@7ots/cli 0.1.6 → 0.1.7

package/llms.txt

@@ -1,7 +1,7 @@
 # 7ots
 
 > An ot is the user's personal AI companion with its own face, personality and voice. It lives on their desktop as a pet
-> (`npx @7ots/cli pet`), watches over their coding agent (Claude Code / Codex hooks), sets reminders, watches prices and
+> (`npx @7ots/cli pet`), watches over their coding agent (Claude Code hooks + bash/zsh hooks), sets reminders, watches prices and
 > processes, can see the screen if allowed, joins apuchat video calls and can work as an Orquesta assistant inside a project.
 > Every ot's identity (face, personality, voice, meet avatar) is reproducible from a short seed. 7ots integrates apuchat,
 > apumail and voice providers; it does not host audio or mail.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@7ots/cli",
-  "version": "0.1.6",
-  "description": "7ots.com — open-source embeddable web agent: it sees the page, speaks and acts for your visitor. Web Component + self-hosted Node proxy, Claude/OpenAI, 2D/3D avatar with voice, i18n, backoffice — plus a CLI with reproducible identities, a desktop pet and apuchat meet.",
+  "version": "0.1.7",
+  "description": "7ots.com — your AI companion with a face of its own: a desktop pet that watches over your coding agent (Claude Code and shell hooks), a personal assistant (reminders, alerts, notes, opens sites, sees your screen if allowed) and a reproducible identity (face, personality, voice) for any agent — in apuchat meet calls, Orquesta projects or your own server.",
   "homepage": "https://7ots.com",
   "repository": {
     "type": "git",
@@ -45,22 +45,25 @@
     "node": ">=20"
   },
   "keywords": [
+    "ai-companion",
+    "desktop-pet",
+    "tamagotchi",
+    "personal-assistant",
+    "agent-identity",
     "ai-agent",
-    "web-component",
-    "assistant",
-    "talkinghead",
-    "three.js",
+    "claude-code",
+    "coding-agent",
+    "hooks",
+    "reminders",
+    "avatar",
+    "voice",
+    "meet",
+    "orquesta",
+    "prowl",
     "mcp",
     "claude",
     "openai",
-    "chatbot",
-    "avatar",
-    "i18n",
-    "proactive",
-    "cli",
-    "pet",
-    "tamagotchi",
-    "claude-code"
+    "cli"
   ],
   "dependencies": {
     "@anthropic-ai/sdk": "^0.129.0",

package/server/platform/db.mjs

@@ -208,6 +208,11 @@ export function openDb(path = process.env.PLATFORM_DB) {
   migrateLookPrints(db);
   // VMs paid by 7ots (provider 'orquesta') are opt-in per account; your own server never needs it (vm.mjs).
   if (!db.prepare('PRAGMA table_info(accounts)').all().some((c) => c.name === 'vm_enabled')) db.exec('ALTER TABLE accounts ADD COLUMN vm_enabled INTEGER NOT NULL DEFAULT 0');
+  // VMs created through Orquesta: its last-seen VM status, when it was checked and the monthly price it quoted.
+  const vmCols = db.prepare('PRAGMA table_info(ots_vms)').all().map((c) => c.name);
+  if (!vmCols.includes('orq_status')) db.exec("ALTER TABLE ots_vms ADD COLUMN orq_status TEXT NOT NULL DEFAULT ''");
+  if (!vmCols.includes('orq_checked_at')) db.exec('ALTER TABLE ots_vms ADD COLUMN orq_checked_at INTEGER');
+  if (!vmCols.includes('price_cents')) db.exec('ALTER TABLE ots_vms ADD COLUMN price_cents INTEGER');
   return db;
 }
 

package/server/platform/routes.mjs

@@ -380,6 +380,7 @@ export function createPlatform({ send, readJson, rateLimit, callLimit, originOf,
     if (sub === '' && req.method === 'DELETE') {
       await stopOtsChannels(ots.id);
       await connect.release(account, ots);
+      await vm.releaseOts(ots.id); // its 7ots server (Orquesta VM) goes too; ots_vms cascades with the ot
       deleteOts(ots.id);
       return send(res, 200, { ok: true });
     }

package/server/platform/runtime.mjs

@@ -14,7 +14,7 @@
  */
 
 import { createLLM } from '../llm.mjs';
-import { synthesize as synthesizeWith, ttsProvider } from '../tts.mjs';
+import { synthesize as synthesizeWith, ttsProvider, openaiTtsKey } from '../tts.mjs';
 import { startAgentChannels } from '../channels/index.mjs';
 import { apumailConfigFromEnv } from '../channels/apumail.mjs';
 import { apuchatConfigFromEnv } from '../channels/apuchat.mjs';
@@ -75,7 +75,7 @@ export function otsEnv(ots) {
 
