openmausbot 0.1.71 → 0.1.73

package/dist-server/server/index.js

@@ -17,7 +17,7 @@ import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
 import * as checkpoints from "./checkpoints.js";
-import { appendDecision, readDecisions } from "./decision-log.js";
+import { appendDecision, readDecisions, flushDecisionLog } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
@@ -38,17 +38,22 @@ import { ComputerControl } from "./computer-control.js";
 import { MAX_REMOTE_COMMAND_LENGTH } from "./remote-computer.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
+import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAGE_GROUPINGS, flushUsageLedger } from "./usage-ledger.js";
+import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
+import { assertWithinBudget, noteSpend, spendState } from "./spend.js";
+import { fleetAvailable, fleetRequest, fleetSocketPath } from "./fleet-client.js";
+import { entitled } from "./enterprise.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
 import { blockedTarget, buildNotification } from "./notify.js";
 import { isEffortLevel, newId, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { decodeGeneratedImage } from "./generated-image.js";
-import { MAX_MCP_SERVERS, listMcpServers, parseMcpServerMutation, parseStoredMcpServer, } from "./mcp-registry.js";
+import { MAX_MCP_SERVERS, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
 import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
 import { getOrCreateChannel, mirrorActivity, mirrorExchange, mirrorReply } from "./comms-visibility.js";
-import { readMessageText, recallMessages, searchMessages } from "./message-db.js";
+import { readMessageText, recallMessages, searchMessages, closeMessageDb } from "./message-db.js";
 import { claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
 /** A session_read answer competes with the transcript for the context
  * window; a computer-use turn's output can run to hundreds of KB. */
@@ -81,7 +86,7 @@ import { fetchSkillFromSource } from "./skill-fetch.js";
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
-import { buildSystemPrompt, computerPrompt, mentionPrompt, COMPOSIO_PROMPT, CREDENTIAL_PROMPT, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, } from "./system-prompt.js";
+import { buildSystemPrompt, computerPrompt, mentionPrompt, COMPOSIO_PROMPT, customMcpPrompt, CREDENTIAL_PROMPT, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, } from "./system-prompt.js";
 import { readCuaConnection, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { LocalVmIdleTimer } from "./local-vm-idle.js";
@@ -123,7 +128,10 @@ import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRe
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
 import { describeEdition, editionStatus, loadEnterpriseLayer } from "./enterprise.js";
-import { environmentDescriptor, loadEnvironmentId } from "./environment.js";
+import { environmentDescriptor, loadEnvironmentId, serverVersion } from "./environment.js";
+import { WorkspaceBackupMaintenance } from "./workspace-backup-maintenance.js";
+import { createWorkspaceBackupRoutes, isWorkspaceBackupSessionControl } from "./workspace-backup-http.js";
+import { applyPendingWorkspaceRestore, readLastWorkspaceRestore } from "./workspace-backup.js";
 import { createCustomDomainVerifier, customDomainIpv4, normalizeCustomDomain } from "./custom-domain.js";
 import { createEmailSignIn, parseAllowList } from "./account-signin.js";
 import { ProviderAuthSessions } from "./provider-auth-sessions.js";
@@ -167,6 +175,16 @@ function releaseDataDirLeaseAtExit() {
     }
 }
 process.once("exit", releaseDataDirLeaseAtExit);
+// Restore before constructing any long-lived config, Store, session or provider
+// objects. Replacing files underneath a live Store would overwrite restored data.
+let workspaceRestore = { restored: false };
+if (existsSync(join(DATA_DIR, ".backups"))) {
+    workspaceRestore = applyPendingWorkspaceRestore(DATA_DIR);
+    if (!workspaceRestore.restored && !workspaceRestore.rolledBack) {
+        workspaceRestore = readLastWorkspaceRestore(DATA_DIR) ?? workspaceRestore;
+    }
+}
+const workspaceMaintenance = new WorkspaceBackupMaintenance();
 // Only after ensureDirs(): it performs the one-time rename of the legacy data
 // dir, which must not find a freshly created ~/.openmausbot already there.
