openmausbot 0.1.55

package/dist-server/server/project-scout.js

@@ -0,0 +1,304 @@
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+import { parseTeamManifest, TEAM_MANIFEST_FORMAT, TEAM_MANIFEST_VERSION, } from "./team-manifest.js";
+// The scout reads, it never writes — and it reads bounded: a handful of
+// well-known files by name, top-level directory listings, and nothing
+// recursive. A folder full of surprises must cost milliseconds, not minutes.
+const MAX_FILE_BYTES = 256_000;
+const MAX_DIR_ENTRIES = 400;
+function readText(path) {
+    try {
+        if (statSync(path).size > MAX_FILE_BYTES)
+            return null;
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function listNames(dir) {
+    try {
+        return readdirSync(dir).slice(0, MAX_DIR_ENTRIES);
+    }
+    catch {
+        return [];
+    }
+}
+function isDir(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function packageJson(cwd) {
+    const raw = readText(join(cwd, "package.json"));
+    if (!raw)
+        return { deps: new Set() };
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return { deps: new Set() };
+        const pkg = parsed;
+        const deps = new Set();
+        for (const field of ["dependencies", "devDependencies"]) {
+            const block = pkg[field];
+            if (block && typeof block === "object" && !Array.isArray(block)) {
+                for (const dep of Object.keys(block))
+                    deps.add(dep);
+            }
+        }
+        return {
+            name: typeof pkg.name === "string" ? pkg.name : undefined,
+            description: typeof pkg.description === "string" ? pkg.description : undefined,
+            deps,
+        };
+    }
+    catch {
+        return { deps: new Set() };
+    }
+}
+/** README h1 and the first prose paragraph after it. Badge rows and heading
+ * lines are skipped so the summary reads like a sentence, not markup. */
+function readme(cwd) {
+    const raw = readText(join(cwd, "README.md")) ?? readText(join(cwd, "readme.md")) ?? readText(join(cwd, "README"));
+    if (!raw)
+        return {};
+    let title;
+    let summary;
+    for (const line of raw.slice(0, 64_000).split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        if (trimmed.startsWith("#")) {
+            if (!title)
+                title = trimmed.replace(/^#+\s*/, "").trim() || undefined;
+            continue;
+        }
+        // badge rows, raw HTML, and blockquote callouts (warnings, notices) are
+        // not the sentence that says what the project is
+        if (trimmed.startsWith("[![") || trimmed.startsWith("![") || trimmed.startsWith("<") || trimmed.startsWith(">"))
+            continue;
+        // the summary is rendered as plain text; markdown emphasis would show
+        // its asterisks
+        summary = trimmed.replace(/[*_`]/g, "").slice(0, 1_000);
+        break;
+    }
+    return { title, summary };
+}
+// Order is priority: when a suggestion has to be trimmed, the roles that
+// define the project's shape survive over the ones that polish it.
+const DETECTORS = [
+    {
+        role: "frontend",
+        deps: ["react", "vue", "svelte", "next", "nuxt", "astro", "vite", "@angular/core", "solid-js"],
+        paths: ["index.html", "vite.config.ts", "vite.config.js", "next.config.js", "next.config.ts"],
+    },
+    {
+        role: "backend",
+        deps: ["express", "fastify", "koa", "hono", "@nestjs/core", "django", "flask", "fastapi"],
+        paths: ["server", "api", "go.mod"],
+    },
+    {
+        role: "mobile",
+        deps: ["react-native", "expo"],
+        paths: ["ios", "android", "pubspec.yaml"],
+    },
+    {
+        role: "data",
+        deps: ["prisma", "drizzle-orm", "knex", "sequelize", "typeorm", "mongoose", "pg", "mysql2", "better-sqlite3", "sqlalchemy"],
+        paths: ["prisma", "migrations"],
+    },
+    {
+        role: "testing",
+        deps: ["vitest", "jest", "mocha", "@playwright/test", "cypress", "pytest"],
+        paths: ["test", "tests", "__tests__", "e2e"],
+    },
+    {
+        role: "infra",
+        deps: [],
+        paths: ["Dockerfile", "docker-compose.yml", "docker-compose.yaml", "compose.yaml", ".github/workflows", "terraform", "helm"],
+    },
+    {
+        role: "docs",
+        deps: [],
