@chibitek/chibi 0.1.171 → 0.1.173

package/dist-server/server/remote-desktop.js

@@ -40,6 +40,80 @@ export const remoteInputSchema = z.discriminatedUnion("type", [
         amount: z.number().int().min(1).max(20).default(3),
     }),
 ]);
+// Pointer events in frame space (docs/computer-pointer-contract.md). The phone
+// sends where on the picture the person touched; the host owns the way back
+// to the display, because only the host knows what it captured and shrank.
+const unit = z.number().finite().min(0).max(1);
+const frameSide = z.number().int().min(1).max(20_000);
+const pointerBase = {
+    type: z.literal("pointer"),
+    u: unit,
+    v: unit,
+    frameWidth: frameSide,
+    frameHeight: frameSide,
+    display: z.string().min(1).max(64).optional(),
+};
+export const pointerInputSchema = z.discriminatedUnion("action", [
+    z.object({ ...pointerBase, action: z.enum(["tap", "doubleTap", "secondaryTap"]) }),
+    z.object({ ...pointerBase, action: z.literal("drag"), toU: unit, toV: unit }),
+    z.object({
+        ...pointerBase,
+        action: z.literal("scroll"),
+        direction: z.enum(["up", "down", "left", "right"]),
+        amount: z.number().int().min(1).max(20).default(3),
+    }),
+]);
+/** Null when the event was aimed at the frame the host last sent, else why
+ * not. A different size means the resolution, monitor or shrink changed
+ * since the phone's picture, so a mapped point would land somewhere else. */
+export function staleFrameReason(event, sent) {
+    if (!sent)
+        return "No frame has been sent for this computer yet; wait for the next picture";
+    if (event.display !== undefined && event.display !== sent.layout.id)
+        return "That picture is from another display; wait for the next one";
+    if (event.frameWidth !== sent.frameWidth || event.frameHeight !== sent.frameHeight) {
+        return "The screen changed since that picture; wait for the next one";
+    }
+    return null;
+}
+/** The capture shrink is uniform, so (u, v) over the frame is the same
+ * fraction of the display: no need to undo the JPEG size, only to land on
+ * a real pixel (u = 1 is the far edge, not one past it). */
+export function framePointToDisplay(u, v, layout) {
+    const x = Math.min(Math.floor(u * layout.width), layout.width - 1);
+    const y = Math.min(Math.floor(v * layout.height), layout.height - 1);
+    return { display: layout.id, x, y, pointX: layout.originX + x / layout.scale, pointY: layout.originY + y / layout.scale };
+}
+/** Pointer events through Cua Driver's desktop target, which takes display
+ * pixels and does the point and scale conversion itself. It addresses the
+ * primary display only in this release, which is all remoteFrame captures.
+ * Windows and Linux plug in here: the same driver ships for both, so the
+ * work there is lifting the darwin gate in remoteDesktopRoute and checking
+ * its desktop target on each; a backend that wants global points uses
+ * pointX/pointY instead. */
+export async function remotePointer(call, event, layout) {
+    const at = framePointToDisplay(event.u, event.v, layout);
+    const target = { kind: "desktop", display_id: at.display };
+    switch (event.action) {
+        case "tap":
+        case "doubleTap":
+        case "secondaryTap":
+            await call("click", {
+                target, x: at.x, y: at.y,
+                button: event.action === "secondaryTap" ? "right" : "left",
+                count: event.action === "doubleTap" ? 2 : 1,
+            });
+            return;
+        case "drag": {
+            const to = framePointToDisplay(event.toU, event.toV, layout);
+            await call("drag", { target, from_x: at.x, from_y: at.y, to_x: to.x, to_y: to.y });
+            return;
+        }
+        case "scroll":
+            await call("scroll", { target, x: at.x, y: at.y, direction: event.direction, amount: event.amount });
+            return;
+    }
+}
 export function hostCuaCall(connection) {
     const socket = connection.args[connection.args.indexOf("--socket") + 1];
     if (!connection.args.includes("--socket") || !socket)
