openmausbot 0.1.78 → 0.1.80

package/dist-server/server/managed-desktop.js

@@ -0,0 +1,205 @@
+import { createHash } from "node:crypto";
+import { lstatSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+const uuid = z.string().uuid();
+const model = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._/:+-]{0,199}$/).refine(value => !value.includes("::"));
+const connectionSchema = z.object({
+    portalOrigin: z.string().max(2048), organizationId: uuid, organizationName: z.string().trim().min(1).max(100),
+    email: z.string().email().max(320), deviceId: uuid, token: z.string().regex(/^omg_[A-Za-z0-9_-]{43}$/),
+    expiresAt: z.number().finite().int().positive(),
+    providers: z.array(z.object({ id: z.enum(["anthropic", "openai", "openrouter"]), configured: z.boolean(), models: z.array(model).max(500) }).strict()).max(3),
+}).strict();
+const signature = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const expiredMessage = "Company access has ended. Reconnect your organization or explicitly choose a personal model; personal billing will not be used automatically.";
+/** Validate only messages received over Electron's private utility-parent port.
+ * Never expose this input to renderer HTTP or merge it into saved AppConfig.
+ */
+export function parseManagedDesktopConnection(raw, now = Date.now()) {
+    if (raw === null)
+        return null;
+    const parsed = connectionSchema.safeParse(raw);
+    if (!parsed.success)
+        throw new Error("Invalid Company connection from the desktop parent.");
+    const value = parsed.data, url = new URL(value.portalOrigin);
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash ||
+        (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)))) {
+        throw new Error("Company connection must use an HTTPS origin or loopback fixture.");
+    }
+    if (value.expiresAt <= now)
+        throw new Error("Company connection expired. Reconnect your organization.");
+    if (new Set(value.providers.map(provider => provider.id)).size !== value.providers.length)
+        throw new Error("Duplicate Company provider configuration.");
+    return { ...value, portalOrigin: url.origin, email: value.email.toLowerCase(), providers: value.providers.map(provider => ({ ...provider, models: [...new Set(provider.models)] })).sort((a, b) => a.id.localeCompare(b.id)) };
+}
+export function companyInstanceId(connection, provider) {
+    // Device identity prevents an old company's native resume cursor from being
+    // inherited by a different enrollment using the same organization/email.
+    return `company.${signature([connection.portalOrigin, connection.organizationId, connection.deviceId]).slice(0, 24)}.${provider}`;
+}
+export function companyInstanceConfigs(connection, runtimeDirectory) {
+    const entries = {};
+    for (const provider of connection.providers) {
+        if (!provider.configured || !provider.models.length)
+            continue;
+        const id = companyInstanceId(connection, provider.id), base = `${connection.portalOrigin}/api/desktop/gateway/${provider.id}`;
+        const displayName = `Company · ${connection.organizationName} · ${provider.id === "anthropic" ? "Claude" : provider.id === "openai" ? "Codex" : "OpenRouter"}`;
+        if (provider.id === "anthropic")
+            entries[id] = {
+                driver: "claudeAgent", displayName,
+                config: { configDir: join(runtimeDirectory, id, "claude"), managed: true },
+                environment: { ANTHROPIC_API_KEY: connection.token, ANTHROPIC_AUTH_TOKEN: connection.token, ANTHROPIC_BASE_URL: base, ANTHROPIC_MODEL: provider.models[0] },
+            };
+        if (provider.id === "openai")
+            entries[id] = {
+                driver: "codex", displayName, config: { managed: { url: `${base}/v1`, models: provider.models } },
+                environment: { OPENMAUSBOT_COMPANY_API_KEY: connection.token, CODEX_HOME: join(runtimeDirectory, id, "codex") },
+            };
+        if (provider.id === "openrouter")
+            entries[id] = {
+                driver: "openai-compat", displayName, config: { url: `${base}/v1`, apiKeyEnv: "OPENMAUSBOT_COMPANY_API_KEY", model: provider.models[0], provider: "" },
+                environment: { OPENMAUSBOT_COMPANY_API_KEY: connection.token },
+            };
+    }
+    return entries;
+}
+/** One memory-only Company overlay, separate from all personal settings.
+ * Revocation fences wrappers synchronously, then stops only their instances.
+ */
+export class ManagedDesktopProviders {
+    connection = null;
+    currentSignature = signature(null);
+    revision = 0;
+    ids = new Set();
+    tail = Promise.resolve();
+    timer;
+    now;
+    options;
+    constructor(options) { this.options = options; this.now = options.now ?? Date.now; }
+    info(instanceId) {
+        if (!this.ids.has(instanceId) || !this.connection || this.connection.expiresAt <= this.now())
+            return;
+        return { organizationId: this.connection.organizationId, organizationName: this.connection.organizationName };
+    }
+    /** Ids this overlay has ever created in this process, so a personal instance
+     * that happens to be named company.* is never treated as managed. */
+    known = new Set();
+    owns(instanceId) { return this.known.has(instanceId); }
+    apply(raw, force = false) {
+        const connection = parseManagedDesktopConnection(raw, this.now()), nextSignature = signature(connection);
+        if (!force && nextSignature === this.currentSignature)
+            return this.tail;
+        this.currentSignature = nextSignature;
+        this.connection = connection;
+        const revision = ++this.revision;
+        clearTimeout(this.timer);
+        const replace = async () => {