+        paths: ["docs", "mkdocs.yml"],
+    },
+];
+const STACK_MARKERS = [
+    { stack: "TypeScript", deps: ["typescript"], paths: ["tsconfig.json"] },
+    { stack: "React", deps: ["react"] },
+    { stack: "Vue", deps: ["vue"] },
+    { stack: "Svelte", deps: ["svelte"] },
+    { stack: "Next.js", deps: ["next"] },
+    { stack: "Vite", deps: ["vite"] },
+    { stack: "Node", paths: ["package.json"] },
+    { stack: "Python", paths: ["pyproject.toml", "requirements.txt", "setup.py"] },
+    { stack: "Rust", paths: ["Cargo.toml"] },
+    { stack: "Go", paths: ["go.mod"] },
+    { stack: "Ruby", paths: ["Gemfile"] },
+    { stack: "PHP", paths: ["composer.json"] },
+    { stack: "Java", paths: ["pom.xml", "build.gradle", "build.gradle.kts"] },
+    { stack: "Docker", paths: ["Dockerfile", "docker-compose.yml", "compose.yaml"] },
+];
+/** Read a folder and describe the project in it: name, one-line summary,
+ * stack chips, and which team roles the contents argue for. Deterministic
+ * and offline — the same folder always scouts to the same profile. */
+export function scoutProject(cwd) {
+    const pkg = packageJson(cwd);
+    const md = readme(cwd);
+    const entries = new Set(listNames(cwd));
+    // Python deps live in files, not a lockfile-adjacent field; a cheap
+    // substring scan of the two conventional files covers the common cases.
+    const pythonDeps = `${readText(join(cwd, "requirements.txt")) ?? ""}\n${readText(join(cwd, "pyproject.toml")) ?? ""}`.toLowerCase();
+    const hasDep = (dep) => pkg.deps.has(dep) || (pythonDeps.length > 1 && pythonDeps.includes(dep));
+    const pathEvidence = (path) => {
+        if (path.includes("/"))
+            return isDir(join(cwd, path)) && listNames(join(cwd, path)).length > 0 ? `${path}/` : null;
+        if (entries.has(path))
+            return isDir(join(cwd, path)) ? `${path}/` : path;
+        return null;
+    };
+    const signals = [];
+    for (const detector of DETECTORS) {
+        const evidence = [];
+        for (const dep of detector.deps)
+            if (hasDep(dep))
+                evidence.push(dep);
+        for (const path of detector.paths) {
+            const found = pathEvidence(path);
+            if (found)
+                evidence.push(found);
+        }
+        // docs need substance: a folder with no markdown in it is not a docs site
+        if (detector.role === "docs" && evidence.length > 0) {
+            const hasMkdocs = evidence.includes("mkdocs.yml");
+            const hasMarkdown = listNames(join(cwd, "docs")).some((name) => name.endsWith(".md"));
+            if (!hasMkdocs && !hasMarkdown)
+                continue;
+        }
+        if (evidence.length > 0)
+            signals.push({ role: detector.role, evidence: evidence.slice(0, 6) });
+    }
+    const stacks = [];
+    for (const marker of STACK_MARKERS) {
+        const byDep = marker.deps?.some((dep) => hasDep(dep)) ?? false;
+        const byPath = marker.paths?.some((path) => entries.has(path)) ?? false;
+        if (byDep || byPath)
+            stacks.push(marker.stack);
+    }
+    return {
+        name: (md.title ?? pkg.name ?? basename(cwd)).slice(0, 100),
+        summary: (md.summary ?? pkg.description ?? "").slice(0, 1_000),
+        stacks,
+        signals,
+    };
+}
+const stackLine = (profile) => profile.stacks.length > 0 ? ` The stack: ${profile.stacks.join(", ")}.` : "";
+const ROLE_TEMPLATES = {
+    frontend: {
+        name: "Pixel",
+        title: "Frontend Builder",
+        color: "pink",
+        describe: (profile, evidence) => `You build and refine the user interface of ${profile.name}.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. Keep changes small, match the existing component patterns, and check what you built actually renders before calling it done.`,
+    },
+    backend: {
+        name: "Forge",
+        title: "Backend Builder",
+        color: "blue",
+        describe: (profile, evidence) => `You own the server side of ${profile.name}: endpoints, business logic, and the contracts the frontend relies on.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. Change behavior only alongside the tests that prove it.`,
+    },
+    mobile: {
+        name: "Pocket",
+        title: "Mobile Builder",
+        color: "coral",