@@ -55,14 +129,36 @@ export async function remoteFrame(call, shrink = sipsJpeg) {
     const dir = await mkdtemp(join(tmpdir(), "atomic-remote-"));
     try {
         const png = join(dir, "screen.png");
-        const state = z.object({ screenshot_width: z.number().int().positive(), screenshot_height: z.number().int().positive() })
-            .parse(await call("get_desktop_state", {}, png));
+        const state = z.object({
+            screenshot_width: z.number().int().positive(),
+            screenshot_height: z.number().int().positive(),
+            scale_factor: z.number().positive().optional(),
+            display: z.string().min(1).optional(),
+        }).parse(await call("get_desktop_state", {}, png));
         const jpeg = join(dir, "screen.jpg");
         await shrink(png, jpeg);
-        return {
-            image: `data:image/jpeg;base64,${(await readFile(jpeg)).toString("base64")}`,
+        const bytes = await readFile(jpeg);
+        const size = jpegSize(bytes);
+        if (!size)
+            throw new Error("The screen picture came back unreadable");
+        const layout = {
+            id: state.display ?? "primary",
             width: state.screenshot_width,
             height: state.screenshot_height,
+            scale: state.scale_factor ?? 1,
+            originX: 0,
+            originY: 0,
+        };
+        return {
+            frame: {
+                image: `data:image/jpeg;base64,${bytes.toString("base64")}`,
+                width: layout.width,
+                height: layout.height,
+                frameWidth: size.width,
+                frameHeight: size.height,
+                display: layout.id,
+            },
+            sent: { frameWidth: size.width, frameHeight: size.height, layout },
         };
     }
     finally {
@@ -70,6 +166,24 @@ export async function remoteFrame(call, shrink = sipsJpeg) {
         await rm(dir, { recursive: true, force: true });
     }
 }
+/** Pixel size from a JPEG's start-of-frame marker, or null if it has none. */
+export function jpegSize(bytes) {
+    if (bytes[0] !== 0xff || bytes[1] !== 0xd8)
+        return null;
+    let at = 2;
+    while (at + 9 < bytes.length) {
+        if (bytes[at] !== 0xff)
+            return null;
+        const marker = bytes[at + 1];
+        const length = (bytes[at + 2] << 8) | bytes[at + 3];
+        // SOF0..SOF15, minus DHT (C4), JPG (C8) and DAC (CC), which share the range.
+        if (marker >= 0xc0 && marker <= 0xcf && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc) {
+            return { height: (bytes[at + 5] << 8) | bytes[at + 6], width: (bytes[at + 7] << 8) | bytes[at + 8] };
+        }
+        at += 2 + length;
+    }
+    return null;
+}
 async function sipsJpeg(input, output) {
     await run("/usr/bin/sips", ["-s", "format", "jpeg", "-s", "formatOptions", "60", "-Z", "1600", input, "--out", output], { timeout: 15_000 });
 }
@@ -112,6 +226,7 @@ export async function remoteDesktopRoute(path, method, req, res, deps) {
     if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
         return reply(415, { error: "content-type must be application/json" });
     }
+    // Windows and Linux: see remotePointer. Lifting this gate is the switch.
     if ((deps.platform ?? process.platform) !== "darwin" || await deps.surface(bot, bot.threadId) !== "local") {
         return reply(409, { error: "Phone remote control works for This Mac for now. Choose This Mac for this bot, or open the cloud desktop." });
     }
@@ -120,11 +235,27 @@ export async function remoteDesktopRoute(path, method, req, res, deps) {
         return reply(409, { error: readCuaUnavailableReason() ?? "CUA Driver is not ready on this computer" });
     res.setHeader("cache-control", "private, no-store");
     try {
-        if (m[2] === "frame")
-            return reply(200, await remoteFrame(call));
+        const frames = deps.frames ?? sentFrames;
+        if (m[2] === "frame") {
+            const { frame, sent } = await remoteFrame(call);
+            frames.set(bot.id, sent);
+            return reply(200, frame);
+        }
         if (!deps.controlHeld(bot.id))
