openmausbot 0.1.61 → 0.1.62

package/dist-server/server/screen-frame-source.js

@@ -0,0 +1,57 @@
+import { captureOutsideHumanControl } from "./private-screen-capture.js";
+/** One serialized preview source. A cached or in-flight desktop frame must
+ * never become the browser's settled picture after the bot switches surfaces. */
+export function createScreenFrameSource(input) {
+    let current = null;
+    let lastAt = 0;
+    let attemptedSurface;
+    let last = null;
+    let lastSurface;
+    const selectedSurface = () => input.captures[source.surface]
+        ? source.surface
+        : input.captures.computer ? "computer" : "browser";
+    const source = {
+        surface: (input.captures.computer ? "computer" : "browser"),
+        get last() {
+            return lastSurface === selectedSurface() ? last : null;
+        },
+        async capture(fresh = false) {
+            // Wait for the previous source before selecting the next one. A final
+            // capture bypasses the preview throttle, even if a poke just finished.
+            while (current)
+                await current;
+            if (input.control().held)
+                return;
+            const surface = selectedSurface();
+            if (!fresh && attemptedSurface === surface && Date.now() - lastAt < input.minGapMs)
+                return;
+            attemptedSurface = surface;
+            current = (async () => {
+                try {
+                    const capture = input.captures[surface];
+                    if (!capture)
+                        return;
+                    const frame = await captureOutsideHumanControl(input.control, capture);
+                    if (!frame || surface !== selectedSurface())
+                        return;
+                    last = frame;
+                    lastSurface = surface;
+                    input.onFrame(frame);
+                }
+                catch {
+                    // A sleeping or mid-command surface is retried by the next tick.
+                }
+                finally {
+                    lastAt = Date.now();
+                }
+            })();
+            try {
+                await current;
+            }
+            finally {
+                current = null;
+            }
+        },
+    };
+    return source;
+}

package/dist-server/server/sessions.js

@@ -4,8 +4,8 @@
 //
 // A pairing code is 12 characters from a 32-symbol alphabet with no 0/O/1/I
 // (60 bits), single use, five minutes. Exchanging it yields an opaque
-// session token (`omb_sess_…`, 256 bits) that lives 30 days; only its sha256
-// is stored. A stream ticket is a 5-minute single-use credential for the SSE
+// session token (`omb_sess_…`, 256 bits) that lives 30 days, renewed on use
+// up to 180 days from pairing (`renew`); only its sha256 is stored. A stream ticket is a 5-minute single-use credential for the SSE
 // endpoint, because EventSource cannot set headers. Failed exchanges are
 // counted per source: five in a minute lock that source out for ten.
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -16,7 +16,31 @@ export const SCOPES = ["admin", "client"];
 export const PAIRING_CODE_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 export const PAIRING_CODE_LENGTH = 12;
 export const PAIRING_CODE_TTL_MS = 5 * 60_000;
-export const SESSION_TTL_MS = 30 * 24 * 60 * 60_000;
+/** A whole number of days from an environment variable, as milliseconds.
+ * Anything that is not a whole number of days between 1 and 3650 falls back
+ * to the default rather than being clamped, so a typo is not silently
+ * turned into a policy. */
+export function daysMs(value, fallbackDays) {
+    const days = Number(value);
+    const ok = Number.isInteger(days) && days >= 1 && days <= 3650;
+    return (ok ? days : fallbackDays) * 24 * 60 * 60_000;
+}
+/** How long a session lives after its last renewal. A session used with half
+ * the term or less left is renewed for the full term again (see `renew`), so
+ * a device in regular use keeps working; one that goes quiet lapses.
+ * OMB_SESSION_TTL_DAYS overrides the 30-day default. */
+export const SESSION_TTL_MS = daysMs(process.env.OMB_SESSION_TTL_DAYS, 30);
+/** The most a session may live from the day it was paired, however often it
+ * is used. Renewal never pushes a session past this, so a stolen cookie has a
+ * bounded life and every device re-pairs occasionally. OMB_SESSION_MAX_DAYS
+ * overrides the 180-day default. */
+export const SESSION_MAX_AGE_MS = daysMs(process.env.OMB_SESSION_MAX_DAYS, 180);
+/** Renewal is due once half the term or less is left. */
+export const SESSION_RENEW_WHEN_LEFT_MS = SESSION_TTL_MS / 2;
+/** Max-Age for a cookie that should die with its session: whole seconds, at least one. */
+export function cookieMaxAgeSeconds(session, now = Date.now()) {
+    return Math.max(1, Math.floor((session.expiresAt - now) / 1000));
+}
 export const STREAM_TICKET_TTL_MS = 5 * 60_000;
 /** Per-source slow-down only. A 60-bit code cannot be guessed online in
  * five minutes whatever the rate, so the lock exists to make noise visible,
@@ -248,7 +272,9 @@ export class SessionRegistry {
             scopes: [...pairing.scopes],
             createdAt: now,
             lastSeenAt: now,
-            expiresAt: now + SESSION_TTL_MS,
+            // The absolute cap applies from the first term, so a TTL configured
+            // longer than the cap does not hand out a session the cap forbids.
+            expiresAt: now + Math.min(SESSION_TTL_MS, SESSION_MAX_AGE_MS),
         };
         this.sessions.push(record);
         this.lastSeenWrites.set(record.id, now); // the exchange itself was the first sighting
@@ -275,6 +301,28 @@ export class SessionRegistry {
         }
         return record;
     }
+    /** Sliding expiry. Called by the request gate once a request has passed
+     * the origin and scope checks (so a rejected request never extends
+     * anything): a still-valid session with half its term or less left is
+     * renewed for the full term, capped at SESSION_MAX_AGE_MS from pairing.
+     * Nothing expired is revived. Writes at most once per half-term, so it
+     * adds nothing to the last-seen traffic. Returns whether it renewed. */
+    renew(sessionId) {
+        const record = this.sessions.find((s) => s.id === sessionId);
+        const now = this.now();
+        if (!record || record.expiresAt <= now)
+            return false;
+        if (record.expiresAt - now > SESSION_RENEW_WHEN_LEFT_MS)
+            return false;
+        const next = Math.min(now + SESSION_TTL_MS, record.createdAt + SESSION_MAX_AGE_MS);
+        if (next <= record.expiresAt)
+            return false; // already at the absolute cap
+        record.expiresAt = next;
+        record.lastSeenAt = now;
+        this.lastSeenWrites.set(record.id, now);
+        this.persist();
+        return true;
+    }
     /** Still valid right now (prunes expiry first). */
     isLive(sessionId) {
         this.prune();

