@chibitek/chibi 0.1.170 → 0.1.172

package/dist-server/openmausbot.js

@@ -19556,7 +19556,7 @@ var init_provider_accounts = __esm({
       // Kimi Code reads its whole data root (login included) from KIMI_CODE_HOME.
       { id: "kimi", kind: "signIn", label: "Kimi Code", billing: "subscription", driver: "kimiAgent", homeEnv: "KIMI_CODE_HOME", loginArgs: ["login"], signupUrl: "https://www.kimi.com/code" },
       // Droid resolves <FACTORY_HOME_OVERRIDE>/.factory, so the folder is a home, not the data root.
-      { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.ai/pricing" },
+      { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.com/pricing" },
       {
         id: "anthropic",
         kind: "apiKey",
@@ -19567,7 +19567,7 @@ var init_provider_accounts = __esm({
         icon: "anthropic",
         config: {},
         keyTest: { provider: "anthropic" },
-        keyUrl: "https://console.anthropic.com/settings/keys"
+        keyUrl: "https://platform.claude.com/settings/keys"
       },
       {
         id: "openai",
@@ -19605,7 +19605,7 @@ var init_provider_accounts = __esm({
         envVar: "PERPLEXITY_API_KEY",
         icon: "perplexity",
         config: { url: "https://api.perplexity.ai", apiKeyEnv: "PERPLEXITY_API_KEY", model: "sonar-pro", provider: "" },
-        keyUrl: "https://www.perplexity.ai/account/api/keys"
+        keyUrl: "https://console.perplexity.ai/project/keys"
       },
       {
         // Alibaba's flat-price Qwen Coding Plan: one plan key serves Qwen, GLM, Kimi and MiniMax models.
@@ -19618,7 +19618,7 @@ var init_provider_accounts = __esm({
         icon: "qwen",
         config: { url: "https://coding-intl.dashscope.aliyuncs.com/v1", apiKeyEnv: "QWEN_CODING_PLAN_API_KEY", model: "qwen3.7-plus", provider: "" },
         keyTest: { provider: "openaiCompat", url: "https://coding-intl.dashscope.aliyuncs.com/v1" },
-        keyUrl: "https://modelstudio.console.alibabacloud.com/",
+        keyUrl: "https://modelstudio.console.alibabacloud.com/ap-southeast-1/subscription/coding-plan",
         signupUrl: "https://www.alibabacloud.com/help/en/model-studio/coding-plan"
       },
       {
@@ -19683,7 +19683,7 @@ var init_provider_accounts = __esm({
         driver: "opencodeGo",
         envVar: "OPENCODE_API_KEY",
         config: {},
-        keyUrl: "https://opencode.ai/docs/providers/",
+        keyUrl: "https://opencode.ai/go",
         signupUrl: "https://opencode.ai/go"
       }
     ];
@@ -56503,6 +56503,7 @@ var init_custom = __esm({
       transformEnv: (env, config2, instanceId) => {
         applyAtomicEngineAccounts(env, instanceId, config2.cli);
         lockAtomicEngineMemory(env, instanceId, config2.cli);
+        if (isAtomicEngine(instanceId, config2.cli)) env.HERMES_ACP_SKIP_CONFIGURED_MCP = "1";
       },
       pickAuthMethod: () => null,
       authFailure: "continue",

package/dist-server/pair-cli.js

@@ -19556,7 +19556,7 @@ var init_provider_accounts = __esm({
       // Kimi Code reads its whole data root (login included) from KIMI_CODE_HOME.
       { id: "kimi", kind: "signIn", label: "Kimi Code", billing: "subscription", driver: "kimiAgent", homeEnv: "KIMI_CODE_HOME", loginArgs: ["login"], signupUrl: "https://www.kimi.com/code" },
       // Droid resolves <FACTORY_HOME_OVERRIDE>/.factory, so the folder is a home, not the data root.