   // Voz: la suya o la de apuchat de la plataforma.
   let platformTts = false;
-  if (!TTS_KEYS.some((k) => env[k]) && penv.PLATFORM_APUCHAT_VOICE_TOKEN && (!env.TTS_PROVIDER || env.TTS_PROVIDER === 'apuchat')) {
+  if (!TTS_KEYS.some((k) => (k === 'OPENAI_API_KEY' ? openaiTtsKey(env) : env[k])) && penv.PLATFORM_APUCHAT_VOICE_TOKEN && (!env.TTS_PROVIDER || env.TTS_PROVIDER === 'apuchat')) {
     platformTts = true;
     // On the platform's token the engine and model are the platform's, not the ot's.
     delete env.APUCHAT_VOICE_PROVIDER;

package/server/platform/vm.mjs

@@ -1,15 +1,23 @@
 /**
  * The machine where an ot's assistant worker runs, and the desktop → VM offload channel (docs/VM-PLAN.md).
  *
- * Phase 0: the owner brings their own Linux box (provider 'byo'): the dashboard hands out a one-time
+ * Provider 'byo': the owner brings their own Linux box: the dashboard hands out a one-time
  * `7ve_` code and the exact command; `7ots vm enroll` trades it for a `7vm_` token bound to that one
- * ot and `7ots vm worker` connects outbound only (no SSH keys ever reach 7ots). VMs paid by 7ots
- * (provider 'orquesta', created through Orquesta) come in Phase 1 and are what accounts.vm_enabled gates.
+ * ot and `7ots vm worker` connects outbound only (no SSH keys ever reach 7ots).
+ * Provider 'orquesta': a VM paid by 7ots, gated by accounts.vm_enabled and ORQUESTA_VM_TOKEN (an
+ * org-wide Orquesta key, never shown to anyone). 7ots creates project `ot-<id>` + its VM with a
+ * bootstrap that enrolls it the same way (code valid VM_ORQ_ENROLL_MIN, default 60, to cover the boot).
+ * Quotas VM_PER_ACCOUNT (default 1) and VM_MAX_TOTAL (default 10). Deleting the VM, the ot or the
+ * account tears down VM and project; a reconciliation every VM_RECONCILE_MIN (30) compares
+ * GET /api/v1/vms with ots_vms, retries failed teardowns and logs orphans (VM_REAP_ORPHANS=1 deletes them).
+ * Env: ORQUESTA_URL, ORQUESTA_VM_SIZE (default: cheapest), ORQUESTA_VM_SIZES ('slug[:usd],…'), ORQUESTA_VM_REGION,
+ * ORQUESTA_VM_REF_PREFIX ('7ots:', distinct per 7ots install sharing one org), SEVENOTS_VM_CLI (pinned, 0.1.6).
  *
  * Dashboard (session + X-7ots-Admin, via routes.mjs):
- *   GET    /api/platform/ots/:id/vm          { vm|null, online, jobs, kinds, daily, paidVms }
+ *   GET    /api/platform/ots/:id/vm          { vm|null, jobs, kinds, daily, paidVms, hosted: { available, canCreate, reason, sizes, … } }
+ *   POST   /api/platform/ots/:id/vm          { provider: 'orquesta', size? } → 202 { vm } (provisioning in the background)
  *   POST   /api/platform/ots/:id/vm/enroll   { provider?: 'byo' } → { code, expiresIn, command }
- *   DELETE /api/platform/ots/:id/vm          revokes the worker, marks it terminated
+ *   DELETE /api/platform/ots/:id/vm          revokes the worker; byo → terminated, orquesta → 202 terminating → terminated
  *
  * Worker on the VM (Authorization: Bearer 7vm_…):
  *   POST /api/vm/enroll { code } → { token, ots }          (no auth, rate-limited, code used once)
@@ -37,7 +45,7 @@ import { identityPrompt } from '../identity.mjs';
 import { errorText, reqT } from '../i18n.mjs';
 import { getDb, tx } from './db.mjs';
 import { newId, sha256, token } from './crypto.mjs';
-import { getOts, getOwnOts } from './store.mjs';
+import { getOts, getOwnOts, getPlatformState, setPlatformState } from './store.mjs';
 import { otsStep } from './runtime.mjs';
 
 const penv = process.env;
@@ -113,6 +121,7 @@ function vmView(vm) {
     enrollExpiresAt: vm.enroll_hash ? vm.enroll_exp : null,
     error: vm.error || null,
     since: vm.created_at,
+    ...(vm.provider === 'orquesta' ? { orqStatus: vm.orq_status || null, ip: vm.ip || null, monthlyPrice: vm.price_cents ? vm.price_cents / 100 : null, checkedAt: vm.orq_checked_at || null } : {}),
   };
 }
 
@@ -180,6 +189,329 @@ function workerJob(j, ots) {
   return { id: j.id, kind: j.kind, input: j.input, context: j.context, prompt, createdAt: j.created_at };
 }
 
