, killSignal: "SIGKILL", cwd: "/", env: { PATH: "/usr/bin:/bin" }, stdio: ["pipe", "pipe", "pipe"] };
+    const account = execFileSync("/usr/bin/getent", ["passwd", owner], { ...options, maxBuffer: 8192 }).trim().split(":");
+    const uid = Number(account[2]);
+    const gid = Number(account[3]);
+    const home = account[5];
+    if (account.length !== 7 || account[0] !== owner || !Number.isSafeInteger(uid) || uid <= 0 || !Number.isSafeInteger(gid) || gid <= 0 || !home?.startsWith("/") || posix.normalize(home) !== home || !file.startsWith(`${home}/`) || posix.normalize(file) !== file) {
+        throw new Error(`unsafe filesystem identity or path for ${owner}`);
+    }
+    try {
+        return JSON.parse(execFileSync(process.execPath, ["--eval", TENANT_IO], { ...options, maxBuffer: action === "usage" ? 8192 : 32 * 1024 * 1024, input: JSON.stringify({ uid, gid, home, file, action, content, mode }) }));
+    }
+    catch {
+        // Do not repeat helper stderr: tenant-controlled file contents may be secret.
+        throw new Error(`could not ${action} workspace file as ${owner}: check ownership, links, file size and permissions`);
+    }
+}
 export function defaultFleetDeps() {
     return {
         isRoot: () => typeof process.getuid === "function" && process.getuid() === 0,
@@ -27,9 +140,39 @@ export function defaultFleetDeps() {
                 resolve({ code: null, output: error instanceof Error ? error.message : String(error) });
             }
         }),
-        readText: (path) => (existsSync(path) ? readFileSync(path, "utf8") : null),
-        writeText: (path, content, mode) => writeFileSync(path, content, { mode }),
-        mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
+        pathExists: (path) => { try {
+            lstatSync(path);
+            return true;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return false;
+            throw error;
+        } },
+        readText: (path, owner) => owner ? tenantIo(owner, path, "read") : (existsSync(path) ? readFileSync(path, "utf8") : null),
+        usage: (dataDir, owner, now) => {
+            const at = now.toISOString();
+            return tenantIo(owner, posix.join(dataDir, "usage", `${at.slice(0, 7)}.jsonl`), "usage", at);
+        },
+        writeText: (path, content, mode, owner) => {
+            if (owner) {
+                tenantIo(owner, path, "write", content, mode);
+                return;
+            }
+            writeFileAtomic(path, content, { mode });
+            // Persist the rename before the next external step (notably useradd).
+            const directory = openSync(posix.dirname(path), "r");
+            try {
+                fsyncSync(directory);
+            }
+            finally {
+                closeSync(directory);
+            }
+        },
+        mkdir: (path, mode, owner) => { if (owner)
+            tenantIo(owner, path, "mkdir", undefined, mode);
+        else
+            mkdirSync(path, { recursive: true, mode }); },
         appendOnce: (path, line) => {
             const current = existsSync(path) ? readFileSync(path, "utf8") : "";
             if (!current.split("\n").some((existing) => existing.trim() === line))
@@ -60,20 +203,10 @@ export async function executePlan(steps, deps, io) {
     for (const step of steps) {
         switch (step.kind) {
             case "mkdir":
-                deps.mkdir(step.path, step.mode);
-                if (step.owner) {
-                    const chown = await deps.run(["chown", `${step.owner}:${step.owner}`, step.path]);
-                    if (chown.code !== 0)
-                        return failed(io, `chown ${step.path}`, chown.output);
-                }
+                deps.mkdir(step.path, step.mode, step.owner);
                 break;
             case "write":
-                deps.writeText(step.path, step.content, step.mode);
-                if (step.owner) {
-                    const chown = await deps.run(["chown", `${step.owner}:${step.owner}`, step.path]);
-                    if (chown.code !== 0)
-                        return failed(io, `chown ${step.path}`, chown.output);
-                }
+                deps.writeText(step.path, step.content, step.mode, step.owner);
                 break;
             case "append-once":
                 deps.appendOnce(step.path, step.line);
@@ -125,20 +258,34 @@ export function planFleetAction(input, deps) {
             const existing = deps.readText(layout.registryFile);
             if (existing !== null && !input.yes)
                 throw new Error(`${layout.registryFile} exists; pass --yes to rewrite the template unit and fence (workspaces are kept)`);
-            const plan = initPlan({ domain: input.domain, node: input.node, script: input.script, operator: input.operator, layout });
-            if (existing) {
-                // Keep the workspaces already registered; only the domain and templates are rewritten.
