openmausbot 0.1.55

package/dist-server/server/drivers/retry.js

@@ -0,0 +1,96 @@
+export const RETRY_MAX_ATTEMPTS = 3;
+/** Backoff schedule before attempt N (N is 1-based over retries): 1s / 3s / 8s. */
+export const BACKOFF_BASE_MS = [1_000, 3_000, 8_000];
+const TRANSIENT_PATTERNS = [
+    { pattern: /\b(?:429|rate.?limit|too many requests)\b/i, reason: "rate_limited" },
+    { pattern: /\boverloaded\b|\bcapacity\b/i, reason: "overloaded" },
+    { pattern: /\b5\d{2}\b|\binternal server error\b|\bbad gateway\b|\bservice unavailable\b/i, reason: "server_error" },
+    {
+        pattern: /\b(?:econnreset|econnrefused|epipe|etimedout|eai_again|connection reset|connection refused|socket hang up|network error|fetch failed)\b/i,
+        reason: "connection_reset",
+    },
+    { pattern: /\btimeout(ed)?\b|\btimed? out\b/i, reason: "timeout" },
+];
+const TERMINAL_PATTERNS = [
+    {
+        pattern: /\b(?:40[13]|unauthorized|forbidden|invalid api key|missing bearer|authentication required|not logged in|logged out)\b/i,
+        reason: "auth",
+    },
+    { pattern: /\b402\b|\bquota\b|\bbilling\b|\bsubscription\b/i, reason: "quota" },
+    { pattern: /\bmodel not found\b|\bunknown model\b|\bdoes not exist for model\b|\bunsupported model\b/i, reason: "unknown_model" },
+    { pattern: /\b400\b|\b422\b|\binvalid request\b|\bmalformed\b|\bunexpected status\b/i, reason: "invalid_request" },
+    { pattern: /\b404\b|\bno such thread\b|\bthread gone\b/i, reason: "not_found" },
+    // interrupt/cancel vocabulary from the drivers' own stop paths — a turn the
+    // user stopped must never come back as an auto-retry
+    { pattern: /\b(?:interrupted|cancelled by user)\b/i, reason: "interrupted" },
+];
+const messageOf = (err) => {
+    if (!err)
+        return "";
+    if (err instanceof Error)
+        return `${err.message}${err.cause ? ` ${String(err.cause)}` : ""}`;
+    if ("text" in err)
+        return err.text;
+    return [err.stderr ?? "", ""].join(" ").trim();
+};
+/** Classify a thrown error or a CLI exit into retry-worthy vs terminal.
+ *
+ * Exit-report shape: a nonzero exit with no error text is treated as
+ * terminal (`terminal_exit`) — drivers only reach it after the CLI already
+ * reported its own protocol-level failure. A signal kill (negative code) is
+ * never retried either.
+ */
+export function classifyError(err) {
+    const text = messageOf(err);
+    if (err && "exitCode" in err) {
+        const { exitCode: code } = err;
+        if (code !== null && code < 0)
+            return { transient: false, reason: "interrupted" };
+        for (const { pattern, reason } of TRANSIENT_PATTERNS) {
+            if (pattern.test(text))
+                return { transient: true, reason };
+        }
+        for (const { pattern, reason } of TERMINAL_PATTERNS) {
+            if (pattern.test(text))
+                return { transient: false, reason };
+        }
+        return { transient: false, reason: "terminal_exit" };
+    }
+    for (const { pattern, reason } of TERMINAL_PATTERNS) {
+        if (pattern.test(text))
+            return { transient: false, reason };
+    }
+    for (const { pattern, reason } of TRANSIENT_PATTERNS) {
+        if (pattern.test(text))
+            return { transient: true, reason };
+    }
+    return { transient: false, reason: "unknown" };
+}
+/** Capped exponential delay with jitter, in milliseconds. Attempt 0 (the
+ * first retry) waits ~1s, then ~3s, then ~8s; beyond that the cap holds.
