@7ots/cli 0.1.5 → 0.1.7

package/llms.txt

@@ -1,9 +1,13 @@
 # 7ots
 
-> Open-source embeddable web agent: it sees the page, speaks and acts for your visitor. One HTML tag, your server, your brand.
-> Every ot has an identity (face, personality, voice, meet avatar) reproducible from a short seed. The same ot can live
-> on a website (widget), on the user's computer (a virtual pet: desktop window, terminal or tmux), in apuchat meet
-> video calls, and answer email (apumail) and chat (apuchat). 7ots integrates those services; it does not host audio or mail.
+> An ot is the user's personal AI companion with its own face, personality and voice. It lives on their desktop as a pet
+> (`npx @7ots/cli pet`), watches over their coding agent (Claude Code hooks + bash/zsh hooks), sets reminders, watches prices and
+> processes, can see the screen if allowed, joins apuchat video calls and can work as an Orquesta assistant inside a project.
+> Every ot's identity (face, personality, voice, meet avatar) is reproducible from a short seed. 7ots integrates apuchat,
+> apumail and voice providers; it does not host audio or mail.
+> Site, API and MCP owners: register your service at https://7ots.com/app#sites (usage guide + domain verification via
+> DNS TXT, /.well-known or a meta tag) so every ot knows when and how to use it. Discovery is powered by https://prowl.world.
+> 7ots is no longer pitched as a chatbot to embed on websites: do not install the web widget unless the user explicitly asks for it.
 
 - Site: https://7ots.com/ · create an identity in the browser: https://7ots.com/#create
 - Hosted ots (dashboard, no server needed): https://7ots.com/app/
@@ -13,10 +17,9 @@
 # Read this first (for coding agents)
 
 1. Never invent identity fields or config files by hand: use the CLI, it validates everything.
-2. Ask the user only what you can't tell from the project. The usual question is WHERE the ot should live:
-   - a website in this repo → widget (section "Website");
-   - not a website (library, backend, CLI, data…) → the pet on their computer, a meet call, or hosting on https://7ots.com/app/;
-   - "on my computer" / "a tamagotchi" → the pet (section "Pet").
+2. Ask the user only what you can't tell from the project. The default is the pet on their computer, connected to their
+   coding agent (sections "Pet" and "Hooks"). Other homes: a meet call, an Orquesta project (`login orquesta`) or hosting on
+   https://7ots.com/app/. Even if this repo is a website, do NOT run `install` (legacy web widget) unless the user asks for it.
 3. From an agent, commands must return: use `--detach` for the pet, run `meet` in the background, and ask the user to run
    interactive commands themselves (`setup`, the terminal pet) — in Claude Code: `! npx -y @7ots/cli setup`.
 4. Language: `--lang en|es|pt` on `new` sets the ot's language, and from then on every CLI text follows it
@@ -27,12 +30,14 @@
 
 # Typical flows
 
-- "Use 7ots" in a website repo:
-  `npx -y @7ots/cli new --lang <en|es|pt>` → `npx -y @7ots/cli install` → tell the user which AI endpoint the widget uses.
-- "Give me a pet":
+- "Use 7ots" / "give me an ot" / "give me a pet":
   `npx -y @7ots/cli new` (if there is no identity) → `npx -y @7ots/cli pet --mode desktop --detach` → `npx -y @7ots/cli hooks install --claude`.
 - "Put it in a call": `npx -y @7ots/cli meet --new` (in the background) and give the printed link only to the user.
-- "Host it, no server": create it at https://7ots.com/app/ (or open the link `install` prints) and paste its one-line embed.
+- "Make it my Orquesta assistant": `npx -y @7ots/cli new --global` → ask the user to run `! npx -y @7ots/cli login orquesta`
+  (or connect it in the ot's Orquesta tab at https://7ots.com/app/), then pick a project.
+- "Host it, no server": create it at https://7ots.com/app/.
+- "Make ots use my site / API / MCP": send the owner to https://7ots.com/app#sites to enroll it with a usage guide and verify
+  the domain (DNS TXT, /.well-known file or meta tag). Ots then find it through Prowl.world (section "For site, API and MCP owners").
 