package/dist-server/vps-container-mcp.js

@@ -14914,6 +14914,9 @@ function date4(params) {
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// server/contracts.ts
+var EFFORT_LEVELS = ["none", "low", "medium", "high", "xhigh", "max"];
+
 // server/mcp-registry.ts
 var MAX_ARGS = 64;
 var storedEntrySchema = external_exports.object({
@@ -15077,7 +15080,19 @@ var instanceConfigSchema = external_exports.object({
   config: external_exports.json().optional()
 });
 var instanceConfigMapSchema = external_exports.record(external_exports.string(), instanceConfigSchema);
+var defaultModelSelectionSchema = external_exports.object({
+  instanceId: external_exports.string().trim().min(1),
+  model: external_exports.string().trim().min(1),
+  effort: external_exports.enum(EFFORT_LEVELS).optional()
+});
 var appConfigSchema = external_exports.object({
+  defaultModelSelection: defaultModelSelectionSchema.optional(),
+  /** CLI-only launch preferences. Never enable remote access implicitly. */
+  cliStartup: external_exports.object({
+    access: external_exports.enum(["local", "tunnel", "tailscale", "public-url"]),
+    publicUrl: external_exports.string().url().optional(),
+    phone: external_exports.enum(["ios", "android"]).optional()
+  }).optional(),
   xai: external_exports.object({ key: optionalText, url: optionalText }).optional(),
   /** `model` seeds the default selection; `provider` pins an OpenRouter
    * upstream (e.g. "fireworks"). Both are non-secret and optional. */
@@ -15114,7 +15129,7 @@ var appConfigSchema = external_exports.object({
 var storedAppConfigSchema = appConfigSchema.extend({
   browserProfiles: storedBrowserProfilesSchema.optional()
 });
-var appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true });
+var appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true });
 var jsonObjectSchema = external_exports.record(external_exports.string(), external_exports.json());
 var DATA_DIR = process.env.OMB_DATA_DIR ?? join2(homedir2(), ".openmausbot");
 var LEGACY_DATA_DIR = join2(homedir2(), ".opengrokbot");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",