+        describe: (profile, evidence) => `You keep ${profile.name} working on phones: screens, navigation, and platform quirks.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. Test on both platforms before declaring victory.`,
+    },
+    data: {
+        name: "Schema",
+        title: "Data Engineer",
+        color: "teal",
+        describe: (profile, evidence) => `You own the data layer of ${profile.name}: models, migrations, and query performance.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. Every migration ships with its rollback story.`,
+    },
+    testing: {
+        name: "Probe",
+        title: "Test Engineer",
+        color: "green",
+        describe: (profile, evidence) => `You guard ${profile.name} with tests: you reproduce bugs before they are fixed and extend coverage where changes land.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. A red test you wrote is worth more than a green suite nobody trusts.`,
+    },
+    infra: {
+        name: "Anchor",
+        title: "Infra & CI",
+        color: "orange",
+        describe: (profile, evidence) => `You keep ${profile.name} buildable, shippable, and observable: CI, containers, and deploy paths.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. Prefer boring, reproducible steps over clever ones.`,
+    },
+    docs: {
+        name: "Quill",
+        title: "Docs Writer",
+        color: "purple",
+        describe: (profile, evidence) => `You keep the documentation of ${profile.name} truthful and current.${stackLine(profile)} Your turf shows up as ${evidence.join(", ")}. When code and docs disagree, you chase down which one is lying.`,
+    },
+};
+const LEAD = {
+    name: "Compass",
+    title: "Project Lead",
+    color: "yellow",
+    describe: (profile) => `You coordinate work on ${profile.name}: break briefs into tasks for the team, keep the room's bulletin current, and review results before they count as done.${stackLine(profile)}${profile.summary ? ` The project, in its own words: ${profile.summary}` : ""}`,
+};
+/** at most the lead plus this many specialists — a suggestion is a starting
+ * lineup, not a payroll */
+const MAX_SUGGESTED_SPECIALISTS = 5;
+/** Turn a scouted profile into an importable team: a lead plus one member
+ * per detected role, as a regular v2 manifest. Suggesting is all this does —
+ * creating bots and the room stays behind the existing import endpoint and
+ * its human click. */
+export function suggestTeam(profile) {
+    const reasons = {
+        lead: "Every project room needs one member who briefs, splits, and reviews.",
+    };
+    const members = [
+        {
+            key: "lead",
+            name: LEAD.name,
+            title: LEAD.title,
+            description: LEAD.describe(profile, []),
+            appearance: { color: LEAD.color },
+        },
+    ];
+    for (const signal of profile.signals.slice(0, MAX_SUGGESTED_SPECIALISTS)) {
+        const template = ROLE_TEMPLATES[signal.role];
+        members.push({
+            key: signal.role,
+            name: template.name,
+            title: template.title,
+            description: template.describe(profile, signal.evidence),
+            appearance: { color: template.color },
+        });
+        reasons[signal.role] = `Detected via ${signal.evidence.join(", ")}.`;
+    }
+    // no signals at all → the room still gets a working pair of hands
+    if (members.length === 1) {
+        members.push({
+            key: "builder",
+            name: "Wrench",
+            title: "Builder",
+            description: `You do the hands-on work in ${profile.name}: read the folder, make the change, show the result.${stackLine(profile)}`,
+            appearance: { color: "blue" },
+        });
+        reasons.builder = "No specific stack detected — a generalist covers the ground.";
+    }
+    const manifest = {
+        format: TEAM_MANIFEST_FORMAT,
+        version: TEAM_MANIFEST_VERSION,
+        team: {
+            name: `${profile.name} team`.slice(0, 100),
+            members,
+        },
+    };
+    if (profile.summary)
+        manifest.team.description = profile.summary.slice(0, 2_000);
+    // Lockstep with import: a suggestion must be exactly as valid as a file
+    // someone shared — same parser, same limits, same normalization.