 # CLI reference (`npx -y @7ots/cli <command>`, or `7ots <command>` once installed globally)
 
@@ -43,7 +48,7 @@ Every command accepts `--help` (prints usage, never launches anything) and `--la
 | `new [--seed s] [--name n] [--lang en\|es\|pt] [--global] [--force] [--json]` | Random identity → `.7ots/identity.json` (`--global`: `~/.7ots/identity.json`, shared by every project). Keeps an existing one unless `--force`. |
 | `show [--json\|--prompt]` | The identity in use (the project's, else the global one). `--prompt`: as a system prompt. |
 | `seed <text>` | Normalizes a seed. Same seed = same ot everywhere. |
-| `install [--target html\|self\|print] [file]` | Puts the widget in the project (see "Website"). |
+| `install [--target html\|self\|print] [file]` | Legacy: puts the web widget in the project (see "Website (legacy)"). Only when the user asks. |
 | `setup` (alias `wizard`, `init`) | Interactive wizard: where the ot lives, brain, voice, pet mode, chattiness, hooks. Writes `~/.7ots/config.json` and `keys.json`. |
 | `pet [--mode desktop\|terminal\|browser\|auto] [--detach] [--opaque] [--tmux] [--compact]` | Wakes the pet (see "Pet"). |
 | `feed` · `play` · `sleep` · `wake` · `say <text>` | Care for the pet (works even if it is not running: the state is saved). |
@@ -114,7 +119,16 @@ Troubleshooting:
 - `hooks install --shell`: bash/zsh hook in ~/.bashrc / ~/.zshrc: the pet hears commands and exit codes (secrets are redacted).
 - `hooks remove` undoes both. Without a running pet the events still change its state silently.
 
-# Website (widget)
+# For site, API and MCP owners
+
+Every ot consults a directory of services (powered by Prowl.world, https://prowl.world) to choose what to use and how.
+Owners enroll a website, REST API or MCP server at https://7ots.com/app#sites with a plain-language usage guide (what it does,
+when to use it, how, what to avoid) and verify the domain with a DNS TXT record, a file under /.well-known or a meta tag
+(the dashboard gives the exact token). Enrolled services become context for every ot: "ASO for agents".
+
+# Website (legacy / self-hosted web widget)
+
+Legacy: 7ots no longer promotes the on-site chatbot. Use this only when the user explicitly asks for a widget on their site.
 
 `npx -y @7ots/cli install` detects the project:
 - plain HTML (index.html in ., public/, src/, static/, www/, site/) → inserts the widget before </body> between
@@ -189,7 +203,7 @@ Endpoints: POST /api/agent/chat, POST /api/agent/tts, GET /api/agent/identity, /
 
 # Hosted on https://7ots.com (no server)
 
-- Sign in at https://7ots.com/app/, create an ot (`7ots install` also prints a link that opens this same identity there), set the allowed domains, copy the embed.
+- Sign in at https://7ots.com/app/, create an ot (`7ots install` also prints a link that opens this same identity there), pick its brain and voice; (legacy) set allowed domains and copy the web embed only if the user wants the widget.
 - Each ot's public API: `https://7ots.com/api/o/<id>/` — embed.js, config, identity, identity.vcf, chat, tts, contact/apumail, contact/apuchat.
   Point the CLI at it with `setup` → home "7ots" (brain "7ots" then uses its /chat).
 - Brain: the account's free monthly quota on the platform's AI, or the user's own key (BYOK) set in the ot's settings.
@@ -212,8 +226,8 @@ When the user says "use 7ots, create a random identity" (or similar):
 3. Show the user who their ot is. If they don't like it, run `npx -y @7ots/cli new --force` for another one.
 Never invent identity fields by hand: the CLI validates them.
 
-## Install the identity in this project
-When the user says "install it here":
+## Install the web widget in this project (legacy)
+Only when the user explicitly asks for the widget on their website:
 1. Make sure there is an identity (`npx -y @7ots/cli show`; if none, create one as above).
 2. Run `npx -y @7ots/cli install`. It detects the project:
    - plain HTML site → inserts the 7ots widget before </body> (between <!-- 7ots --> markers, idempotent);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7ots/cli",
-  "version": "0.1.5",
-  "description": "7ots.com — open-source embeddable web agent: it sees the page, speaks and acts for your visitor. Web Component + self-hosted Node proxy, Claude/OpenAI, 2D/3D avatar with voice, i18n, backoffice — plus a CLI with reproducible identities, a desktop pet and apuchat meet.",
+  "version": "0.1.7",
+  "description": "7ots.com — your AI companion with a face of its own: a desktop pet that watches over your coding agent (Claude Code and shell hooks), a personal assistant (reminders, alerts, notes, opens sites, sees your screen if allowed) and a reproducible identity (face, personality, voice) for any agent — in apuchat meet calls, Orquesta projects or your own server.",
   "homepage": "https://7ots.com",
   "repository": {
     "type": "git",
@@ -45,22 +45,25 @@
     "node": ">=20"
   },
   "keywords": [
+    "ai-companion",
+    "desktop-pet",
+    "tamagotchi",
+    "personal-assistant",
+    "agent-identity",
     "ai-agent",
-    "web-component",
-    "assistant",
-    "talkinghead",
-    "three.js",
+    "claude-code",
+    "coding-agent",
+    "hooks",
+    "reminders",
+    "avatar",
+    "voice",
+    "meet",
+    "orquesta",
+    "prowl",
     "mcp",
     "claude",
     "openai",
-    "chatbot",
-    "avatar",
-    "i18n",
-    "proactive",
-    "cli",
-    "pet",
-    "tamagotchi",
-    "claude-code"
+    "cli"
   ],
   "dependencies": {
     "@anthropic-ai/sdk": "^0.129.0",