 // Remote clients (server/request-auth.ts, server/sessions.ts): a stable identity
@@ -214,6 +232,17 @@ const registry = new ProviderRegistry(BUILT_IN_DRIVERS);
 // Engines installed from Settings live under the data directory and win over
 // any other copy on PATH.
 registerEnginesBinDir();
+// Who asked for the next turn on a thread, noted where a message comes in
+// and read by the usage ledger when the turn settles. The last note stands
+// until the next message: a resumed connector or a drained queued send
+// still belongs to the person who wrote, and routine or peer turns are
+// told apart before this is consulted.
+const turnTriggers = new Map();
+function noteTurnTrigger(threadId, auth) {
+    turnTriggers.set(threadId, auth.kind === "session"
+        ? { kind: "user", ...(auth.session.email ? { email: auth.session.email } : {}), label: auth.session.label }
+        : { kind: "owner" });
+}
 const providerAuthSessions = new ProviderAuthSessions();
 await registry.load(instanceConfigs(cfg));
 const bundledSkills = loadBundledSkills();
@@ -1066,6 +1095,7 @@ function previewSystemPrompt(bot) {
         },
         { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
         { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? COMPOSIO_PROMPT : "" },
+        { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(customMcpServers(cfg, bot.mcpServers))) : "" },
         { id: "browser", label: "Browser", text: caps?.browserMcp && builtInBrowserEnabled(cfg) && bot.browser !== false && bot.computer !== "off" ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
         { id: "coordination", label: "Team", text: agentsMounted && coordination ? ` ${coordination}` : "" },
         { id: "credential", label: "Credentials", text: agentsMounted ? CREDENTIAL_PROMPT : "" },
@@ -2510,6 +2540,9 @@ let localVmProvisionBusy = false;
 let localVmModeChangeBusy = false;
 const activeVpsThreads = new Map();
 const boxLifecycleBusyBots = new Set();
+// A refresh is a reader, not a lifecycle change. Keep its reservation until
+// the provider settles even if the HTTP client leaves, and share it on retry.
+const vpsPreviewRequests = new Map();
 const orphanBoxLifecycleBusyIds = new Set();
 const boxInventoryRequestsBusyIds = new Set();
 const computerProviderConfigTransitions = new Set();
@@ -2558,7 +2591,7 @@ function providerOperationConflict(provider) {
     if (managedBoxOwners().some((owner) => owner.inUse)) {
         return `stop active bot work and computer control before changing ${provider === "box" ? "the Box account" : "the VPS connection"}`;
     }
-    if (boxLifecycleBusyBots.size > 0) {
+    if (boxLifecycleBusyBots.size > 0 || vpsPreviewRequests.size > 0) {
         return "wait for cloud computer actions to finish before changing provider settings";
     }
     if (provider === "box") {
@@ -2612,13 +2645,17 @@ function claimManagedBoxMutation(instance) {
     }
     return claimBotComputerLifecycle(ownerBotId);
 }
-/** One synchronous lane for every Box lifecycle consumer. Both Settings and
+/** One synchronous lane for cloud lifecycle consumers. Both Settings and
  * bot-scoped actions use it, so whichever operation starts first excludes the
- * other instead of relying on a stale check made before a provider await. */
-function claimBotComputerLifecycle(botId) {
+ * other instead of relying on a stale check made before a provider await.
+ * Only opening an existing VPS viewer may coexist with its pending preview. */
+function claimBotComputerLifecycle(botId, allowPreview = false) {
     if (boxLifecycleBusyBots.has(botId)) {
         throw Object.assign(new Error("this bot's cloud computer is being changed — wait for it to finish"), { status: 409 });
     }
+    if (!allowPreview && vpsPreviewRequests.has(botId)) {
+        throw Object.assign(new Error("a screen preview is still refreshing — wait before changing this computer"), { status: 409 });
+    }
     boxLifecycleBusyBots.add(botId);
     return () => boxLifecycleBusyBots.delete(botId);
 }
@@ -3236,6 +3273,28 @@ bus.subscribe((event) => {
                     cachedInput: tokens?.cachedInput,
                     costUsd: event.cost ?? null,
                 });
+                // and write the same figures to the month's ledger, which outlives
+                // the task and answers "what did we spend, by whom" for a period
+                const settledTask = store.taskByThread(bot.id, event.threadId);
+                const selection = settledTask?.modelSelection ?? bot.modelSelection;
+                appendUsage(DATA_DIR, {
+                    botId: bot.id,
+                    botName: bot.name,
+                    threadId: event.threadId,
+                    instanceId: selection.instanceId,
+                    driverKind: registry.get(selection.instanceId)?.driverKind ?? "unknown",
+                    model: selection.model,
+                    input: tokens?.input ?? 0,
+                    output: tokens?.output ?? 0,
+                    ...(typeof tokens?.cachedInput === "number" ? { cachedInput: tokens.cachedInput } : {}),
+                    costUsd: event.cost ?? null,
+                    trigger: routineRun
+                        ? { kind: "routine", routineId: routineRun.routineId, label: routineRun.routineName }
+                        : internal
+                            ? { kind: "bot", ...(settledTask?.openedBy?.botId ? { botId: settledTask.openedBy.botId } : {}) }
+                            : turnTriggers.get(event.threadId) ?? { kind: "owner" },
+                });
+                noteSpend(DATA_DIR, event.cost ?? null);
                 const routineReportThread = routineRun ? routineSourceThread(routineRun) : null;
                 // A routine's result belongs to its reporting thread's unread state.
