openmausbot 0.1.67 → 0.1.68

package/dist-server/server/brand.js

@@ -10,6 +10,7 @@ import { DATA_DIR } from "./config.js";
 import { entitled } from "./enterprise.js";
 const HEX_COLOUR = /^#[0-9a-fA-F]{6}$/;
 const MAX_LOGO_CHARS = 300_000;
+const MAX_FAVICON_CHARS = 120_000;
 export const brandSchema = z
     .object({
     /** Product name shown in the window title, onboarding and settings. */
@@ -26,6 +27,12 @@ export const brandSchema = z
         .optional(),
     /** Where "get help" points for this deployment. */
     supportUrl: z.string().url().startsWith("https://", "supportUrl must be an https:// URL").optional(),
+    /** Tab and home-screen icon: an inline data:image/... URI (PNG or SVG, small) or an https:// URL. */
+    favicon: z
+        .string()
+        .max(MAX_FAVICON_CHARS, `favicon must be under ${MAX_FAVICON_CHARS} characters (a 64px PNG or a small SVG)`)
+        .refine((v) => v.startsWith("data:image/") || v.startsWith("https://"), "favicon must be a data:image/... URI or an https:// URL")
+        .optional(),
 })
     .strict();
 export const DEFAULT_BRAND = { name: "OpenMausBot" };

package/dist-server/server/cli.js

@@ -32,12 +32,13 @@ import qrcode from "qrcode-terminal";
 import { parseAllowList } from "./account-signin.js";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
+import { runServiceCommand } from "./service-cli.js";
 import { explainTailscaleFailure, tailscaleServe, tailscaleServeOff, tailscaleStatus } from "./tailscale.js";
 import { defaultSetupIo, SetupCancelled } from "./cli-prompts.js";
 import { normalizePhoneOrigin, phonePairingInstructions, runPhoneSetup } from "./cli-phone-setup.js";
 import { cleanupTunnelOrigin, createTunnelAccount, createTunnelOrigin, describeTunnelAccount, describeTunnelState, ensureCloudflared, FLEET_CREDENTIAL_ENV, fleetAccess, fleetCredential, guardianEntry, startTunnel, tunnelAccess, } from "./tunnel.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
-const COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "access", "browser", "help", "--help", "-h"];
+const COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "access", "service", "browser", "help", "--help", "-h"];
 export function parseArgs(argv, env = process.env) {
     const implicitStart = !argv.length || (argv[0].startsWith("--") && argv[0] !== "--help");
     const [command = "start", ...rest] = implicitStart ? ["start", ...argv] : argv;
@@ -105,6 +106,8 @@ export function parseArgs(argv, env = process.env) {
             }
             else if (options.command === "access" && arg === "--chat-only")
                 options.chatOnly = true;
+            else if (options.command === "service" && !options.serviceAction && (arg === "install" || arg === "uninstall"))
+                options.serviceAction = arg;
             else if (options.command === "browser" && (arg === "install" || arg === "status"))
                 options.browserAction = arg;
             else if (options.command === "browser" && arg === "--with-deps")
@@ -124,6 +127,8 @@ export function parseArgs(argv, env = process.env) {
         return { error: "choose one of --tailscale (your tailnet) and --tunnel (a public address)" };
     if (options.command === "access" && !options.accessAction)
         return { error: "access needs one of: list, add EMAIL [--chat-only], remove EMAIL" };
+    if (options.command === "service" && !options.serviceAction)
+        return { error: "service needs one of: install [the same options as serve], uninstall" };
     if (options.domain && (options.tailscale || options.tunnel || options.publicUrl))
         return { error: "--domain already gives the server its address; drop --tailscale, --tunnel and --public-url" };
     if (options.local && (options.tailscale || options.tunnel || options.publicUrl))
@@ -145,6 +150,7 @@ export const USAGE = `openmausbot — your team of AI bots, ready in a few steps
   openmausbot login [--email you@example.com]
   openmausbot logout
   openmausbot access list | add EMAIL [--chat-only] | remove EMAIL
+  openmausbot service install [--domain HOST | --tunnel | --tailscale] [--port N] [--data-dir DIR] | uninstall
   openmausbot browser install [--with-deps] | status
 
