openmausbot 0.1.65 → 0.1.66

package/dist-server/server/config.js

@@ -513,7 +513,7 @@ export const PROVIDER_CREDENTIAL_ENV = [
 ];
 /** Merge a partial config into ~/.openmausbot/config.json (secrets never
  * echoed back — callers report configured-or-not booleans only). */
-export function saveConfig(patch) {
+export function saveConfig(patch, options = {}) {
     const p = join(DATA_DIR, "config.json");
     let disk = {};
     try {
@@ -577,10 +577,17 @@ export function saveConfig(patch) {
     }
     if (checkedPatch.instances) {
         const currentInstances = jsonObjectSchema.safeParse(disk.instances);
-        const diskInstances = currentInstances.success ? currentInstances.data : {};
+        const storedInstances = currentInstances.success ? currentInstances.data : {};
+        const diskInstances = options.replaceInstances ? {} : storedInstances;
         for (const [instanceId, entry] of Object.entries(checkedPatch.instances)) {
-            const current = jsonObjectSchema.safeParse(diskInstances[instanceId]);
+            const current = jsonObjectSchema.safeParse(storedInstances[instanceId]);
             const merged = current.success ? { ...current.data } : {};
+            // Replacement clears omitted known settings, but retained shadow
+            // entries keep fields understood only by a newer app or driver.
+            if (options.replaceInstances) {
+                for (const key of Object.keys(instanceConfigSchema.shape))
+                    delete merged[key];
+            }
             Object.assign(merged, entry);
             diskInstances[instanceId] = merged;
         }
@@ -594,13 +601,13 @@ export function saveConfig(patch) {
  * entry rides driver.defaultConfig(). Returns false for unknown instances
  * when the fleet is explicitly configured. The returned map must stay
  * PERSISTABLE: instanceConfigs() injects credential env into consuming
- * drivers' entries for the live fleet, so those injected keys are stripped
- * back out before the map is returned — otherwise saving an override would
+ * drivers' entries for the live fleet, so only their originally configured
+ * environment is retained — otherwise saving an override would
  * copy xai/box/opencodeGo secrets into the instances section of
  * config.json. */
 export function withInstanceCli(cfg, instanceId, cli) {
     const next = structuredClone(cfg);
-    const map = instanceConfigs(next);
+    const map = persistableInstanceConfigs(next);
     // hasOwn, not truthiness: map is a plain object literal, so
     // map["__proto__"] resolves to Object.prototype — truthy — and the
     // assignment below would poison EVERY object in the process (instanceId
@@ -620,22 +627,22 @@ export function withInstanceCli(cfg, instanceId, cli) {
         delete rest.cli;
         entry.config = Object.keys(rest).length ? rest : undefined;
     }
-    for (const e of Object.values(map)) {
-        if (!e.environment)
-            continue;
-        const injected = injectedEnvironment(next, e.driver);
-        for (const [k, v] of Object.entries(e.environment)) {
-            if (injected.get(k) === v)
-                delete e.environment[k];
-        }
-        if (!Object.keys(e.environment).length)
-            delete e.environment;
-    }
     next.instances = map;
     return { ok: true, config: next };
 }
-/** The credential env instanceConfigs() injects for one driver — shared with
- * withInstanceCli() so the inject rule and the strip rule cannot drift apart.
+/** Materialize defaults without copying injected workspace secrets to disk. */
+export function persistableInstanceConfigs(cfg) {
+    const map = instanceConfigs(cfg);
+    for (const [id, entry] of Object.entries(map)) {
+        const environment = cfg.instances?.[id]?.environment;
+        if (environment)
+            entry.environment = { ...environment };
+        else
+            delete entry.environment;
+    }
+    return map;
+}
+/** The credential env instanceConfigs() injects for one driver at runtime.
  * Each secret goes only to the driver that actually reads it: the API-key
  * Grok driver reads XAI_API_KEY, the Computer driver reads BOX_TOKEN, and
  * OpenCode reads OPENCODE_API_KEY. Every other engine brings its own