+    return { roomName: profile.name, manifest: parseTeamManifest(manifest), reasons };
+}

package/dist-server/server/proxy-paths.js

@@ -0,0 +1,47 @@
+// Where the server's own files live at runtime, and the one place a spawned
+// proxy's path is worked out.
+//
+// This must NOT be resolved relative to the module that happens to need it.
+// esbuild inlines modules into an entry bundle (scripts/bundle-server.mjs), so
+// a `".."` written inside drivers/claude.ts stops climbing from drivers/ and
+// starts climbing from the BUNDLE's directory — one level too high, silently.
+//
+// That is not hypothetical: it shipped into the 0.1.24 release candidate.
+// Every proxy resolved outside Resources/server, so permission prompting,
+// computer use and dweb all died on the first turn that needed them, while
+// /api/health stayed perfectly green and the packaging checks passed.
+//
+// This file sits at the server root and is only ever inlined into entries that
+// also sit at the server root (index, computer-proxy, container-mcp) — the
+// nested drivers/* entries import nothing local, which is what keeps the
+// anchor correct in both the dev tree and the bundle. proxy-paths.test.ts pins
+// that invariant. Resolve proxies through SPAWNED_PROXIES and nowhere else.
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/** The directory holding the server's runtime files: server/ in dev, the
+ * extraResources copy of dist-server/ (Resources/server) in the packaged app. */
+export const SERVER_ROOT = dirname(fileURLToPath(import.meta.url));
+/** .ts in dev, where node strips types; the compiled sibling once packaged. */
+export function resolveProxy(relative) {
+    const source = join(SERVER_ROOT, `${relative}.ts`);
+    return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
+}
+/** Every file the server spawns as its own process. Single source of truth so
+ * the smoke test can assert each one actually exists in a packaged layout —
+ * the check that would have caught the 0.1.24 breakage. */
+export const SPAWNED_PROXIES = {
+    computer: resolveProxy("computer-proxy"),
+    permission: resolveProxy("permission-proxy"),
+    containerMcp: resolveProxy("container-mcp"),
+    vpsContainerMcp: resolveProxy("vps-container-mcp"),
+    agents: resolveProxy("drivers/agents-proxy"),
+    dweb: resolveProxy("drivers/dweb-proxy"),
+    connectors: resolveProxy("connector-proxy"),
+    phone: resolveProxy("drivers/phone-proxy"),
+    browser: resolveProxy("drivers/browser-proxy"),
+    // Loaded by the external `pi` process via `-e`, not by this server — but
+    // resolved through the same single source of truth so the packaged layout
+    // check can assert it ships.
+    piMcpExtension: resolveProxy("drivers/pi-mcp-extension"),
+};

package/dist-server/server/redact.js

@@ -0,0 +1,102 @@
+// Keeping secrets out of the native protocol log.
+//
+// The native tee writes every provider message verbatim, which is what makes
+// protocol drift diagnosable — but the messages that set a session up carry
+// the credentials the agent is handed: the box token and the comms token
+// travel inside `session/new`'s mcpServers env, and a Composio consumer key
+// travels in an MCP header. Those logs sit in ~/.openmausbot/native as
+// ordinary files, are read by anyone debugging, and get pasted into issues.
+//
+// So the log keeps the SHAPE and loses the VALUES: a redacted entry still
+// tells you a token was passed, under which name, and how long it was —
+// enough to debug "the proxy got no token" without the token being there.
+/** Key names whose value is a credential. Matched case-insensitively as a
+ * substring, so KEY catches ANTHROPIC_API_KEY and x-api-key. */
+const SECRET_KEY_PARTS = ["token", "secret", "password", "passwd", "apikey", "api_key", "authorization", "auth_token"];
+/** `key` alone is too broad — it matches `keyboard`, `keys`, `hotkey`. Only
+ * treat it as a credential when it stands alone or is a suffix, which is how
+ * every real one is spelled (API_KEY, consumer-key, xai_key). */
+function isSecretName(name) {
+    const lower = name.toLowerCase();
+    if (SECRET_KEY_PARTS.some((part) => lower.includes(part)))
+        return true;
+    return /(^|[_.-])keys?$/.test(lower);
+}
+const REDACTION_MARKER = /^«redacted \d+ chars»$/;
+/** Keep repeated redaction byte-for-byte stable. Persisted payloads can pass
+ * through both a content scrub and the store-wide scrub; re-masking our own
+ * marker would change its reported length (and any hash over the payload). */
+const mask = (value) => (REDACTION_MARKER.test(value) ? value : `«redacted ${value.length} chars»`);
+// ── content-shaped secrets ────────────────────────────────────────────
+// What a bot's own reply, a tool title, or a permission card can carry —
+// and, since the rebuild replays activity into every handed-over context,
+// what would otherwise become permanent. High precision on purpose: a
+// generic "long hex/base64" heuristic would rewrite real code in the
+// transcript, so only shapes that are unmistakably credentials match.
