openmates 0.27.0-alpha.60 → 0.27.0-alpha.62

package/dist/{chunk-HA4UBUFE.js → chunk-CFP7IA76.js}

@@ -3923,6 +3923,14 @@ async function encryptEmbed(embed, masterKey, chatKey, chatId, messageId, userId
       hashed_user_id: hashedUserId,
       file_path: embed.filePath,
       content_hash: embed.contentHash,
+      ...embed.appId && embed.skillId ? {
+        app_id: embed.appId,
+        skill_id: embed.skillId,
+        root_embed_id: embed.embedId,
+        workspace_origin: "chat"
+      } : {},
+      ...embed.versionNumber ? { version_number: embed.versionNumber } : {},
+      encryption_mode: "client",
       text_length_chars: embed.textLengthChars,
       created_at: nowSeconds3,
       updated_at: nowSeconds3,
@@ -7311,6 +7319,35 @@ import { basename as basename2, extname as extname2, resolve as resolve3 } from
 import { homedir as homedir2 } from "os";
 import { createHash as createHash10 } from "crypto";
 import JSZip2 from "jszip";
+
+// src/diagramHtml.ts
+function inspectDiagramHtml(source) {
+  if (!source || Buffer.byteLength(source, "utf8") > 1024 * 1024) return null;
+  if (!/^\s*<!doctype html\s*>/i.test(source) || !/<html\b[^>]*>[\s\S]*<head\b[^>]*>[\s\S]*<\/head\s*>[\s\S]*<body\b[^>]*>[\s\S]*<svg\b/i.test(source) || !/<\/svg\s*>[\s\S]*<\/body\s*>[\s\S]*<\/html\s*>\s*$/i.test(source) || !/<g\b[^>]*\bdata-om-component\s*=\s*["'][a-z][a-z0-9_-]{0,63}["']/i.test(source)) return null;
+  let checked = source.replace(/\sxmlns(?::[\w-]+)?\s*=\s*["']http:\/\/www\.w3\.org\/[A-Za-z0-9/.-]+["']/gi, "");
+  checked = checked.replace(/<!--[\s\S]*?-->/g, "").replace(/&amp;/gi, "&");
+  checked = checked.replace(/data:font\/woff2;base64,([A-Za-z0-9+/]+={0,2})/gi, (whole, encoded) => {
+    const bytes2 = Buffer.from(encoded, "base64");
+    return bytes2.length > 0 && bytes2.length <= 256 * 1024 && bytes2.subarray(0, 4).toString() === "wOF2" && /@font-face\s*\{[^}]*$/i.test(checked.slice(0, checked.indexOf(whole))) ? "#embedded-font" : "unsafe-font-data";
+  });
+  if (/<!--|-->|<![^d]|<\?|&#|&[a-z][a-z0-9]+;/i.test(checked) || /<\s*\/?\s*(?:script|iframe|frame|object|embed|applet|link|base|img|image|video|audio|source|track|form|input|textarea|select|button|template|portal|foreignobject|animate|set|discard|feimage|math|noscript)\b/i.test(source) || /\s(?:on[a-z]+|srcdoc|src|srcset|poster|data|action|formaction|background|http-equiv)\s*=/i.test(source) || /(?:https?:|file:|javascript:|data:|\/\/|unsafe-font-data)/i.test(checked) || /@\s*(?:import|namespace|document)|expression\s*\(|image-set\s*\(|behavior\s*:|-moz-binding\s*:|\\/i.test(checked)) return null;
+  for (const match of checked.matchAll(/url\(\s*(['"]?)([^)"']+)\1\s*\)/gi)) {
+    if (!/^#[a-z_][\w.:-]{0,119}$/i.test(match[2].trim())) return null;
+  }
+  if (/url\s*\(/i.test(checked.replace(/url\(\s*(['"]?)([^)"']+)\1\s*\)/gi, ""))) return null;
+  const title = /<title\b[^>]*>([^<>]{1,160})<\/title\s*>/i.exec(source)?.[1]?.trim();
+  const viewBox = /<svg\b[^>]*\bviewBox\s*=\s*["']([^"']+)["']/i.exec(source)?.[1];
+  if (!title || !viewBox) return null;
+  const parts = viewBox.trim().split(/[\s,]+/).map(Number);
+  if (parts.length !== 4 || parts.some((n) => !Number.isFinite(n)) || parts[2] < 1 || parts[2] > 8192 || parts[3] < 1 || parts[3] > 8192) return null;
+  const kind = /<svg\b[^>]*\bdata-diagram-kind\s*=\s*["']([a-z][a-z0-9_-]{0,63})["']/i.exec(source)?.[1] ?? /<svg\b[^>]*\bdata-om-diagram\s*=\s*["']([a-z][a-z0-9_-]{0,63})["']/i.exec(source)?.[1] ?? /<meta\b[^>]*\bname\s*=\s*["']diagram-kind["'][^>]*\bcontent\s*=\s*["']([a-z][a-z0-9_-]{0,63})["']/i.exec(source)?.[1] ?? "diagram";
+  const renderWidth = Number(/<html\b[^>]*\bdata-om-render-width\s*=\s*["']([0-9]{1,4})["']/i.exec(source)?.[1] ?? parts[2]);
+  const renderHeight = Number(/<html\b[^>]*\bdata-om-render-height\s*=\s*["']([0-9]{1,4})["']/i.exec(source)?.[1] ?? parts[3]);
+  if (!(renderWidth >= 1 && renderWidth <= 8192 && renderHeight >= 1 && renderHeight <= 8192)) return null;
+  return { title, diagramKind: kind, renderWidth: Math.round(renderWidth), renderHeight: Math.round(renderHeight) };
+}
+
+// src/fileEmbed.ts
 var MAX_PER_FILE_SIZE = 100 * 1024 * 1024;
 var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([
   ".pem",
@@ -7833,6 +7870,47 @@ function processCodeFile(filePath, filename, redactor) {
       }
     }
     const language = detectLanguage(filename);
+    if (language === "html") {
+      const diagram = inspectDiagramHtml(content);
+      if (diagram) {
+        const embedId2 = generateEmbedId();
+        const embedRef2 = createEmbedRef("diagram_html", `${filename}:${embedId2}`);
+        return {
+          embed: {
+            embedId: embedId2,
+            embedRef: embedRef2,
+            type: "diagram_html",
+            content: toonEncodeContent({
+              type: "diagram_html",
+              app_id: "diagrams",
+              skill_id: "html",
+              html_source: content,
+              title: diagram.title,
+              diagram_kind: diagram.diagramKind,