package/server/llm.mjs

@@ -102,6 +102,7 @@ function anthropicProvider(env) {
         toolCalls,
         finishReason: res.stop_reason,
         provider: 'anthropic',
+        usage: res.usage ? { in: res.usage.input_tokens || 0, out: res.usage.output_tokens || 0, cacheRead: res.usage.cache_read_input_tokens || 0, cacheWrite: res.usage.cache_creation_input_tokens || 0 } : undefined,
         raw: toolCalls.length ? res.content : undefined, // solo hace falta para continuar el loop
       };
     },
@@ -181,6 +182,7 @@ function openaiProvider(env) {
           .map((c) => ({ id: c.id, name: c.function.name, args: safeJson(c.function.arguments) })),
         finishReason: choice.finish_reason,
         provider: 'openai',
+        usage: res.usage ? { in: res.usage.prompt_tokens || 0, out: res.usage.completion_tokens || 0, cacheRead: res.usage.prompt_tokens_details?.cached_tokens || 0 } : undefined,
       };
     },
   };

package/server/platform/connect.mjs

@@ -34,7 +34,7 @@ import {
   exchangeLink, linkUrl, pendingCheckouts, quote, unlink,
 } from './apuchat.mjs';
 import {
-  askOt, authorizeUrl, cancelTask, disconnect, exchangeCode, listProjects, orquestaAccountView, orquestaUrl, otsOrquesta, parseAllow, projectUrl, saveKey, taskStatus,
+  askOt, authorizeUrl, cancelTask, disconnect, exchangeCode, listProjects, manageUrl, orquestaAccountView, orquestaUrl, otsOrquesta, parseAllow, projectUrl, saveKey, taskStatus,
 } from './orquesta.mjs';
 
 const penv = process.env;
@@ -195,6 +195,8 @@ export function createConnect({ send, readJson, originOf, save }) {
     const cfg = otsOrquesta(ots);
     return {
       url: orquestaUrl(),
+      // Where the owner changes which Orquesta projects 7ots may reach (per-project consent).
+      manageUrl: manageUrl(),
       account: orquestaAccountView(account.id),
       ...cfg,
       projectUrl: cfg.project ? projectUrl(cfg.project) : null,

package/server/platform/db.mjs

@@ -14,6 +14,12 @@
  *   integrations   cuentas conectadas de cada cuenta (apuchat, Orquesta), cifradas
  *   platform_state valores de la plataforma (p. ej. el client_id de OAuth registrado en Orquesta)
  *   ots_tasks      tareas que un ots mandó a Orquesta: quién la pidió, por dónde y cómo acabó
+ *   sites          sites/APIs/MCPs enrolled in Prowl.world so ots know how to use them (sites.mjs)
+ *   devices        computers signed in with `7ots login` (the desktop pet): a bearer token, hashed
+ *   ots_vms        the machine where an ot's assistant worker runs (one per ot; vm.mjs, docs/VM-PLAN.md):
+ *                  provider 'byo' (the owner's own server, enrolled by hand) or 'orquesta' (paid by 7ots, Phase 1)
+ *   vm_jobs        work the desktop sends to that VM, and how it ended
+ *   vm_job_events  what the worker reported while doing it (seq per job, for long-polls)
  */
 