+            const previous = [...this.ids];
+            await this.options.beforeReplace?.(previous);
+            for (const id of previous)
+                await this.options.registry.dispose(id);
+            this.ids.clear();
+            if (revision !== this.revision || !connection || connection.expiresAt <= this.now()) {
+                this.options.afterReplace?.([]);
+                return;
+            }
+            // Keep native sessions across server/app restarts, but outside portable
+            // workspace backups. Device-scoped ids prevent a new enrollment from
+            // inheriting another account's native conversation or credentials.
+            const directory = this.ensureDirectory(["providers", "company"]);
+            const configs = companyInstanceConfigs(connection, directory);
+            for (const [id, entry] of Object.entries(configs)) {
+                if (this.options.registry.entries().some(existing => existing.instanceId === id))
+                    throw new Error("Company instance conflicts with an existing account.");
+                if (entry.driver === "claudeAgent" || entry.driver === "codex") {
+                    this.ensureDirectory(["providers", "company", id, entry.driver === "claudeAgent" ? "claude" : "codex"]);
+                }
+                this.ids.add(id);
+                this.known.add(id);
+            }
+            const active = () => revision === this.revision && connection.expiresAt > this.now();
+            await this.options.registry.load(configs, instance => {
+                const provider = connection.providers.find(provider => companyInstanceId(connection, provider.id) === instance.instanceId);
+                const models = { default: provider.models[0], options: provider.models.map(id => ({ id, label: `${id} (Company)` })) };
+                return {
+                    ...instance, models,
+                    refreshModels: async () => { },
+                    startAuthentication: undefined, getAuthentication: undefined, completeAuthentication: undefined, cancelAuthentication: undefined, signOut: undefined,
+                    snapshot: async () => {
+                        if (!active())
+                            return { state: "unavailable", reason: expiredMessage };
+                        const snapshot = await instance.snapshot();
+                        if (!active())
+                            return { state: "unavailable", reason: expiredMessage };
+                        return { ...snapshot, authenticated: snapshot.state === "available", billing: "metered", account: { email: connection.email, organization: connection.organizationName, method: "api-key" } };
+                    },
+                    adapter: {
+                        ...instance.adapter,
+                        sendTurn: async (input) => {
+                            if (!active())
+                                throw new Error(expiredMessage);
+                            if (!input.model || !provider.models.includes(input.model))
+                                throw new Error("This model is not enabled by your Company administrator.");
+                            return instance.adapter.sendTurn(input);
+                        },
+                    },
+                };
+            });
+            if (revision === this.revision) {
+                this.options.afterReplace?.([...this.ids]);
+                this.scheduleExpiry(connection, revision);
+            }
+        };
+        this.tail = this.tail.catch(() => { }).then(replace).catch(async (error) => {
+            // A partial replacement must neither retain usable Company wrappers
+            // nor memoize failure forever. Do not invalidate a newer queued grant.
+            if (revision === this.revision) {
+                this.revision++;
+                this.connection = null;
+                this.currentSignature = null;
+                clearTimeout(this.timer);
+            }
+            await Promise.allSettled([...this.ids].map(id => this.options.registry.dispose(id)));
+            this.ids.clear();
+            this.options.afterReplace?.([]);
+            throw error;
+        });
+        return this.tail;
+    }
+    /** Called after the ordinary fleet is rebuilt; never add Company to cfg. */
+    restore() { return this.apply(this.connection && this.connection.expiresAt > this.now() ? this.connection : null, true); }
+    ensureDirectory(parts) {
+        // Only the configured workspace root may already be an operator-chosen
+        // alias. None of our owned descendants may redirect into personal homes.
+        mkdirSync(this.options.dataDirectory, { recursive: true, mode: 0o700 });
+        let directory = this.options.dataDirectory;
+        for (const part of parts) {
+            directory = join(directory, part);
+            try {
+                mkdirSync(directory, { mode: 0o700 });
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+            const stat = lstatSync(directory);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                throw new Error("Company native storage must be an owned workspace directory.");
+        }
+        return directory;
+    }
+    scheduleExpiry(connection, revision) {
+        this.timer = setTimeout(() => {
+            if (revision !== this.revision)
+                return;
+            if (connection.expiresAt > this.now())
+                this.scheduleExpiry(connection, revision);
+            else
+                void this.apply(null).catch(() => { });
+        }, Math.min(2_147_483_647, Math.max(1, connection.expiresAt - this.now())));
+        this.timer.unref?.();
+    }
+    async close() {
+        await this.apply(null, true);
+    }
+}