+              render_width: diagram.renderWidth,
+              render_height: diagram.renderHeight,
+              schema_version: 1,
+              version_number: 1,
+              embed_ref: embedRef2,
+              status: "finished"
+            }),
+            textPreview: `${diagram.title} (${diagram.diagramKind})`,
+            status: "finished",
+            filePath: filename,
+            contentHash: createHash10("sha256").update(content).digest("hex"),
+            textLengthChars: content.length,
+            appId: "diagrams",
+            skillId: "html",
+            versionNumber: 1
+          },
+          referenceBlock: createEmbedReferenceBlock(embedRef2),
+          displayName: filename,
+          secretsRedacted,
+          zeroKnowledge,
+          requiresUpload: false
+        };
+      }
+    }
     const lineCount = content.split("\n").length;
     const embedId = generateEmbedId();
     const embedRef = createEmbedRef("code", `${filename}:${embedId}`);
@@ -11157,6 +11235,7 @@ function extractVersionedEmbedContent(content) {
     ].join("\n").trim();
   }
   if (typeof content.remotion_source === "string") return content.remotion_source;
+  if (typeof content.html_source === "string") return content.html_source;
   if (typeof content.code === "string") return content.code;
   if (typeof content.html === "string") return content.html;
   if (typeof content.table === "string") return content.table;
@@ -11172,6 +11251,7 @@ function buildRestoredEmbedContentObject(current2, restoredContent, newVersion)
   if (typeof current2.remotion_source === "string") {
     return { ...restored, remotion_source: restoredContent, current_source_version: newVersion };
   }
+  if (typeof current2.html_source === "string") return { ...restored, html_source: restoredContent };
   if (typeof current2.code === "string") return { ...restored, code: restoredContent };
   if (typeof current2.html === "string") return { ...restored, html: restoredContent };
   if (typeof current2.table === "string") return { ...restored, table: restoredContent };
@@ -11274,9 +11354,14 @@ async function persistCompressionCheckpoints(ws, chatKeyBytes, checkpoints) {
     }
   }
 }
+function authCookieFingerprint(cookies) {
+  return createHash13("sha256").update(JSON.stringify(Object.entries(cookies).sort(([a], [b]) => a.localeCompare(b)))).digest("hex");
+}
 var OpenMatesClient = class _OpenMatesClient {
   workflowDeliveriesBySocket = /* @__PURE__ */ new WeakMap();
   ownTeamDisplayNames = /* @__PURE__ */ new Map();
+  pendingWhoAmIAuthHandoff = null;
+  personalMemoryAuthHandoff = null;
   apiUrl;
   session;
   http;
@@ -12738,6 +12823,7 @@ var OpenMatesClient = class _OpenMatesClient {
   }
   async whoAmI() {
     return this.withFreshStoredSession(async () => {
+      this.pendingWhoAmIAuthHandoff = null;
       const session = this.requireSession();
       const previousRefreshToken = session.cookies.auth_refresh_token;
       const response = await this.http.post(
@@ -12760,6 +12846,22 @@ var OpenMatesClient = class _OpenMatesClient {
       }
       session.cookies = this.http.getCookieMap();
       saveSession(session, { expectedRefreshToken: previousRefreshToken });
+      const ownerId2 = typeof response.data.user?.id === "string" ? response.data.user.id : "";
+      const wsToken = typeof response.data.ws_token === "string" ? response.data.ws_token : "";
+      if (ownerId2 && wsToken && session.wsToken === wsToken && authCookieFingerprint(session.cookies) === authCookieFingerprint(this.http.getCookieMap())) {
+        this.pendingWhoAmIAuthHandoff = {
+          ownerId: ownerId2,
+          wsToken,
+          validatedAt: performance.now(),
+          apiUrl: session.apiUrl,
+          hashedEmail: session.hashedEmail,
+          sessionId: session.sessionId,
+          createdAt: session.createdAt,
+          masterKeyExportedB64: session.masterKeyExportedB64,
+          activeTeamId: session.activeTeamId,
+          cookieFingerprint: authCookieFingerprint(session.cookies)
+        };
+      }
       return response.data.user ?? {};
     });
   }
@@ -15210,7 +15312,8 @@ var OpenMatesClient = class _OpenMatesClient {
                   code: "code",
                   pcb_schematic: "code",
                   sheet: "table",
-                  mermaid: "diagram_code"
+                  mermaid: "diagram_code",
+                  diagram_html: "html_source"
                 };
                 const field3 = historicalFieldByType[content.type];
                 if (!field3 || typeof sealedEmbed[field3] !== "string") {
@@ -15462,6 +15565,7 @@ var OpenMatesClient = class _OpenMatesClient {
     }
   }
   async sendMessage(params) {
+    const preWsStartedAt = performance.now();
     const teamId = this.resolveTeamContext({ teamId: params.teamId, personal: params.personal });
     const teamSenderName = teamId ? await this.ownTeamSenderName(teamId) : "User";
     if (params.chatId && params.newChatId) {
@@ -15500,6 +15604,7 @@ var OpenMatesClient = class _OpenMatesClient {