+// ───────────── VMs paid by 7ots, created through Orquesta (provider 'orquesta') ─────────────
+//
+// One Orquesta project `ot-<otsId>` per VM (Orquesta allows one VM per project), created with the
+// org-wide ORQUESTA_VM_TOKEN; the VM boots with a bootstrap that enrolls it with a one-time 7ve_
+// code, exactly as an owner's own server would. ots_vms.status: creating (Orquesta calls in flight)
+// → pending (VM booting, waiting for the worker) → enrolled · error · terminating → terminated.
+// orq_status mirrors Orquesta's own VM status (checked at most every 15 s).
+
+const ORQ = () => (penv.ORQUESTA_URL || 'https://getorquesta.com').replace(/\/+$/, '');
+const orqToken = () => String(penv.ORQUESTA_VM_TOKEN || '').trim();
+export const hostedConfigured = () => !!orqToken();
+const REF_PREFIX = () => penv.ORQUESTA_VM_REF_PREFIX || '7ots:';
+const ORQ_ENROLL_TTL = () => Math.max(10, Number(penv.VM_ORQ_ENROLL_MIN || 60)) * 60_000; // covers the boot
+const ORQ_CACHE_MS = 15_000;
+const MAX_TOTAL = () => Math.max(0, Number(penv.VM_MAX_TOTAL ?? 10));
+const PER_ACCOUNT = () => Math.max(0, Number(penv.VM_PER_ACCOUNT ?? 1));
+const RECONCILE_MS = () => Math.max(0.01, Number(penv.VM_RECONCILE_MIN || 30)) * 60_000;
+const PROJECT_RETRY_MS = () => Number(penv.VM_ORQ_RETRY_MS || 10_000);
+const LIVE_ORQ = "provider = 'orquesta' AND status <> 'terminated'";
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** The CLI the VM installs, pinned (SEVENOTS_VM_CLI: '0.1.6' or '@7ots/cli@0.1.6'). */
+function cliSpec() {
+  const v = String(penv.SEVENOTS_VM_CLI || '0.1.6').trim();
+  const s = v.startsWith('@7ots/cli@') ? v : `@7ots/cli@${v}`;
+  if (!/^@7ots\/cli@\d+\.\d+\.\d+(-[0-9A-Za-z.]+)?$/.test(s)) throw new Error('SEVENOTS_VM_CLI must be an exact version');
+  return s;
+}
+
+/** Sizes known (ORQUESTA_VM_SIZES 'slug[:usd/month],…'; prices from Orquesta's AWS catalogue). */
+function hostedSizes() {
+  const list = String(penv.ORQUESTA_VM_SIZES || 't3.micro:17,t3.small:28,t3.medium:49')
+    .split(/[\s,]+/)
+    .map((x) => x.split(':'))
+    .filter(([id]) => /^[a-z0-9][a-z0-9.-]{1,40}$/.test(id))
+    .map(([id, p]) => ({ id, monthlyPrice: Number(p) > 0 ? Number(p) : null }));
+  return list.length ? list : [{ id: 't3.small', monthlyPrice: null }];
+}
+/** Always the cheapest size (ORQUESTA_VM_SIZE overrides only if listed). */
+function defaultSize() {
+  const all = hostedSizes();
+  const forced = all.find((s) => s.id === penv.ORQUESTA_VM_SIZE);
+  if (forced) return forced.id;
+  return all.reduce((a, b) => ((b.monthlyPrice ?? Infinity) < (a.monthlyPrice ?? Infinity) ? b : a)).id;
+}
+
+/** Monthly price in cents from whatever Orquesta returns (its catalogue counts cents). */
+function priceCents(v) {
+  const c = v?.priceMonthly ?? v?.price_monthly ?? v?.size?.priceMonthly ?? v?.size?.price_monthly;
+  if (Number(c) > 0) return Math.round(Number(c));
+  const usd = v?.monthly_price_usd ?? v?.monthlyPriceUsd ?? v?.monthly_price ?? v?.monthlyPrice;
+  return Number(usd) > 0 ? Math.round(Number(usd) * 100) : null;
+}
+
+class OrqError extends Error {}
+
+async function orq(method, path, body, timeoutMs = 20_000) {
+  let res;
+  try {
+    res = await fetch(`${ORQ()}/api/v1${path}`, {
+      method,
+      headers: { Accept: 'application/json', Authorization: `Bearer ${orqToken()}`, ...(body ? { 'Content-Type': 'application/json' } : {}) },
+      body: body ? JSON.stringify(body) : undefined,
+      redirect: 'manual',
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    throw Object.assign(new OrqError(`Orquesta unreachable (${e.name === 'TimeoutError' ? 'timeout' : e.code || e.name})`), { status: 0 });
+  }
+  const data = res.status === 204 ? {} : await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const msg = typeof data.error === 'string' ? data.error : data.error?.message || data.message || '';
+    throw Object.assign(new OrqError(`Orquesta ${method} ${path.replace(/\/[^/]{20,}/g, '/…')}: HTTP ${res.status}${msg ? ` ${clean(msg, 200)}` : ''}`), { status: res.status, code: data.error?.code || data.code });
+  }
+  return data;
+}
+
+/** Bash run as root at the end of the VM's user-data (≤ 8 KB). Every value is validated, never free text. */