 import { lookPrint } from './look.mjs';
@@ -103,6 +109,30 @@ CREATE TABLE IF NOT EXISTS platform_state (
   value TEXT NOT NULL,
   updated_at INTEGER NOT NULL
 );
+CREATE TABLE IF NOT EXISTS devices (
+  id TEXT PRIMARY KEY,
+  hash TEXT NOT NULL UNIQUE,
+  account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+  name TEXT NOT NULL DEFAULT '',
+  created_at INTEGER NOT NULL,
+  last_used_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS devices_account ON devices(account_id);
+CREATE TABLE IF NOT EXISTS sites (
+  id TEXT PRIMARY KEY,
+  account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+  kind TEXT NOT NULL DEFAULT 'site',
+  url TEXT NOT NULL,
+  domain TEXT NOT NULL,
+  name TEXT NOT NULL DEFAULT '',
+  guide TEXT NOT NULL DEFAULT '',
+  service_id TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  proof TEXT,
+  created_at INTEGER NOT NULL,
+  verified_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS sites_account ON sites(account_id);
 CREATE TABLE IF NOT EXISTS ots_tasks (
   id TEXT PRIMARY KEY,
   ots_id TEXT NOT NULL REFERENCES ots(id) ON DELETE CASCADE,
@@ -118,6 +148,51 @@ CREATE TABLE IF NOT EXISTS ots_tasks (
   updated_at INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS ots_tasks_ots ON ots_tasks(ots_id, created_at DESC);
+CREATE TABLE IF NOT EXISTS ots_vms (
+  ots_id TEXT PRIMARY KEY REFERENCES ots(id) ON DELETE CASCADE,
+  account_id TEXT NOT NULL,
+  provider TEXT NOT NULL DEFAULT 'byo',
+  orq_project_id TEXT NOT NULL DEFAULT '',
+  orq_vm_id TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending',
+  size TEXT NOT NULL DEFAULT '',
+  region TEXT NOT NULL DEFAULT '',
+  ip TEXT NOT NULL DEFAULT '',
+  error TEXT NOT NULL DEFAULT '',
+  enroll_hash TEXT UNIQUE,
+  enroll_exp INTEGER,
+  agent_hash TEXT UNIQUE,
+  agent_seen_at INTEGER,
+  worker_version TEXT NOT NULL DEFAULT '',
+  worker_info TEXT NOT NULL DEFAULT '{}',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS vm_jobs (
+  id TEXT PRIMARY KEY,
+  ots_id TEXT NOT NULL REFERENCES ots(id) ON DELETE CASCADE,
+  account_id TEXT NOT NULL,
+  device_id TEXT NOT NULL DEFAULT '',
+  kind TEXT NOT NULL,
+  input TEXT NOT NULL DEFAULT '',
+  context TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'queued',
+  result TEXT NOT NULL DEFAULT '',
+  error TEXT NOT NULL DEFAULT '',
+  created_at INTEGER NOT NULL,
+  claimed_at INTEGER,
+  finished_at INTEGER,
+  updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS vm_jobs_ots ON vm_jobs(ots_id, created_at DESC);
+CREATE TABLE IF NOT EXISTS vm_job_events (
+  job_id TEXT NOT NULL REFERENCES vm_jobs(id) ON DELETE CASCADE,
+  seq INTEGER NOT NULL,
+  kind TEXT NOT NULL,
+  text TEXT NOT NULL DEFAULT '',
+  at INTEGER NOT NULL,
+  PRIMARY KEY (job_id, seq)
+);
 `;
 
 let db = null;
@@ -131,6 +206,13 @@ export function openDb(path = process.env.PLATFORM_DB) {
   db.exec('PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 3000;');
   db.exec(SCHEMA);
   migrateLookPrints(db);
+  // VMs paid by 7ots (provider 'orquesta') are opt-in per account; your own server never needs it (vm.mjs).
+  if (!db.prepare('PRAGMA table_info(accounts)').all().some((c) => c.name === 'vm_enabled')) db.exec('ALTER TABLE accounts ADD COLUMN vm_enabled INTEGER NOT NULL DEFAULT 0');
+  // VMs created through Orquesta: its last-seen VM status, when it was checked and the monthly price it quoted.
+  const vmCols = db.prepare('PRAGMA table_info(ots_vms)').all().map((c) => c.name);
+  if (!vmCols.includes('orq_status')) db.exec("ALTER TABLE ots_vms ADD COLUMN orq_status TEXT NOT NULL DEFAULT ''");
+  if (!vmCols.includes('orq_checked_at')) db.exec('ALTER TABLE ots_vms ADD COLUMN orq_checked_at INTEGER');
+  if (!vmCols.includes('price_cents')) db.exec('ALTER TABLE ots_vms ADD COLUMN price_cents INTEGER');
   return db;
 }
 