       finalMessage = rewriteRememberMessageReferences(finalMessage, messages);
     }
     const shouldWaitForAi = shouldWaitForTeamAi(finalMessage, teamId);
+    const memoryStartedAt = performance.now();
     let availableMemories = params.memorySnapshot ?? [];
     let memoryCountsLoaded = false;
     let memoryMetadataKeys = [];
@@ -15519,6 +15624,12 @@ var OpenMatesClient = class _OpenMatesClient {
         }
       }
     }
+    const snapshotAuthHandoff = this.personalMemoryAuthHandoff?.snapshot.deref() === availableMemories ? this.personalMemoryAuthHandoff.auth : null;
+    this.personalMemoryAuthHandoff = null;
+    this.pendingWhoAmIAuthHandoff = null;
+    const personalSendAuthHandoff = !teamId && !params.incognito ? snapshotAuthHandoff : null;
+    const memoryPrepMs = Math.round(performance.now() - memoryStartedAt);
+    const privacyStartedAt = performance.now();
     const savedPrivacyHistory = !params.incognito && params.chatId ? await this.getChatMessages(chatId, teamId ? { teamId } : { personal: true }) : null;
     let piiMappings = [...savedPrivacyHistory?.messages.flatMap((message) => (message.piiMappings ?? []).map((mapping) => ({ ...mapping, type: mapping.type ?? "OTHER" }))) ?? [], ...params.piiMappings ?? []];
     if (params.piiDetection !== false) {
@@ -15542,10 +15653,13 @@ var OpenMatesClient = class _OpenMatesClient {
       }
     }
     params.onPrivacyPrepared?.(finalMessage);
+    const privacyPrepMs = Math.round(performance.now() - privacyStartedAt);
     const explicitTasksAppSkill = messageExplicitlyRequestsTasksAppSkill(finalMessage);
     const taskUpdateJobsEnabled = params.taskUpdateJobs !== false && !explicitTasksAppSkill;
+    const preWsMs = Math.round(performance.now() - preWsStartedAt);
     const authSocketStartedAt = Date.now();
     const { ws, ownerId: ownerId2 } = await this.openWsClient({
+      personalSendAuthHandoff,
       taskUpdateJobs: taskUpdateJobsEnabled,
       projectFileJobs: !params.incognito,
       remoteCommandJobs: !params.incognito,
@@ -15808,7 +15922,7 @@ var OpenMatesClient = class _OpenMatesClient {
         if (!prepared.ok) throw prepared.error;
         if (!contextOwnerIsCurrent()) throw new Error("Chat workspace changed while preparing context.");
         if (process.env.OPENMATES_DEBUG === "1") {
-          console.error(`[chat preparation] auth_ws_ms=${authSocketMs} recovery_ms=${recoveryMs} context_ms=${prepared.elapsedMs}`);
+          console.error(`[chat preparation] pre_ws_ms=${preWsMs} memory_ms=${memoryPrepMs} privacy_ms=${privacyPrepMs} auth_ws_ms=${authSocketMs} recovery_ms=${recoveryMs} context_ms=${prepared.elapsedMs}`);
         }
         Object.assign(messagePayload, prepared.value);
       }
@@ -16565,7 +16679,8 @@ var OpenMatesClient = class _OpenMatesClient {
                 chatId,
                 chatKeyBytes,
                 fallbackMessageId: assistantId,
-                ownerId: ownerId2
+                ownerId: ownerId2,
+                teamId
               });
               clearSyncCache(teamId);
               await persistCompressionCheckpoints(ws, chatKeyBytes, resp.compressionCheckpoints);
@@ -16716,7 +16831,8 @@ var OpenMatesClient = class _OpenMatesClient {
               chatId,
               chatKeyBytes,
               fallbackMessageId: assistantId,
-              ownerId: ownerId2
+              ownerId: ownerId2,
+              teamId
             });
             if (isNewChat && (resp.generatedTitle || resp.generatedIcon)) {
               const metadataStored = ws.waitForMessage(
@@ -17163,6 +17279,12 @@ var OpenMatesClient = class _OpenMatesClient {
         version_number: embed.version_number,
         file_path: embed.file_path,
         content_hash: embed.content_hash,
+        ...embed.type === "diagram_html" ? {
+          app_id: "diagrams",
+          skill_id: "html",
+          chat_id: params.chatId,
+          ...params.teamId ? { team_id: params.teamId } : {}
+        } : {},
         text_length_chars: embed.text_length_chars,
         is_private: embed.is_private ?? false,
         is_shared: embed.is_shared ?? false,
@@ -20430,10 +20552,15 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     if (!teamId) {
       let accountDocuments = [];
+      this.pendingWhoAmIAuthHandoff = null;
+      let accountDocumentsLoaded = false;
       try {
         accountDocuments = await this.getCustomRuleDocuments();
+        accountDocumentsLoaded = true;
       } catch {
       }
+      const handoff = this.pendingWhoAmIAuthHandoff;
+      this.pendingWhoAmIAuthHandoff = null;
       for (const memory of accountDocuments) {
         const title = /^title:\s*(.+)$/m.exec(memory.document)?.[1]?.replace(/^['"]|['"]$/g, "") ?? "Memory";
         results.push({
@@ -20447,6 +20574,7 @@ var OpenMatesClient = class _OpenMatesClient {
           item_version: 1
         });
       }
+      if (accountDocumentsLoaded && handoff) this.personalMemoryAuthHandoff = { snapshot: new WeakRef(results), auth: handoff };
     }
     return results;
   }