+ * Jitter stays within ±25% so tests can bound it and a thundering herd of
+ * bots doesn't re-sync on the same tick. */
+export function computeBackoff(attempt, random = Math.random) {
+    const base = BACKOFF_BASE_MS[Math.min(Math.max(attempt, 0), BACKOFF_BASE_MS.length - 1)];
+    const jitter = base * 0.25;
+    return Math.round(base - jitter + random() * jitter * 2);
+}
+export function interruptibleDelay(ms, signal) {
+    let timer = null;
+    let onCancel = null;
+    const promise = new Promise((resolve) => {
+        timer = setTimeout(() => resolve("elapsed"), Math.max(1, ms));
+        timer.unref?.();
+        if (signal?.aborted)
+            return resolve("cancelled");
+        onCancel = () => {
+            clearTimeout(timer);
+            resolve("cancelled");
+        };
+        signal?.addEventListener("abort", onCancel, { once: true });
+    });
+    return {
+        promise,
+        cancel: () => onCancel?.(),
+    };
+}

package/dist-server/server/enterprise.js

@@ -0,0 +1,93 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+// Neutral hook point for the source-available enterprise layer.
+//
+// The layer lives in ../enterprise (its own LICENSE) and is loaded only if that
+// folder is present: delete it and this file still compiles, the server still
+// starts, and /api/edition reports the open-source edition. Core never imports
+// the layer statically, so the bundle and the packaged app carry no trace of it.
+// The layer's only obligation is `register()`, which turns OMB_LICENSE_KEY into
+// entitlements; core keeps the resulting status and answers `entitled()`.
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { z } from "zod";
+import { SERVER_ROOT } from "./proxy-paths.js";
+/** What the enterprise layer's register() must return; validated because it is external code. */
+const layerSchema = z.object({
+    customer: z.string().min(1),
+    features: z.array(z.string().min(1)),
+    expiresAt: z.string().nullable(),
+});
+const DEFAULT_DIR = join(SERVER_ROOT, "..", "enterprise");
+let current = { edition: "oss", features: [] };
+function oss(notice) {
+    current = notice ? { edition: "oss", features: [], notice } : { edition: "oss", features: [] };
+    return current;
+}
+/** Resolve the edition once at startup. Never throws: a broken layer or key
+ * degrades to the open-source edition with a notice that says what to fix. */
+export async function loadEnterpriseLayer(options = {}) {
+    const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
+    const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
+    // Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts.
+    const entry = [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+    if (!entry) {
+        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dir}` : undefined);
+    }
+    try {
+        const loaded = await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
+        const register = Reflect.get(Object(loaded), "register");
+        if (typeof register !== "function")
+            throw new Error(`${entry} does not export register()`);
+        if (!licenseKey)
+            return oss("enterprise layer present but OMB_LICENSE_KEY is not set");
+        const registered = await register({ licenseKey });
+        const layer = layerSchema.parse(registered);
+        current = {
+            edition: "enterprise",
+            customer: layer.customer,
+            features: [...new Set(layer.features)].sort(),
+            expiresAt: layer.expiresAt,
+        };
+        return current;
+    }
+    catch (error) {
+        return oss(`enterprise layer disabled: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/** A license that expires while the server keeps running stops granting
+ * features at that moment, not at the next restart. */
+function expired(now) {
+    if (current.edition !== "enterprise" || !current.expiresAt)
+        return false;
+    return now >= new Date(current.expiresAt).getTime();
+}
+export function editionStatus(now = Date.now()) {
+    if (!expired(now))
+        return current;
+    return {
+        edition: "oss",
+        features: [],
+        notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+    };
+}
+/** Feature gates in core ask this and nothing else. Unknown ids are simply not
+ * granted, and the open-source edition always carries an empty feature list. */
+export function entitled(feature, now = Date.now()) {
+    return !expired(now) && current.features.includes(feature);
+}
+/** One line for the startup log. */
+export function describeEdition(status) {
+    if (status.edition === "enterprise") {
+        const until = status.expiresAt ? ` until ${status.expiresAt}` : "";
+        return `openmausbot enterprise edition for ${status.customer}${until}: ${status.features.join(", ") || "no features"}`;
+    }
+    return `openmausbot open-source edition${status.notice ? ` (${status.notice})` : ""}`;
+}

package/dist-server/server/env-path.js

@@ -0,0 +1,329 @@
+// PATH augmentation for GUI launches — the fix for "CLI not found" when
+// the app is opened from Finder (issues #8, #12).
+//
+// A macOS app launched from Finder inherits a bare PATH
+// (/usr/bin:/bin:...): no ~/.local/bin (the claude installer default),
+// no /opt/homebrew/bin, and no nvm/volta/asdf shims — those only exist
+// in interactive shells. The terminal sees the CLIs; the packaged app
+// doesn't. So every spawn of an agent CLI goes through augmentedPath():
+// the inherited PATH, plus the well-known install locations that exist
+// on this machine, plus (async, best-effort) whatever PATH the user's
+// real login shell reports.