 setup   choose AI access and optional phone access; keep existing bots and chats
@@ -159,6 +165,10 @@ logout  releases that address and signs out
 access  who may sign in with an emailed code at /pair: an address or
         @domain; --chat-only gives chat and approvals without settings.
         Takes effect at once, no restart.
+service keep the server running across reboots: writes a systemd unit
+        (Linux) or a launchd agent (macOS) for the same serve options and
+        prints the commands that install it. Install the package
+        permanently first (npm install -g openmausbot).
 browser install: the bots' browser engine (agent-browser, pinned) into the
         data dir, and Chrome for Testing into the user's browser cache.
         --with-deps also installs
@@ -1013,6 +1023,18 @@ export async function main(argv = process.argv.slice(2)) {
             return runLogin(options);
         case "access":
             return runAccess(options);
+        case "service":
+            return runServiceCommand({
+                action: options.serviceAction ?? "install",
+                dataDir: options.dataDir,
+                port: options.port,
+                domain: options.domain,
+                tunnel: options.tunnel,
+                tailscale: options.tailscale,
+                label: options.label,
+                script: process.argv[1] ?? "",
+                node: process.execPath,
+            }, { log: (line) => console.log(line), error: (line) => console.error(line) });
         case "logout":
             return runLogout(options);
         case "browser":

package/dist-server/server/config.js

@@ -16,6 +16,8 @@ const BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
 export const DEFAULT_ROOM_TURN_TIMEOUT_MINUTES = 5;
 export const MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 export const MAX_ROOM_TURN_TIMEOUT_MINUTES = 1_440;
+export const DEFAULT_MAX_CONCURRENT_BOT_THREADS = 3;
+export const MAX_CONCURRENT_BOT_THREADS = 10;
 export const DEFAULT_LOCAL_VM_MODE = "shared";
 export const DEFAULT_LOCAL_VM_MAX_INSTANCES = 2;
 export const MIN_LOCAL_VM_MAX_INSTANCES = 1;
@@ -253,6 +255,7 @@ const appConfigSchema = z.object({
      * system language. Unknown tags degrade to English in the renderer. */
     language: optionalText,
     rooms: roomConfigSchema.optional(),
+    threads: z.object({ maxConcurrentPerBot: z.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS) }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     browserProfiles: browserProfilesSchema.optional(),
@@ -349,6 +352,9 @@ export function vpsSshAlias(cfg) {
 export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
+export function maxConcurrentBotThreads(cfg) {
+    return cfg.threads?.maxConcurrentPerBot ?? DEFAULT_MAX_CONCURRENT_BOT_THREADS;
+}
 export function localVmMode(cfg) {
     return cfg.localVm?.mode ?? DEFAULT_LOCAL_VM_MODE;
 }
@@ -544,7 +550,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "localVm", "features"]) {
+    for (const key of ["xai", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "localVm", "features"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;