@@ -20965,6 +21093,66 @@ Required: ${schema.required.join(", ")}`
     const now = Math.floor(Date.now() / 1e3);
     const { ws } = await this.openWsClient();
     try {
+      if (currentObject.type === "diagram_html") {
+        const chat = cache.chats.find((entry) => computeSHA256(String(entry.details.id ?? "")) === embed.hashed_chat_id);
+        const chatId = String(chat?.details.id ?? "");
+        if (!chatId || typeof embed.content_hash !== "string" || embed.content_hash !== computeSHA256(currentContent)) {
+          throw new Error("Diagram restore requires a current chat and matching source hash.");
+        }
+        const teamId = this.resolveTeamContext();
+        const versions = await this.listEmbedVersions(embedId, { chatId, teamId: teamId ?? void 0 });
+        if (versions.readonly) throw new Error("Diagram version history is read-only.");
+        const historyRows = [];
+        if (currentVersion === 1 && !versions.versions.some((row3) => row3.version_number === 1)) {
+          historyRows.push({
+            version_number: 1,
+            encrypted_snapshot: await encryptWithAesGcmCombined(currentContent, embedKey),
+            created_at: normalizeUnixSeconds(embed.created_at, now)
+          });
+        }
+        historyRows.push({
+          version_number: newVersion,
+          encrypted_patch: encryptedPatch,
+          encrypted_snapshot: encryptedSnapshot,
+          created_at: now
+        });
+        const requestId = randomUUID9();
+        const operationId = randomUUID9();
+        const receipt = ws.waitForMessage(
+          "commit_chat_diagram_revision_result",
+          (payload) => payload.request_id === requestId,
+          3e4
+        );
+        await ws.sendAsync("commit_chat_diagram_revision", {
+          request_id: requestId,
+          operation_id: operationId,
+          embed_id: embedId,
+          chat_id: chatId,
+          ...teamId ? { team_id: teamId } : {},
+          expected_revision: currentVersion,
+          expected_content_hash: embed.content_hash,
+          head: {
+            encrypted_content: encryptedRestoredContent,
+            encrypted_text_preview: embed.encrypted_text_preview ?? null,
+            content_hash: contentHash,
+            status: "finished",
+            updated_at: now
+          },
+          history_rows: historyRows
+        });
+        const result = (await receipt).payload;
+        if (result.status !== "committed" || result.current_revision !== newVersion || result.current_content_hash !== contentHash) {
+          throw new Error(result.status === "conflict" ? "Diagram advanced on another device; reload and retry restore." : `Diagram restore was rejected: ${String(result.code ?? "unknown")}`);
+        }
+        clearSyncCache(teamId);
+        return {
+          embed_id: embedId,
+          restored_from_version: version,
+          version_number: newVersion,
+          content: target.content,
+          content_hash: contentHash
+        };
+      }
       const storeRequestId = randomUUID9();
       const storeConfirmed = ws.waitForMessage(
         "store_embed_confirmed",
@@ -21279,16 +21467,26 @@ Required: ${schema.required.join(", ")}`
   }
   /**
    * Refresh ws_token, then create and open a WebSocket client.
-   * Combines refreshWsToken() + makeWsClient() + ws.open() into one call
-   * so every WebSocket usage gets a fresh HMAC token automatically.
+   * Opens an authenticated socket. Only a Personal send may supply a
+   * one-use, same-send validated auth receipt; every other use refreshes.
    */
   async openWsClient(options = {}) {
-    const ownerId2 = await this.refreshWsToken();
+    const reusedOwner = options.personalSendAuthHandoff ? await this.reusePersonalSendAuthHandoff(options.personalSendAuthHandoff) : null;
+    const ownerId2 = reusedOwner ?? await this.refreshWsToken();
     const session = this.requireSession();
     const ws = this.makeWsClient(session, options);
     await ws.open();
     return { ws, session, ownerId: ownerId2 };
   }
+  personalSendAuthHandoffCurrent(handoff) {
+    const age = performance.now() - handoff.validatedAt;
+    const session = this.requireSession();
+    return age >= 0 && age <= 5e3 && handoff.ownerId.length > 0 && handoff.wsToken.length > 0 && session.apiUrl === handoff.apiUrl && session.apiUrl.replace(/\/$/, "") === this.apiUrl && session.hashedEmail === handoff.hashedEmail && session.sessionId === handoff.sessionId && session.createdAt === handoff.createdAt && session.masterKeyExportedB64 === handoff.masterKeyExportedB64 && session.activeTeamId === handoff.activeTeamId && session.wsToken === handoff.wsToken && authCookieFingerprint(session.cookies) === handoff.cookieFingerprint && authCookieFingerprint(this.http.getCookieMap()) === handoff.cookieFingerprint;
+  }
+  async reusePersonalSendAuthHandoff(handoff) {
+    if (!this.personalSendAuthHandoffCurrent(handoff)) return null;
+    return this.withFreshStoredSession(async () => this.personalSendAuthHandoffCurrent(handoff) ? handoff.ownerId : null);