                 // Its internal execution should not light up the sidebar as well.
@@ -3928,6 +3987,7 @@ async function finalScreenFrame(_botId, threadId) {
 }
 // ── turn dispatch (upstream ProviderCommandReactor, miniature) ──────────
 async function startTurn(botId, text, opts) {
+    workspaceMaintenance.assertAvailable();
     const profile = store.bot(botId);
     if (!profile)
         throw Object.assign(new Error("no such bot"), { status: 404 });
@@ -3956,6 +4016,9 @@ async function startTurn(botId, text, opts) {
         throw Object.assign(new Error(transitionError), { status: 409 });
     if (providerFleetReloading)
         throw Object.assign(new Error("provider settings are being updated — try again shortly"), { status: 409 });
+    // A workspace at its monthly spend limit starts no turn of any kind: a
+    // person's message, a routine, a peer hop or a webhook all stop here.
+    assertWithinBudget(cfg, DATA_DIR);
     if (checkpointRestoreLeases.has(botId)) {
         throw Object.assign(new Error("this bot's project files are being restored — wait for the restore to finish"), {
             status: 409,
@@ -4184,7 +4247,7 @@ async function startTurn(botId, text, opts) {
             // composio — only to a driver that can mount them. Their tools are
             // never pre-allowed, so every call rides the normal permission flow.
             if (instance.adapter.capabilities.customMcp === true) {
-                const custom = customMcpServers(cfg);
+                const custom = customMcpServers(cfg, bot.mcpServers);
                 if (Object.keys(custom).length)
                     integrations.custom = custom;
             }
@@ -4544,6 +4607,7 @@ async function startTurn(botId, text, opts) {
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
                 { id: "composio", label: "Connected apps", text: integrations.composio ? COMPOSIO_PROMPT : "" },
+                { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
                 { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
                 { id: "coordination", label: "Team", text: coordinationPrompt ? ` ${coordinationPrompt}` : "" },
                 { id: "credential", label: "Credentials", text: credentialPrompt },
@@ -5217,7 +5281,10 @@ const webhooks = new WebhookManager({
 let webhookIngress = null;
 let webhookIngressError = null;
 try {
-    webhookIngress = await listenWebhookIngress(webhooks, { port: WEBHOOK_PORT, publicBaseUrl: WEBHOOK_PUBLIC_URL });
+    webhookIngress = await listenWebhookIngress(webhooks, {
+        port: WEBHOOK_PORT, publicBaseUrl: WEBHOOK_PUBLIC_URL,
+        claimRequest: () => workspaceMaintenance.request(),
+    });
     const advertised = WEBHOOK_PUBLIC_URL ? ` (advertised as ${webhookIngress.baseUrl})` : "";
     console.log(`openmausbot webhook receiver on http://${webhookIngress.host}:${webhookIngress.port}${advertised}`);
 }
@@ -5296,6 +5363,10 @@ operation,
 // execution setting changes in that gap, rebuild the turn once from the
 // fresh bot rather than mixing a stale adapter with fresh permissions.
 setupRetry = 0) {
+    if (workspaceMaintenance.active) {
+        onDispatchError?.("A workspace backup or restore is in progress.");
+        return false;
+    }
     if (isCancelled?.())
         return false;
     if (providerFleetReloading) {
@@ -5416,7 +5487,7 @@ setupRetry = 0) {
         }
         // user-configured MCP servers: same gating as the 1:1 site above.