package/dist-server/server/delegations.js

@@ -251,7 +251,10 @@ export function queueDelegation(bus, from, item, maxDepth, sourceThreadId = from
  * of the target turn is delegated to `runTarget` so delegations.ts
  * stays free of harness-level concerns (commsDepth is the only thing
  * the caller needs). */
-export function drainDelegations(bus, approvalBus, threadId, runTarget) {
+export function drainDelegations(bus, approvalBus, threadId, runTarget, 
+/** Terminal failures before dispatch also need to wake the source. A
+ * launched peer reports through its provider-turn finalizer instead. */
+onSettled) {
     if (drainingThreads.has(threadId)) {
         queuedRedrains.add(threadId);
         return;
@@ -263,6 +266,10 @@ export function drainDelegations(bus, approvalBus, threadId, runTarget) {
     drainingThreads.add(threadId);
     void (async () => {
         for (const item of snapshot) {
+            // Stop/deletion may remove queued work while another item awaits a
+            // person's approval. A stale snapshot is never authority to launch it.
+            if (!pendingDelegations.get(threadId)?.some((candidate) => candidate.id === item.id))
+                continue;
             // A shared channel's thread is not owned by any single bot, so each
             // queued item carries its own source bot identity.
             const from = bus.store.botByThread(threadId) ??
@@ -307,8 +314,19 @@ export function drainDelegations(bus, approvalBus, threadId, runTarget) {
             finally {
                 // A requeued item (busy target, retries left) stays for the drain
                 // that the target's own settling turn will trigger.
+                const stillQueued = pendingDelegations.get(threadId)?.some((candidate) => candidate.id === item.id);
                 if (outcome !== "requeued")
                     acknowledgeDelegation(threadId, item.id);
+                if (outcome === "settled" && stillQueued) {
+                    const receipt = findDelegationReceipt(item.id);
+                    try {
+                        if (receipt)
+                            onSettled?.(receipt);
+                    }
+                    catch (error) {
+                        console.error("delegation settled but its source could not be resumed", error);
+                    }
+                }
             }
         }
     })().finally(() => {
@@ -321,7 +339,7 @@ export function drainDelegations(bus, approvalBus, threadId, runTarget) {
         const snapshotIds = new Set(snapshot.map((item) => item.id));
         const hasNewItems = pendingDelegations.get(threadId)?.some((item) => !snapshotIds.has(item.id)) ?? false;
         if (redrainRequested || hasNewItems) {
-            drainDelegations(bus, approvalBus, threadId, runTarget);
+            drainDelegations(bus, approvalBus, threadId, runTarget, onSettled);
         }
     });
 }
@@ -368,6 +386,19 @@ export function discardDelegations(bus, threadId) {
 async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarget) {
     let sender = from;
     let target = bus.store.bot(item.toBotId);
+    // Retained approval authorizes the message, not a deleted conversation or
+    // revoked room membership. Check every retry before writing to its source.
+    if (!sourceThreadBelongsToBot(bus.store, sender.id, sourceThreadId)) {
+        recordDelegationReceipt({
+            id: item.id,
+            sourceThreadId,
+            toBotId: item.toBotId,
+            toBotName: target?.name ?? item.toBotId,
+            status: "dropped",
+            result: "the source conversation no longer belongs to the delegating bot",
+        });
+        return "settled";
+    }
     if (!target) {
         recordDelegationReceipt({
             id: item.id,
@@ -422,6 +453,23 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     }
     if (sender.approvePeerComms && !item.approvalAlreadyGranted) {
         const verdict = await requestPeerApproval(approvalBus, sender, target, item.message, "delegate_bot", sourceThreadId);
+        if (!pendingDelegations.get(sourceThreadId)?.some((candidate) => candidate.id === item.id))
+            return "settled";
+        // Approval may have waited for minutes. Revalidate before even reporting
+        // a denial, which otherwise recreates a deleted source transcript.
+        const current = bus.store.bot(item.toBotId);
+        const currentSender = bus.store.bot(from.id);
+        if (!current || !currentSender || !sourceThreadBelongsToBot(bus.store, currentSender.id, sourceThreadId)) {
+            recordDelegationReceipt({
+                id: item.id,
+                sourceThreadId,
+                toBotId: item.toBotId,
+                toBotName: target.name,
+                status: "dropped",
+                result: "the peer or source conversation no longer exists",
+            });
+            return "settled";
+        }
         if (verdict !== "allow") {
             recordDelegationReceipt({
                 id: item.id,
@@ -438,14 +486,11 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
             });
             return "settled";
         }
-        // The approval could have been sitting for up to 15 minutes. Everything
-        // checked above is a stale snapshot now: re-read both bots and re-check
-        // busy, or an allow can start a second turn on a bot that is mid-turn —
-        // and mirror a "Messaged @X" chip for an exchange that never happens.
-        const current = bus.store.bot(item.toBotId);
-        const currentSender = bus.store.bot(from.id);
-        if (!current || !currentSender || !sourceThreadBelongsToBot(bus.store, currentSender.id, sourceThreadId))
-            return "settled";
+        // A busy-target retry must not ask for the very same approval again.
+        item.approvalAlreadyGranted = true;
+        savePending();
+        // Recheck peer access and busy state too: an approval must not start a
+        // second turn or mirror an exchange that cannot actually happen.
         if (dropIfUnreachable(bus, currentSender, current, sourceThreadId, item)) {
             return "settled";
         }
@@ -490,7 +535,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     const reasonLine = item.reason ? `\n\n[Reason: ${item.reason}]` : "";
     const prefixed = `[Delegated by @${sender.name}, another bot in this OpenMausBot workspace. Do the work and reply directly.]\n\n${item.message}${reasonLine}`;
     await runTarget(item.toBotId, prefixed, item.depth + 1, sourceThreadId, channel, item.id, sender.id);
-    return "settled";
+    return "dispatched";
 }
 /** The source thread may be a bot's own task or a shared group where the
  * bot is a member. This is the same check the API gate uses for group turns. */