+  }
   interactiveViewerChatId = null;
   interactiveViewerSocket = null;
   interactiveViewerAllowed = false;
@@ -34318,6 +34516,8 @@ var DIRECT_TYPES = /* @__PURE__ */ new Set([
   "recording",
   "mail-email",
   "math-plot",
+  "diagram_html",
+  "diagrams-html",
   "mindmap",
   "mindmaps-mindmap",
   "events-event",
@@ -34349,6 +34549,8 @@ var DIRECT_TYPE_LABELS = {
   "recording": "recording",
   "mail-email": "email",
   "math-plot": "plot",
+  "diagram_html": "diagram",
+  "diagrams-html": "diagram",
   "mindmap": "Mind Map",
   "mindmaps-mindmap": "Mind Map",
   "events-event": "event",
@@ -35420,6 +35622,15 @@ function renderByDirectType(embed, c, ln) {
       ln("\x1B[2m[mathematical plot]\x1B[0m");
       break;
     }
+    case "diagram_html":
+    case "diagrams-html": {
+      ln(str(c.title) ?? "Diagram");
+      const kind = str(c.diagram_kind) ?? "diagram";
+      const width = typeof c.render_width === "number" ? c.render_width : 0;
+      const height = typeof c.render_height === "number" ? c.render_height : 0;
+      ln(`\x1B[2m${kind}${width && height ? ` \xB7 ${width} \xD7 ${height}` : ""}\x1B[0m`);
+      break;
+    }
     case "mindmap":
     case "mindmaps-mindmap": {
       const document = mindMapDocumentFromContent(c);
@@ -35611,6 +35822,18 @@ function renderDirectTypeFullscreen(embed, c, write) {
       }
       break;
     }
+    case "diagram_html":
+    case "diagrams-html": {
+      writeEmbedLine(write, `Title: ${str(c.title) ?? "Diagram"}`);
+      writeEmbedLine(write, `Kind: ${str(c.diagram_kind) ?? "diagram"}`);
+      if (typeof c.render_width === "number" && typeof c.render_height === "number") {
+        writeEmbedLine(write, `Size: ${c.render_width} \xD7 ${c.render_height}`);
+      }
+      writeEmbedLine(write, `Version: ${typeof c.version_number === "number" ? c.version_number : 1}`);
+      writeEmbedLine(write, `Source: ${typeof c.html_source === "string" ? c.html_source.length : 0} characters`);
+      writeEmbedLine(write, "Export with: openmates chats download <chat> --output <directory>");
+      break;
+    }
     case "mindmap":
     case "mindmaps-mindmap": {
       const document = mindMapDocumentFromContent(c);
@@ -67694,6 +67917,62 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
       }
     }
   },
+  diagrams: {
+    html: {
+      text: "Editable Diagram"
+    },
+    edit: {
+      text: "Edit diagram"
+    },
+    loading: {
+      text: "Preparing diagram\u2026"
+    },
+    invalid_source: {
+      text: "This diagram contains unsupported content."
+    },
+    conflict: {
+      text: "The diagram changed on another device. Reload before editing."
+    },
+    saved: {
+      text: "Diagram saved"
+    },
+    saved_refresh: {
+      text: "Diagram saved. Refresh this page to sync this device before editing again."
+    },
+    history_unavailable: {
+      text: "This diagram version could not be loaded. Choose another version to retry."
+    },
+    history_version: {
+      text: "Viewing version"
+    },
+    save_failed: {
+      text: "Could not save diagram"
+    },
+    zoom_out: {
+      text: "Zoom out"
+    },
+    zoom_in: {
+      text: "Zoom in"
+    },
+    fit: {
+      text: "Fit diagram"
+    },
+    export: {
+      text: "Export HTML"
+    },
+    undo: {
+      text: "Undo"
+    },
+    cancel: {
+      text: "Cancel"
+    },
+    save: {
+      text: "Save changes"
+    },
+    saving: {
+      text: "Saving\u2026"
+    }
+  },
   digital_team_mates: {
     digital_team_mates: {
       text: "Digital Team Mates"
@@ -70425,6 +70704,9 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
     diagrams: {
       mermaid: {
         text: "Mermaid Diagram"
+      },
+      html: {
+        text: "Editable Diagram"
       }
     },
     mail: {
@@ -116840,6 +117122,7 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
     }
     const codeEmbeds = [];
     const transcriptEmbeds = [];
+    const diagramEmbeds = [];
     const processedEmbedIds = /* @__PURE__ */ new Set();
     const allEmbedIds = [];
     for (const msg of messages) {
@@ -116856,6 +117139,9 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
       const eid = embedQueue.shift();
       try {
         const embed = await client2.getEmbed(eid);
+        if ((embed.type === "diagram_html" || embed.type === "diagrams-html") && typeof embed.content?.html_source === "string" && embed.content.html_source) {
+          diagramEmbeds.push({ embedId: embed.embedId, content: embed.content.html_source });
+        }
         if (embed.type === "code" && embed.content) {
           const code = typeof embed.content.code === "string" ? embed.content.code : typeof embed.content.content === "string" ? embed.content.content : null;
           if (code) {
@@ -116933,6 +117219,13 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
           await writeFile3(join31(tDir, te.filename), te.content);
         }
       }
+      if (diagramEmbeds.length > 0) {
+        const dDir = join31(tmpDir, "diagrams");