package/dist-server/server/model-context-window.js

@@ -0,0 +1,20 @@
+// The model's window, when the driver did not say. A conservative pattern
+// table over the model id: a wrong window would put a wrong percentage next
+// to the context figure, so unknown models get no window and the chip shows
+// the absolute count alone.
+export function modelContextWindow(model) {
+    if (!model)
+        return undefined;
+    const id = model.toLowerCase();
+    if (/claude/.test(id) || /^(opus|sonnet|haiku|fable)\b/.test(id))
+        return /\[1m\]|-1m\b|1m-context/.test(id) ? 1_000_000 : 200_000;
+    if (/^(gpt-5|o[34]\b|codex)/.test(id))
+        return 272_000;
+    if (id.startsWith("gpt-4.1"))
+        return 1_000_000;
+    if (/gemini/.test(id))
+        return 1_000_000;
+    if (id.startsWith("grok"))
+        return 256_000;
+    return undefined;
+}

package/dist-server/server/proxy-paths.js

@@ -32,7 +32,6 @@ export function resolveProxy(relative) {
  * the check that would have caught the 0.1.24 breakage. */
 export const SPAWNED_PROXIES = {
     browser: resolveProxy("browser-proxy"),
-    computer: resolveProxy("computer-proxy"),
     localComputer: resolveProxy("local-computer-proxy"),
     permission: resolveProxy("permission-proxy"),
     containerMcp: resolveProxy("container-mcp"),

package/dist-server/server/redact.js

@@ -34,6 +34,7 @@ const mask = (value) => (REDACTION_MARKER.test(value) ? value : `«redacted ${va
 // generic "long hex/base64" heuristic would rewrite real code in the
 // transcript, so only shapes that are unmistakably credentials match.
 const KEY_PREFIXES = [
+    /\bom[dg]_[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/g, // desktop device and model-only credentials
     /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, // anthropic / openai / stripe
     /\bxai-[A-Za-z0-9_-]{20,}/g, // xai (grok)
     /\bgsk_[A-Za-z0-9]{40,}/g, // groq