+export function bootstrapScript({ server, code, cli = cliSpec() }) {
+  if (!/^https?:\/\/[A-Za-z0-9.:[\]-]+(\/[A-Za-z0-9._~/-]*)?$/.test(server)) throw new Error('bad server url');
+  if (!/^7ve_[A-Za-z0-9_-]{20,100}$/.test(code)) throw new Error('bad code');
+  return `#!/bin/bash
+# 7ots cloud worker: user "ot" runs \`7ots vm worker\` (outbound HTTPS only).
+set -euo pipefail
+exec >>/var/log/7ots-bootstrap.log 2>&1
+echo "[7ots] bootstrap $(date -u +%FT%TZ)"
+CLI='${cli}'
+SERVER='${server}'
+CODE='${code}'
+if ! command -v node >/dev/null 2>&1 || ! node -e 'process.exit(+process.versions.node.split(".")[0] < 20 ? 1 : 0)'; then
+  curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+  DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs
+fi
+id ot >/dev/null 2>&1 || useradd --create-home --shell /bin/bash ot
+# Pinned and installed once: the service never fetches code at restart.
+npm install -g --no-fund --no-audit "$CLI"
+BIN="$(command -v 7ots)"
+sudo -u ot -H "$BIN" vm enroll --server "$SERVER" --code "$CODE"
+# System unit (a --user unit would need a login session/linger for "ot").
+cat >/etc/systemd/system/7ots-vm.service <<UNIT
+[Unit]
+Description=7ots cloud worker (7ots vm worker)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+User=ot
+Group=ot
+WorkingDirectory=/home/ot
+Environment=HOME=/home/ot
+ExecStart=$BIN vm worker
+Restart=always
+RestartSec=10
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
+UNIT
+systemctl daemon-reload
+systemctl enable --now 7ots-vm
+echo "[7ots] worker started"
+`;
+}
+
+function setRow(otsId, fields, where = '') {
+  const keys = Object.keys(fields);
+  return getDb()
+    .prepare(`UPDATE ots_vms SET ${keys.map((k) => `${k} = ?`).join(', ')}, updated_at = ? WHERE ots_id = ?${where ? ` AND ${where}` : ''}`)
+    .run(...keys.map((k) => fields[k]), now(), otsId).changes;
+}
+
+const inflight = new Map(); // ots id → provisioning promise
+const checking = new Map(); // ots id → status refresh promise
+
+function teardownQueue() {
+  try {
+    const q = JSON.parse(getPlatformState('vm_teardowns') || '[]');
+    return Array.isArray(q) ? q : [];
+  } catch {
+    return [];
+  }
+}
+function queueTeardown(item) {
+  const q = teardownQueue().filter((x) => x.pid !== item.pid);
+  setPlatformState('vm_teardowns', JSON.stringify([...q, { ...item, at: now() }].slice(-500)));
+}
+function dequeueTeardown(pid) {
+  setPlatformState('vm_teardowns', JSON.stringify(teardownQueue().filter((x) => x.pid !== pid)));
+}
+
+/** Terminates the project's VM, then the project. 404 = already gone. 409 on the project = VM still going away. */
+async function destroy(pid, { retries = 6 } = {}) {
+  if (!pid) return;
+  const p = `/projects/${encodeURIComponent(pid)}`;
+  try {
+    await orq('DELETE', `${p}/vm`, null, 60_000);
+  } catch (e) {
+    if (e.status !== 404) throw e;
+  }
+  for (let i = 0; ; i++) {
+    try {
+      return void (await orq('DELETE', p));
+    } catch (e) {
+      if (e.status === 404) return;
+      if (e.status !== 409 || i >= retries) throw e;
+      await sleep(PROJECT_RETRY_MS());
+    }
+  }
+}
+
+/** Runs after DELETE (and after a provisioning in flight ends): row 'terminating' → 'terminated'. */
+async function finishTeardown(otsId) {
+  await inflight.get(otsId)?.catch(() => {});
+  const row = vmRow(otsId);
+  if (!row || row.status !== 'terminating') return;
+  try {
+    await destroy(row.orq_project_id);
+    setRow(otsId, { status: 'terminated', orq_status: 'terminated', ip: '', error: '' }, "status = 'terminating'");
+    dequeueTeardown(row.orq_project_id);
+  } catch (e) {
+    console.warn(`[7ots] vm teardown ${otsId}:`, e.message);
+    setRow(otsId, { error: clean(e.message, 500) }, "status = 'terminating'"); // reconciliation retries
+  }
+}
+
+/** Creates project + VM. The row may be deleted (ot gone) or set 'terminating' meanwhile: then it undoes its own work. */
+async function provision(ots, { server, code, size, region }) {
+  let pid = '';
+  const gone = () => !vmRow(ots.id);
+  try {
+    const p = await orq('POST', '/projects', { name: `ot-${ots.id}`, description: clean(`7ots cloud worker for "${ots.name}" (ot ${ots.id}, account ${ots.accountId})`, 300) });