         if (instance.adapter.capabilities.customMcp === true) {
-            const custom = customMcpServers(cfg);
+            const custom = customMcpServers(cfg, bot.mcpServers);
             if (Object.keys(custom).length)
                 integrations.custom = custom;
         }
@@ -5629,6 +5700,7 @@ setupRetry = 0) {
                 store.patchBot(bot.id, { soulDrift: drift.drift });
         }
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
+            { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
             { id: "computer", label: "Computer", text: computerPrompt(roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
@@ -7260,6 +7332,19 @@ async function perBotLocalVmCountForModeChange() {
 function configStatus() {
     return {
         xai: { configured: Boolean(cfg.xai?.key) },
+        anthropic: { configured: Boolean(cfg.anthropic?.key) },
+        // a fleet agent on this server means Settings → Workspaces has something to drive
+        fleet: { available: fleetAvailable(fleetSocketPath()) },
+        // what this build is entitled to, so Settings shows only what works here
+        edition: (({ edition, features }) => ({ edition, features }))(editionStatus()),
+        // settings, not secrets: the cap and the operator's own price list
+        budgets: {
+            ...(cfg.budgets?.monthlyUsd !== undefined ? { monthlyUsd: cfg.budgets.monthlyUsd } : {}),
+            ...(cfg.budgets?.warnAtPercent !== undefined ? { warnAtPercent: cfg.budgets.warnAtPercent } : {}),
+        },
+        billing: { currency: cfg.billing?.currency ?? "USD", prices: cfg.billing?.prices ?? {} },
+        // the base URL is a setting, not a secret; the key stays write-only
+        openaiCompat: { configured: Boolean(cfg.openaiCompat?.key), url: cfg.openaiCompat?.url ?? "" },
         composio: {
             configured: composio.configured(cfg),
             mode: composio.connectionMode(cfg),
@@ -7537,6 +7622,39 @@ function readBody(req, limit = 1_000_000) {
 // requests from any loopback connection and any web page that DNS-rebinds
 // onto it. Reject non-loopback Hosts outright (defeats rebinding) and
 // origins outside loopback (blocks remote-web CSRF).
+const workspaceBackupRoutes = createWorkspaceBackupRoutes({
+    dataDir: DATA_DIR,
+    appVersion: serverVersion(),
+    readBody,
+    restored: workspaceRestore,
+    status: () => ({ busy: workspaceMaintenance.active, pendingRestore: workspaceMaintenance.pendingRestore }),
+    authorized: (req, original) => {
+        const current = resolveRequestAuth(req, {
+            sessions, cookieName: SESSION_COOKIE, streamPath: "/api/events",
+            url: new URL(req.url ?? "/", `http://localhost:${PORT}`),
+            loopbackMutationToken: desktopMutationToken, companionMutationToken,
+        }).auth;
+        return Boolean(current?.scopes.includes("admin") && current.kind === original.kind &&
+            (current.kind !== "session" || (original.kind === "session" && current.session.id === original.session.id)));
+    },
+    exclusive: (work, keepLocked) => workspaceMaintenance.run(work, {
+        idle: () => !providerFleetReloading && !providerAuthSessions.active && !browserEngineInstall &&
+            !routines?.isTicking && !calendarCalls?.isTicking &&
+            !localVmImageBusy && !localVmProvisionBusy && !localVmModeChangeBusy &&
+            !localVmLifecycleBusy.size && !boxLifecycleBusyBots.size && !vpsPreviewRequests.size && !orphanBoxLifecycleBusyIds.size &&
+            !computerProviderConfigTransitions.size && !checkpointRestoreLeases.size &&
+            store.bots.every((bot) => !botHasActiveTurn(bot.id) && !routines?.activeRunForBot(bot.id) && !computerControl.snapshot(bot.id).held) &&
+            store.groups.every((group) => !groupIsWorking(group)),
+        pause: () => { routines?.stop(); calendarCalls?.stop(); watchdog.stop(); },
+        resume: () => { routines?.start(); calendarCalls?.start(); watchdog.start(); },
+        flush: async () => {
+            await Promise.all([flushAllProfileHistory(), flushAllMemoryJournals(), flushUsageLedger(DATA_DIR), flushDecisionLog(DATA_DIR)]);
+            // With writers gated and work idle, release our WAL connection for the
+            // consistent snapshot. Store reopens it lazily after maintenance.