-      { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.ai/pricing" },
+      { id: "droid", kind: "signIn", label: "Factory Droid", billing: "subscription", driver: "droidAgent", homeEnv: "FACTORY_HOME_OVERRIDE", loginArgs: [], signupUrl: "https://factory.com/pricing" },
       {
         id: "anthropic",
         kind: "apiKey",
@@ -19567,7 +19567,7 @@ var init_provider_accounts = __esm({
         icon: "anthropic",
         config: {},
         keyTest: { provider: "anthropic" },
-        keyUrl: "https://console.anthropic.com/settings/keys"
+        keyUrl: "https://platform.claude.com/settings/keys"
       },
       {
         id: "openai",
@@ -19605,7 +19605,7 @@ var init_provider_accounts = __esm({
         envVar: "PERPLEXITY_API_KEY",
         icon: "perplexity",
         config: { url: "https://api.perplexity.ai", apiKeyEnv: "PERPLEXITY_API_KEY", model: "sonar-pro", provider: "" },
-        keyUrl: "https://www.perplexity.ai/account/api/keys"
+        keyUrl: "https://console.perplexity.ai/project/keys"
       },
       {
         // Alibaba's flat-price Qwen Coding Plan: one plan key serves Qwen, GLM, Kimi and MiniMax models.
@@ -19618,7 +19618,7 @@ var init_provider_accounts = __esm({
         icon: "qwen",
         config: { url: "https://coding-intl.dashscope.aliyuncs.com/v1", apiKeyEnv: "QWEN_CODING_PLAN_API_KEY", model: "qwen3.7-plus", provider: "" },
         keyTest: { provider: "openaiCompat", url: "https://coding-intl.dashscope.aliyuncs.com/v1" },
-        keyUrl: "https://modelstudio.console.alibabacloud.com/",
+        keyUrl: "https://modelstudio.console.alibabacloud.com/ap-southeast-1/subscription/coding-plan",
         signupUrl: "https://www.alibabacloud.com/help/en/model-studio/coding-plan"
       },
       {
@@ -19683,7 +19683,7 @@ var init_provider_accounts = __esm({
         driver: "opencodeGo",
         envVar: "OPENCODE_API_KEY",
         config: {},
-        keyUrl: "https://opencode.ai/docs/providers/",
+        keyUrl: "https://opencode.ai/go",
         signupUrl: "https://opencode.ai/go"
       }
     ];
@@ -56503,6 +56503,7 @@ var init_custom = __esm({
       transformEnv: (env, config2, instanceId) => {
         applyAtomicEngineAccounts(env, instanceId, config2.cli);
         lockAtomicEngineMemory(env, instanceId, config2.cli);
+        if (isAtomicEngine(instanceId, config2.cli)) env.HERMES_ACP_SKIP_CONFIGURED_MCP = "1";
       },
       pickAuthMethod: () => null,
       authFailure: "continue",

package/dist-server/server/drivers/acp/custom.js

@@ -142,6 +142,9 @@ const support = {
     transformEnv: (env, config, instanceId) => {
         applyAtomicEngineAccounts(env, instanceId, config.cli);
         lockAtomicEngineMemory(env, instanceId, config.cli);
+        // Atomic owns session mounts; ambient discovery must not race the same names.
+        if (isAtomicEngine(instanceId, config.cli))
+            env.HERMES_ACP_SKIP_CONFIGURED_MCP = "1";
     },
     pickAuthMethod: () => null,
     authFailure: "continue",

package/dist-server/server/index.js

@@ -1,3 +1,5 @@
+import { createMessageFileRoutes } from "./routes/message-file.js";
+import { SharedDeliverables, createSharedDeliverablesRoutes, sharedDeliverableAccess } from "./shared-deliverables.js";
 import { connectionCredentialServer } from "./connection-credential.js";
 import { requestCredentialCard } from "./credential-card-request.js";
 import { invalidateBrokenCheckpoint } from "./checkpoint-recovery.js";
@@ -50,7 +52,6 @@ import { ApprovalGrantStore, describeScope, matchGrant } from "./approval-grants
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { companyCheck, companyContext } from "./company-document-check.js";
-import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, avatarImageStatus, snapshotAvatarGenerationState } from "./avatar-image.js";
 import { generateRoutedAvatar, installAvatarSubscriptionRoute } from "./avatar-subscription.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
@@ -157,11 +158,12 @@ import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite,
 import { resolveSkillImport, skillImportSchema } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
-import { expandLearnTurnText, learnSource } from "./skill-learn.js";
+import { expandSkillTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