-                const kept = parseRegistry(existing);
-                plan.registry.workspaces = kept.workspaces;
-                plan.registry.nextPort = kept.nextPort;
-                return plan.steps.map((step) => (step.kind === "write" && step.path === layout.registryFile ? { ...step, content: `${JSON.stringify(plan.registry, null, 2)}\n` } : step));
+            const kept = existing !== null ? parseRegistry(existing) : undefined;
+            const plan = initPlan({ domain: input.domain, node: input.node, script: input.script, operator: input.operator ?? kept?.operator, layout });
+            if (kept) {
+                // Reinitializing templates must not erase reservations or open sibling ports.
+                const registry = { ...kept, ...plan.registry, workspaces: kept.workspaces, nextPort: kept.nextPort };
+                return plan.steps.flatMap((step) => {
+                    if (step.kind === "write" && step.path === layout.registryFile)
+                        return [{ ...step, content: `${JSON.stringify(registry, null, 2)}\n` }];
+                    if (step.kind === "write" && step.path === layout.fenceFile)
+                        return [{ ...step, content: fenceRules(Object.values(registry.workspaces)) }];
+                    if (step.kind === "run" && step.argv.join(" ") === "systemctl enable --now openmausbot-fence.service")
+                        return [step, { kind: "run", argv: ["nft", "-f", layout.fenceFile], why: "reapply the preserved workspace fence" }];
+                    return [step];
+                });
             }
             return plan.steps;
         }
         case "create": {
             if (!input.slug)
                 throw new Error("fleet create needs a workspace name");
+            assertSlug(input.slug);
             const registry = loadRegistry(layout, deps);
+            if (registry.workspaces[input.slug])
+                throw new Error(`workspace "${input.slug}" already exists`);
+            for (const path of [workspaceHome(layout, input.slug), posix.join(layout.instancesDir, `${input.slug}.env`), posix.join(layout.caddyDir, `${input.slug}.caddy`), posix.join(posix.dirname(layout.unitFile), `openmausbot@${input.slug}.service.d`)]) {
+                if (deps.pathExists(path))
+                    throw new Error(`workspace path already exists: ${path}; recover or remove it explicitly before provisioning a fresh workspace`);
+            }
             const brandJson = input.brandJson ?? (input.brandFile ? deps.readText(input.brandFile) : undefined);
             if (input.brandFile && brandJson === null)
                 throw new Error(`${input.brandFile} not found`);
@@ -150,12 +297,58 @@ export function planFleetAction(input, deps) {
             return createPlan({
                 registry,
                 slug: input.slug,
-                seed: { admins: input.admins, members: input.members, ...(anthropicKey ? { anthropicKey } : {}), ...(input.cap !== undefined ? { monthlyCapUsd: input.cap } : {}), ...(brandJson ? { brandJson } : {}) },
+                seed: { admins: input.admins, members: input.members, ...(anthropicKey ? { anthropicKey } : {}), ...(input.anthropicUrl ? { anthropicUrl: input.anthropicUrl } : {}), ...(input.portalUrl ? { portalUrl: input.portalUrl } : {}), ...(input.cap !== undefined ? { monthlyCapUsd: input.cap } : {}), ...(brandJson ? { brandJson } : {}), openrouterKey: input.openrouterKey, openrouterUrl: input.openrouterUrl, openrouterModels: input.openrouterModels, openrouterDefault: input.openrouterDefault },
                 ...(input.licenseKey ? { licenseKey: input.licenseKey } : {}),
                 ...(input.memory ? { memoryMax: input.memory } : {}),
                 layout,
             }).steps;
         }
+        case "providers": {
+            if (!input.slug)
+                throw new Error("fleet providers needs a workspace name");
+            assertSlug(input.slug);
+            const workspace = loadRegistry(layout, deps).workspaces[input.slug];
+            if (!workspace)
+                throw new Error(`no workspace "${input.slug}"`);
+            assertManagedWorkspace(workspace);
+            const models = managedOpenRouterModels(input.openrouterModels);
+            const env = deps.readText(posix.join(layout.instancesDir, `${input.slug}.env`)) ?? "";
+            const portal = /^OMB_ADMIN_URL=(.+)$/m.exec(env)?.[1];
+            if (!portal || !env.split("\n").includes(`OMB_ADMIN_WORKSPACE=${input.slug}`))
+                throw new Error("workspace has no trusted portal configuration; operator recovery is required");
+            try {
+                const url = new URL(portal);
+                if (url.protocol !== "https:" || url.origin !== portal)
+                    throw new Error();
+            }
+            catch {
+                throw new Error("workspace portal configuration is invalid; operator recovery is required");
+            }
+            const file = posix.join(workspaceHome(layout, input.slug), ".config", "opencode", "opencode.json");
+            const raw = deps.readText(file, fleetUser(input.slug));
+            const object = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+            let config;
+            try {
+                const parsed = JSON.parse(raw ?? "null");
+                if (!object(parsed))
+                    throw new Error();
+                config = parsed;
+            }
+            catch {