+        await mkdir4(dDir, { recursive: true });
+        for (const diagram of diagramEmbeds) {
+          await writeFile3(join31(dDir, `${diagram.embedId}.html`), diagram.content);
+        }
+      }
       const zipPath = join31(outputDir, `${filenameBase}.zip`);
       const { execSync: execSync2 } = await import("child_process");
       try {
@@ -116974,6 +117267,15 @@ ${deleted}/${resolved.length} chat(s) deleted.`);
           written.push(`transcripts/${te.filename}`);
         }
       }
+      if (diagramEmbeds.length > 0) {
+        const dDir = join31(chatDir, "diagrams");
+        await mkdir4(dDir, { recursive: true });
+        for (const diagram of diagramEmbeds) {
+          const filename = `${diagram.embedId}.html`;
+          await writeFile3(join31(dDir, filename), diagram.content);
+          written.push(`diagrams/${filename}`);
+        }
+      }
       const label4 = chat.title ? `"${chat.title}"` : chatHandle(chat);
       process.stdout.write(
         `\x1B[1mDownloaded chat ${label4}\x1B[0m \u2192 ${chatDir}
@@ -121758,6 +122060,7 @@ ${String(response.assistant ?? "")}
   }
 }
 async function sendMessageStreaming(client2, params, redactor) {
+  const preparationStartedAt = performance.now();
   let memorySnapshot = [];
   const needsMemorySnapshot = client2.hasSession() && (params.incognito !== true || params.piiDetection !== false || params.message.includes("@"));
   if (needsMemorySnapshot) {
@@ -121774,9 +122077,12 @@ async function sendMessageStreaming(client2, params, redactor) {
       memorySnapshot = [];
     }
   }
+  const memorySnapshotMs = Math.round(performance.now() - preparationStartedAt);
+  const redactorSeedStartedAt = performance.now();
   if (params.piiDetection !== false && redactor) {
     redactor.initializeFromMemories(memorySnapshot);
   }
+  const redactorSeedMs = Math.round(performance.now() - redactorSeedStartedAt);
   let headerPrinted = false;
   let typingShown = false;
   const renderedEmbedIds = /* @__PURE__ */ new Set();
@@ -122186,6 +122492,9 @@ ${renderRemoteCommandReview(review)}
   const urlResult = prepareUrlEmbeds(finalMessage);
   finalMessage = urlResult.message;
   preparedEmbeds.push(...urlResult.embeds);
+  if (process.env.OPENMATES_DEBUG === "1") {
+    console.error(`[cli preparation] pre_sdk_ms=${Math.round(performance.now() - preparationStartedAt)} memory_snapshot_ms=${memorySnapshotMs} redactor_seed_ms=${redactorSeedMs}`);
+  }
   const result = await client2.sendMessage({
     message: finalMessage,
     chatId: params.chatId,

package/dist/{cli-BAQLcaZb.d.ts → cli-CPgxlEQg.d.ts}

@@ -183,6 +183,8 @@ interface SendEmbedDataFrame {
     version_number?: number;
     file_path?: string;
     content_hash?: string;
+    app_id?: string;
+    skill_id?: string;
     text_length_chars?: number;
     is_private?: boolean;
     is_shared?: boolean;
@@ -731,6 +733,9 @@ interface PreparedEmbed {
     filePath?: string;
     contentHash?: string;
     textLengthChars?: number;
+    appId?: string;
+    skillId?: string;
+    versionNumber?: number;
 }
 /** A fully encrypted embed ready for the WebSocket payload */
 interface EncryptedEmbed {
@@ -745,6 +750,12 @@ interface EncryptedEmbed {
     embed_ids?: string[];
     file_path?: string;
     content_hash?: string;
+    app_id?: string;
+    skill_id?: string;
+    root_embed_id?: string;
+    workspace_origin?: "chat";
+    version_number?: number;
+    encryption_mode?: "client";
     text_length_chars?: number;
     created_at: number;
     updated_at: number;
@@ -2421,6 +2432,8 @@ declare function deriveAppUrl(apiUrl: string): string;
 declare class OpenMatesClient {
     private readonly workflowDeliveriesBySocket;
     private readonly ownTeamDisplayNames;
+    private pendingWhoAmIAuthHandoff;
+    private personalMemoryAuthHandoff;
     readonly apiUrl: string;
     private session;
     private readonly http;
@@ -3776,10 +3789,12 @@ declare class OpenMatesClient {
     private makeWsClient;
     /**
      * Refresh ws_token, then create and open a WebSocket client.
-     * Combines refreshWsToken() + makeWsClient() + ws.open() into one call
-     * so every WebSocket usage gets a fresh HMAC token automatically.
+     * Opens an authenticated socket. Only a Personal send may supply a
+     * one-use, same-send validated auth receipt; every other use refreshes.
      */
     private openWsClient;
+    private personalSendAuthHandoffCurrent;
+    private reusePersonalSendAuthHandoff;
     private interactiveViewerChatId;
     private interactiveViewerSocket;
     private interactiveViewerAllowed;

package/dist/cli.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export { ak as ImagesAiDetectionClassification, al as ImagesAiDetectionSummary, aK as assertTrustedAccountCommandAllowed, aL as assertTrustedAccountGuardEnvironment, aC as buildImagesAiDetectionSummary, aM as buildProjectDefaultFocus, aN as buildTravelConnectionsRequest, aD as classifyImagesAiDetection, aO as extractExplicitProjectMentions, aF as formatImagesAiDetectionLabel, aG as getExtForLang, aP as handleWiki, aQ as printWhoAmI, aR as readRootProjectInstructions, aS as renderProjectReadApprovalRequest, aT as renderProjectWriteApprovalRequest, aU as renderRemoteCommandEvent, aV as requireExactConfirmation, aW as resolveProjectContext, aJ as serializeToYaml, aX as shouldRequireTrustedAccountGuard, aY as waitForSafeE2ETotpWindow, aZ as waitForWorkflowRun } from './cli-BAQLcaZb.js';