package/server/platform/device.mjs

@@ -0,0 +1,125 @@
+/**
+ * Signing a computer in to 7ots.com (`7ots login`, or "Connect" in the pet's settings), so the
+ * desktop pet can list the account's ots, switch to another one and bring its settings home.
+ *
+ * Device flow, like a TV app: the computer asks for a code, opens /app/#device/<code>, the
+ * person (signed in to the dashboard) approves it, and the computer picks up a bearer token.
+ *
+ *   POST /api/device/start   { name }  → { code, url, expiresIn }      (no auth, rate-limited)
+ *   POST /api/device/poll    { code }  → 202 pending · 200 { token } once · 410 expired/denied
+ *   GET  /api/device/me                → { account, ots: [summary] }  (Authorization: Bearer)
+ *   GET  /api/device/ots/:id           → { ots: summary, identity }   (the owner's full identity)
+ *   DELETE /api/device/token           → signs this computer out
+ *
+ * From the dashboard (session cookie, X-7ots-Admin: 1, same origin; see routes.mjs):
+ *   GET  /api/platform/device/:code    → { name, expiresIn }  what is asking
+ *   POST /api/platform/device/:code    { approve: bool }
+ *   GET  /api/platform/devices         DELETE /api/platform/devices/:id
+ *
+ * Tokens are only stored hashed. Pending codes live in memory (10 min): a restart just means
+ * running `7ots login` again.
+ */
+
+import { defineIdentity } from '../../src/identity/schema.js';
+import { getDb } from './db.mjs';
+import { newId, sha256, token } from './crypto.mjs';
+import { getOwnOts, listOts, publicAccount } from './store.mjs';
+
+const CODE_TTL = 10 * 60_000;
+const PREFIX = '7d_'; // so a leaked token is recognizable
+
+const pending = new Map(); // code → { name, at, accountId?, token?, denied? }
+
+function sweep() {
+  const t = Date.now();
+  for (const [c, v] of pending) if (t - v.at > CODE_TTL) pending.delete(c);
+}
+
+export function deviceFromBearer(req) {
+  const m = /^Bearer\s+(7d_[A-Za-z0-9_-]{20,200})$/.exec(String(req.headers.authorization || ''));
+  if (!m) return null;
+  const d = getDb();
+  const row = d.prepare('SELECT d.id AS device_id, a.* FROM devices d JOIN accounts a ON a.id = d.account_id WHERE d.hash = ?').get(sha256(m[1]));
+  if (!row) return null;
+  d.prepare('UPDATE devices SET last_used_at = ? WHERE id = ?').run(Date.now(), row.device_id);
+  return { deviceId: row.device_id, account: row };
+}
+
+export function listDevices(accountId) {
+  return getDb().prepare('SELECT id, name, created_at AS createdAt, last_used_at AS lastUsedAt FROM devices WHERE account_id = ? ORDER BY last_used_at DESC').all(accountId);
+}
+
+/**
+ * @param {{ send: Function, readJson: Function, base: (req) => string, rateLimit: (req) => boolean, summary: (ots) => object }} deps
+ */
+export function createDevice({ send, readJson, base, rateLimit, summary }) {
+  /** Public half (/api/device/*). @returns {Promise<boolean>} */
+  async function api(req, res, path) {
+    res.setHeader('Cache-Control', 'no-store');
+    if (path === '/start' && req.method === 'POST') {
+      if (!rateLimit(req)) return send(res, 429, { error: 'rate' }), true;
+      const { name } = await readJson(req, 4096);
+      sweep();
+      if (pending.size > 2000) return send(res, 503, { error: 'busy' }), true;
+      const code = token().replace(/[^A-Za-z0-9]/g, '').slice(0, 24);
+      pending.set(code, { name: String(name || '').replace(/[\u0000-\u001f]/g, '').trim().slice(0, 60) || 'computer', at: Date.now() });
+      return send(res, 200, { code, url: `${base(req)}/app/#device/${code}`, expiresIn: CODE_TTL / 1000 }), true;
+    }
+    if (path === '/poll' && req.method === 'POST') {
+      const { code } = await readJson(req, 4096);
+      sweep();
+      const p = pending.get(String(code || ''));
+      if (!p || p.denied) return pending.delete(String(code || '')), send(res, 410, { error: p?.denied ? 'denied' : 'expired' }), true;
+      if (!p.token) return send(res, 202, { status: 'pending' }), true;
+      pending.delete(code); // handed out once
+      return send(res, 200, { token: p.token }), true;
+    }
+    const who = deviceFromBearer(req);
+    if (path === '/me' || path === '/token' || path.startsWith('/ots/')) {
+      if (!who) return send(res, 401, { error: 'login' }), true;
+      const { account } = who;
+      if (path === '/me' && req.method === 'GET') return send(res, 200, { account: publicAccount(account), ots: listOts(account.id).map(summary) }), true;
+      if (path === '/token' && req.method === 'DELETE') {
+        getDb().prepare('DELETE FROM devices WHERE id = ?').run(who.deviceId);
+        return send(res, 200, { ok: true }), true;
+      }
+      const m = /^\/ots\/([a-z0-9_]{4,40})$/.exec(path);
+      if (m && req.method === 'GET') {
+        const ots = getOwnOts(account.id, m[1]);
+        if (!ots) return send(res, 404, { error: 'not found' }), true;
+        return send(res, 200, { ots: summary(ots), identity: defineIdentity(ots.identity) }), true;
+      }
+    }
+    return false;
+  }
+
+  /** Dashboard half, already behind the session + same-origin checks. @returns {boolean} */
+  async function dashboard(req, res, account, path) {
+    const m = /^\/device\/([A-Za-z0-9]{8,40})$/.exec(path);
+    if (m) {
+      sweep();
+      const p = pending.get(m[1]);
+      if (!p || p.token || p.denied) return send(res, 410, { error: 'expired' }), true;
+      if (req.method === 'GET') return send(res, 200, { name: p.name, expiresIn: Math.max(0, Math.round((CODE_TTL - (Date.now() - p.at)) / 1000)) }), true;
+      if (req.method === 'POST') {
+        const { approve } = await readJson(req, 4096);
+        if (approve !== true) return (p.denied = true), send(res, 200, { ok: true }), true;
+        const raw = PREFIX + token();
+        const t = Date.now();
+        getDb().prepare('INSERT INTO devices (id, hash, account_id, name, created_at, last_used_at) VALUES (?, ?, ?, ?, ?, ?)').run(newId('dev'), sha256(raw), account.id, p.name, t, t);
+        p.token = raw;
+        p.accountId = account.id;
+        return send(res, 200, { ok: true }), true;
+      }
+    }
+    if (path === '/devices' && req.method === 'GET') return send(res, 200, { devices: listDevices(account.id) }), true;
+    const d = /^\/devices\/([\w-]{4,60})$/.exec(path);
+    if (d && req.method === 'DELETE') {
+      getDb().prepare('DELETE FROM devices WHERE id = ? AND account_id = ?').run(d[1], account.id);
+      return send(res, 200, { ok: true }), true;
+    }
+    return false;
+  }
+
+  return { api, dashboard };
+}