+                throw new Error("managed OpenRouter configuration is missing or invalid; operator recovery is required");
+            }
+            const providers = config.provider;
+            const managed = object(providers) ? providers[MANAGED_OPENROUTER] : undefined;
+            const options = object(managed) ? managed.options : undefined;
+            if (!object(managed) || managed.npm !== "@ai-sdk/openai-compatible" || !object(options) || options.baseURL !== `${portal}/api/gateway/${input.slug}/openrouter/v1` || typeof options.apiKey !== "string" || !/^[!-~]+$/.test(options.apiKey)) {
+                throw new Error("managed OpenRouter configuration does not match the workspace portal; operator recovery is required");
+            }
+            managed.models = models;
+            return [
+                { kind: "write", path: file, content: `${JSON.stringify(config, null, 2)}\n`, mode: 0o600, owner: fleetUser(input.slug) },
+                { kind: "note", text: "managed OpenRouter models updated; refresh the workspace model picker to load its catalog" },
+            ];
+        }
         case "users": {
             if (!input.slug || !input.userAction || !input.email)
                 throw new Error("fleet users needs: NAME add|remove EMAIL [--chat-only]");
@@ -163,8 +356,9 @@ export function planFleetAction(input, deps) {
             const registry = loadRegistry(layout, deps);
             if (!registry.workspaces[input.slug])
                 throw new Error(`no workspace "${input.slug}"`);
+            assertManagedWorkspace(registry.workspaces[input.slug]);
             const file = posix.join(workspaceDataDir(layout, input.slug), "config.json");
-            const next = applySignIn(deps.readText(file) ?? "{}", input.userAction, input.email, Boolean(input.chatOnly));
+            const next = applySignIn(deps.readText(file, fleetUser(input.slug)) ?? "{}", input.userAction, input.email, Boolean(input.chatOnly));
             return [
                 { kind: "write", path: file, content: next.config, mode: 0o600, owner: fleetUser(input.slug) },
                 { kind: "note", text: next.summary },
@@ -181,7 +375,7 @@ export function planFleetAction(input, deps) {
             if (!input.slug)
                 throw new Error("fleet delete needs a workspace name");
             if (!input.yes)
-                throw new Error(`fleet delete removes the workspace's account${input.keepData ? "" : " and all of its data"}; pass --yes to confirm${input.keepData ? "" : ", or --keep-data to keep the home folder"}`);
+                throw new Error(`fleet delete ${input.keepData ? "retires the workspace, keeping its data and reserved Unix account" : "removes the workspace's account and all of its data"}; pass --yes to confirm${input.keepData ? "" : ", or --keep-data to keep the home folder and account reserved"}`);
             const registry = loadRegistry(layout, deps);
             return deletePlan({ registry, slug: input.slug, keepData: input.keepData, layout }).steps;
         }
@@ -191,8 +385,20 @@ export function planFleetAction(input, deps) {
             return [];
     }
 }
+/** Preserve the reservation and any account checkpoint after a failed create. */
+export function markProvisioningFailed(input, deps) {
+    if (input.action !== "create" || !input.slug)
+        return;
+    const layout = fleetLayout(input.root ?? "/");
+    const registry = loadRegistry(layout, deps);
+    const workspace = registry.workspaces[input.slug];
+    if (workspace?.status !== "provisioning")
+        return;
+    registry.workspaces[input.slug] = { ...workspace, status: "error" };
+    deps.writeText(layout.registryFile, `${JSON.stringify(registry, null, 2)}\n`, 0o600);
+}
 function printPlan(steps, io, reason) {
-    io.log(`${reason}; run these as root:`);
+    io.log(`${reason}; inspect this plan, then rerun the fleet command as root without --dry-run (with --yes where required):`);
     io.log("");
     for (const line of describeSteps(steps))
         io.log(line);
@@ -210,13 +416,24 @@ export async function runFleetCommand(input, io, deps = defaultFleetDeps()) {
                 return 0;
             }
             for (const workspace of rows) {
-                const live = asRoot ? (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() : workspace.status;
+                const live = asRoot && (workspace.status === "running" || workspace.status === "suspended") ? (await deps.run(["systemctl", "is-active", `openmausbot@${workspace.slug}.service`])).output.trim() : workspace.status;
                 io.log(`${workspace.slug.padEnd(24)} https://${workspace.host.padEnd(40)} :${String(workspace.port).padEnd(6)} ${live}`);
             }
             return 0;
         }
         const steps = planFleetAction(input, deps);
-        return asRoot ? await executePlan(steps, deps, io) : printPlan(steps, io, input.dryRun ? "dry run" : "not running as root");
+        if (!asRoot)
+            return printPlan(steps, io, input.dryRun ? "dry run" : "not running as root");
+        try {
+            const code = await executePlan(steps, deps, io);
+            if (code !== 0)
+                markProvisioningFailed(input, deps);
+            return code;
+        }
+        catch (error) {
+            markProvisioningFailed(input, deps);
+            throw error;
+        }
     }
     catch (error) {
         io.error(`fleet: ${error instanceof Error ? error.message : String(error)}`);