+import { execFile } from "node:child_process";
+import { closeSync, existsSync, openSync, readFileSync, readSync, statSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, delimiter, dirname, extname, join } from "node:path";
+/** nvm keeps every node version's bin dir separately; newest first so a
+ * CLI installed under the latest node wins. */
+function nvmBinDirs() {
+    try {
+        const base = join(homedir(), ".nvm", "versions", "node");
+        return readdirSync(base)
+            .filter((v) => v.startsWith("v"))
+            .sort((a, b) => b.localeCompare(a, undefined, { numeric: true }))
+            .map((v) => join(base, v, "bin"));
+    }
+    catch {
+        return [];
+    }
+}
+function knownDirs() {
+    const home = homedir();
+    return [
+        join(home, ".local", "bin"), // claude installer default
+        join(home, ".npm-global", "bin"), // npm prefix ~/.npm-global (claude, opencode)
+        join(home, ".kimi-code", "bin"), // kimi-code installer
+        join(home, ".grok", "bin"), // x.ai installer
+        join(home, ".opencode", "bin"), // opencode installer
+        join(home, ".claude", "local"), // claude "local install"
+        "/opt/homebrew/bin", // brew, Apple silicon
+        "/usr/local/bin", // brew Intel / classic installs
+        join(home, ".volta", "bin"),
+        join(home, ".bun", "bin"),
+        join(home, ".asdf", "shims"),
+        join(home, ".deno", "bin"),
+        join(home, "bin"),
+        ...nvmBinDirs(),
+    ];
+}
+/** Windows equivalents of knownDirs. A GUI app inherits the user PATH at
+ * launch, but only at launch: a CLI installed while the app is running is
+ * invisible until it restarts, because Windows never pushes PATH changes
+ * into a live process. Scanning the standard install locations recovers
+ * those without a restart — `~/.grok/bin` (the x.ai installer) and
+ * `%APPDATA%\npm` (global npm shims), plus `%LOCALAPPDATA%\agy\bin`, cover
+ * every engine we ship an install command for. */
+function windowsKnownDirs() {
+    const home = homedir();
+    const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
+    const localAppData = process.env.LOCALAPPDATA ?? join(home, "AppData", "Local");
+    return [
+        join(appData, "npm"), // npm -g shims: claude, codex
+        join(home, ".grok", "bin"), // x.ai installer
+        join(localAppData, "agy", "bin"), // Antigravity installer
+        join(home, ".local", "bin"), // claude native installer
+        join(home, ".claude", "local"),
+        join(home, "bin"), // Factory droid installer (%USERPROFILE%\bin)
+        join(home, ".bun", "bin"),
+        join(home, ".deno", "bin"),
+        join(home, "go", "bin"),
+    ];
+}
+let cached = null;
+let probed = false;
+let loginShellPath = null;
+/** Drop the memoized PATH so the next augmentedPath() rescans. Called when
+ * the app re-probes engines, so "check again" can find something installed
+ * since launch instead of answering from the PATH we booted with. `probed`
+ * must reset too: the login-shell probe merges rc-file PATH entries (e.g.
+ * ~/.kimi-code/bin exported from .zshrc) into the cache asynchronously,
+ * and without resetting it a rescan would rebuild the cache without those
+ * entries and never re-probe — "check again" would permanently lose
+ * anything only the login shell's rc file knows about. */
+export function resetPathCache() {
+    cached = null;
+    probed = false;
+}
+/** Current best PATH, synchronously. Cheap after the first call. */
+export function augmentedPath() {
+    if (cached === null) {
+        cached = mergePaths([
+            ...(process.env.OMB_EXTRA_PATH ? process.env.OMB_EXTRA_PATH.split(delimiter) : []),
+            ...(process.env.PATH ? process.env.PATH.split(delimiter) : []),
+            // Keep the last successful login-shell result while a rescan starts a
+            // fresh asynchronous probe. Otherwise resetPathCache() would make
+            // rc-only CLIs disappear again for the response that triggered it.
+            ...(loginShellPath ? loginShellPath.split(delimiter) : []),
+            // Both platforms scan their standard install locations; only the
+            // login-shell probe below stays unix-only, since Windows has no
+            // equivalent rc file to source.
+            ...(process.platform === "win32" ? windowsKnownDirs() : knownDirs()).filter((d) => existsSync(d)),
+        ]);
+    }
+    // belt-and-braces: fold in the login shell's PATH once, in the
+    // background — catches anything the known-dirs list doesn't (custom
+    // rc exports). Never blocks a spawn; the next one benefits.