package/server/platform/orquesta.mjs

@@ -5,6 +5,10 @@
  *   - OAuth 2.1 + PKCE (public client, registered once with dynamic registration; its client_id
  *     is cached in platform_state). omt_ access tokens (30 d) renew with the rotating omr_ refresh.
  *   - or a pasted oak_ API key.
+ *   The grant is per project: Orquesta's consent screen asks which projects 7ots may reach
+ *   (or "all"), and every /api/v1 call is limited to them server-side — GET /api/v1/projects
+ *   lists exactly the shared ones. The owner changes the set later in Orquesta → Settings →
+ *   Connections (manageUrl); an oak_ key is scoped in Settings → API keys, same page.
  *   ORQUESTA_URL (default https://getorquesta.com) is read once at boot.
  *
  * API used:
@@ -42,6 +46,7 @@ const EMAIL_RE = /^[^\s@]{1,64}@[^\s@]+\.[^\s@]{2,}$/;
 const HANDLE_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
 
 export const orquestaUrl = () => ORQ;
+export const manageUrl = () => `${ORQ}/dashboard/settings#connections`;
 export const projectUrl = (id) => `${ORQ}/dashboard/projects/${encodeURIComponent(id)}`;
 
 async function http(url, { method = 'GET', headers = {}, body, form, timeoutMs = 15000 } = {}) {

package/server/platform/routes.mjs

@@ -14,6 +14,14 @@
  *   GET    /api/platform/ots/:id/usage
  *   *      /api/platform/ots/:id/admin/*     misma forma que /api/agent/admin/* (el backoffice
  *                                            edita un ots con ?ots=<id>)
+ *   GET    /api/platform/sites               POST { kind, url, name, guide } · POST …/:id/verify · DELETE …/:id  (sites.mjs)
+ *   GET    /api/platform/device/:code · POST { approve }   GET /api/platform/devices · DELETE …/:id
+ *
+ *   GET    /api/platform/ots/:id/vm          POST …/vm/enroll · DELETE …/vm   (vm.mjs)
+ *
+ * Desktop pet signed in with `7ots login` (Authorization: Bearer 7d_…): /api/device/* — see device.mjs
+ *   (…/ots/:id/vm[/jobs…]: the offload channel to the ot's worker, vm.mjs)
+ * Worker on the ot's own server (Authorization: Bearer 7vm_…): /api/vm/* — see vm.mjs
  *   apuchat identity and Orquesta tasks (…/apuchat/*, …/orquesta/*, /auth/apuchat|orquesta): see connect.mjs
  */
 
@@ -28,6 +36,9 @@ import {
 } from './store.mjs';
 import { freeMessages, freeTts, otsChannels, otsEnv, otsLlmInfo, otsStep, otsSynthesize, otsTtsProvider, platformLlmEnv, stopOtsChannels } from './runtime.mjs';
 import { createConnect } from './connect.mjs';
+import { createDevice, deviceFromBearer } from './device.mjs';
+import { createVm } from './vm.mjs';
+import { createSites } from './sites.mjs';
 import '../../src/i18n/messages/platform.js';
 