+            closeMessageDb();
+        },
+    }, keepLocked),
+});
 const handleRequest = async (req, res) => {
     let url;
     try {
@@ -7549,6 +7667,7 @@ const handleRequest = async (req, res) => {
     const method = req.method ?? "GET";
     /** scratch for route matches, shared by every `path.match` below */
     let m = null;
+    let releaseWorkspaceRequest;
     try {
         // ── who is asking (server/request-auth.ts) ──────────────────────────
         // Two public routes come first: what this server is, and turning a pairing
@@ -7666,6 +7785,13 @@ const handleRequest = async (req, res) => {
         if (!gate.auth)
             return json(res, gate.status, { error: gate.error });
         const auth = gate.auth;
+        if (await workspaceBackupRoutes(req, res, path, auth))
+            return;
+        // Count ordinary requests until their asynchronous handler returns, not
+        // merely until the browser disconnects. A cancelled upload can still write.
+        if (path.startsWith("/api/") && path !== "/api/events" && path !== "/api/health" && !isWorkspaceBackupSessionControl(method, path)) {
+            releaseWorkspaceRequest = workspaceMaintenance.request();
+        }
         // ── sessions: who am I, tickets, pairing and revocation ─────────────
         if (method === "GET" && path === "/api/auth/session") {
             return json(res, 200, auth.kind === "loopback"
@@ -10350,6 +10476,13 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "threadId must be a task id" });
             }
             const threadId = body.threadId ?? group.threadId;
+            noteTurnTrigger(threadId, auth);
+            try {
+                assertWithinBudget(cfg, DATA_DIR);
+            }
+            catch (error) {
+                return json(res, 409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
+            }
             const ownsThread = group.dm
                 ? group.threadId === threadId
                 : Boolean(store.groupTaskByThread(group.id, threadId));
@@ -10829,6 +10962,27 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "composio must be true or false" });
                 patch.composio = body.composio;
             }
+            // Per-bot selection of app-wide MCP servers. Omitted keeps the current
+            // selection; null restores all enabled servers; [] explicitly mounts none.
+            let requestedMcpServers = existingBot?.mcpServers;
+            if (body.mcpServers !== undefined) {
+                if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                    return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
+                }
+                if (body.mcpServers === null) {
+                    requestedMcpServers = undefined;
+                }
+                else if (!Array.isArray(body.mcpServers) || body.mcpServers.some((t) => typeof t !== "string" || mcpServerNameError(t) !== null)) {
+                    return json(res, 400, { error: "mcpServers must be a list of server names, or null" });
+                }
+                else {
+                    requestedMcpServers = [...new Set(body.mcpServers)];
+                    if (requestedMcpServers.length > MAX_MCP_SERVERS) {
+                        return json(res, 400, { error: `Select at most ${MAX_MCP_SERVERS} MCP servers.` });
+                    }
+                }
+                patch.mcpServers = requestedMcpServers;
+            }
             // per-bot gate on the app's built-in browser
             if (body.browser !== undefined) {
                 if (typeof body.browser !== "boolean")
@@ -11045,6 +11199,10 @@ const handleRequest = async (req, res) => {
             if (Array.isArray(patch.alwaysAllow) && patch.alwaysAllow.some((key) => !(existingBot?.alwaysAllow ?? []).includes(key))) {
                 loosened.push("alwaysAllow");
             }
+            if (body.mcpServers !== undefined && Array.isArray(existingBot?.mcpServers) &&
+                (requestedMcpServers === undefined || requestedMcpServers.some((name) => !existingBot.mcpServers.includes(name)))) {
+                loosened.push("mcpServers");
+            }
             const browserOrigin = typeof req.headers.origin === "string" && req.headers.origin.trim() !== "";
             if (loosened.length && auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin) {
                 if (store.bots.some((candidate) => candidate.busy)) {
@@ -11073,6 +11231,23 @@ const handleRequest = async (req, res) => {
                 sectionKey(existingBot?.section) !== sectionKey(section);
             let bot;
             const freshBrowserBot = store.bot(m[1]);
+            // Custom servers are process configuration: a running turn cannot
+            // unmount them. Recheck after any awaited runtime revocation above.