package/dist-server/server/custom-domain.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { lookup as dnsLookup } from "node:dns/promises";
 import { request as httpsRequest } from "node:https";
 import { BlockList, isIP } from "node:net";
+import { networkInterfaces } from "node:os";
 const CHECK_TIMEOUT_MS = 8_000;
 const MAX_RESPONSE_BYTES = 16_384;
 const DESCRIPTOR_PATH = "/.well-known/openmausbot/environment";
@@ -57,6 +58,19 @@ export function isPublicDomainAddress(address) {
         return !excludedAddresses.check(address, "ipv4");
     return family === 6 && globalIpv6.check(address, "ipv6") && !excludedAddresses.check(address, "ipv6");
 }
+/** Local interfaces only: a tunnel/CDN address or an external IP-echo service
+ * does not identify the server where the customer's HTTPS proxy runs. */
+export function customDomainIpv4(interfaces = networkInterfaces(), configured = process.env.OMB_PUBLIC_IPV4) {
+    if (configured?.trim()) {
+        const address = configured.trim();
+        return isIP(address) === 4 && isPublicDomainAddress(address) ? address : null;
+    }
+    const addresses = new Set(Object.values(interfaces).flatMap((entries) => entries ?? [])
+        .filter((entry) => !entry.internal && entry.family === "IPv4" && isPublicDomainAddress(entry.address))
+        .map((entry) => entry.address));
+    // Containers/NAT and multi-address hosts need an explicit operator choice.
+    return addresses.size === 1 ? [...addresses][0] : null;
+}
 function withAbort(promise, signal) {
     return new Promise((resolve, reject) => {
         const abort = () => reject(new CustomDomainError("The domain check timed out. Check DNS, HTTPS, and your reverse proxy, then try again."));