             return reply(409, { error: "Take control before using this computer" });
-        const input = remoteInputSchema.safeParse(await readBody(req));
+        const body = await readBody(req);
+        if (body?.type === "pointer") {
+            const event = pointerInputSchema.safeParse(body);
+            if (!event.success)
+                return reply(400, { error: "invalid pointer input" });
+            const sent = frames.get(bot.id);
+            const stale = staleFrameReason(event.data, sent);
+            if (stale || !sent)
+                return reply(409, { error: stale, code: "stale-frame" });
+            await remotePointer(call, event.data, sent.layout);
+            return reply(200, { ok: true });
+        }
+        const input = remoteInputSchema.safeParse(body);
         if (!input.success)
             return reply(400, { error: "invalid remote input" });
         await remoteInput(call, input.data);
@@ -136,6 +267,7 @@ export async function remoteDesktopRoute(path, method, req, res, deps) {
         return reply(409, { error: error.message });
     }
 }
+const sentFrames = new Map();
 function hostCall() {
     const connection = readCuaConnection();
     return connection ? hostCuaCall(connection) : null;

package/dist-server/server/routes/engine-tiers.js

@@ -1,5 +1,6 @@
 import { isBotTier, isModelClass, MODEL_CLASSES } from "../../shared/engine-tiers.js";
-import { checkedLadder, engineTiersView, rebalanceRow, withLadder, withTierClass } from "../engine-tiers.js";
+import { checkedLadder, rebalanceRow, withLadder, withTierClass } from "../engine-tiers.js";
+import { engineTiersView } from "../engine-tiers-view.js";
 import { PASS } from "./table.js";
 const MAX_CHANGES = 500;
 export function createEngineTierRoutes(deps) {
@@ -87,6 +88,16 @@ export function createEngineTierRoutes(deps) {
             deps.saveEngineTiers(withTierClass(deps.engineTiers(), tier, value));
             return json(res, 200, await view());
         }
+        if (path === "/api/engine-tiers/include-free" && method === "PUT") {
+            if (deps.disabled())
+                return disabled();
+            const body = await readBody(req);
+            const value = body && typeof body === "object" && !Array.isArray(body) && Object.keys(body).length === 1 ? body.includeFree : undefined;
+            if (typeof value !== "boolean")
+                return json(res, 400, { error: "send { includeFree: boolean }" });
+            deps.saveEngineTiers({ ...(deps.engineTiers() ?? { ladders: {} }), includeFree: value || undefined });
+            return json(res, 200, await view());
+        }
         if (path === "/api/engine-tiers/rebalance" && method === "GET") {
             if (deps.disabled())
                 return disabled();

package/dist-server/server/subscription-bots.js

@@ -1,23 +1,3 @@
-// Subscription bots' rules (docs/chibitek/subscription-bots.md;
-// shared/subscription-bots.ts). Pure, so each rule is unit tested without a
-// server; server/index.ts wires them into the engine-selection points, the
-// sign-in refresh and the routes.
-//
-//   1. One bot per signed-in subscription account, made once. The record of
-//      what was made (config.json `subscriptionBots.made`) is keyed by the
-//      account and its owner, so signing in again never makes a second, and
-//      a bot the person deleted is not made again.
-//   2. It runs only on its provider's own engine, on accounts of that
-//      provider on its own side of the personal line: never the Atomic
-//      Engine, the company connection, a pay-per-use key or another
-//      provider. Every ladder walk, failover, stand-in, rebalance and manual
-//      pick reads the same refusal (`providerAllows`).
-//   3. Its model is the best its account offers for the bot's job, within
-//      the provider; a person may pick any other model the account offers.
-//   4. When none of its accounts can take a turn, it stops with one line and
-//      offers Chibi. It never fails over to another provider.
-//   5. An account marked Personal makes a bot under the Private Bot's rules
-//      (server/personal-bot.ts): `personal: true` on the bot.