+    pid = String(p.project?.id || '');
+    if (!pid) throw new OrqError('Orquesta returned no project id');
+    setRow(ots.id, { orq_project_id: pid });
+    if (gone()) return void (await destroy(pid, { retries: 0 }).catch(() => queueTeardown({ pid, otsId: ots.id })));
+    if (vmRow(ots.id).status !== 'creating') return; // DELETE came first: finishTeardown takes it from here
+    const r = await orq('POST', `/projects/${encodeURIComponent(pid)}/vm`, { size, ...(region ? { region } : {}), external_ref: `${REF_PREFIX()}${ots.id}`, bootstrap: bootstrapScript({ server, code }) }, 6 * 60_000);
+    const v = r.vm || {};
+    if (gone()) return void (await destroy(pid).catch(() => queueTeardown({ pid, otsId: ots.id })));
+    setRow(ots.id, { orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), price_cents: priceCents(v) ?? vmRow(ots.id).price_cents, orq_checked_at: now() }, "status <> 'terminated'");
+    setRow(ots.id, { status: 'pending' }, "status = 'creating'");
+  } catch (e) {
+    console.warn(`[7ots] vm create ${ots.id}:`, e.message);
+    if (gone()) return void (pid && (await destroy(pid).catch(() => queueTeardown({ pid, otsId: ots.id }))));
+    if (vmRow(ots.id).status !== 'creating') return;
+    // Undo what exists (a timed-out create may still have made the VM): ids cleared only once it is gone.
+    let undone = !pid;
+    if (pid) undone = await destroy(pid).then(() => true, () => false);
+    setRow(ots.id, { status: 'error', error: clean(e.message, 500), enroll_hash: null, enroll_exp: null, ...(undone ? { orq_project_id: '', orq_vm_id: '', orq_status: '' } : {}) }, "status = 'creating'");
+  }
+}
+
+/** Orquesta's view of the VM, at most every 15 s per ot (shared by concurrent readers). */
+async function refreshHosted(otsId, { force = false } = {}) {
+  const row = vmRow(otsId);
+  if (!row || row.provider !== 'orquesta' || !row.orq_project_id || !hostedConfigured()) return row;
+  if (!['pending', 'enrolled', 'error'].includes(row.status) || inflight.has(otsId)) return row;
+  if (!force && row.orq_checked_at && now() - row.orq_checked_at < ORQ_CACHE_MS) return row;
+  if (!checking.has(otsId)) {
+    const p = (async () => {
+      try {
+        const v = (await orq('GET', `/projects/${encodeURIComponent(row.orq_project_id)}/vm`, null, 8000)).vm;
+        if (!v) throw Object.assign(new OrqError('no vm'), { status: 404 });
+        const st = clean(v.status, 40);
+        const fields = { orq_status: st, ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) };
+        const pc = priceCents(v);
+        if (pc) fields.price_cents = pc;
+        setRow(otsId, fields);
+        if (/^(error|failed)$/i.test(st)) setRow(otsId, { status: 'error', error: clean(v.error || `Orquesta reports the VM as ${st}`, 500) }, "status = 'pending'");
+        else if (/^(terminated|deleted|destroyed)$/i.test(st)) setRow(otsId, { status: 'error', error: 'The VM was terminated outside 7ots' }, "status IN ('pending', 'enrolled')");
+        else if (/^(running|active)$/i.test(st)) {
+          const cur = vmRow(otsId);
+          if (cur.status === 'pending' && cur.enroll_exp && cur.enroll_exp < now()) setRow(otsId, { status: 'error', error: 'The server did not connect before its enrollment code expired; delete it and create it again', enroll_hash: null, enroll_exp: null }, "status = 'pending'");
+        }
+      } catch (e) {
+        if (e.status === 404) {
+          setRow(otsId, { orq_status: 'gone', orq_checked_at: now() });
+          setRow(otsId, { status: 'error', error: 'The VM no longer exists in Orquesta' }, "status IN ('pending', 'enrolled')");
+        } else {
+          setRow(otsId, { orq_checked_at: now() }); // keep the cache window on errors too
+          console.warn(`[7ots] vm status ${otsId}:`, e.message);
+        }
+      } finally {
+        checking.delete(otsId);
+      }
+    })();
+    checking.set(otsId, p);
+  }
+  await checking.get(otsId);
+  return vmRow(otsId);
+}
+
+/** Compares Orquesta's VMs with ots_vms: refreshes them, retries teardowns, adopts or flags lost creates and logs orphans. */
+export async function reconcileVms() {