package/dist-server/server/drivers/claude.js

@@ -12,7 +12,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer as createNetServer } from "node:net";
 import { homedir, tmpdir } from "node:os";
-import { join, dirname } from "node:path";
+import { join, dirname, isAbsolute, normalize } from "node:path";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.js";
 import { augmentedPath } from "../env-path.js";
 import { brokerSocketPath, describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
@@ -29,19 +29,61 @@ import { SPAWNED_PROXIES } from "../proxy-paths.js";
  * backends over time. Presence checks also accept stale credentials. The CLI's
  * own machine-readable auth command is the source of truth for every backend.
  */
-export function claudeSignedIn(cli, env, run = execCli) {
+function claudeAuthStatus(cli, env, run = execCli) {
     return new Promise((resolve) => {
-        run(cli, ["auth", "status", "--json"], { timeout: 8000, env }, (_error, stdout) => {
+        run(cli, ["auth", "status", "--json"], { timeout: 8000, maxBuffer: 65_536, env }, (_error, stdout) => {
             try {
                 const status = JSON.parse(stdout);
-                resolve(typeof status === "object" && status !== null && "loggedIn" in status && status.loggedIn === true);
+                if (!status || typeof status !== "object" || !("loggedIn" in status) || status.loggedIn !== true) {
+                    return resolve({ authenticated: false });
+                }
+                // Only display identity fields, never the CLI's full auth response.
+                const identity = status;
+                const boundedText = (value, max) => typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\p{Cc}\p{Cf}]/u.test(value)
+                    ? value.trim() : undefined;
+                const candidateEmail = boundedText(identity.email, 254);
+                const email = candidateEmail && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(candidateEmail) ? candidateEmail : undefined;
+                const organization = boundedText(identity.orgName, 160);
+                resolve({
+                    authenticated: true,
+                    ...(email || organization ? { account: { ...(email ? { email } : {}), ...(organization ? { organization } : {}) } } : {}),
+                });
             }
             catch {
-                resolve(false);
+                resolve({ authenticated: false });
             }
         });
     });
 }
+export async function claudeSignedIn(cli, env, run = execCli) {
+    return (await claudeAuthStatus(cli, env, run)).authenticated;
+}
+/** Parent-session credentials/routing that a named account must not inherit.
+ * Shared with terminal sign-in instructions so login and turns select alike. */
+export const CLAUDE_ACCOUNT_ENV_KEYS = [
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+    "CLAUDE_CODE_OAUTH_SCOPES",
+    "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+    "CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR",
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_CUSTOM_HEADERS",
+    "CLAUDE_CODE_USE_BEDROCK",
+    "CLAUDE_CODE_USE_VERTEX",
+    "CLAUDE_CODE_USE_FOUNDRY",
+];
+/** Resolve the CLI's config location without changing HOME or Keychain. */
+export function resolveClaudeConfigDir(configDir, env = process.env) {
+    const home = env.HOME || env.USERPROFILE || homedir();
+    const configured = configDir?.trim() || env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
+    const expanded = configured === "~" ? home : configured.startsWith("~/") ? join(home, configured.slice(2)) : configured;
+    if (!isAbsolute(expanded) || /[\p{Cc}\p{Cf}]/u.test(expanded)) {
+        throw new Error("claude: configDir must be an absolute path or start with ~/");
+    }
+    return normalize(expanded);
+}
 /** Whether a stream frame is the CLI reporting that it has no login.
  *
  * The CLI flags its own api-error frames (`error`, `is_api_error_message`);
@@ -63,8 +105,21 @@ export function claudeAuthFailure(frame, text) {
  * Keeping the probe and turn environments identical prevents setup from
  * claiming an API-key login that the turn itself would deliberately remove.
  */
-function claudeEnvironment(model, source = process.env) {
+function claudeEnvironment(model, source = process.env, configDir, instanceEnvironment = {}) {
     const env = { ...source, PATH: augmentedPath(), NPM_CONFIG_LOGLEVEL: "error" };
+    if (configDir?.trim()) {
+        env.CLAUDE_CONFIG_DIR = resolveClaudeConfigDir(configDir, env);
+        for (const key of CLAUDE_ACCOUNT_ENV_KEYS) {
+            // Explicit custom endpoint settings still work; subscription OAuth
+            // always belongs to this account's CLI-managed login, never its parent.
+            if (key.startsWith("CLAUDE_CODE_OAUTH_") || key.endsWith("_FILE_DESCRIPTOR") || !Object.hasOwn(instanceEnvironment, key)) {
+                delete env[key];
+            }
+        }
+    }
+    else if (env.CLAUDE_CONFIG_DIR) {
+        env.CLAUDE_CONFIG_DIR = resolveClaudeConfigDir(undefined, env);
+    }
     delete env.CLAUDECODE;
     delete env.CLAUDE_CODE_ENTRYPOINT;
     // The harness process may hold workspace credentials (xai/box/voice keys,
@@ -97,11 +152,6 @@ async function resolveClaudeTurnModel(model, env) {
     }
     return resolveInjectId(model, await probeLocalInjects(env)) ?? model;
 }
-function claudeConfigDir(env) {
-    if (env.CLAUDE_CONFIG_DIR)
-        return env.CLAUDE_CONFIG_DIR;
-    return join(env.HOME || env.USERPROFILE || homedir(), ".claude");
-}
 function extrasFromUnknown(value) {
     if (!Array.isArray(value))
         return [];
@@ -127,7 +177,7 @@ function extrasFromUnknown(value) {
 export function readClaudeModelCatalog(env = process.env) {
     let settings = {};
     try {
-        settings = JSON.parse(readFileSync(join(claudeConfigDir(env), "settings.json"), "utf8"));
+        settings = JSON.parse(readFileSync(join(resolveClaudeConfigDir(undefined, env), "settings.json"), "utf8"));
     }
     catch {
         return STATIC_CLAUDE_MODELS;
@@ -446,8 +496,14 @@ function decodeConfig(raw) {
     }
     const tools = decodeToolList(o.tools, "tools");
     const disallowedTools = decodeToolList(o.disallowedTools, "disallowedTools");
+    if (o.configDir !== undefined && typeof o.configDir !== "string")
+        throw new Error("claude: configDir must be a string");
+    const configDir = typeof o.configDir === "string" ? o.configDir.trim() : undefined;
+    if (configDir)
+        resolveClaudeConfigDir(configDir);
     return {
         cli: typeof o.cli === "string" ? o.cli : "claude",
+        ...(configDir ? { configDir } : {}),
         permissionMode: mode ?? "acceptEdits",
         ...(tools !== undefined ? { tools } : {}),
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
@@ -523,7 +579,8 @@ export const ClaudeDriver = {
     defaultConfig: () => decodeConfig({}),
     async create(input) {
         const { instanceId, config } = input;
-        const catalogEnv = { ...process.env, ...input.environment };
+        const environment = (model) => claudeEnvironment(model, { ...process.env, ...input.environment }, config.configDir, input.environment);
+        const catalogEnv = environment();
         let models = STATIC_CLAUDE_MODELS;
         const refreshModels = async () => {
             try {
@@ -659,7 +716,7 @@ export const ClaudeDriver = {
             if (config.disallowedTools?.length) {
                 args.push("--disallowedTools", config.disallowedTools.join(","));
             }
-            const turnEnvironment = { ...process.env, ...input.environment };
+            const turnEnvironment = environment();
             const turnModel = await resolveClaudeTurnModel(turn.model, turnEnvironment);
             const injected = applyClaudeInject({ ...turnEnvironment }, turnModel);
             if (injected.model)
@@ -762,7 +819,7 @@ export const ClaudeDriver = {
                 args.push("--mcp-config", mcpConfigPath);
                 args.push("--allowedTools", allowed.join(","));
             }
-            const env = claudeEnvironment(turnModel, turnEnvironment);
+            const env = environment(turnModel);
             // Our approvals and browser credentials expire at the user-turn
             // boundary. Native background workers cannot outlive that boundary;
             // parallel bot work must use the harness's durable delegate_bot path.
@@ -779,6 +836,7 @@ export const ClaudeDriver = {
                 cwd,
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
+                configDir: env.CLAUDE_CONFIG_DIR ?? null,
             });
             // Reuse the live process when it is idle, unchanged, and is the session
             // the harness wants resumed. Anything else: close it and spawn fresh
@@ -1230,17 +1288,17 @@ export const ClaudeDriver = {
             return writeUser(s, threadId, claudeUserMessage(text, undefined));
         };
         const snapshot = async () => {
-            const env = claudeEnvironment(undefined, { ...process.env, ...input.environment });
+            const env = environment();
             const version = await new Promise((resolve) => {
                 execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) => resolve(err ? null : stdout.trim()));
             });
             if (!version)
                 return { state: "unavailable", reason: `\`${config.cli}\` CLI not found` };
-            const authenticated = await claudeSignedIn(config.cli, env);
+            const auth = await claudeAuthStatus(config.cli, env);
             // claudeEnvironment strips ANTHROPIC_API_KEY, so turns run on the
             // CLI's own login (Pro/Max): the cost it reports is what the call
             // WOULD bill, not a charge
-            return { state: "available", version, authenticated, billing: "subscription" };
+            return { state: "available", version, ...auth, billing: "subscription" };
         };
         /** One-shot Claude call with the prompt on stdin, never argv. Approval
          * summaries can contain paths, commands, or secrets, so the generic
@@ -1249,7 +1307,7 @@ export const ClaudeDriver = {
         const generateReview = (prompt, signal) => new Promise((resolve, reject) => {
             const child = spawnCli(config.cli, ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"], {
                 stdio: ["pipe", "pipe", "pipe"],
-                env: claudeEnvironment("claude-haiku-4-5", { ...process.env, ...input.environment }),
+                env: environment("claude-haiku-4-5"),
             });
             let stdout = "";
             let stderr = "";