+    if (!probed && !process.env.VITEST && process.platform !== "win32") {
+        probed = true;
+        probeLoginShellPath();
+    }
+    return cached;
+}
+function mergePaths(parts) {
+    return [...new Set(parts.filter(Boolean))].join(delimiter);
+}
+function probeLoginShellPath() {
+    const shell = process.env.SHELL || "/bin/zsh";
+    // -l -i: nvm and friends live in .zshrc/.bashrc, which only interactive
+    // shells read. A marker isolates $PATH from any rc-file noise.
+    execFile(shell, ["-l", "-i", "-c", 'printf "__OMB_PATH__%s" "$PATH"'], { timeout: 5000 }, (err, stdout) => {
+        if (err || !stdout)
+            return;
+        const m = /__OMB_PATH__([^\n]*)/.exec(stdout);
+        if (!m || !m[1])
+            return;
+        loginShellPath = m[1];
+        cached = mergePaths([...(cached ?? "").split(delimiter), ...m[1].split(delimiter)]);
+    });
+}
+/** Test hook — the cache is process-wide otherwise. */
+export function resetPathCacheForTests() {
+    cached = null;
+    probed = false;
+    loginShellPath = null;
+}
+/** Every `name` binary on the augmented PATH as absolute paths, in PATH
+ * order (first = what a bare name would run). Used by the Engines panel's
+ * "detected" dropdown and the /api/cli-candidates endpoint. A path-ish
+ * name is echoed back as-is — it already IS a location. */
+export function findCliCandidates(name) {
+    if (!name || /[\n\r]/.test(name))
+        return [];
+    if (/[/\\]/.test(name) || /^[a-zA-Z]:/.test(name))
+        return [name];
+    const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+    const out = [];
+    for (const dir of augmentedPath().split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const p = join(dir, name + ext);
+            if (existsSync(p)) {
+                out.push(p);
+                break;
+            }
+        }
+    }
+    return out;
+}
+/** Split a `cli` string into [command, ...fixedArgs] on unquoted whitespace —
+ * a mini tokenizer, never a shell. Quotes group segments (paths with spaces,
+ * fixed args with spaces); no escapes, no substitution, nothing evaluated. */
+export function splitCliString(cli) {
+    const out = [];
+    let cur = "";
+    let quote = null;
+    for (const ch of cli.trim()) {
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else
+                cur += ch;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+        }
+        else if (/\s/.test(ch)) {
+            if (cur)
+                out.push(cur);
+            cur = "";
+        }
+        else {
+            cur += ch;
+        }
+    }
+    if (cur)
+        out.push(cur);
+    return out;
+}
+function isFile(p) {
+    try {
+        return statSync(p, { throwIfNoEntry: false })?.isFile() ?? false;
+    }
+    catch {
+        return false;
+    }
+}
+/** PATHEXT-aware `which`. A path-ish cli is probed where it points. */
+function whichWin(cli) {
+    const exts = (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+    // an extensionless name is not runnable on Windows, so PATHEXT wins over
+    // the bare file — npm installs both `claude` (a sh script) and `claude.cmd`
+    const probe = (base) => {
+        const order = extname(base) ? [base, ...exts.map((e) => base + e)] : [...exts.map((e) => base + e), base];
+        return order.find(isFile) ?? null;
+    };
+    if (/[\\/]/.test(cli) || /^[a-zA-Z]:/.test(cli))
+        return probe(cli);
+    for (const dir of augmentedPath().split(delimiter)) {
+        if (!dir)
+            continue;
+        const hit = probe(join(dir, cli));
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+/** node.exe to run a script with: the one npm's shim would pick, else PATH,
+ * else this executable only when it really is Node. In a packaged app,
+ * process.execPath is Electron and must never be mistaken for node.exe. */
+function nodeExe(near) {
+    const local = join(near, "node.exe");
+    if (isFile(local))
+        return local;
+    // Ask for the executable explicitly so a custom PATHEXT ordering cannot
+    // make a stray node.cmd hide the real node.exe beside it.