+export { ak as ImagesAiDetectionClassification, al as ImagesAiDetectionSummary, aK as assertTrustedAccountCommandAllowed, aL as assertTrustedAccountGuardEnvironment, aC as buildImagesAiDetectionSummary, aM as buildProjectDefaultFocus, aN as buildTravelConnectionsRequest, aD as classifyImagesAiDetection, aO as extractExplicitProjectMentions, aF as formatImagesAiDetectionLabel, aG as getExtForLang, aP as handleWiki, aQ as printWhoAmI, aR as readRootProjectInstructions, aS as renderProjectReadApprovalRequest, aT as renderProjectWriteApprovalRequest, aU as renderRemoteCommandEvent, aV as requireExactConfirmation, aW as resolveProjectContext, aJ as serializeToYaml, aX as shouldRequireTrustedAccountGuard, aY as waitForSafeE2ETotpWindow, aZ as waitForWorkflowRun } from './cli-CPgxlEQg.js';

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   shouldRequireTrustedAccountGuard,
   waitForSafeE2ETotpWindow,
   waitForWorkflowRun
-} from "./chunk-HA4UBUFE.js";
+} from "./chunk-CFP7IA76.js";
 import "./chunk-5SFXCJJ4.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-F2U6KIMR.js";

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { O as OpenMatesSession, U as UserPlanStatus, a as UserPlanRecord, b as UserPlanVerificationStatus, c as UserPlanLearningType, d as UserPlanLearningTargetKind, e as UserPlanLearningStatus, f as UserPlanLearningLevel, g as UserPlanLearningRecord, h as UserPlanCriterionRecord, i as UserPlanVerificationRecord, j as UserPlanCreateInput, k as UserPlanUpdateInput, B as BuyerAddress, P as ProjectItemRecord, T as TaskCreateOptions, l as TaskUpdateOptions, m as UserPlanLearningCreateTasksInput, n as UserPlanLearningCreateTasksResult, o as UserTaskStatus, E as ExternalChatContext, p as TaskPriorityLevel, D as DecryptedUserTask, q as DecryptedTaskActivityEntry, r as TaskActivityCreateOptions, s as UserTaskReorderInput, W as WorkflowSummary, t as WorkflowCapability, u as WorkflowDetail, v as WorkflowAuthoringWarning, w as WorkflowInputStartParams, x as WorkflowInputSessionResult, y as WorkflowInputSessionDetail, z as WorkflowInputEvent, A as WorkflowGraph, C as WorkflowRunContentRetention, F as WorkflowRunOnceOptions, G as WorkflowRunDetail, H as WorkflowRunOptions, I as WorkflowNode, J as WorkflowRunCancellationResult, K as WorkflowTemplateProjectionUpsertParams, L as WorkflowTemplateProjectionResult, M as PublicWorkflowTemplateProjection, N as WorkflowTemplateProjectionRevocationResult, Q as WorkflowTemplateBindingCompletionParams, R as WorkflowTemplateBindingCompletionResult, S as WorkflowTemplateShortUrlParams, V as WorkflowTemplateShortUrlResult, X as ShortUrlRevokeResult, Y as WorkflowTemplateImportPayload, Z as ImportedWorkflowTemplate, _ as WikipediaLearningBundle } from './cli-BAQLcaZb.js';
-export { $ as AuthMethodsStatus, a0 as AuthoritativeChatReconciliation, a1 as BackupCodesResult, a2 as BankTransferOrderDetails, a3 as BankTransferStatus, a4 as CachedChat, a5 as CachedNewChatSuggestion, a6 as ChatListPage, a7 as CliSignupResult, a8 as DecryptedDraft, a9 as DecryptedEmbed, aa as DecryptedMemoryEntry, ab as DecryptedMessage, ac as DecryptedNewChatSuggestion, ad as DocsFile, ae as DocsFolder, af as DocsSearchResult, ag as DocsTree, ah as EncryptedDraft, ai as GiftCardBankTransferStatus, aj as INTEREST_TAG_IDS, ak as ImagesAiDetectionClassification, al as ImagesAiDetectionSummary, am as InterestTagId, an as MATE_NAMES, ao as MEMORY_TYPE_REGISTRY, ap as MemoryFieldDef, aq as MemoryTypeDef, ar as OpenMatesClient, as as OpenMatesClientOptions, at as SyncCache, au as TopicPreferencesPayload, av as TotpSetupStartResult, aw as WorkflowEdge, ax as WorkflowNodeRun, ay as WorkflowNodeType, az as WorkflowReturnedOutputReference, aA as WorkflowRunContentStorage, aB as WorkflowRunRouting, aC as buildImagesAiDetectionSummary, aD as classifyImagesAiDetection, aE as deriveAppUrl, aF as formatImagesAiDetectionLabel, aG as getExtForLang, aH as normalizeInterestTagIds, aI as reconcileAuthoritativeChats, aJ as serializeToYaml } from './cli-BAQLcaZb.js';