 import { ATOMIC_ENGINE_INSTANCE } from "./harness-import/engine-policy.js";
 import { MODEL_CLASSES } from "../shared/engine-tiers.js";
 import { SUBSCRIPTION_PROVIDERS, isProviderModel, isSubscriptionBot, subscriptionBotName, subscriptionProvider, subscriptionProviderForEngine, } from "../shared/subscription-bots.js";
@@ -34,7 +14,8 @@ export function subscriptionAccount(candidate, facts) {
         return undefined;
     if (facts.companyManaged(candidate.instanceId))
         return undefined;
-    if (candidate.billing === "payPerUse")
+    // a pay-per-use key or a free tier is never a plan that gets its own bot
+    if (candidate.billing === "payPerUse" || candidate.billing === "free")
         return undefined;
     if (provider.planOnly && candidate.billing !== "subscription")
         return undefined;

package/dist-server/server/turn-resources.js

@@ -46,6 +46,34 @@ export function workspaceResource(cwd) {
     const canonical = realpathSync.native(resolve(cwd));
     return `workspace:${process.platform === "win32" ? canonical.toLowerCase() : canonical}`;
 }
+/** The folder a queued turn will claim, predicted without side effects so
+ * the handoff queue can wait for it instead of dispatching straight into
+ * workspace_busy. Mirrors prepareTurnRepos + pinTaskCwd: a pinned folder
+ * stays; an unstarted thread takes its worktree or primary repo, then the
+ * bot's folder; a worktree still to be created is new, so nothing holds it. */
+export function queuedTurnFolder(taskCwd, started, plan, botCwd) {
+    if (taskCwd !== undefined)
+        return taskCwd;
+    if (started)
+        return null;
+    if (plan?.createWorktree)
+        return null;
+    const repoCwd = plan?.worktree && plan.primary && plan.worktree.repoId === plan.primary.id ? plan.worktree.path : plan?.primary?.path;
+    return repoCwd ?? botCwd ?? null;
+}
+/** True when another thread holds `folder`, so a queued handoff waits
+ * like it does for a busy bot instead of failing with workspace_busy. A
+ * missing folder reads as free so the turn itself reports the real error. */
+export function folderHeldElsewhere(resources, folder, threadId) {
+    if (!folder)
+        return false;
+    try {
+        return Boolean(resources.blocker(workspaceResource(folder), { threadId, generation: "" }));
+    }
+    catch {
+        return false;
+    }
+}
 function overlaps(a, b) {
     if (a === b)
         return true;

package/dist-server/server/workspace-backup-archive.js

@@ -0,0 +1,138 @@
+// The .ombbackup container. Two layouts share one extension:
+//   encrypted  "OMB-WORKSPACE-1\n" + salt(16) + iv(12), AES-256-GCM tar, tag(16).
+//              The key comes from the passphrase through scrypt; the header is
+//              authenticated too. Only this layout may carry secrets.
+//   plain      "OMB-WORKSPACE-PLAIN-1\n", tar, SHA-256 of everything before it.
+//              The checksum catches damage, not deliberate edits, which is why
+//              a plain backup never holds credentials.
+// Nothing is parsed until the whole file has been authenticated or checked.
+import { createCipheriv, createDecipheriv, createHash, randomBytes, scrypt } from "node:crypto";
+import { closeSync, constants, createReadStream, createWriteStream, fstatSync, fsyncSync, openSync, readSync, writeFileSync, writeSync } from "node:fs";
+import { pipeline } from "node:stream/promises";
+import * as tar from "tar";
+export const MAX_WORKSPACE_BACKUP_BYTES = 64 * 1024 ** 3;
+export const MAX_WORKSPACE_BACKUP_UPLOAD_BYTES = MAX_WORKSPACE_BACKUP_BYTES + 256 * 1024 ** 2;
+const MAGIC = Buffer.from("OMB-WORKSPACE-1\n");
+const PLAIN = Buffer.from("OMB-WORKSPACE-PLAIN-1\n");
+const HEADER_BYTES = MAGIC.length + 16 + 12;
+const TAG_BYTES = 16;
+const DIGEST_BYTES = 32;
+const DAMAGED = "The backup password is incorrect, or the backup file is damaged. Nothing was restored.";
+export function passwordKey(password, salt) {
+    if (typeof password !== "string" || password.length < 12 || Buffer.byteLength(password) > 1024) {
+        throw new Error("Use a backup password of at least 12 characters (at most 1024 bytes).");
+    }
+    return new Promise((resolveKey, reject) => {
+        scrypt(password, salt, 32, { N: 131_072, r: 8, p: 1, maxmem: 256 * 1024 ** 2 }, (error, key) => {
+            if (error)
+                reject(error);
+            else
+                resolveKey(key);
+        });
+    });
+}
+/** Tar `names` from `cwd` into `path`; encrypted when a key is given. */
+export async function writeArchive(path, cwd, names, encryption) {
+    const source = () => tar.c({ cwd, portable: true, strict: true }, names);
+    if (!encryption) {
+        writeFileSync(path, PLAIN, { mode: 0o600, flag: "wx" });
+        await pipeline(source(), createWriteStream(path, { flags: "a", mode: 0o600 }));
+        const digest = await digestRange(path, 0);
+        const fd = openSync(path, "a");
+        try {
+            writeSync(fd, digest);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        return;
+    }
+    const iv = randomBytes(12);
+    const header = Buffer.concat([MAGIC, encryption.salt, iv]);