+const KEY_PREFIXES = [
+    /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, // anthropic / openai / stripe
+    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, // github classic
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g, // github fine-grained
+    /\bxox[abposr]-[A-Za-z0-9-]{20,}/g, // slack
+    /\bAKIA[0-9A-Z]{16}\b/g, // aws access key id
+    /\bAIza[0-9A-Za-z_-]{30,}/g, // google api key
+    /\bnpm_[A-Za-z0-9]{20,}/g, // npm
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, // jwt
+];
+const BEARER = /(\bBearer\s+)([A-Za-z0-9._~+/=-]{12,})/g;
+const PEM_BLOCK = /(-----BEGIN [A-Z ]*PRIVATE KEY-----)([\s\S]*?)(-----END [A-Z ]*PRIVATE KEY-----)/g;
+/** key=value / key: value / key="value" where the key is secret-shaped.
+ * The value must be a single token of some length; prose after a colon
+ * ("password: leave blank…") has spaces and does not match. */
+const KEY_VALUE = /\b((?:[A-Za-z0-9_-]*_)?(?:api[_-]?key|apikey|secret|token|password|passwd|authorization|auth[_-]?token|access[_-]?key|private[_-]?key)s?)(["']?\s*[=:]\s*)(["']?)([A-Za-z0-9._~+/=-]{8,})\3/gi;
+export function redactSecretsInText(text) {
+    if (!text || text.length < 8)
+        return text;
+    let out = text;
+    out = out.replace(PEM_BLOCK, (_m, open, body, close) => `${open}\n${mask(body.trim())}\n${close}`);
+    for (const re of KEY_PREFIXES)
+        out = out.replace(re, (m) => mask(m));
+    out = out.replace(BEARER, (_m, lead, tok) => `${lead}${mask(tok)}`);
+    out = out.replace(KEY_VALUE, (_m, key, sep, quote, value) => `${key}${sep}${quote}${mask(value)}${quote}`);
+    return out;
+}
+/** Deep copy with credential VALUES replaced. Handles the two shapes that
+ * actually carry them: a plain object of env vars ({KEY: "v"}) and the ACP
+ * wire shape (env: [{name, value}]). Anything unrecognised is copied as-is. */
+export function redactSecrets(input, depth = 0) {
+    if (typeof input === "string")
+        return redactSecretsInText(input);
+    if (depth > 12 || input === null || typeof input !== "object")
+        return input;
+    if (Array.isArray(input)) {
+        return input.map((item) => {
+            // ACP env entries: {name: "OMB_COMMS_TOKEN", value: "…"}
+            if (item !== null &&
+                typeof item === "object" &&
+                !Array.isArray(item) &&
+                typeof item.name === "string" &&
+                typeof item.value === "string") {
+                const entry = item;
+                // A non-secret-shaped name (a custom env var, a feature flag) does
+                // not clear the value of suspicion — the same content pass every
+                // other string in this tree gets is what catches a credential
+                // someone stashed under an ordinary-looking name.
+                return isSecretName(entry.name)
+                    ? { ...entry, value: mask(entry.value) }
+                    : { ...entry, value: redactSecretsInText(entry.value) };
+            }
+            return redactSecrets(item, depth + 1);
+        });
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (typeof value === "string" && isSecretName(key)) {
+            out[key] = mask(value);
+            continue;
+        }
+        // any other string may still CONTAIN a credential (a command line, a
+        // header value, a bot's reply) — the content pass catches those
+        out[key] = redactSecrets(value, depth + 1);
+    }
+    return out;
+}

package/dist-server/server/remote-computer.js

@@ -0,0 +1,170 @@
+// Shared provisioning and shell contract for the cloud computer's Cua Driver.