 import { buildSystemPrompt, userProfileSystemPrompt, computerPrompt, accountsPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
+import { remoteDesktopRoute } from "./remote-desktop.js";
 import { discoverExistingPerBotLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { ATOMIC_BACKUP_DIR, BROWSER_BACKUP_INTERVAL_MS, backupBrowserProfiles, localVmWorkspaces } from "./atomic-backup.js";
 import { LocalVmIdleTimer } from "./local-vm-idle.js";
@@ -2664,12 +2666,13 @@ function subscriptionModel(bot, candidate, wanted) {
     const provider = subscriptionProvider(bot.subscription?.provider);
     if (!provider)
         return undefined;
+    const usable = (model) => !engineResting(candidate, model);
     const flagship = wanted !== undefined ? undefined : provider.host ? hostDefaultModel(provider, candidate) : frontierChoice(bot, candidate)?.model;
-    if (flagship)
+    if (flagship && usable(flagship))
         return flagship;
     return bestProviderModel({
         provider, candidate, wanted: wanted ?? engineTierClasses(cfg.engineTiers)[botTier(bot)],
-        classOf: (model) => modelClassOf(candidate.driverKind, model), ranked: rankedModelIds(candidate.driverKind),
+        classOf: (model) => modelClassOf(candidate.driverKind, model), ranked: rankedModelIds(candidate.driverKind), usable,
     });
 }
 /** Thrown when a subscription bot's turn has no account of its provider
@@ -10041,7 +10044,7 @@ async function startTurn(botId, text, opts) {
             // the bot's first tool call (desktop attachments are host paths).
             const attachedText = commsDepth === 0 ? await withZipListings(providerText) : providerText;
             const setupText = agentsMounted ? expandSetupTurnText(attachedText) : attachedText;
-            const userTurnText = withAssistantProvenance(promptWithReply(skillAuthoring ? expandLearnTurnText(setupText) : setupText, opts?.replyTo, cfg.profile?.name?.trim() || "User"), userMessage.sender, cfg.profile?.name?.trim() || "the person");
+            const userTurnText = withAssistantProvenance(promptWithReply(expandSkillTurnText(setupText, skillAuthoring), opts?.replyTo, cfg.profile?.name?.trim() || "User"), userMessage.sender, cfg.profile?.name?.trim() || "the person");
             // Decided again at dispatch when setup outlasted a soul edit (config).
             const decideContext = (config) => {
                 const handedStale = Boolean(handed && (!unseen || (externalUpdate && handed.config !== config)));
@@ -12536,7 +12539,7 @@ failover) {
             .filter(Boolean)
             .join("\n");
         const latestUserText = usesNativeImageInput ? resolvedLatestImages.text : latestUser?.text;
-        const learnTurn = skillAuthoring && latestUserText ? expandLearnTurnText(latestUserText) : "";
+        const learnTurn = latestUserText ? expandSkillTurnText(latestUserText, skillAuthoring) : "";
         const learnBlock = learnTurn && learnTurn !== latestUserText ? `\n\n${learnTurn}` : "";
         const addressedRequest = orchestration?.roomHandoffId ? roomHandoffs.nodes.get(orchestration.roomHandoffId) : undefined;
         // The room transcript already carries recent requests and reports. Repeat
@@ -16167,6 +16170,14 @@ ROUTES.push(createThreadStopRoutes({
         routines?.activeBotRunForBot(botId)?.threadId === threadId,
     stop: stopBotThread,
 }));
+const sharedDeliverables = new SharedDeliverables(DATA_DIR);
+const deliverableAccess = (senderId, auth) => sharedDeliverableAccess(sharedDeliverables, {
+    dataDir: DATA_DIR, pawRoot: paw.root, store, senderId,
+    canSeeBot: auth ? (id) => visibleTo(viewerFor(auth)).bot(id) : () => true,
+    canSeeGroup: auth ? (id) => visibleTo(viewerFor(auth)).group(id) : () => true,
+});
+ROUTES.push(createSharedDeliverablesRoutes(sharedDeliverables, () => deliverableAccess(undefined).sharedBlockedRoots ?? []));
+ROUTES.push(createMessageFileRoutes({ store, attachments: ATTACHMENTS_DIR, workspaceDir, access: deliverableAccess }));
 ROUTES.push(createPinOrderRoutes({ store, visible: (auth) => visibleTo(viewerFor(auth)), personalHidden: personalBotHidden, fromBot: (req) => authorizedInternalCapability(req.headers.authorization) !== null }));
 // Linked repos: Settings > Repos, per-thread links and worktrees. See
 // server/routes/repos.ts for the routes and docs/chibitek/README.md.