package/dist-server/server/drivers/agents-proxy.js

@@ -130,6 +130,20 @@ function normalizeScheduleInput(args) {
     if (!jsonRecord(raw))
         return { error: `The schedule must be a JSON object. ${SUPPORTED_SCHEDULES}` };
     const type = typeof raw.type === "string" ? raw.type.trim().toLowerCase() : "";
+    const fields = type === "once"
+        ? ["type", "at"]
+        : type === "weekly" || type === "daily"
+            ? ["type", "time", "weekdays"]
+            : type === "interval"
+                ? ["type", "every_minutes", "everyMinutes", "starts_at", "anchorAt"]
+                : null;
+    // Provider conversions may send unused optional fields as null. Ignore
+    // those, but never silently discard an actual scheduling constraint (for
+    // example timezone or a misspelled starts_at) and approve different work.
+    const unsupported = fields && Object.keys(raw).find((key) => raw[key] != null && !fields.includes(key));
+    if (unsupported) {
+        return { error: `Unsupported ${type} schedule field "${unsupported}". Weekly and daily times use the computer's timezone from list_routines. ${SUPPORTED_SCHEDULES}` };
+    }
     if (type === "once") {
         if (typeof raw.at !== "string" || !raw.at.trim()) {
             return { error: `A once schedule needs "at": a future RFC3339 date-time with an explicit offset, for example 2026-09-01T09:00:00+05:30.` };
@@ -500,7 +514,29 @@ function routineAction(value) {
 }
 function routineFields(args) {
     const fields = {};
-    if (args.clear_timeout === true && typeof args.timeout_minutes === "number") {
+    // list_routines returns the harness names. Accept those when a model
+    // copies back a definition, as we already do for interval fields.
+    if (args.run_on != null && args.runOn != null && args.run_on !== args.runOn) {
+        return { fields, error: "Choose one run_on destination; run_on and runOn disagree." };
+    }
+    if (args.timeout_minutes != null && args.timeoutMinutes != null && args.timeout_minutes !== args.timeoutMinutes) {
+        return { fields, error: "Choose one timeout_minutes limit; timeout_minutes and timeoutMinutes disagree." };
+    }
+    const runOn = args.run_on ?? args.runOn;
+    const timeoutMinutes = args.timeout_minutes ?? args.timeoutMinutes;
+    if (runOn != null && runOn !== "maus" && runOn !== "cloud") {
+        return { fields, error: 'run_on must be "maus" or "cloud".' };
+    }
+    if (timeoutMinutes != null && (typeof timeoutMinutes !== "number" || !Number.isInteger(timeoutMinutes) || timeoutMinutes < 5 || timeoutMinutes > 240)) {
+        return { fields, error: "timeout_minutes must be a whole number from 5 to 240. Use clear_timeout to remove a limit." };
+    }
+    if (args.continuity != null && typeof args.continuity !== "boolean") {
+        return { fields, error: "continuity must be true or false." };
+    }
+    if (args.clear_timeout != null && typeof args.clear_timeout !== "boolean") {
+        return { fields, error: "clear_timeout must be true or false." };
+    }
+    if (args.clear_timeout === true && timeoutMinutes != null) {
         return { fields, error: "Choose timeout_minutes or clear_timeout, not both." };
     }
     if (typeof args.name === "string")
@@ -513,12 +549,12 @@ function routineFields(args) {
             return { fields, error: normalized.error };
         fields.schedule = normalized.schedule;
     }
-    if (typeof args.run_on === "string")
-        fields.runOn = args.run_on;
+    if (runOn != null)
+        fields.runOn = runOn;
     if (args.clear_timeout === true)
         fields.timeoutMinutes = null;
-    else if (typeof args.timeout_minutes === "number")
-        fields.timeoutMinutes = args.timeout_minutes;
+    else if (timeoutMinutes != null)
+        fields.timeoutMinutes = timeoutMinutes;
     if (typeof args.continuity === "boolean")
         fields.continuity = args.continuity;
     return { fields };