package/dist-server/server/room-handoffs.js

@@ -8,11 +8,13 @@ const nodeSchema = z.object({
     key: z.string(), text: z.string(), createdAt: z.number(),
     status: z.enum(["source", "queued", "running", "waiting", "resume", "completed", "failed", "cancelled"]),
     result: z.string().default(""), reported: z.boolean().default(false),
-    executions: z.number().int().nonnegative().default(0),
+    executions: z.number().int().nonnegative().default(0), startedAt: z.number().optional(),
     approvalGranted: z.boolean().default(false),
     kind: z.enum(["work", "assignment"]).default("work"),
 });
-export const ROOM_HANDOFF_LIMITS = { depth: 4, requests: 24, executions: 48, lifetimeMs: 30 * 60_000 };
+export const ROOM_HANDOFF_LIMITS = { depth: 4, requests: 24, executions: 48, lifetimeMs: 30 * 60_000, minRunwayMs: 10 * 60_000, queueMs: 60 * 60_000 };
+/** Renders elapsed milliseconds as whole minutes, or seconds under one minute. */
+const duration = (ms) => ms >= 60_000 ? `${Math.floor(ms / 60_000)}m` : `${Math.floor(ms / 1000)}s`;
 const terminal = (n) => ["completed", "failed", "cancelled"].includes(n.status);
 /** A bounded tree of addressed room turns. Waiting for children never holds a
  * room/provider queue; reporting is data, and only the named parent is resumed.
@@ -65,6 +67,41 @@ export class RoomHandoffs {
         }
         return path;
     }
+    /** The earliest moment this node may be failed for lifetime: the tree
+     * ceiling, a running node's own start plus a minimum runway, or, for work
+     * parked in a busy teammate's queue, its own queue window (#1238). */
+    deadline(n) {
+        const anchor = n.status === "running" ? n.startedAt ?? n.createdAt : n.createdAt;
+        const ceiling = n.status === "queued" && n.executions === 0
+            ? anchor + ROOM_HANDOFF_LIMITS.queueMs
+            : this.root(n).createdAt + ROOM_HANDOFF_LIMITS.lifetimeMs;
+        return Math.max(ceiling, anchor + ROOM_HANDOFF_LIMITS.minRunwayMs);
+    }
+    /** An ancestor past its ceiling is not failed while a descendant is still
+     * running inside its own runway; cancelling would cascade into that work. */
+    protectsRunner(n) {
+        return this.children(n.id).some(c => !terminal(c) && ((c.status === "running" && this.now() <= this.deadline(c)) || this.protectsRunner(c)));
+    }
+    /** A parent still owes the follow-up execution that decides on its
+     * children's results; the ceiling defers to that execution's own runway.
+     * A child parked in a queue has produced nothing to decide on yet. */
+    owesFollowUp(n) {
+        if (n.status === "resume")
+            return true;
+        if (n.status !== "waiting")
+            return false;
+        const children = this.children(n.id);
+        return (children.length > 0 && children.every(c => terminal(c))) ||
+            children.some(c => this.owesFollowUp(c) || (c.status === "queued" && c.executions === 0));
+    }
+    /** Names the budget, the node's status, and the elapsed time. Work that
+     * never started reports the queue window it waited out, not the tree's. */
+    lifetimeError(n) {
+        if (n.status === "queued" && n.executions === 0) {
+            return `Room handoff queue budget exhausted: never started while waiting for a busy teammate after ${duration(this.now() - n.createdAt)} of the ${duration(ROOM_HANDOFF_LIMITS.queueMs)} queue window`;
+        }
+        return `Room handoff lifetime budget exhausted: node was ${n.status} after ${duration(this.now() - this.root(n).createdAt)} of the ${duration(ROOM_HANDOFF_LIMITS.lifetimeMs)} tree lifetime`;
+    }
     enqueue(source, generation, parentId, target, key, text, approvalGranted = false, rework = false, sourceText = "") {
         if (this.loadError)
             throw new Error(this.loadError);
@@ -100,8 +137,14 @@ export class RoomHandoffs {
             throw new Error("Room handoff depth limit reached");
         const root = fresh ? parent : this.root(parent);
         const count = [...this.nodes.values()].filter(n => n.rootId === parent.rootId && n.parentId).length;
-        if (count >= ROOM_HANDOFF_LIMITS.requests || this.now() - root.createdAt > ROOM_HANDOFF_LIMITS.lifetimeMs)
+        if (count >= ROOM_HANDOFF_LIMITS.requests)
             throw new Error("Room handoff budget exhausted");
+        // Refuse work the tree's lifetime budget cannot honestly serve: a node
+        // accepted in the root's last minutes would be doomed at enqueue time.
+        const remaining = ROOM_HANDOFF_LIMITS.lifetimeMs - (this.now() - root.createdAt);
+        if (remaining < ROOM_HANDOFF_LIMITS.minRunwayMs) {
+            throw new Error(`Room handoff budget exhausted: only ${duration(Math.max(remaining, 0))} of the ${duration(ROOM_HANDOFF_LIMITS.lifetimeMs)} tree lifetime remains`);
+        }
         // Retain a bounded audit history without evicting active requests.
         if (this.nodes.size >= 1000) {
             const oldRoots = [...this.nodes.values()].filter(n => !n.parentId && terminal(n)).sort((a, b) => a.createdAt - b.createdAt);
@@ -210,14 +253,18 @@ export class RoomHandoffs {
     tick() {
         if (this.loadError)
             return;
+        // Validate and expire deepest nodes first so each one is failed with its
+        // own status; an ancestor's cancellation then only sweeps what is left.
+        for (const n of [...this.nodes.values()].reverse()) {
+            if (terminal(n))
+                continue;
+            const error = this.hooks.validate(n, n.parentId ? this.nodes.get(n.parentId) : undefined);
+            if (error || (this.now() > this.deadline(n) && !this.protectsRunner(n) && !this.owesFollowUp(n))) {
+                this.cancelTree(n, error ?? this.lifetimeError(n), "failed");
+            }
+        }
         for (const n of this.nodes.values()) {
             const parent = n.parentId ? this.nodes.get(n.parentId) : undefined;
-            if (!terminal(n)) {
-                const error = this.hooks.validate(n, parent);
-                if (error || this.now() - this.root(n).createdAt > ROOM_HANDOFF_LIMITS.lifetimeMs) {
-                    this.cancelTree(n, error ?? "Room request timed out", "failed");
-                }
-            }
             if (terminal(n) && parent && !n.reported) {
                 this.hooks.report(n, parent);
                 n.reported = true;
@@ -253,6 +300,7 @@ export class RoomHandoffs {
             const childCount = this.children(n.id).length;
             root.executions += executionCost;
             n.status = "running";
+            n.startedAt = this.now();
             this.publish(n, root);
             const controller = new AbortController();
             this.controllers.set(n.id, controller);