+  if (!hostedConfigured()) return null;
+  const { vms = [] } = await orq('GET', '/vms', null, 30_000);
+  const prefix = REF_PREFIX();
+  const ours = vms.filter((v) => String(v.external_ref || '').startsWith(prefix));
+  const byRef = new Map(ours.map((v) => [String(v.external_ref).slice(prefix.length), v]));
+  const rows = getDb().prepare(`SELECT * FROM ots_vms WHERE ${LIVE_ORQ}`).all();
+  const report = { checked: rows.length, orquesta: ours.length, orphans: [], missing: [], retried: 0 };
+  for (const row of rows) {
+    if (inflight.has(row.ots_id)) continue;
+    const v = byRef.get(row.ots_id) || ours.find((x) => row.orq_project_id && String(x.project_id) === row.orq_project_id);
+    if (row.status === 'terminating') {
+      report.retried++;
+      await finishTeardown(row.ots_id);
+      continue;
+    }
+    if (row.status === 'creating') {
+      // The server stopped mid-create: adopt what Orquesta made, or give up on it.
+      if (v) setRow(row.ots_id, { orq_project_id: String(v.project_id || row.orq_project_id), orq_vm_id: String(v.id || ''), orq_status: clean(v.status, 40), ip: clean(v.ip, 60), status: 'pending' }, "status = 'creating'");
+      else if (now() - row.updated_at > 15 * 60_000) setRow(row.ots_id, { status: 'error', error: 'Creation was interrupted' }, "status = 'creating'");
+      continue;
+    }
+    if (!v && row.orq_project_id) {
+      report.missing.push(row.ots_id);
+      setRow(row.ots_id, { orq_status: 'gone', orq_checked_at: now() });
+      if (!online(row)) setRow(row.ots_id, { status: 'error', error: 'The VM no longer exists in Orquesta' }, "status IN ('pending', 'enrolled')");
+      console.warn(`[7ots] vm reconcile: ${row.ots_id} has no VM in Orquesta`);
+    } else if (v) setRow(row.ots_id, { orq_status: clean(v.status, 40), ip: clean(v.ip, 60), orq_checked_at: now(), ...(v.id ? { orq_vm_id: String(v.id) } : {}) });
+  }
+  // Teardowns that failed when an ot was deleted.
+  for (const item of teardownQueue()) {
+    report.retried++;
+    await destroy(item.pid).then(() => dequeueTeardown(item.pid), (e) => console.warn(`[7ots] vm teardown retry ${item.pid}:`, e.message));
+  }
+  const live = new Set(rows.map((r) => r.ots_id));
+  const queued = new Set(teardownQueue().map((x) => x.pid));
+  for (const [otsId, v] of byRef) {
+    if (live.has(otsId) || queued.has(String(v.project_id))) continue;
+    if (/^(terminated|deleted|destroyed)$/i.test(String(v.status))) continue;
+    report.orphans.push({ otsId, vmId: v.id, projectId: v.project_id, status: v.status });
+    console.warn(`[7ots] vm reconcile: orphan VM ${v.id} (project ${v.project_id}, ref ${v.external_ref}) has no live ot`);
+    if (penv.VM_REAP_ORPHANS === '1') await destroy(String(v.project_id)).catch((e) => console.warn('[7ots] vm orphan teardown:', e.message));
+  }
+  setPlatformState('vm_orphans', JSON.stringify({ at: now(), orphans: report.orphans, missing: report.missing }));
+  return report;
+}
+
+/** Before an ot (or its account) is deleted: revoke its worker and tear its Orquesta VM down (queued if Orquesta fails). */
+export async function releaseOtsVm(otsId) {
+  const row = vmRow(otsId);
+  if (!row) return;
+  getDb().prepare('UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, updated_at = ? WHERE ots_id = ?').run(now(), otsId);
+  if (row.provider !== 'orquesta' || row.status === 'terminated') return;
+  setRow(otsId, { status: 'terminating' });
+  if (inflight.has(otsId)) return; // provision() sees the row gone and undoes its own work
+  if (!row.orq_project_id) return;
+  try {
+    await destroy(row.orq_project_id, { retries: 0 });
+  } catch (e) {
+    console.warn(`[7ots] vm teardown on delete ${otsId}:`, e.message);
+    queueTeardown({ pid: row.orq_project_id, otsId });
+  }
+}
+
+export async function releaseAccountVms(accountId) {
+  for (const { ots_id } of getDb().prepare('SELECT ots_id FROM ots_vms WHERE account_id = ?').all(accountId)) await releaseOtsVm(ots_id);
+}
+
 /**
  * @param {{ send: Function, readJson: Function, rateLimit: (req) => boolean, base: (req) => string }} deps
  */
@@ -353,20 +685,69 @@ export function createVm({ send, readJson, rateLimit, base }) {
 