+    const cipher = createCipheriv("aes-256-gcm", encryption.key, iv);
+    cipher.setAAD(header);
+    writeFileSync(path, header, { mode: 0o600, flag: "wx" });
+    await pipeline(source(), cipher, createWriteStream(path, { flags: "a", mode: 0o600 }));
+    const fd = openSync(path, "a");
+    try {
+        writeSync(fd, cipher.getAuthTag());
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+async function digestRange(path, trailer) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const size = fstatSync(fd).size - trailer;
+        const hash = createHash("sha256");
+        if (size > 0)
+            await pipeline(createReadStream(path, { fd, autoClose: false, start: 0, end: size - 1 }), hash);
+        return hash.digest();
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Whether a backup file needs a password, without reading past its header. */
+export function archiveEncrypted(path) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const head = Buffer.alloc(PLAIN.length);
+        const count = readSync(fd, head, 0, head.length, 0);
+        if (count >= PLAIN.length && head.equals(PLAIN))
+            return false;
+        if (count >= MAGIC.length && head.subarray(0, MAGIC.length).equals(MAGIC))
+            return true;
+        throw new Error("This is not a supported workspace backup.");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Authenticate (or checksum) the whole file, then write its tar payload. */
+export async function readArchive(inputPath, plaintext, password) {
+    const encrypted = archiveEncrypted(inputPath);
+    const fd = openSync(inputPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    let key;
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_WORKSPACE_BACKUP_UPLOAD_BYTES)
+            throw new Error("Invalid or oversized workspace backup file.");
+        if (!encrypted) {
+            if (stat.size < PLAIN.length + DIGEST_BYTES)
+                throw new Error("The backup file is damaged. Nothing was restored.");
+            const expected = Buffer.alloc(DIGEST_BYTES);
+            readSync(fd, expected, 0, DIGEST_BYTES, stat.size - DIGEST_BYTES);
+            if (!(await digestRange(inputPath, DIGEST_BYTES)).equals(expected))
+                throw new Error("The backup file is damaged. Nothing was restored.");
+            await pipeline(createReadStream(inputPath, { fd, autoClose: false, start: PLAIN.length, end: stat.size - DIGEST_BYTES - 1 }), createWriteStream(plaintext, { flags: "wx", mode: 0o600 }));
+            return { encrypted };
+        }
+        if (!password)
+            throw new Error("This backup is encrypted. Enter its password.");
+        if (stat.size < HEADER_BYTES + TAG_BYTES)
+            throw new Error("This is not a supported encrypted workspace backup.");
+        const header = Buffer.alloc(HEADER_BYTES);
+        const tag = Buffer.alloc(TAG_BYTES);
+        readSync(fd, header, 0, header.length, 0);
+        readSync(fd, tag, 0, tag.length, stat.size - TAG_BYTES);
+        key = await passwordKey(password, header.subarray(MAGIC.length, MAGIC.length + 16));
+        const decipher = createDecipheriv("aes-256-gcm", key, header.subarray(MAGIC.length + 16));
+        decipher.setAAD(header);
+        decipher.setAuthTag(tag);
+        try {
+            await pipeline(createReadStream(inputPath, { fd, autoClose: false, start: HEADER_BYTES, end: stat.size - TAG_BYTES - 1 }), decipher, createWriteStream(plaintext, { flags: "wx", mode: 0o600 }));
+        }
+        catch {
+            throw new Error(DAMAGED);
+        }
+        return { encrypted };
+    }
+    finally {
+        key?.fill(0);
+        closeSync(fd);
+    }
+}

package/dist-server/server/workspace-backup-http.js

@@ -6,6 +6,7 @@ import { pipeline } from "node:stream/promises";
 import { z } from "zod";
 import { WORKSPACE_BACKUP_CLIENT_KEYS } from "../shared/workspace-backup-client.js";
 import { createWorkspaceBackup, stageWorkspaceBackup, commitPendingWorkspaceRestore, MAX_WORKSPACE_BACKUP_UPLOAD_BYTES, removeWorkspaceBackupJob, } from "./workspace-backup.js";
+import { desktopWorkspaceSecrets } from "./workspace-backup-secrets.js";
 import { listSavedBackups, revealInFileManager, saveWorkspaceBackup, savedBackupPath, savedWorkspaceBackupFile } from "./atomic-backup.js";
 const PREFIX = "/api/workspace-backup";
 const MAX_UPLOAD_BYTES = MAX_WORKSPACE_BACKUP_UPLOAD_BYTES;
@@ -13,6 +14,7 @@ const MAX_CLIENT_STATE_BYTES = 2 * 1024 ** 2;
 const EXPIRES_MS = 60 * 60_000;
 const passwordSchema = z.string().min(12, "Use a password of at least 12 characters.").max(1024);
 const failure = (message, status = 400) => Object.assign(new Error(message), { status });
+const TOO_LARGE = "Select a backup containing no more than 64 GB of workspace data.";
 /** Session-only controls remain usable while the workspace is locked. Their
  * excluded session file is not part of the snapshot or replacement. */
 export function isWorkspaceBackupSessionControl(method, path) {
@@ -25,7 +27,12 @@ export function isWorkspaceBackupSessionControl(method, path) {
 export function createWorkspaceBackupRoutes(options) {
     // ponytail: one bounded set per server; transfers expire after an hour.