package/dist-server/server/store.js

@@ -26,7 +26,7 @@ export function isProjectEmoji(value) {
 }
 const TASK_PATCH_FIELDS = [
     "title", "projectId", "modelSelection", "approvalMode", "autoApprove", "alwaysAllow",
-    "unread", "rewound", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
+    "unread", "rewound", "archivedAt", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
     "routineRunId",
 ];
 /** Everything the BOT authored is scrubbed of content-shaped secrets before
@@ -1485,12 +1485,24 @@ export class Store {
         const turnInput = clean(turn.input);
         const nextCachedInput = Math.min(clean(prev.cachedInput), prevInput)
             + Math.min(clean(turn.cachedInput), turnInput);
+        const contextTokens = clean(turn.context?.tokens);
+        const contextWindow = clean(turn.context?.window);
         task.usage = {
             input: prevInput + turnInput,
             output: prev.output + clean(turn.output),
             ...(cachedKnown ? { cachedInput: nextCachedInput } : {}),
             costUsd: cost === null ? prevCost : (prevCost ?? 0) + cost,
             turns: prev.turns + 1,
+            lastTurn: {
+                input: turnInput, output: clean(turn.output),
+                ...(typeof turn.cachedInput === "number" ? { cachedInput: Math.min(clean(turn.cachedInput), turnInput) } : {}),
+                costUsd: cost,
+            },
+            // a turn that reported no context keeps the previous reading rather
+            // than pretending the window emptied
+            ...(contextTokens > 0
+                ? { context: { tokens: contextTokens, ...(contextWindow > 0 ? { window: contextWindow } : {}) } }
+                : prev.context ? { context: prev.context } : {}),
         };
         this.saveBots();
         this.emit({ type: "bot", botId });