   // ───────────── dashboard (/api/platform/ots/:id/vm…) ─────────────
 
+  /** What the dashboard needs to offer a 7ots server (and why not, when it can't). */
+  function hostedInfo(account) {
+    const enabled = account.vm_enabled === 1;
+    const configured = hostedConfigured();
+    const used = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n;
+    const total = getDb().prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ}`).get().n;
+    const reason = !enabled ? 'notEnabled' : !configured ? 'notConfigured' : used >= PER_ACCOUNT() ? 'accountLimit' : total >= MAX_TOTAL() ? 'full' : null;
+    return { enabled, configured, available: enabled && configured, canCreate: !reason, reason, sizes: hostedSizes().filter((z) => z.id === defaultSize()), defaultSize: defaultSize(), region: penv.ORQUESTA_VM_REGION || null, used, max: PER_ACCOUNT() };
+  }
+
+  /** POST /vm {provider:'orquesta', size?}: reserves the slot (quotas, atomically) and provisions in the background. */
+  async function createHosted(req, res, account, ots, body) {
+    const t = reqT(req);
+    if (account.vm_enabled !== 1) return send(res, 403, { error: t('platform.vm.paidOff') });
+    if (!hostedConfigured()) return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+    const size = defaultSize();
+    let server;
+    try {
+      server = base(req);
+      bootstrapScript({ server, code: `7ve_${'x'.repeat(30)}` }); // validates the URL and SEVENOTS_VM_CLI before spending anything
+    } catch (e) {
+      console.warn('[7ots] vm create:', e.message);
+      return send(res, 503, { error: t('platform.vm.paidUnavailable') });
+    }
+    const region = penv.ORQUESTA_VM_REGION || '';
+    const code = `7ve_${token()}`;
+    const tm = now();
+    const price = hostedSizes().find((s) => s.id === size).monthlyPrice;
+    const err = tx((d) => {
+      const cur = d.prepare('SELECT * FROM ots_vms WHERE ots_id = ?').get(ots.id);
+      if (cur && cur.status !== 'terminated' && (cur.provider === 'orquesta' || cur.status === 'enrolled')) return [409, t('platform.vm.exists')];
+      if (inflight.has(ots.id)) return [409, t('platform.vm.exists')];
+      if (d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ} AND account_id = ?`).get(account.id).n >= PER_ACCOUNT()) return [403, t('platform.vm.accountLimit', { max: PER_ACCOUNT() })];
+      if (d.prepare(`SELECT COUNT(*) AS n FROM ots_vms WHERE ${LIVE_ORQ}`).get().n >= MAX_TOTAL()) return [503, t('platform.vm.full')];
+      d.prepare(`INSERT INTO ots_vms (ots_id, account_id, provider, status, size, region, enroll_hash, enroll_exp, price_cents, created_at, updated_at) VALUES (?, ?, 'orquesta', 'creating', ?, ?, ?, ?, ?, ?, ?)
+                 ON CONFLICT(ots_id) DO UPDATE SET account_id = excluded.account_id, provider = 'orquesta', status = 'creating', orq_project_id = '', orq_vm_id = '', orq_status = '', orq_checked_at = NULL, size = excluded.size, region = excluded.region,
+                   ip = '', error = '', enroll_hash = excluded.enroll_hash, enroll_exp = excluded.enroll_exp, agent_hash = NULL, agent_seen_at = NULL, worker_version = '', worker_info = '{}', price_cents = excluded.price_cents, created_at = excluded.created_at, updated_at = excluded.updated_at`)
+        .run(ots.id, account.id, size, region, sha256(code), tm + ORQ_ENROLL_TTL(), price ? Math.round(price * 100) : null, tm, tm);
+      return null;
+    });
+    if (err) return send(res, err[0], { error: err[1] });
+    const job = provision(ots, { server, code, size, region }).finally(() => inflight.delete(ots.id));
+    inflight.set(ots.id, job);
+    return send(res, 202, { vm: vmView(vmRow(ots.id)), hosted: hostedInfo(account) });
+  }
+
   /** @returns {Promise<boolean>} true if it served the route */
   async function dashboard(req, res, account, ots, sub) {
     if (sub !== '/vm' && !sub.startsWith('/vm/')) return false;
     const t = reqT(req);
-    const vm = vmRow(ots.id);
+    let vm = vmRow(ots.id);
     if (sub === '/vm' && req.method === 'GET') {
       reap(ots.id);
-      return send(res, 200, { vm: vmView(vm), jobs: recentJobs(ots.id), kinds: otsVmKinds(ots), allKinds: VM_KINDS, daily: { used: jobsLastDay(ots.id), max: DAILY() }, paidVms: account.vm_enabled === 1 }), true;
+      if (vm?.provider === 'orquesta') vm = await refreshHosted(ots.id);
+      return send(res, 200, { vm: vmView(vm), jobs: recentJobs(ots.id), kinds: otsVmKinds(ots), allKinds: VM_KINDS, daily: { used: jobsLastDay(ots.id), max: DAILY() }, paidVms: account.vm_enabled === 1, hosted: hostedInfo(account) }), true;
     }
-    if (sub === '/vm/enroll' && req.method === 'POST') {
-      const { provider = 'byo' } = await readJson(req, 4096);
-      // VMs paid by 7ots are created through Orquesta (Phase 1): not yet.
-      if (provider === 'orquesta') return send(res, account.vm_enabled === 1 ? 501 : 403, { error: t('platform.vm.paidSoon') }), true;
-      if (provider !== 'byo') return send(res, 400, { error: t('server.http.badRequest') }), true;
+    if ((sub === '/vm' || sub === '/vm/enroll') && req.method === 'POST') {
+      const body = await readJson(req, 4096);
+      const provider = body.provider || (sub === '/vm' ? 'orquesta' : 'byo');
+      if (provider === 'orquesta') return await createHosted(req, res, account, ots, body), true;
+      if (provider !== 'byo' || sub !== '/vm/enroll') return send(res, 400, { error: t('server.http.badRequest') }), true;
+      // A 7ots server must be deleted first: re-enrolling would leave its VM running unattached.
+      if (vm?.provider === 'orquesta' && vm.status !== 'terminated') return send(res, 409, { error: t('platform.vm.exists') }), true;
       const code = `7ve_${token()}`;
       const tm = now();
       if (vm) getDb().prepare("UPDATE ots_vms SET enroll_hash = ?, enroll_exp = ?, provider = 'byo', status = CASE WHEN status = 'terminated' THEN 'pending' ELSE status END, updated_at = ? WHERE ots_id = ?").run(sha256(code), tm + ENROLL_TTL, tm, ots.id);
@@ -375,12 +756,23 @@ export function createVm({ send, readJson, rateLimit, base }) {
     }
     if (sub === '/vm' && req.method === 'DELETE') {
       if (!vm) return send(res, 200, { ok: true }), true;
-      getDb().prepare("UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, status = 'terminated', updated_at = ? WHERE ots_id = ?").run(now(), ots.id);
+      const hosted = vm.provider === 'orquesta' && vm.status !== 'terminated';
+      getDb().prepare(`UPDATE ots_vms SET agent_hash = NULL, enroll_hash = NULL, enroll_exp = NULL, status = '${hosted ? 'terminating' : 'terminated'}', updated_at = ? WHERE ots_id = ?`).run(now(), ots.id);
       for (const j of getDb().prepare("SELECT * FROM vm_jobs WHERE ots_id = ? AND status NOT IN ('completed', 'failed', 'cancelled')").all(ots.id)) setStatus(j, 'cancelled', { error: 'worker revoked' });
-      return send(res, 200, { ok: true }), true;
+      if (!hosted) return send(res, 200, { ok: true }), true;
+      finishTeardown(ots.id); // background: VM, then project; reconciliation retries if Orquesta fails
+      return send(res, 202, { ok: true, vm: vmView(vmRow(ots.id)) }), true;
     }
     return send(res, 404, { error: t('server.http.unknownRoute') }), true;
   }
 