     const artifacts = new Map();
+    // A staged backup's desktop secrets wait here, never on disk, until the
+    // person confirms the restore or the staged backup expires.
+    const stagedSecrets = new Map();
     let operating = false;
+    let progress = null;
+    const onProgress = (next) => { progress = next; };
     const json = (res, status, body) => {
         res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
         res.end(JSON.stringify(body));
@@ -49,6 +56,7 @@ export function createWorkspaceBackupRoutes(options) {
             catch { /* Recovery jobs are deliberately protected. */ }
         }
         artifacts.delete(id);
+        stagedSecrets.delete(id);
     }
     // A crashed process has no in-memory transfer map. Reclaim only its old,
     // app-named jobs; never safety copies or pending/committed recovery state.
@@ -126,6 +134,7 @@ export function createWorkspaceBackupRoutes(options) {
         }
         finally {
             operating = false;
+            progress = null;
         }
     }
     return async (req, res, path, auth) => {
@@ -136,10 +145,17 @@ export function createWorkspaceBackupRoutes(options) {
         try {
             check(req, auth);
             if (method === "GET" && path === `${PREFIX}/status`) {
+                const restored = options.restored;
                 json(res, 200, {
                     ...options.status(),
-                    lastRestoreId: options.restored.restored ? options.restored.id : null,
-                    safetyCopyPath: options.restored.safetyCopyPath ?? null,
+                    progress,
+                    lastRestoreId: restored.restored ? restored.id : null,
+                    safetyCopyPath: restored.safetyCopyPath ?? null,
+                    // What Settings shows after a restore: what to sign in to or clone again.
+                    lastRestore: restored.restored ? {
+                        secretsIncluded: restored.summary?.secrets === true, secrets: restored.secrets ?? null,
+                        unresolvedPaths: restored.unresolvedPaths ?? [], checkouts: restored.summary?.checkouts ?? [], exclusions: restored.summary?.exclusions ?? [],
+                    } : null,
                 });
                 return true;
             }
@@ -153,16 +169,32 @@ export function createWorkspaceBackupRoutes(options) {
             }
             if (method === "POST" && path === `${PREFIX}/export`) {
                 // Allow the full preference budget plus the JSON envelope/password.
-                const body = z.object({ password: passwordSchema, clientState: z.record(z.string(), z.string()).default({}), excludePrivateBot: z.boolean().default(false) }).parse(await options.readBody(req, MAX_CLIENT_STATE_BYTES + 8 * 1024));
+                // Encryption is on unless the caller turns it off; secrets need it.