package/dist-server/server/tts/chatterbox.js

@@ -0,0 +1,83 @@
+export const DEFAULT_MODEL = "chatterbox-turbo";
+/** What the picker falls back to when the server has no /v1/models. Most
+ * Chatterbox servers speak with one built-in voice unless told otherwise,
+ * so one honest entry beats a list of names the server may reject. */
+export const FALLBACK_VOICES = [
+    { id: "default", label: "Default", description: "the server's built-in Chatterbox voice" },
+];
+/** Accept "http://127.0.0.1:4123", the same with a trailing slash, and a
+ * base that already ends in /v1 — the address is typed by hand, so meet
+ * it halfway rather than 404ing over a slash. */
+export function apiRoot(baseUrl) {
+    const trimmed = baseUrl.trim().replace(/\/+$/, "");
+    return /\/v1$/i.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+async function safeJson(res) {
+    try {
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
+/** Prefer the server's own words over anything we can invent — wrapper
+ * services vary, and their "model not loaded" says more than a 500. */
+function message(status, what, body) {
+    const theirs = (typeof body?.error === "string" && body.error.trim()) ||
+        (typeof body?.detail === "string" && body.detail.trim()) ||
+        (typeof body?.message === "string" && body.message.trim()) ||
+        "";
+    return theirs ? `${what} failed: ${theirs}` : `${what} failed (${status})`;
+}
+/** One bounded request shape for both calls: a dead server is the common
+ * failure, and it must be named in the user's words, quickly. */
+async function request(url, init, what, baseUrl) {
+    try {
+        return await fetch(url, init);
+    }
+    catch (e) {
+        if (e instanceof Error && (e.name === "TimeoutError" || e.name === "AbortError")) {
+            throw new Error(`${what} timed out — the Chatterbox server at ${baseUrl.trim()} did not answer`);
+        }
+        throw new Error(`couldn't reach the Chatterbox server at ${baseUrl.trim()} — check that it is running`);
+    }
+}
+export async function listChatterboxVoices(baseUrl) {
+    try {
+        const res = await request(`${apiRoot(baseUrl)}/models`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) }, "listing voices", baseUrl);
+        if (res.ok) {
+            const body = await safeJson(res);
+            const voices = (body?.data ?? [])
+                .map((m) => ({ id: String(m?.id ?? ""), label: String(m?.id ?? "") }))
+                .filter((v) => v.id);
+            if (voices.length)
+                return voices;
+        }
+    }
+    catch {
+        // fall through: the built-in entry below beats an empty picker
+    }
+    return FALLBACK_VOICES;
+}
+/** Ask for wav because every browser plays it and every OpenAI-compatible
+ * server can produce it; the server's own content-type wins when it says
+ * something else, so returned bytes are never mislabeled. */
+export async function synthesizeChatterbox(text, voiceId, baseUrl, model) {
+    const res = await request(`${apiRoot(baseUrl)}/audio/speech`, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "audio/wav" },
+        body: JSON.stringify({ model: model?.trim() || DEFAULT_MODEL, input: text, voice: voiceId, response_format: "wav" }),
+        signal: AbortSignal.timeout(60_000),
+    }, "speaking", baseUrl);
+    if (!res.ok)
+        throw new Error(message(res.status, "speaking", await safeJson(res)));
+    const header = (res.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    const mime = header === "audio/mpeg" || header === "audio/mp3"
+        ? "audio/mpeg"
+        : header === "audio/x-wav"
+            ? "audio/wav"
+            : header.startsWith("audio/")
+                ? header
+                : "audio/wav";
+    return { bytes: new Uint8Array(await res.arrayBuffer()), mime };
+}