+            if (body.mcpServers !== undefined) {
+                if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                    return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
+                }
+                if (Array.isArray(freshBrowserBot?.mcpServers) &&
+                    (requestedMcpServers === undefined || requestedMcpServers.some((name) => !freshBrowserBot.mcpServers.includes(name))) &&
+                    auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin && store.bots.some((candidate) => candidate.busy)) {
+                    return json(res, 409, { error: "A bot is working right now, so this change has to come from the desktop app or a paired device. Try again once every bot is idle." });
+                }
+                if (freshBrowserBot &&
+                    JSON.stringify(requestedMcpServers?.toSorted()) !== JSON.stringify(freshBrowserBot.mcpServers?.toSorted()) &&
+                    (freshBrowserBot.busy || activeGroupTurnForBot(freshBrowserBot.id))) {
+                    return json(res, 409, { error: "Stop this bot's turns before changing its MCP servers." });
+                }
+            }
             if (normalizedSelection && selectedTask) {
                 const current = store.projectBotForTask(selectedTask.id, selectedTask.threadId);
                 if (!current)
@@ -11814,6 +11989,15 @@ const handleRequest = async (req, res) => {
             // receipt after a task switch, while a genuinely new send still has to
             // target the task that is active now.
             const threadId = body.threadId ?? bot.threadId;
+            noteTurnTrigger(threadId, auth);
+            // The send is acknowledged before the turn starts, so a workspace at its
+            // spend limit is refused here, where the person can see it.
+            try {
+                assertWithinBudget(cfg, DATA_DIR);
+            }
+            catch (error) {
+                return json(res, 409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
+            }
             if (!store.taskByThread(bot.id, threadId)) {
                 return json(res, 409, { error: "the bot switched tasks before it could receive the message" });
             }
@@ -12589,6 +12773,39 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 202, { installing: true });
         }
+        // ── the fleet: client workspaces on this server, through the root agent ──
+        // Admin scope by default plus the `admin` entitlement; the socket's own
+        // permissions decide whether this workspace may drive the agent at all.
+        const fleetRoute = /^\/api\/fleet(?:\/(workspaces(?:\/([a-z0-9-]+)(?:\/(users|suspend|resume))?)?|upgrade))?$/.exec(path);
+        if (fleetRoute) {
+            if (!entitled("admin"))
+                return json(res, 403, { error: "Workspaces need an enterprise licence with the admin feature." });
+            const socket = fleetSocketPath();
+            if (!fleetAvailable(socket))
+                return json(res, 404, { error: "No fleet agent on this server. Run `openmausbot fleet init --domain … --operator <this user>` as root." });
+            const [, resource, slug, sub] = fleetRoute;
+            let forward = null;
+            if (method === "GET" && !resource)
+                forward = { method: "GET", path: "/workspaces" };
+            else if (method === "POST" && resource === "workspaces")
+                forward = { method: "POST", path: "/workspaces", body: await readBody(req, 256 * 1024) };
+            else if (method === "POST" && resource === "upgrade")
+                forward = { method: "POST", path: "/upgrade" };
+            else if (slug && method === "POST" && (sub === "users" || sub === "suspend" || sub === "resume"))
+                forward = { method: "POST", path: `/workspaces/${slug}/${sub}`, ...(sub === "users" ? { body: await readBody(req, 8192) } : {}) };
+            else if (slug && method === "DELETE" && !sub)
+                forward = { method: "DELETE", path: `/workspaces/${slug}`, body: await readBody(req, 8192) };
+            if (!forward)
+                return json(res, 405, { error: "no such fleet operation" });
+            res.setHeader("cache-control", "no-store");
+            try {
+                const reply = await fleetRequest(socket, forward.method, forward.path, forward.body);
+                return json(res, reply.status, reply.body ?? {});
+            }
+            catch (error) {
+                return json(res, 502, { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
         // Which edition this server runs and why (see server/enterprise.ts). Read-only.
         if (method === "GET" && path === "/api/edition") {
             return json(res, 200, editionStatus());
@@ -12619,6 +12836,62 @@ const handleRequest = async (req, res) => {
         // Read-only like the inspector above: the rows were written at the
         // request.opened fold and in answerRequest; this only reads them back,
         // newest last, same order as thread events.