-  return { worker, device, dashboard };
+  // Reconciliation with Orquesta (every VM_RECONCILE_MIN, default 30), only when hosted VMs are configured.
+  if (hostedConfigured() && !createVm.timer) {
+    const run = () => reconcileVms().catch((e) => console.warn('[7ots] vm reconcile:', e.message));
+    createVm.timer = setInterval(run, RECONCILE_MS());
+    createVm.timer.unref?.();
+    setTimeout(run, Math.min(60_000, RECONCILE_MS())).unref?.();
+  }
+
+  return { worker, device, dashboard, releaseOts: releaseOtsVm, releaseAccount: releaseAccountVms, reconcile: reconcileVms };
 }

package/server/tts.mjs

@@ -11,7 +11,7 @@
  *   grok        → xAI (POST https://api.x.ai/v1/tts). XAI_API_KEY, XAI_TTS_VOICE (eve, ara, leo, rex, sal o voz propia)
  *   fish        → Fish Audio (POST https://api.fish.audio/v1/tts). FISH_API_KEY, FISH_VOICE_ID (reference_id;
  *                 vacío = voz propia del modelo), FISH_MODEL (vacío = s2.1-pro; va en la cabecera `model`)
- *   openai      → (compatibilidad) OPENAI_API_KEY, OPENAI_TTS_MODEL (gpt-4o-mini-tts), OPENAI_TTS_VOICE (alloy)
+ *   openai      → (compatibilidad) OPENAI_API_KEY (solo si LLM_BASE_URL es OpenAI o está vacío; si no, OPENAI_TTS_API_KEY), OPENAI_TTS_MODEL (gpt-4o-mini-tts), OPENAI_TTS_VOICE (alloy)
  *   none        → 501: el widget usa la voz del navegador (speechSynthesis)
  *
  * La voz de la identidad del agente (server/identity.mjs → voice) manda sobre las variables:
@@ -39,10 +39,22 @@ export function ttsProvider(env = process.env) {
   if (env.ELEVENLABS_API_KEY) return 'elevenlabs';
   if (env.XAI_API_KEY) return 'grok';
   if (env.FISH_API_KEY) return 'fish';
-  if (env.OPENAI_API_KEY) return 'openai';
+  if (openaiTtsKey(env)) return 'openai';
   return 'none';
 }
 
+/**
+ * ¿OPENAI_API_KEY sirve para la voz de OpenAI? No si el LLM apunta a otro servicio compatible
+ * (LLM_BASE_URL = DeepSeek, Groq, OpenRouter…): esa clave es de ese servicio y OpenAI la rechazaría
+ * (antes: auto-detección → 'openai' → 502 en cada frase). OPENAI_TTS_API_KEY la fuerza.
+ */
+export function openaiTtsKey(env = process.env) {
+  if (env.OPENAI_TTS_API_KEY) return env.OPENAI_TTS_API_KEY;
+  if (!env.OPENAI_API_KEY) return '';
+  const base = String(env.LLM_BASE_URL || '').trim();
+  return !base || /^https?:\/\/api\.openai\.com(\/|$)/i.test(base) ? env.OPENAI_API_KEY : '';
+}
+
 export async function synthesize({ text, voice = {}, env = process.env }) {
   const provider = PROVIDERS.includes(voice.provider) ? voice.provider : voice.provider === 'browser' ? 'none' : ttsProvider(env);
   const input = String(text || '').slice(0, 1500);
@@ -120,8 +132,9 @@ export async function synthesize({ text, voice = {}, env = process.env }) {
   }
 
   if (provider === 'openai') {
-    if (!env.OPENAI_API_KEY) throw i18nError(501, 'server.tts.noKey', { provider: 'OpenAI', key: 'OPENAI_API_KEY' });
-    const openai = await openaiClient(env.OPENAI_API_KEY); // TTS siempre contra OpenAI (no LLM_BASE_URL)
+    const key = openaiTtsKey(env);
+    if (!key) throw i18nError(501, 'server.tts.noKey', { provider: 'OpenAI', key: env.OPENAI_API_KEY ? 'OPENAI_TTS_API_KEY' : 'OPENAI_API_KEY' });
+    const openai = await openaiClient(key); // TTS siempre contra OpenAI (no LLM_BASE_URL)
     const model = voice.model || env.OPENAI_TTS_MODEL || 'gpt-4o-mini-tts';
     const res = await openai.audio.speech.create({
       model,

package/src/character/Character.js

@@ -208,7 +208,7 @@ export function randomCharacter(seed = Math.random() * 1e9) {
     return `#${[f(0), f(8), f(4)].map((v) => v.toString(16).padStart(2, '0')).join('')}`;
   };
   const groups = new Map();
-  for (const a of ACCESSORIES) if (a.group !== 'extra') groups.set(a.group, [...(groups.get(a.group) || []), a]);
+  for (const a of ACCESSORIES) if (a.group !== 'extra' && a.random !== false) groups.set(a.group, [...(groups.get(a.group) || []), a]);
   const acc = [];
   for (const [, list] of groups) if (rnd() < 0.35) acc.push({ id: pick(list).id });
   return normalizeCharacter({