package/dist-server/server/harness/bus.js

@@ -12,7 +12,7 @@ import { newId } from "../contracts.js";
 const INCOMPLETE_LOG_MESSAGE = "Canonical event history is incomplete: OpenMausBot could not write one or more events to disk. Live updates will continue.";
 export class EventBus {
     listeners = new Set();
-    unsubscribes = [];
+    unsubscribes = new Map();
     pendingLogWarnings = new Map();
     appendLog;
     constructor(appendLog = appendFileSync) {
@@ -20,6 +20,7 @@ export class EventBus {
     }
     attach(instances) {
         for (const instance of instances) {
+            this.detach(instance.instanceId);
             const unsub = instance.adapter.onEvent((event) => {
                 // hard invariant borrowed from correlateRuntimeEventWithInstance:
                 // an adapter may only emit events for its own driver kind
@@ -29,7 +30,7 @@ export class EventBus {
                 }
                 this.publish({ ...event, providerInstanceId: instance.instanceId });
             });
-            this.unsubscribes.push(unsub);
+            this.unsubscribes.set(instance.instanceId, unsub);
         }
     }
     publish(event) {
@@ -80,7 +81,11 @@ export class EventBus {
         return () => this.listeners.delete(listener);
     }
     detachAll() {
-        for (const unsub of this.unsubscribes.splice(0))
-            unsub();
+        for (const id of this.unsubscribes.keys())
+            this.detach(id);
+    }
+    detach(instanceId) {
+        this.unsubscribes.get(instanceId)?.();
+        this.unsubscribes.delete(instanceId);
     }
 }

package/dist-server/server/harness/registry.js

@@ -35,6 +35,8 @@ export class ProviderRegistry {
     }
     async load(configs) {
         for (const [instanceId, entry] of Object.entries(configs)) {
+            // Account edits replace only their own process/session state.
+            await this.dispose(instanceId);
             const driver = this.driversByKind.get(entry.driver);
             if (!driver) {
                 this.byId.set(instanceId, {
@@ -221,4 +223,10 @@ export class ProviderRegistry {
         this.byId.clear();
         this.cliByInstance.clear();
     }
+    async dispose(instanceId) {
+        const entry = this.byId.get(instanceId);
+        this.byId.delete(instanceId);
+        this.cliByInstance.delete(instanceId);
+        await entry?.live?.dispose();
+    }
 }