@@ -19213,118 +19224,6 @@ const handleRequest = async (req, res) => {
             });
             return res.end(bytes);
         }
-        // Download one local file only when this exact stored message grants it:
-        // a bot must render a Markdown link or carry a generated-image attachment,
-        // while a user message must carry the standalone composer tag. The bot
-        // branch derives conversation/workspace roots; the user branch is limited
-        // to OpenMausBot's private attachment directory. This is deliberately not
-        // a general path reader.
-        m = path.match(/^\/api\/threads\/([\w-]+)\/messages\/([\w-]+)\/file$/);
-        const streamsMessageImage = Boolean(m && method === "GET" && url.searchParams.get("preview") === "1");
-        if (m && (method === "POST" || streamsMessageImage)) {
-            if (method === "POST" && !String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
-                return json(res, 415, { error: "content-type must be application/json" });
-            }
-            const threadId = m[1];
-            const directBot = store.botByThread(threadId);
-            const group = directBot ? undefined : store.groupByThread(threadId);
-            if (!directBot && !group)
-                return json(res, 404, { error: "no such conversation" });
-            const message = store.messagesFor(threadId).find((candidate) => candidate.id === m[2]);
-            if (!message)
-                return json(res, 404, { error: "no such message" });
-            if (message.kind !== "text") {
-                return json(res, 403, { error: "that message does not share this file" });
-            }
-            const body = method === "POST" ? await readBody(req) : null;
-            const rawReference = streamsMessageImage ? url.searchParams.get("ref") : null;
-            if (streamsMessageImage && (!rawReference || !/^\d+$/.test(rawReference))) {
-                return json(res, 400, { error: "ref must identify a rendered image" });
-            }
-            const href = method === "POST"
-                ? (typeof body.path === "string" ? body.path : "")
-                : messageImageTargetAt(message.text ?? "", Number(rawReference));
-            if (!href)
-                return json(res, 400, { error: "path is required" });
-            // Generated image paths are durable capabilities on this exact message.
-            // They do not grant access to arbitrary workspace files or Markdown refs.
-            const generatedImage = method === "POST" && message.role === "bot" &&
-                message.attachments?.some((attachment) => attachment.kind === "image" && attachment.path === href) === true;
-            let roots;
-            let downloadName;
-            if (generatedImage) {
-                roots = [ATTACHMENTS_DIR];
-            }
-            else if (message.role === "user") {
-                downloadName = messageAttachmentName(message.text ?? "", href) ?? undefined;
-                if (!downloadName) {
-                    return json(res, 403, { error: "that message does not share this file" });
-                }
-                roots = [ATTACHMENTS_DIR];
-            }
-            else {
-                if (!messageReferencesFile(message.text ?? "", href)) {
-                    return json(res, 403, { error: "that bot message does not link to this file" });
-                }
-                const senderId = directBot?.id ?? message.from?.botId;
-                // The persisted bot-role message is the author record. Membership is
-                // intentionally not consulted: removing a bot must not break files it
-                // already shared in channel history.