+    const onPath = whichWin("node.exe");
+    if (onPath && extname(onPath).toLowerCase() === ".exe")
+        return onPath;
+    return process.versions.electron ? null : process.execPath;
+}
+/** npm/pnpm .cmd shims all spell their target as "%dp0%\..." (or
+ * "%~dp0\..."). Whatever of those exists on disk is what the shim runs. */
+function parseCmdShim(shim) {
+    let text;
+    try {
+        text = readFileSync(shim, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const dir = dirname(shim);
+    const targets = [...text.matchAll(/"%~?dp0%?\\?([^"]+)"/g)]
+        .map((m) => join(dir, m[1]))
+        .filter((p) => isFile(p) && basename(p).toLowerCase() !== "node.exe");
+    const script = targets.find((p) => /\.[cm]?js$/i.test(p));
+    if (script) {
+        const node = nodeExe(dir);
+        if (node)
+            return { command: node, args: [script] };
+    }
+    const exe = targets.find((p) => extname(p).toLowerCase() === ".exe");
+    return exe ? { command: exe, args: [] } : null;
+}
+/** `#!/usr/bin/env node` → `node <script>`. Only node: nothing else has a
+ * meaningful Windows equivalent worth guessing at. */
+function parseNodeShebang(file) {
+    let head = "";
+    let fd = null;
+    try {
+        fd = openSync(file, "r");
+        const buf = Buffer.alloc(128);
+        const n = readSync(fd, buf, 0, buf.length, 0);
+        head = buf.subarray(0, n).toString("utf8").split("\n", 1)[0];
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* best-effort descriptor cleanup */
+            }
+        }
+    }
+    if (!/^#!.*\bnode(\.exe)?\b/.test(head))
+        return null;
+    const node = nodeExe(dirname(file));
+    return node ? { command: node, args: [file] } : null;
+}
+/**
+ * How to actually spawn `cli` with `args` on this platform. Identity
+ * everywhere but win32 — POSIX already resolves PATH and #! itself.
+ */
+/** Resolve a single command word (no tokenizer) — the platform spawn rules. */
+function resolveWord(cli, args) {
+    if (process.platform !== "win32")
+        return { command: cli, args };
+    const file = whichWin(cli);
+    // not found: hand back the name so spawn reports its own ENOENT
+    if (!file)
+        return { command: cli, args };
+    const ext = extname(file).toLowerCase();
+    if (ext === ".cmd" || ext === ".bat") {
+        const direct = parseCmdShim(file);
+        return direct ? { command: direct.command, args: [...direct.args, ...args] } : { command: file, args };
+    }
+    if (ext === ".exe" || ext === ".com")
+        return { command: file, args };
+    const viaNode = parseNodeShebang(file);
+    return viaNode ? { command: viaNode.command, args: [...viaNode.args, ...args] } : { command: file, args };
+}
+export function resolveCliSpawn(cli, args) {
+    // An EXISTING FILE wins over the tokenizer: paths with spaces come from
+    // our own candidate list unquoted ("/Applications/My Tools/claude"), and
+    // splitting those would shred them. Only a bare word (no spaces) or an
+    // explicitly-quoted/wrapper string reaches the split below.
+    const trimmed = cli.trim();
+    if (trimmed.includes(" ") && existsSync(trimmed))
+        return resolveWord(trimmed, args);
+    // A `cli` value may carry fixed leading arguments — wrapper scripts like
+    // `/usr/local/bin/ag claude agp` are one string in the Engines panel. ONE
+    // tokenizer pass, then resolve the head directly (never re-tokenized: a
+    // quoted token may itself contain spaces, so feeding it back through the
+    // splitter would shred it). Fixed args go BEFORE invocation args — a
+    // wrapper's subcommand must lead (`ag claude agp --help`), or the wrapper
+    // swallows the flag itself.
+    const split = splitCliString(cli);
+    if (split.length > 1 || split[0] !== trimmed) {
+        const [head, ...fixed] = split;
+        // empty input → hand the raw string to spawn so IT reports the ENOENT
+        if (!head)
+            return { command: cli, args };
+        return resolveWord(head, [...fixed, ...args]);
+    }
+    return resolveWord(cli, args);
+}

package/dist-server/server/environment.js

@@ -0,0 +1,105 @@
+// What a client learns about this server before it authenticates: a stable
+// identity, a label, the version, and what it can do. Served without auth at
+// /.well-known/openmausbot/environment so a saved connection can check it is
+// still talking to the same server, and so version skew is visible.