+// The box command API is the transport boundary: the daemon stays loopback-only
+// inside the VM and OpenMausBot never exposes another inbound port.
+export const REMOTE_CUA_VERSION = "0.20.0";
+export const REMOTE_CUA_EXECUTABLE = "/opt/ogb/cua-driver";
+export const REMOTE_CUA_SOCKET = "/opt/ogb/run/cua.sock";
+export const REMOTE_CUA_SESSION = "openmausbot";
+export const REMOTE_CDP_HELPER = "/opt/ogb/openmausbot-cdp.mjs";
+const REMOTE_CUA_WHEELS = {
+    x86_64: {
+        url: "https://files.pythonhosted.org/packages/fa/d7/a43008a328a40c85e7bc706fc20235b9abedc75e28b413817655153157ff/cua_driver-0.20.0-py3-none-manylinux_2_31_x86_64.whl",
+        sha256: "f60c35696a37f37ac954935e478ae4754f220856d022036625c9400d72185961",
+    },
+    aarch64: {
+        url: "https://files.pythonhosted.org/packages/94/9d/1c1838b69067e83266c3d2aae02d74eef353a43dc8644884ccf03fe7f933/cua_driver-0.20.0-py3-none-manylinux_2_31_aarch64.whl",
+        sha256: "48833bc5e4c60e701fc9eefb57dbac36ec77ef3990f816fbbe85b4e954af2c77",
+    },
+};
+const CDP_HELPER_SOURCE = String.raw `const [action, encoded = ""] = process.argv.slice(2);
+const input = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8") || "{}");
+const pages = await fetch("http://127.0.0.1:9222/json/list").then((r) => r.json());
+const page = pages.find((item) => item.type === "page" && item.webSocketDebuggerUrl);
+if (!page) throw new Error("no debuggable browser page");
+if (input.url && page.url !== input.url) throw new Error("page changed; take a new browser snapshot");
+const socket = new WebSocket(page.webSocketDebuggerUrl);
+await new Promise((resolve, reject) => {
+  socket.addEventListener("open", resolve, { once: true });
+  socket.addEventListener("error", () => reject(new Error("DevTools connection failed")), { once: true });
+});
+let nextId = 0;
+const pending = new Map();
+socket.addEventListener("message", (event) => {
+  const message = JSON.parse(String(event.data));
+  if (!message.id) return;
+  const waiter = pending.get(message.id);
+  if (!waiter) return;
+  pending.delete(message.id);
+  if (message.error) waiter.reject(new Error(message.error.message));
+  else waiter.resolve(message.result ?? {});
+});
+const send = (method, params = {}) => new Promise((resolve, reject) => {
+  const id = ++nextId;
+  pending.set(id, { resolve, reject });
+  socket.send(JSON.stringify({ id, method, params }));
+});
+const refId = (value) => {
+  const match = /^b(\d+)$/.exec(String(value ?? ""));
+  if (!match) throw new Error("invalid or stale browser ref; take a new snapshot");
+  return Number(match[1]);
+};
+if (action === "snapshot") {
+  await send("Accessibility.enable");
+  const { nodes = [] } = await send("Accessibility.getFullAXTree", { depth: 14 });
+  const useful = new Set(["button", "checkbox", "combobox", "heading", "link", "menuitem", "radio", "searchbox", "slider", "spinbutton", "switch", "tab", "textbox"]);
+  const elements = [];
+  for (const node of nodes) {
+    const role = String(node.role?.value ?? "").toLowerCase();
+    const name = String(node.name?.value ?? "").replace(/\s+/g, " ").trim().slice(0, 180);
+    const backend = Number(node.backendDOMNodeId ?? 0);
+    if (!backend || !useful.has(role) || (!name && role !== "textbox" && role !== "searchbox")) continue;
+    const disabled = node.properties?.some((property) => property.name === "disabled" && property.value?.value === true) ?? false;
+    elements.push({ ref: "b" + backend, role, name: name || "unnamed", disabled });