-                if (!senderId) {
-                    return json(res, 403, { error: "the file's bot author could not be verified" });
-                }
-                let pinnedCwd;
-                let configuredCwd;
-                if (directBot) {
-                    pinnedCwd = store.taskByThread(directBot.id, threadId)?.cwd;
-                    configuredCwd = directBot.cwd;
-                }
-                else if (group) {
-                    const task = store.groupTaskByThread(group.id, threadId);
-                    pinnedCwd = task ? task.pinnedCwd : group.threadId === threadId ? group.pinnedCwd : undefined;
-                    configuredCwd = group.cwd;
-                }
-                roots = messageFileRoots({
-                    senderWorkspace: workspaceDir(senderId),
-                    attachments: ATTACHMENTS_DIR,
-                    pinnedCwd,
-                    configuredCwd,
-                });
-            }
-            const file = await openMessageFile(href, roots);
-            if ((streamsMessageImage || generatedImage) && !file.mime.startsWith("image/")) {
-                await file.handle.close();
-                return json(res, 415, { error: "only images can be previewed here" });
-            }
-            res.writeHead(200, {
-                "content-type": file.mime,
-                "content-length": String(file.bytes),
-                ...(streamsMessageImage
-                    ? { "content-disposition": "inline" }
-                    : { "content-disposition": messageFileDisposition(messageFileDownloadName(downloadName, file.name)) }),
-                "cache-control": streamsMessageImage ? "private, max-age=3600" : "private, no-store",
-                "cdn-cache-control": "no-store",
-                "cloudflare-cdn-cache-control": "no-store",
-                pragma: "no-cache",
-                vary: "Authorization",
-                "x-content-type-options": "nosniff",
-                ...(streamsMessageImage
-                    ? {
-                        "cross-origin-resource-policy": "same-origin",
-                        "referrer-policy": "no-referrer",
-                    }
-                    : {}),
-            });
-            if (file.bytes === 0) {
-                await file.handle.close();
-                return res.end();
-            }
-            const stream = file.handle.createReadStream({ start: 0, end: file.bytes - 1, autoClose: true });
-            stream.on("error", () => res.destroy());
-            res.on("close", () => stream.destroy());
-            stream.pipe(res);
-            return;
-        }
         // ── image attachments ────────────────────────────────────────────────
         // Pasted/dropped images are stored as files and referenced by path in
         // the prompt (<attached-image path="…"/>); this pair of routes is the
@@ -25136,6 +25035,8 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 405, { error: "method not allowed" });
         }
+        if (await remoteDesktopRoute(path, method, req, res, { store, surface: computerPreviewSurface, controlHeld: (id) => botComputerControlSnapshot(id).held }))
+            return;
         m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/viewer-close$/);
         if (m && method === "POST") {
             const bot = computerPreviewBot(m[1], url);

package/dist-server/server/message-file.js

@@ -343,16 +343,25 @@ function mimeFor(path) {
         default: return "application/octet-stream";
     }
 }
-/**
- * Open a message-linked file under one of the supplied roots. The returned
- * handle, not the pathname, is what the caller streams. We canonicalise both
- * before and after opening and compare the handle with the post-open path;
- * this rejects symlink escapes and directory swaps instead of checking a
- * path and then opening a potentially different file.
- */
-export async function openMessageFile(href, roots) {
+export async function openMessageFile(href, roots, access = {}) {
     const requested = referencedPath(href);
-    const canonicalRoots = (await Promise.all(roots.map(async (root) => {
+    const canonicalize = async (paths) => Promise.all(paths.map(async (path) => {
+        try {
+            return await realpath(path);
+        }
+        catch {
+            return resolve(path);
+        }
+    }));
+    const blocked = [...(access.blockedRoots ?? []), ...await canonicalize(access.blockedRoots ?? [])];
+    const sharedBlocked = [...(access.sharedBlockedRoots ?? []), ...await canonicalize(access.sharedBlockedRoots ?? [])];
+    const isBlocked = (paths, candidate) => paths.some((root) => containedBy(resolve(root), candidate));
+    // Relative links keep their original conversation-relative meaning.