+        // ── the usage ledger: what this workspace spent over a period ──
+        // Read-only over the month files usage-ledger.ts appends at turn.completed.
+        // Admin scope by default, like every route not opened to clients.
+        if (method === "GET" && (path === "/api/usage" || path === "/api/usage.csv")) {
+            const range = parseUsageRange(url.searchParams.get("from"), url.searchParams.get("to"));
+            if (!range)
+                return json(res, 400, { error: "from and to must be YYYY-MM-DD, from no later than to, at most a year apart" });
+            const rows = readUsage(DATA_DIR, range);
+            // The operator's price list is applied only with the billing entitlement.
+            const prices = entitled("billing") && cfg.billing?.prices && Object.keys(cfg.billing.prices).length ? cfg.billing.prices : null;
+            if (path === "/api/usage.csv") {
+                const stamp = (date) => date.toISOString().slice(0, 10);
+                res.writeHead(200, {
+                    "content-type": "text/csv; charset=utf-8",
+                    "content-disposition": `attachment; filename="usage-${stamp(range.from)}-${stamp(range.to)}.csv"`,
+                    "cache-control": "no-store",
+                });
+                res.end(usageCsv(rows, prices));
+                return;
+            }
+            const requested = url.searchParams.get("groupBy") ?? "bot";
+            if (!USAGE_GROUPINGS.includes(requested)) {
+                return json(res, 400, { error: `groupBy must be one of ${USAGE_GROUPINGS.join(", ")}` });
+            }
+            const groupBy = requested;
+            res.setHeader("cache-control", "no-store");
+            return json(res, 200, {
+                from: range.from.toISOString(),
+                to: range.to.toISOString(),
+                groupBy,
+                ...summarizeUsage(rows, groupBy, prices),
+                budget: spendState(cfg, DATA_DIR),
+                billing: prices ? { currency: cfg.billing?.currency ?? "USD" } : null,
+            });
+        }
+        // ── provider key check: does a pasted or saved key open the provider's door ──
+        // One read-only request from this server; the verdict never carries the
+        // key. Admin scope by default, like every route not opened to clients.
+        if (method === "POST" && path === "/api/keys/test") {
+            const body = await readBody(req, 8192);
+            const provider = body?.provider;
+            if (!PROVIDER_KEY_KINDS.includes(provider)) {
+                return json(res, 400, { error: `provider must be one of ${PROVIDER_KEY_KINDS.join(", ")}` });
+            }
+            const kind = provider;
+            const saved = kind === "anthropic" ? cfg.anthropic : kind === "openaiCompat" ? cfg.openaiCompat : cfg.xai;
+            const pasted = typeof body?.key === "string" ? body.key.trim() : "";
+            const key = pasted || saved?.key || "";
+            if (!key)
+                return json(res, 400, { error: "No key to test. Paste one or save one first." });
+            if (key.length > 512)
+                return json(res, 400, { error: "That does not look like an API key." });
+            const url = typeof body?.url === "string" && body.url.trim() ? body.url.trim() : saved?.url;
+            res.setHeader("cache-control", "no-store");
+            return json(res, 200, await checkProviderKey({ provider: kind, key, url }));
+        }
         if (method === "GET" && path === "/api/decisions") {
             const rawLimit = url.searchParams.get("limit");
             const parsedLimit = rawLimit === null ? undefined : Number(rawLimit);
@@ -12941,6 +13214,42 @@ const handleRequest = async (req, res) => {
                 mcpConfigBusy = false;
             }
         }
+        // Paste-to-add: the {"mcpServers": {...}} block every other agent tool
+        // writes. Same rules as POST: disabled until explicitly enabled.