+import { O as OpenMatesSession, U as UserPlanStatus, a as UserPlanRecord, b as UserPlanVerificationStatus, c as UserPlanLearningType, d as UserPlanLearningTargetKind, e as UserPlanLearningStatus, f as UserPlanLearningLevel, g as UserPlanLearningRecord, h as UserPlanCriterionRecord, i as UserPlanVerificationRecord, j as UserPlanCreateInput, k as UserPlanUpdateInput, B as BuyerAddress, P as ProjectItemRecord, T as TaskCreateOptions, l as TaskUpdateOptions, m as UserPlanLearningCreateTasksInput, n as UserPlanLearningCreateTasksResult, o as UserTaskStatus, E as ExternalChatContext, p as TaskPriorityLevel, D as DecryptedUserTask, q as DecryptedTaskActivityEntry, r as TaskActivityCreateOptions, s as UserTaskReorderInput, W as WorkflowSummary, t as WorkflowCapability, u as WorkflowDetail, v as WorkflowAuthoringWarning, w as WorkflowInputStartParams, x as WorkflowInputSessionResult, y as WorkflowInputSessionDetail, z as WorkflowInputEvent, A as WorkflowGraph, C as WorkflowRunContentRetention, F as WorkflowRunOnceOptions, G as WorkflowRunDetail, H as WorkflowRunOptions, I as WorkflowNode, J as WorkflowRunCancellationResult, K as WorkflowTemplateProjectionUpsertParams, L as WorkflowTemplateProjectionResult, M as PublicWorkflowTemplateProjection, N as WorkflowTemplateProjectionRevocationResult, Q as WorkflowTemplateBindingCompletionParams, R as WorkflowTemplateBindingCompletionResult, S as WorkflowTemplateShortUrlParams, V as WorkflowTemplateShortUrlResult, X as ShortUrlRevokeResult, Y as WorkflowTemplateImportPayload, Z as ImportedWorkflowTemplate, _ as WikipediaLearningBundle } from './cli-CPgxlEQg.js';
+export { $ as AuthMethodsStatus, a0 as AuthoritativeChatReconciliation, a1 as BackupCodesResult, a2 as BankTransferOrderDetails, a3 as BankTransferStatus, a4 as CachedChat, a5 as CachedNewChatSuggestion, a6 as ChatListPage, a7 as CliSignupResult, a8 as DecryptedDraft, a9 as DecryptedEmbed, aa as DecryptedMemoryEntry, ab as DecryptedMessage, ac as DecryptedNewChatSuggestion, ad as DocsFile, ae as DocsFolder, af as DocsSearchResult, ag as DocsTree, ah as EncryptedDraft, ai as GiftCardBankTransferStatus, aj as INTEREST_TAG_IDS, ak as ImagesAiDetectionClassification, al as ImagesAiDetectionSummary, am as InterestTagId, an as MATE_NAMES, ao as MEMORY_TYPE_REGISTRY, ap as MemoryFieldDef, aq as MemoryTypeDef, ar as OpenMatesClient, as as OpenMatesClientOptions, at as SyncCache, au as TopicPreferencesPayload, av as TotpSetupStartResult, aw as WorkflowEdge, ax as WorkflowNodeRun, ay as WorkflowNodeType, az as WorkflowReturnedOutputReference, aA as WorkflowRunContentStorage, aB as WorkflowRunRouting, aC as buildImagesAiDetectionSummary, aD as classifyImagesAiDetection, aE as deriveAppUrl, aF as formatImagesAiDetectionLabel, aG as getExtForLang, aH as normalizeInterestTagIds, aI as reconcileAuthoritativeChats, aJ as serializeToYaml } from './cli-CPgxlEQg.js';
 
 type ChatModelSelection = "auto" | (string & {});
 interface ChatModelCatalogEntry {

package/dist/index.js

@@ -44,7 +44,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-HA4UBUFE.js";
+} from "./chunk-CFP7IA76.js";
 import "./chunk-5SFXCJJ4.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-F2U6KIMR.js";

package/fixtures/privacy-runtime/linux-arm64/manifest.json

@@ -17,47 +17,47 @@
     {
       "name": "libggml-base.so",
       "bytes": 1110088,
-      "sha256": "5dff6acb47e0e59d38be8485d1be0aa9e072b569545ad121cf11abafdc4bf028"
+      "sha256": "b856a8904ac1caa9103ca4958a4d9749b967be77cf30f1ad352d14c6605bf2c2"
     },
     {
       "name": "libggml-base.so.0",
       "bytes": 1110088,
-      "sha256": "5dff6acb47e0e59d38be8485d1be0aa9e072b569545ad121cf11abafdc4bf028"
+      "sha256": "b856a8904ac1caa9103ca4958a4d9749b967be77cf30f1ad352d14c6605bf2c2"
     },
     {
       "name": "libggml-base.so.0.15.1",
       "bytes": 1110088,
-      "sha256": "5dff6acb47e0e59d38be8485d1be0aa9e072b569545ad121cf11abafdc4bf028"
+      "sha256": "b856a8904ac1caa9103ca4958a4d9749b967be77cf30f1ad352d14c6605bf2c2"
     },
     {
       "name": "libggml-cpu.so",
       "bytes": 869800,
-      "sha256": "1161f237b78e0c4f744098a87bfbd5a8ed80a535b8ad540525d21d70f66dbffb"
+      "sha256": "02d1f3ecfdc0e0416c481564e679fb0903c73199d5eec6d97aea1011643b7f53"
     },
     {
       "name": "libggml-cpu.so.0",
       "bytes": 869800,
-      "sha256": "1161f237b78e0c4f744098a87bfbd5a8ed80a535b8ad540525d21d70f66dbffb"
+      "sha256": "02d1f3ecfdc0e0416c481564e679fb0903c73199d5eec6d97aea1011643b7f53"
     },
     {
       "name": "libggml-cpu.so.0.15.1",
       "bytes": 869800,
-      "sha256": "1161f237b78e0c4f744098a87bfbd5a8ed80a535b8ad540525d21d70f66dbffb"
+      "sha256": "02d1f3ecfdc0e0416c481564e679fb0903c73199d5eec6d97aea1011643b7f53"
     },
     {
       "name": "libggml.so",
       "bytes": 1899104,
-      "sha256": "d3373e0d9c5f67d3cbff809881412dbeeba9a8614dcccb71ead8a868ad8c2a45"
+      "sha256": "0bad7ec53db97eb39bcb4b351af20b5942255d0d1f6c0de3e9fbbfa0d312d702"
     },
     {
       "name": "libggml.so.0",
       "bytes": 1899104,
-      "sha256": "d3373e0d9c5f67d3cbff809881412dbeeba9a8614dcccb71ead8a868ad8c2a45"
+      "sha256": "0bad7ec53db97eb39bcb4b351af20b5942255d0d1f6c0de3e9fbbfa0d312d702"
     },
     {
       "name": "libggml.so.0.15.1",
       "bytes": 1899104,
-      "sha256": "d3373e0d9c5f67d3cbff809881412dbeeba9a8614dcccb71ead8a868ad8c2a45"
+      "sha256": "0bad7ec53db97eb39bcb4b351af20b5942255d0d1f6c0de3e9fbbfa0d312d702"
     },
     {
       "name": "openmates-pii-worker",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.27.0-alpha.60",
+  "version": "0.27.0-alpha.62",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",