+    const shared = isAbsolute(requested) ? access.sharedRoots ?? [] : [];
+    const boundaries = await canonicalize(access.sharedRootBoundaries ?? []);
+    const canonicalShared = (await canonicalize(shared)).filter(root => !boundaries.some(boundary => containedBy(root, boundary)));
+    const canonicalOrdinary = await canonicalize(roots);
+    const canonicalRoots = (await Promise.all([...roots, ...canonicalShared].map(async (root) => {
         try {
             const canonical = await realpath(root);
             return (await stat(canonical)).isDirectory() ? canonical : null;
@@ -375,7 +384,15 @@ export async function openMessageFile(href, roots) {
         catch {
             continue;
         }
-        const root = canonicalRoots.find((allowed) => containedBy(allowed, canonicalBefore));
+        const permitted = (canonical) => {
+            if (isBlocked(blocked, candidate) || isBlocked(blocked, canonical))
+                return false;
+            if (canonicalOrdinary.some((root) => containedBy(root, canonical)))
+                return true;
+            return canonicalShared.some((root) => containedBy(root, canonical))
+                && !isBlocked(sharedBlocked, candidate) && !isBlocked(sharedBlocked, canonical);
+        };
+        const root = permitted(canonicalBefore) && canonicalRoots.find((allowed) => containedBy(allowed, canonicalBefore));
         if (!root) {
             sawOutsideRoot = true;
             continue;
@@ -391,7 +408,7 @@ export async function openMessageFile(href, roots) {
                 throw statusError(413, `file exceeds ${MESSAGE_FILE_MAX_BYTES} bytes`);
             }
             const canonicalAfter = await realpath(candidate);
-            if (!containedBy(root, canonicalAfter))
+            if (!containedBy(root, canonicalAfter) || !permitted(canonicalAfter))
                 throw statusError(403, "the linked file is outside this conversation's workspace");
             const after = await stat(canonicalAfter);
             if (opened.dev !== after.dev || opened.ino !== after.ino) {

package/dist-server/server/remote-desktop.js

@@ -0,0 +1,142 @@
+// This Mac from the phone: a picture of the whole screen, and taps, keys and
+// typing sent back through the same Cua Driver the bots already use. No VNC
+// server and no second sign-in. The gates are the companion's per-device
+// remote desktop capability and the person's Take control, which pauses the
+// bot so a tap never races its next action.
+//
+// ponytail: one still frame per request (about 1 per second on a Retina Mac).
+// A streamed video path is the upgrade if watching motion ever matters.
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { json, readBody } from "./harness/http.js";
+import { readCuaConnection, readCuaUnavailableReason } from "./local-computer.js";
+const run = promisify(execFile);
+const coordinate = z.number().finite().min(0).max(100_000);
+const key = z.string().regex(/^[a-z0-9]{1,12}$/i);
+const DESKTOP = { kind: "desktop", display_id: "primary" };
+export const remoteInputSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("click"),
+        x: coordinate,
+        y: coordinate,
+        button: z.enum(["left", "right"]).default("left"),
+        count: z.number().int().min(1).max(2).default(1),
+    }),
+    z.object({ type: z.literal("type"), text: z.string().min(1).max(2_000) }),
+    z.object({
+        type: z.literal("key"),
+        key,
+        modifiers: z.array(z.enum(["cmd", "shift", "option", "ctrl"])).max(4).default([]),
+    }),
+    z.object({
+        type: z.literal("scroll"),
+        x: coordinate,
+        y: coordinate,
+        direction: z.enum(["up", "down", "left", "right"]),
+        amount: z.number().int().min(1).max(20).default(3),
+    }),
+]);
+export function hostCuaCall(connection) {
+    const socket = connection.args[connection.args.indexOf("--socket") + 1];
+    if (!connection.args.includes("--socket") || !socket)
+        throw new Error("Cua Driver has no socket for this computer");
+    return async (tool, args, screenshotOut) => {
+        const { stdout } = await run(connection.command, ["call", tool, JSON.stringify(args), "--socket", socket, ...(screenshotOut ? ["--screenshot-out-file", screenshotOut] : [])], { env: { ...process.env, ...connection.env }, timeout: 15_000, maxBuffer: 4 * 1024 * 1024 });
+        return JSON.parse(stdout);
+    };
+}
+/** The whole primary display. `width`/`height` are the coordinate space
+ * clicks use; the image itself is a smaller JPEG to keep it phone-sized. */
+export async function remoteFrame(call, shrink = sipsJpeg) {
+    const dir = await mkdtemp(join(tmpdir(), "atomic-remote-"));
+    try {
+        const png = join(dir, "screen.png");
+        const state = z.object({ screenshot_width: z.number().int().positive(), screenshot_height: z.number().int().positive() })
+            .parse(await call("get_desktop_state", {}, png));
+        const jpeg = join(dir, "screen.jpg");
+        await shrink(png, jpeg);
+        return {
+            image: `data:image/jpeg;base64,${(await readFile(jpeg)).toString("base64")}`,
+            width: state.screenshot_width,
+            height: state.screenshot_height,
+        };
+    }
+    finally {
+        // The picture is the person's screen: never leave it in a temp folder.