+        if (method === "POST" && path === "/api/mcp/servers/import") {
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            if (mcpConfigBusy)
+                return json(res, 409, { error: "MCP servers are already being updated." });
+            mcpConfigBusy = true;
+            try {
+                const body = await readBody(req);
+                const text = typeof body?.json === "string" ? body.json : "";
+                if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                    return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
+                }
+                if (!text.trim())
+                    return json(res, 400, { error: "Paste the JSON block first." });
+                const parsed = parseMcpServersImport(text);
+                if (!parsed.ok)
+                    return json(res, 400, { error: parsed.error });
+                const current = cfg.mcpServers ?? {};
+                const names = Object.keys(parsed.servers);
+                const taken = names.filter((name) => Object.hasOwn(current, name));
+                if (taken.length) {
+                    return json(res, 409, { error: `Already added: ${taken.join(", ")}. Remove or rename ${taken.length === 1 ? "it" : "them"} first.` });
+                }
+                if (Object.keys(current).length + names.length > MAX_MCP_SERVERS) {
+                    return json(res, 400, { error: `You can add at most ${MAX_MCP_SERVERS} MCP servers.` });
+                }
+                persistMcpServers({ ...current, ...parsed.servers });
+                return json(res, 201, { ...mcpServerResponse(), added: names });
+            }
+            finally {
+                mcpConfigBusy = false;
+            }
+        }
         const mcpServerRoute = /^\/api\/mcp\/servers\/([a-z][a-z0-9_-]{0,31})$/.exec(path);
         if (mcpServerRoute && ["PUT", "PATCH", "DELETE"].includes(method)) {
             if (method !== "DELETE" && !String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
@@ -13730,7 +14039,19 @@ const handleRequest = async (req, res) => {
                 return json(res, 409, { error: "this bot's cloud computer is being changed — wait for it to finish" });
             }
             if (bot.cloudBackend === "vps") {
-                const releaseComputerLifecycle = claimBotComputerLifecycle(botId);
+                if (m[2] === "screenshot") {
+                    let preview = vpsPreviewRequests.get(botId);
+                    if (!preview) {
+                        preview = vps.vpsComputerScreenshot(cfg, botId).finally(() => {
+                            vpsPreviewRequests.delete(botId);
+                        });
+                        vpsPreviewRequests.set(botId, preview);
+                    }
+                    return json(res, 200, await preview);
+                }
+                // Opening the existing SSH viewer can coexist with a capture. Start,
+                // stop, remove and Settings deletion still exclude pending previews.
+                const releaseComputerLifecycle = claimBotComputerLifecycle(botId, m[2] === "join");
                 try {
                     if (m[2] === "exec") {
                         return json(res, 409, { error: "the VPS console is available to the bot through its scoped computer tools" });
@@ -13744,8 +14065,6 @@ const handleRequest = async (req, res) => {
                     if (m[2] === "join") {
                         return json(res, 200, await vps.vpsComputerJoin(cfg, botId));
                     }
-                    if (m[2] === "screenshot")
-                        return json(res, 200, await vps.vpsComputerScreenshot(cfg, botId));
                     const action = m[2] === "provision" ? "provision" : m[2] === "remove" ? "remove" : "stop";
                     return json(res, 200, await vps.vpsComputerAction(action, cfg, botId));
                 }
@@ -13806,6 +14125,9 @@ const handleRequest = async (req, res) => {
         const status = e?.status ?? 500;
         return json(res, status, { error: e instanceof Error ? e.message : String(e) });
     }
+    finally {
+        releaseWorkspaceRequest?.();
+    }
 };
 const server = createServer(handleRequest);
 calendarCalls.start();
@@ -13887,11 +14209,14 @@ const gracefulShutdown = createGracefulShutdown({
         },
         () => flushAllProfileHistory(),
         () => flushAllMemoryJournals(),
+        () => flushUsageLedger(DATA_DIR),
+        () => flushDecisionLog(DATA_DIR),
     ],
     // Cleanup jobs run concurrently. Release only after they settle (or reach
     // the shutdown deadline), immediately before the process exits, so no new
     // server can overlap with a still-mutating old one.
     exit: (code) => {
+        closeMessageDb();
         releaseDataDirLeaseAtExit();
         process.exit(code);
     },

package/dist-server/server/local-computer.js

@@ -24,6 +24,10 @@ export function gatedLocalComputer(connection, control) {
         args: ["--experimental-strip-types", SPAWNED_PROXIES.localComputer],
         env: {
             ...connection.env,
+            // In a packaged desktop process execPath is Electron, not node. Without
+            // this the MCP client relaunches OMB, whose single-instance handler
+            // focuses the user's window, instead of starting the headless gate.
+            ELECTRON_RUN_AS_NODE: "1",
             OMB_CUA_COMMAND: connection.command,
             OMB_CUA_ARGS: JSON.stringify(connection.args),
             OMB_CONTROL_URL: control.url,