+    if (elements.length >= 250) break;
+  }
+  process.stdout.write(JSON.stringify({ title: String(page.title ?? "").slice(0, 200), url: page.url, elements }));
+} else if (action === "click") {
+  const backendNodeId = refId(input.ref);
+  const { model } = await send("DOM.getBoxModel", { backendNodeId });
+  const quad = model?.border ?? model?.content;
+  if (!Array.isArray(quad) || quad.length < 8) throw new Error("element is not visible; take a new snapshot");
+  const x = (quad[0] + quad[2] + quad[4] + quad[6]) / 4;
+  const y = (quad[1] + quad[3] + quad[5] + quad[7]) / 4;
+  await send("Input.dispatchMouseEvent", { type: "mousePressed", x, y, button: "left", clickCount: 1 });
+  await send("Input.dispatchMouseEvent", { type: "mouseReleased", x, y, button: "left", clickCount: 1 });
+  process.stdout.write(JSON.stringify({ ok: true, ref: input.ref }));
+} else if (action === "fill") {
+  const backendNodeId = refId(input.ref);
+  await send("DOM.focus", { backendNodeId });
+  await send("Input.dispatchKeyEvent", { type: "keyDown", key: "a", code: "KeyA", modifiers: 2 });
+  await send("Input.dispatchKeyEvent", { type: "keyUp", key: "a", code: "KeyA", modifiers: 2 });
+  await send("Input.dispatchKeyEvent", { type: "keyDown", key: "Backspace", code: "Backspace" });
+  await send("Input.dispatchKeyEvent", { type: "keyUp", key: "Backspace", code: "Backspace" });
+  await send("Input.insertText", { text: String(input.text ?? "") });
+  process.stdout.write(JSON.stringify({ ok: true, ref: input.ref }));
+} else {
+  throw new Error("unknown browser action");
+}
+socket.close();`;
+const shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
+export const MAX_REMOTE_COMMAND_LENGTH = 4_000;
+/** Run a user- or model-supplied command without inheriting provider or
+ * account credentials from an older box image. Keep this shared by the bot
+ * tool and the owner's Computer-panel console so the two boundaries cannot
+ * drift apart. */
+export function isolatedRemoteCommand(command) {
+    return [
+        "exec env -i",
+        'HOME="$HOME"',
+        'USER="${USER:-$(id -un)}"',
+        'LOGNAME="${LOGNAME:-${USER:-$(id -un)}}"',
+        'PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"',
+        'DISPLAY="${DISPLAY:-:0}"',
+        'XAUTHORITY="${XAUTHORITY:-$HOME/.Xauthority}"',
+        'XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"',
+        'DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-}"',
+        "/bin/bash -c",
+        shellQuote(command),
+    ].join(" ");
+}
+/** Start the already-installed daemon after a box resume. This is cheap when
+ * it is healthy and intentionally does not install anything on the hot path. */
+export function ensureRemoteCuaCommand() {
+    return [
+        `if [ -x ${REMOTE_CUA_EXECUTABLE} ]; then`,
+        `  mkdir -p ${REMOTE_CUA_SOCKET.slice(0, REMOTE_CUA_SOCKET.lastIndexOf("/"))}`,
+        `  if ! ${REMOTE_CUA_EXECUTABLE} status --socket ${REMOTE_CUA_SOCKET} >/dev/null 2>&1; then`,
+        `    rm -f ${REMOTE_CUA_SOCKET}`,
+        '    display=${DISPLAY:-$(find /tmp/.X11-unix -maxdepth 1 -name "X*" -printf ":%f\\n" 2>/dev/null | sed "s/:X/:/" | head -1)}',
+        '    display=${display:-:0}',
+        `    nohup env HOME="$HOME" DISPLAY="$display" CUA_DRIVER_INSTALL_CHANNEL=python_package CUA_DRIVER_RS_TELEMETRY_ENABLED=0 ${REMOTE_CUA_EXECUTABLE} serve --socket ${REMOTE_CUA_SOCKET} --permission-mode standard > /tmp/ogb-cua-driver.log 2>&1 &`,