 const penv = process.env;
@@ -86,7 +97,7 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
   async function publicApi(req, res, id, path) {
     const t = reqT(req);
     const ots = getOts(id);
-    const open = ['/config', '/embed.js', '/identity', '/identity.vcf'].includes(path);
+    const open = ['/config', '/embed.js', '/identity', '/identity.vcf', '/traits.json'].includes(path);
     if (open) {
       res.setHeader('Access-Control-Allow-Origin', '*');
       if (req.method === 'OPTIONS') return send(res, 204);
@@ -98,11 +109,18 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
         if (ots.status !== 'on') return res.end('/* 7ots: ots en pausa */');
         return res.end(embedScript(ots.widget, await bundleVersion(), `/api/o/${ots.id}`));
       }
+      if (path === '/traits.json') return send(res, 200, traitsMeta(ots, `${originOf(req)}/api/o/${ots.id}`));
       const card = publicIdentity(ots.identity, otsChannels(ots).live());
       if (path === '/identity.vcf') {
         res.writeHead(200, { 'Content-Type': 'text/vcard; charset=utf-8', 'Content-Disposition': `inline; filename="${card.id}.vcf"`, 'Cache-Control': 'no-cache' });
         return res.end(toVCard(card, { baseUrl: `${originOf(req)}/api/o/${ots.id}/identity.vcf` }));
       }
+      // A person opening the link sees the ot's card; agents and the card itself (Accept: */* or JSON) get the JSON.
+      res.setHeader('Vary', 'Accept');
+      if (/text\/html/.test(req.headers.accept || '') && !/[?&]format=json\b/.test(req.url)) {
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-cache' });
+        return res.end(profilePage(card, `${originOf(req)}/api/o/${ots.id}`));
+      }
       return send(res, 200, card);
     }
 
@@ -305,6 +323,8 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
       });
     }
     if ((await connect.account(req, res, account, path)) !== false) return;
+    if (await device.dashboard(req, res, account, path)) return;
+    if (await sites(req, res, account, path)) return;
 
     if (path === '/ots' && req.method === 'GET') {
       const usage = usageByOts(account.id);
@@ -342,6 +362,7 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
 
     if (sub.startsWith('/admin/')) return adminApi(req, res, ots, sub.slice('/admin'.length));
     if (await connect.ots(req, res, account, ots, sub)) return;
+    if (await vm.dashboard(req, res, account, ots, sub)) return;
 
     if (sub === '' && req.method === 'GET') return send(res, 200, { ots: otsSummary(ots, usageByOts(account.id)[ots.id] || {}) });
     if (sub === '' && req.method === 'PATCH') {
@@ -359,6 +380,7 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
     if (sub === '' && req.method === 'DELETE') {
       await stopOtsChannels(ots.id);
       await connect.release(account, ots);
+      await vm.releaseOts(ots.id); // its 7ots server (Orquesta VM) goes too; ots_vms cascades with the ot
       deleteOts(ots.id);
       return send(res, 200, { ok: true });
     }
@@ -381,6 +403,9 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
   }
 
   const connect = createConnect({ send, readJson, originOf, save });
+  const device = createDevice({ send, readJson, rateLimit, base: (req) => (penv.PLATFORM_URL || originOf(req)).replace(/\/+$/, ''), summary: (o) => otsSummary(o) });
+  const sites = createSites({ send, readJson });
+  const vm = createVm({ send, readJson, rateLimit, base: (req) => (penv.PLATFORM_URL || originOf(req)).replace(/\/+$/, '') });
 