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+async function sipsJpeg(input, output) {
+    await run("/usr/bin/sips", ["-s", "format", "jpeg", "-s", "formatOptions", "60", "-Z", "1600", input, "--out", output], { timeout: 15_000 });
+}
+/** Keys and typing go to the frontmost app, the one the person last tapped. */
+async function frontmostPid(call) {
+    const { apps } = z.object({ apps: z.array(z.object({ pid: z.number().int().positive(), active: z.boolean().optional() }).passthrough()) })
+        .parse(await call("list_apps", {}));
+    const active = apps.find((app) => app.active);
+    if (!active)
+        throw Object.assign(new Error("No app is in front on this computer; tap a window first"), { status: 409 });
+    return active.pid;
+}
+export async function remoteInput(call, input) {
+    switch (input.type) {
+        case "click":
+            await call("click", { target: DESKTOP, x: input.x, y: input.y, button: input.button, count: input.count });
+            return;
+        case "scroll":
+            await call("scroll", { target: DESKTOP, x: input.x, y: input.y, direction: input.direction, amount: input.amount });
+            return;
+        case "type":
+            await call("type_text", { pid: await frontmostPid(call), text: input.text });
+            return;
+        case "key":
+            await call("press_key", { pid: await frontmostPid(call), key: input.key, modifiers: input.modifiers });
+            return;
+    }
+}
+/** `POST /api/bots/:id/computer/remote-frame|remote-input`. The companion
+ * admits these only for a device with remote desktop access; input also needs
+ * the person to hold Take control, which pauses the bot. */
+export async function remoteDesktopRoute(path, method, req, res, deps) {
+    const m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/remote-(frame|input)$/);
+    if (!m || method !== "POST")
+        return false;
+    const reply = (status, body) => (json(res, status, body), true);
+    const bot = deps.store.bot(m[1]);
+    if (!bot)
+        return reply(404, { error: "no such bot" });
+    if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+        return reply(415, { error: "content-type must be application/json" });
+    }
+    if ((deps.platform ?? process.platform) !== "darwin" || await deps.surface(bot, bot.threadId) !== "local") {
+        return reply(409, { error: "Phone remote control works for This Mac for now. Choose This Mac for this bot, or open the cloud desktop." });
+    }
+    const call = (deps.cua ?? hostCall)();
+    if (!call)
+        return reply(409, { error: readCuaUnavailableReason() ?? "CUA Driver is not ready on this computer" });
+    res.setHeader("cache-control", "private, no-store");
+    try {
+        if (m[2] === "frame")
+            return reply(200, await remoteFrame(call));
+        if (!deps.controlHeld(bot.id))
+            return reply(409, { error: "Take control before using this computer" });
+        const input = remoteInputSchema.safeParse(await readBody(req));
+        if (!input.success)
+            return reply(400, { error: "invalid remote input" });
+        await remoteInput(call, input.data);
+        return reply(200, { ok: true });
+    }
+    catch (error) {
+        if (error.status !== 409)
+            throw error;
+        return reply(409, { error: error.message });
+    }
+}
+function hostCall() {
+    const connection = readCuaConnection();
+    return connection ? hostCuaCall(connection) : null;
+}

package/dist-server/server/routes/message-file.js

@@ -0,0 +1,115 @@
+import { messageAttachmentName, messageFileDisposition, messageFileDownloadName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile } from "../message-file.js";
+import { PASS } from "./table.js";
+export function createMessageFileRoutes({ store, attachments: ATTACHMENTS_DIR, workspaceDir, access }) {
+    return async ({ req, res, url, path, method, auth, json, readBody }) => {
+        const m = path.match(/^\/api\/threads\/([\w-]+)\/messages\/([\w-]+)\/file$/);
+        const streamsMessageImage = Boolean(m && method === "GET" && url.searchParams.get("preview") === "1");
+        if (m && (method === "POST" || streamsMessageImage)) {
+            if (method === "POST" && !String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            const threadId = m[1];
+            const directBot = store.botByThread(threadId);
+            const group = directBot ? undefined : store.groupByThread(threadId);
+            if (!directBot && !group)
+                return json(res, 404, { error: "no such conversation" });
+            const message = store.messagesFor(threadId).find((candidate) => candidate.id === m[2]);
+            if (!message)
+                return json(res, 404, { error: "no such message" });
+            if (message.kind !== "text") {
+                return json(res, 403, { error: "that message does not share this file" });
+            }
+            const body = method === "POST" ? await readBody(req) : null;
+            const rawReference = streamsMessageImage ? url.searchParams.get("ref") : null;
+            if (streamsMessageImage && (!rawReference || !/^\d+$/.test(rawReference))) {
+                return json(res, 400, { error: "ref must identify a rendered image" });
+            }
+            const href = method === "POST"
+                ? (typeof body.path === "string" ? body.path : "")
+                : messageImageTargetAt(message.text ?? "", Number(rawReference));
+            if (!href)
+                return json(res, 400, { error: "path is required" });
+            // Generated image paths are durable capabilities on this exact message.