+                const body = z.object({
+                    password: passwordSchema.optional(), encrypted: z.boolean().default(true), includeSecrets: z.boolean().default(false),
+                    clientState: z.record(z.string(), z.string()).default({}), excludePrivateBot: z.boolean().default(false),
+                }).parse(await options.readBody(req, MAX_CLIENT_STATE_BYTES + 8 * 1024));
                 if (Buffer.byteLength(JSON.stringify(body.clientState)) > MAX_CLIENT_STATE_BYTES)
                     throw failure("Saved drafts exceed the 2 MB backup preference limit.", 413);
+                if (body.encrypted !== (body.password !== undefined))
+                    throw failure(body.encrypted ? "Set a backup password of at least 12 characters." : "An unencrypted backup does not use a password.");
+                if (body.includeSecrets && !body.encrypted)
+                    throw failure("Keys, passwords and tokens are only included in an encrypted backup.");
                 const clientState = Object.fromEntries(Object.entries(body.clientState).filter(([key]) => WORKSPACE_BACKUP_CLIENT_KEYS.includes(key)));
                 const result = await operate(() => options.exclusive(async () => {
                     check(req, auth);
                     replacePrevious(auth, ["download"]);
                     if (artifacts.size >= 4)
                         throw failure("There are already four backup files in progress. Restart or wait an hour before creating another.", 409);
-                    return createWorkspaceBackup(options.dataDir, { password: body.password, clientState, appVersion: options.appVersion, excludePrivateBot: body.excludePrivateBot });
+                    const desktop = body.includeSecrets ? desktopWorkspaceSecrets() : null;
+                    const secrets = desktop ? await desktop.export().catch((error) => {
+                        console.error(`[workspace-backup] secure credential store not read: ${error instanceof Error ? error.message : String(error)}`);
+                        return null;
+                    }) : null;
+                    return createWorkspaceBackup(options.dataDir, {
+                        password: body.password, includeSecrets: body.includeSecrets, secrets, onProgress,
+                        clientState, appVersion: options.appVersion, excludePrivateBot: body.excludePrivateBot,
+                    });
                 }));
                 try {
                     check(req, auth);
@@ -211,7 +243,7 @@ export function createWorkspaceBackupRoutes(options) {
                     if (artifacts.size >= 4)
                         throw failure("There are already four backup files in progress. Restart or wait an hour before importing another.", 409);
                     if (statSync(source).size > MAX_UPLOAD_BYTES)
-                        throw failure("Select a backup containing no more than 10 GB of workspace data.", 413);
+                        throw failure(TOO_LARGE, 413);
                     const id = randomUUID();
                     const file = join(uploadsDirectory(), `${id}.ombbackup`);
                     copyFileSync(source, file);
@@ -237,7 +269,7 @@ export function createWorkspaceBackupRoutes(options) {
                 await operate(async () => {
                     const length = Number(req.headers["content-length"]);
                     if (!Number.isSafeInteger(length) || length <= 0 || length > MAX_UPLOAD_BYTES)
-                        throw failure("Select a backup containing no more than 10 GB of workspace data.", 413);
+                        throw failure(TOO_LARGE, 413);
                     replacePrevious(auth, ["upload", "staged"]);
                     if (artifacts.size >= 4)
                         throw failure("There are already four backup files in progress. Restart or wait an hour before uploading another.", 409);
@@ -268,9 +300,10 @@ export function createWorkspaceBackupRoutes(options) {
                 return true;
             }
             if (method === "POST" && path === `${PREFIX}/preview`) {
-                const body = z.object({ id: z.string().uuid(), password: passwordSchema }).parse(await options.readBody(req));
+                // An unencrypted backup needs no password; an encrypted one says so.
+                const body = z.object({ id: z.string().uuid(), password: passwordSchema.optional() }).parse(await options.readBody(req));
                 const artifact = get(body.id, auth, "upload");
-                const result = await operate(() => stageWorkspaceBackup(options.dataDir, artifact.path, { password: body.password, currentAppVersion: options.appVersion }));
+                const result = await operate(() => stageWorkspaceBackup(options.dataDir, artifact.path, { password: body.password, currentAppVersion: options.appVersion, onProgress }));
                 try {
                     check(req, auth);
                 }
@@ -284,6 +317,8 @@ export function createWorkspaceBackupRoutes(options) {
                 catch { }
                 artifacts.delete(body.id);
                 artifacts.set(result.id, { owner: owner(auth), kind: "staged", summary: result.summary, expires: Date.now() + EXPIRES_MS });
+                if (result.secrets)
+                    stagedSecrets.set(result.id, result.secrets);
                 json(res, 200, { id: result.id, summary: result.summary });
                 return true;
             }
@@ -292,9 +327,16 @@ export function createWorkspaceBackupRoutes(options) {
                 get(body.id, auth, "staged");
                 const result = await operate(() => options.exclusive(async () => {
                     check(req, auth);
+                    // The desktop holds the saved credentials until the restored files
+                    // are in place (next boot); refusing here leaves nothing changed.
+                    const secrets = stagedSecrets.get(body.id);
+                    const desktop = desktopWorkspaceSecrets();
+                    if (secrets && desktop)
+                        await desktop.stage(body.id, secrets);
                     return commitPendingWorkspaceRestore(options.dataDir, body.id);
                 }, true));
                 artifacts.delete(body.id);
+                stagedSecrets.delete(body.id);
                 json(res, 200, { ...result, restoreId: body.id });
                 return true;
             }