+        `    for i in 1 2 3 4 5 6 7 8 9 10; do ${REMOTE_CUA_EXECUTABLE} status --socket ${REMOTE_CUA_SOCKET} >/dev/null 2>&1 && break; sleep 0.2; done`,
+        "  fi",
+        "fi",
+    ].join("\n");
+}
+/** Idempotent setup. The exact wheel is verified before its bundled native
+ * executable is installed; installation remains asynchronous so first-time
+ * provisioning does not block the desktop for several minutes. */
+export function remoteComputerBootstrapCommand(botName) {
+    const helper = Buffer.from(CDP_HELPER_SOURCE).toString("base64");
+    const installer = [
+        "set -eu",
+        "trap 'rm -f /tmp/ogb-cua-installing' EXIT",
+        "sudo mkdir -p /opt/ogb/run",
+        'sudo chown -R "$(id -u):$(id -g)" /opt/ogb',
+        'arch="$(uname -m)"',
+        `case "$arch" in x86_64) url=${shellQuote(REMOTE_CUA_WHEELS.x86_64.url)}; sha=${REMOTE_CUA_WHEELS.x86_64.sha256} ;; aarch64|arm64) url=${shellQuote(REMOTE_CUA_WHEELS.aarch64.url)}; sha=${REMOTE_CUA_WHEELS.aarch64.sha256} ;; *) echo "unsupported architecture: $arch" >&2; exit 1 ;; esac`,
+        'wheel="/tmp/cua-driver-${sha}.whl"',
+        'curl -fsSL "$url" -o "$wheel"',
+        'echo "$sha  $wheel" | sha256sum -c -',
+        'python3 - "$wheel" <<\'PY\'\nimport os, sys, zipfile\nwheel = sys.argv[1]\nwith zipfile.ZipFile(wheel) as archive:\n    names = [name for name in archive.namelist() if name == "cua_driver/bin/cua-driver" or name.endswith("/cua_driver/bin/cua-driver")]\n    if len(names) != 1:\n        raise SystemExit("cua-driver executable missing from wheel")\n    with archive.open(names[0]) as source, open("/opt/ogb/cua-driver", "wb") as target:\n        target.write(source.read())\nos.chmod("/opt/ogb/cua-driver", 0o755)\nPY',
+        `test "$(${REMOTE_CUA_EXECUTABLE} --version)" = "cua-driver ${REMOTE_CUA_VERSION}"`,
+        `touch /opt/ogb/cua-${REMOTE_CUA_VERSION}-ready`,
+        'rm -f "$wheel"',
+    ].join("\n");
+    // The display name is untrusted. Encode the banner before composing the
+    // nested tmux shell so substitutions/backticks can never become syntax.
+    const banner = Buffer.from(`  ▦ ${botName}'s computer — OpenMausBot`).toString("base64");
+    const tmuxSessionCommand = [
+        "echo",
+        `printf %s ${shellQuote(banner)} | base64 -d`,
+        "echo",
+        "exec bash -i",
+    ].join("; ");
+    return [
+        "if ! command -v xdotool >/dev/null || ! command -v convert >/dev/null || ! command -v curl >/dev/null || ! command -v python3 >/dev/null; then sudo apt-get update -qq || true; sudo apt-get install -y -qq ca-certificates curl python3 gnome-screenshot xclip wmctrl xdotool imagemagick scrot >/dev/null 2>&1 || true; fi",
+        "sudo mkdir -p /opt/ogb/run",
+        `printf %s ${shellQuote(helper)} | base64 -d | sudo tee ${REMOTE_CDP_HELPER} >/dev/null`,
+        `sudo chmod 0755 ${REMOTE_CDP_HELPER}`,
+        'pkill -f "^/opt/ogb/venv/bin/python -m computer_server( |$)" >/dev/null 2>&1 || true',
+        `[ -f /opt/ogb/cua-${REMOTE_CUA_VERSION}-ready ] || [ -f /tmp/ogb-cua-installing ] || { touch /tmp/ogb-cua-installing; nohup bash -c ${shellQuote(installer)} > /tmp/ogb-cua-install.log 2>&1 & }`,
+        ensureRemoteCuaCommand(),
+        `tmux has-session -t work 2>/dev/null || tmux new-session -d -s work ${shellQuote(tmuxSessionCommand)}`,
+        "echo bootstrapped",
+    ].join("\n");
+}
+export function semanticBrowserCommand(action, input) {
+    const encoded = Buffer.from(JSON.stringify(input ?? {})).toString("base64url");
+    return `node ${REMOTE_CDP_HELPER} ${action} ${shellQuote(encoded)}`;
+}