+            // They do not grant access to arbitrary workspace files or Markdown refs.
+            const generatedImage = method === "POST" && message.role === "bot" &&
+                message.attachments?.some((attachment) => attachment.kind === "image" && attachment.path === href) === true;
+            let roots;
+            let downloadName;
+            if (generatedImage) {
+                roots = [ATTACHMENTS_DIR];
+            }
+            else if (message.role === "user") {
+                downloadName = messageAttachmentName(message.text ?? "", href) ?? undefined;
+                if (!downloadName) {
+                    return json(res, 403, { error: "that message does not share this file" });
+                }
+                roots = [ATTACHMENTS_DIR];
+            }
+            else {
+                if (!messageReferencesFile(message.text ?? "", href)) {
+                    return json(res, 403, { error: "that bot message does not link to this file" });
+                }
+                const senderId = directBot?.id ?? message.from?.botId;
+                // The persisted bot-role message is the author record. Membership is
+                // intentionally not consulted: removing a bot must not break files it
+                // already shared in channel history.
+                if (!senderId) {
+                    return json(res, 403, { error: "the file's bot author could not be verified" });
+                }
+                let pinnedCwd;
+                let configuredCwd;
+                if (directBot) {
+                    pinnedCwd = store.taskByThread(directBot.id, threadId)?.cwd;
+                    configuredCwd = directBot.cwd;
+                }
+                else if (group) {
+                    const task = store.groupTaskByThread(group.id, threadId);
+                    pinnedCwd = task ? task.pinnedCwd : group.threadId === threadId ? group.pinnedCwd : undefined;
+                    configuredCwd = group.cwd;
+                }
+                roots = messageFileRoots({
+                    senderWorkspace: workspaceDir(senderId),
+                    attachments: ATTACHMENTS_DIR,
+                    pinnedCwd,
+                    configuredCwd,
+                });
+            }
+            const file = await openMessageFile(href, roots, message.role === "bot" && !generatedImage
+                ? access(directBot?.id ?? message.from?.botId, auth) : {});
+            if ((streamsMessageImage || generatedImage) && !file.mime.startsWith("image/")) {
+                await file.handle.close();
+                return json(res, 415, { error: "only images can be previewed here" });
+            }
+            res.writeHead(200, {
+                "content-type": file.mime,
+                "content-length": String(file.bytes),
+                ...(streamsMessageImage
+                    ? { "content-disposition": "inline" }
+                    : { "content-disposition": messageFileDisposition(messageFileDownloadName(downloadName, file.name)) }),
+                "cache-control": streamsMessageImage ? "private, max-age=3600" : "private, no-store",
+                "cdn-cache-control": "no-store",
+                "cloudflare-cdn-cache-control": "no-store",
+                pragma: "no-cache",
+                vary: "Authorization",
+                "x-content-type-options": "nosniff",
+                ...(streamsMessageImage
+                    ? {
+                        "cross-origin-resource-policy": "same-origin",
+                        "referrer-policy": "no-referrer",
+                    }
+                    : {}),
+            });
+            if (file.bytes === 0) {
+                await file.handle.close();
+                res.end();
+                return;
+            }
+            const stream = file.handle.createReadStream({ start: 0, end: file.bytes - 1, autoClose: true });
+            stream.on("error", () => res.destroy());
+            res.on("close", () => stream.destroy());
+            stream.pipe(res);
+            return;
+        }
+        return PASS;
+    };
+}