+import { randomUUID } from "node:crypto";
+import { closeSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+import { SERVER_ROOT } from "./proxy-paths.js";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function hasCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+function readEnvironmentId(file) {
+    let contents;
+    try {
+        contents = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (hasCode(error, "ENOENT"))
+            return undefined;
+        throw new Error(`Cannot read the existing environment identity at ${file}; refusing to replace it.`, {
+            cause: error,
+        });
+    }
+    const id = contents.trim();
+    if (!UUID_PATTERN.test(id)) {
+        throw new Error(`The existing environment identity at ${file} is not a valid UUID; refusing to replace it.`);
+    }
+    return id;
+}
+/** Read or create the id. Written once, never rotated by the server itself. */
+export function loadEnvironmentId(dataDir) {
+    const file = join(dataDir, "environment-id");
+    const existing = readEnvironmentId(file);
+    if (existing)
+        return existing;
+    const directory = dirname(file);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const id = randomUUID();
+    const temporaryFile = join(directory, `.environment-id.${process.pid}.${randomUUID()}.tmp`);
+    let descriptor;
+    try {
+        descriptor = openSync(temporaryFile, "wx", 0o600);
+        writeFileSync(descriptor, id + "\n", "utf8");
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        try {
+            // The temporary file is complete before it becomes visible at the final
+            // path. A hard link is an atomic, no-replace publish on every supported
+            // desktop platform, unlike rename (which overwrites on POSIX).
+            linkSync(temporaryFile, file);
+            return id;
+        }
+        catch (error) {
+            if (!hasCode(error, "EEXIST"))
+                throw error;
+            const winner = readEnvironmentId(file);
+            if (winner)
+                return winner;
+            throw new Error(`The environment identity at ${file} disappeared while it was being created.`);
+        }
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        try {
+            unlinkSync(temporaryFile);
+        }
+        catch {
+            // A leftover private temporary file is harmless and must not make a
+            // successfully published identity unusable.
+        }
+    }
+}
+/** The desktop app passes its own version; a checkout reads package.json;
+ * an image sets OMB_APP_VERSION at build time. */
+export function serverVersion() {
+    const fromEnv = process.env.OMB_APP_VERSION?.trim();
+    if (fromEnv)
+        return fromEnv;
+    try {
+        const pkg = JSON.parse(readFileSync(join(SERVER_ROOT, "..", "package.json"), "utf8"));
+        const version = Reflect.get(Object(pkg), "version");
+        if (typeof version === "string" && version)
+            return version;
+    }
+    catch {
+        /* no package.json next to the bundle */
+    }
+    return "unknown";
+}
+export function environmentDescriptor(input) {
+    return {
+        environmentId: input.environmentId,
+        label: process.env.OMB_ENVIRONMENT_LABEL?.trim() || hostname(),
+        platform: process.platform,
+        version: serverVersion(),
+        capabilities: {
+            remoteSessions: true,
+            selfUpdate: input.desktopManaged ? "desktop-managed" : "operator",
+        },
+    };
+}

package/dist-server/server/generated-image.js

@@ -0,0 +1,39 @@
+import { IMAGE_MAX_BYTES } from "./attachments.js";
+const MAX_BASE64_CHARS = Math.ceil(IMAGE_MAX_BYTES / 3) * 4 + 8;
+function sniffRaster(bytes) {
+    if (bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) {
+        return "image/png";
+    }
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+        return "image/jpeg";
+    }
+    const head = bytes.subarray(0, 6).toString("ascii");
+    if (head === "GIF87a" || head === "GIF89a")
+        return "image/gif";
+    if (bytes.length >= 12 &&
+        bytes.subarray(0, 4).toString("ascii") === "RIFF" &&
+        bytes.subarray(8, 12).toString("ascii") === "WEBP") {
+        return "image/webp";
+    }
+    return null;
+}
+/** Decode an untrusted provider image without trusting its claimed MIME.
+ * Codex normally sends raw base64, but accepting a raster data URL makes the
+ * boundary resilient to app-server shape changes without widening formats. */
+export function decodeGeneratedImage(input) {
+    const trimmed = input.trim();
+    const comma = trimmed.startsWith("data:") ? trimmed.indexOf(",") : -1;
+    const encoded = comma >= 0 ? trimmed.slice(comma + 1) : trimmed;
+    if (!encoded || encoded.length > MAX_BASE64_CHARS || !/^[A-Za-z0-9+/\s]*={0,2}$/.test(encoded)) {
+        throw new Error("generated image payload is invalid or too large");
+    }
+    const compact = encoded.replace(/\s/g, "");
+    const bytes = Buffer.from(compact, "base64");
+    if (bytes.length === 0 || bytes.length > IMAGE_MAX_BYTES) {
+        throw new Error(`generated image exceeds ${IMAGE_MAX_BYTES} bytes`);
+    }
+    const mime = sniffRaster(bytes);
+    if (!mime)
+        throw new Error("generated image is not a supported raster format");
+    return { bytes, mime };
+}