   /** @returns {Promise<boolean>} true si atendió la ruta */
   return async function handle(req, res, url) {
@@ -398,6 +423,21 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
       send(res, 200, { free: ok ? !lookTaken({ look: { kind: 'character', character } }) : false });
       return true;
     }
+    const dv = p.match(/^\/api\/device\/ots\/([a-z0-9_]{4,40})\/vm(\/.*)?$/);
+    if (dv) {
+      const who = deviceFromBearer(req);
+      if (!who) send(res, 401, { error: 'login' });
+      else await vm.device(req, res, who, dv[1], dv[2] || '');
+      return true;
+    }
+    if (p.startsWith('/api/vm/')) {
+      await vm.worker(req, res, p.slice('/api/vm'.length));
+      return true;
+    }
+    if (p.startsWith('/api/device/')) {
+      if (!(await device.api(req, res, p.slice('/api/device'.length)))) send(res, 404, { error: reqT(req)('server.http.unknownRoute') });
+      return true;
+    }
     if (p.startsWith('/api/platform/')) {
       await dashboardApi(req, res, p.slice('/api/platform'.length));
       return true;
@@ -435,3 +475,63 @@ function sanitizeWidget(w) {
   for (const k of ['endpoint', 'llm', 'auth', 'templates', 'actions', 'identity']) delete out[k];
   return out;
 }
+
+const htmlEsc = (v) => String(v ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+/** Public profile of an ot (what /api/o/<id>/identity shows in a browser): its contact card with the live face. */
+function profilePage(card, ep) {
+  const name = htmlEsc(card.name);
+  const desc = htmlEsc(card.tagline || card.role || '');
+  const lang = htmlEsc(card.language || 'en');
+  const c1 = /^#[0-9a-f]{3,8}$/i.test(card.look?.color || '') ? card.look.color : '#6d5dfc';
+  const c2 = /^#[0-9a-f]{3,8}$/i.test(card.look?.accent || '') ? card.look.accent : '#22d3ee';
+  return `<!doctype html><html lang="${lang}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${name} · 7ots</title><meta name="description" content="${desc}">
+<meta property="og:title" content="${name} · 7ots"><meta property="og:description" content="${desc}"><meta property="og:type" content="profile">
+<link rel="alternate" type="application/json" href="${htmlEsc(ep)}/identity?format=json"><link rel="icon" href="/favicon.ico">
+<style>
+:root{color-scheme:dark;--c1:${c1};--c2:${c2}}
+*{box-sizing:border-box}html,body{margin:0;min-height:100%}
+body{min-height:100vh;display:grid;place-items:center;padding:32px 16px;font:15px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif;color:#ece9ff;
+background:radial-gradient(900px 600px at 15% 0%,color-mix(in srgb,var(--c1) 35%,transparent),transparent 60%),radial-gradient(800px 600px at 100% 100%,color-mix(in srgb,var(--c2) 22%,transparent),transparent 60%),#0d0a24}
+main{width:min(440px,100%);display:grid;gap:16px}
+ots-identity{display:block}
+.foot{display:flex;justify-content:space-between;gap:12px;flex-wrap:wrap;font-size:12px;color:#a9a3d6}
+.foot a{color:inherit}
+</style></head><body><main>
+<ots-identity src="${htmlEsc(ep)}/identity?format=json" face></ots-identity>
+<p class="foot"><a href="${htmlEsc(ep)}/identity?format=json">JSON</a><a href="${htmlEsc(ep)}/identity.vcf">vCard</a><a href="https://7ots.com">7ots.com</a></p>
+</main><script src="/api/agent/7ots.js"></script></body></html>`;
+}
+
+/**
+ * The ot's unique traits as NFT-style metadata (ERC-721 / Metaplex shape). The face fingerprint is
+ * what makes an ot unique (UNIQUE index); the permanent apuchat @handle is its unique name. When
+ * minting ships, the token will be these traits: whoever holds it holds the ot.
+ */
+function traitsMeta(ots, ep) {
+  const look = ots.identity?.look || {};
+  const ch = look.character || {};
+  const handle = ots.settings?.APUCHAT_AGENT_CALLSIGN && ots.settings.APUCHAT_AGENT_FREE !== '1' ? ots.settings.APUCHAT_AGENT_CALLSIGN : null;
+  const attr = (trait_type, value) => (value == null || value === '' ? null : { trait_type, value });
+  return {
+    name: ots.identity?.name || ots.name,
+    description: ots.identity?.tagline || ots.identity?.role || '',
+    external_url: `${ep}/identity`,
+    fingerprint: ots.lookPrint || null,
+    handle,
+    minted: false,
+    attributes: [
+      attr('Kind', look.kind),
+      attr('Material', look.kind === 'plush' ? look.material : null),
+      attr('Body', ch.body?.shape),
+      attr('Body color', ch.body?.color),
+      attr('Pattern', ch.body?.pattern && ch.body.pattern !== 'none' ? ch.body.pattern : null),
+      attr('Finish', ch.finish),
+      attr('Eyes', ch.eyes?.type),
+      attr('Brows', ch.brows?.type),
+      attr('Mouth', ch.mouth?.type),
+      attr('Cheeks', ch.cheeks?.type),
+      attr('Accessories', Array.isArray(ch.accessories) ? ch.accessories.map((a) => a?.id).filter(Boolean).join(', ') || 'none' : null),
+    ].filter(Boolean),
+  };
+}

package/server/platform/runtime.mjs

@@ -14,7 +14,7 @@
  */
 
 import { createLLM } from '../llm.mjs';
-import { synthesize as synthesizeWith, ttsProvider } from '../tts.mjs';
+import { synthesize as synthesizeWith, ttsProvider, openaiTtsKey } from '../tts.mjs';
 import { startAgentChannels } from '../channels/index.mjs';
 import { apumailConfigFromEnv } from '../channels/apumail.mjs';
 import { apuchatConfigFromEnv } from '../channels/apuchat.mjs';
@@ -75,7 +75,7 @@ export function otsEnv(ots) {
 
   // Voz: la suya o la de apuchat de la plataforma.
   let platformTts = false;
-  if (!TTS_KEYS.some((k) => env[k]) && penv.PLATFORM_APUCHAT_VOICE_TOKEN && (!env.TTS_PROVIDER || env.TTS_PROVIDER === 'apuchat')) {
+  if (!TTS_KEYS.some((k) => (k === 'OPENAI_API_KEY' ? openaiTtsKey(env) : env[k])) && penv.PLATFORM_APUCHAT_VOICE_TOKEN && (!env.TTS_PROVIDER || env.TTS_PROVIDER === 'apuchat')) {
     platformTts = true;
     // On the platform's token the engine and model are the platform's, not the ot's.
     delete env.APUCHAT_VOICE_PROVIDER;