package/dist-server/server/tts/index.js

@@ -1,3 +1,4 @@
+import * as chatterbox from "./chatterbox.js";
 import * as elevenlabs from "./elevenlabs.js";
 import * as systemVoices from "./system-voices.js";
 export class NoVoiceConfigured extends Error {
@@ -5,52 +6,73 @@ export class NoVoiceConfigured extends Error {
     // runs under `node --experimental-strip-types`, which is strip-ONLY, so a
     // parameter property is rejected at load time even though it typechecks
     reason;
-    constructor(reason) {
-        super(reason === "key"
-            ? "Add an ElevenLabs key in Settings on the computer to turn on voice."
-            : "Pick a voice in the agent profile.");
+    constructor(reason, hint) {
+        super(hint ??
+            (reason === "key"
+                ? "Add an ElevenLabs key in Settings on the computer to turn on voice."
+                : "Pick a voice in the agent profile."));
         this.reason = reason;
     }
 }
 export function voiceProvider(cfg) {
-    return cfg.tts?.provider === "system" ? "system" : "elevenlabs";
+    return cfg.tts?.provider === "system" || cfg.tts?.provider === "chatterbox" ? cfg.tts.provider : "elevenlabs";
 }
 /** The system provider needs no credential — it is only ever offered where
  * the platform actually has it, so "configured" means "this engine can
  * speak", not "a key is on file". */
 export function providerConfigured(cfg) {
-    return voiceProvider(cfg) === "system" ? systemVoices.systemVoicesAvailable() : Boolean(cfg.tts?.key);
+    const provider = voiceProvider(cfg);
+    if (provider === "system")
+        return systemVoices.systemVoicesAvailable();
+    if (provider === "chatterbox")
+        return Boolean(cfg.tts?.baseUrl?.trim());
+    return Boolean(cfg.tts?.key);
 }
 export function voiceConfigured(cfg) {
-    if (voiceProvider(cfg) === "system") {
+    const provider = voiceProvider(cfg);
+    if (provider === "system") {
         return systemVoices.systemVoicesAvailable() && Boolean(cfg.tts?.voice);
     }
+    if (provider === "chatterbox")
+        return Boolean(cfg.tts?.baseUrl?.trim() && cfg.tts?.voice);
     return Boolean(cfg.tts?.key && cfg.tts?.voice);
 }
 /** A per-bot voice is a complete choice too; it should not be blocked just
  * because the app-wide fallback has not been selected yet. */
 export function voiceReady(cfg, voiceId) {
-    if (voiceProvider(cfg) === "system") {
+    const provider = voiceProvider(cfg);
+    if (provider === "system") {
         return systemVoices.systemVoicesAvailable() && Boolean(voiceId || cfg.tts?.voice);
     }
+    if (provider === "chatterbox")
+        return Boolean(cfg.tts?.baseUrl?.trim() && (voiceId || cfg.tts?.voice));
     return Boolean(cfg.tts?.key && (voiceId || cfg.tts?.voice));
 }
 /** What the settings panel needs. Never includes the key — same write-only
- * rule as every other credential. */
+ * rule as every other credential. baseUrl and model are Chatterbox
+ * settings, not credentials, so they come back in full. */
 export function describeVoice(cfg) {
+    const provider = voiceProvider(cfg);
     return {
         configured: providerConfigured(cfg),
         ready: voiceConfigured(cfg),
         voice: cfg.tts?.voice ?? "",
-        provider: voiceProvider(cfg),
+        provider,
+        baseUrl: provider === "chatterbox" ? (cfg.tts?.baseUrl ?? "") : "",
+        model: provider === "chatterbox" ? (cfg.tts?.model ?? "") : "",
     };
 }
 export function verifyKey(key) {
     return elevenlabs.verifyKey(key);
 }
 export async function listVoices(cfg, run) {
-    if (voiceProvider(cfg) === "system")
+    const provider = voiceProvider(cfg);
+    if (provider === "system")
         return systemVoices.listSystemVoices(run);
+    if (provider === "chatterbox") {
+        const baseUrl = cfg.tts?.baseUrl?.trim();
+        return baseUrl ? chatterbox.listChatterboxVoices(baseUrl) : [];
+    }
     const key = cfg.tts?.key;
     if (!key)
         return [];
@@ -59,7 +81,8 @@ export async function listVoices(cfg, run) {
 /** Synthesize one utterance. Throws NoVoiceConfigured when there is nothing
  * to speak with, which the route turns into a 409 the client can explain. */
 export function speak(cfg, text, voiceId, run) {
-    if (voiceProvider(cfg) === "system") {
+    const provider = voiceProvider(cfg);
+    if (provider === "system") {
         const voice = voiceId || cfg.tts?.voice;
         // An injected runner is the cross-platform test seam for `/usr/bin/say`;
         // production calls omit it and remain strictly Darwin-gated.
@@ -69,6 +92,16 @@ export function speak(cfg, text, voiceId, run) {
             throw new NoVoiceConfigured("voice");
         return systemVoices.synthesizeSystem(text, voice, run);
     }
+    if (provider === "chatterbox") {
+        const baseUrl = cfg.tts?.baseUrl?.trim();
+        if (!baseUrl) {
+            throw new NoVoiceConfigured("key", "Add the address of your Chatterbox server in Settings on the computer to turn on voice.");
+        }
+        const voice = voiceId || cfg.tts?.voice;
+        if (!voice)
+            throw new NoVoiceConfigured("voice");
+        return chatterbox.synthesizeChatterbox(text, voice, baseUrl, cfg.tts?.model);
+    }
     const key = cfg.tts?.key;
     if (!key)
         throw new NoVoiceConfigured("key");

package/dist-server/server/workspace.js

@@ -16,6 +16,10 @@ import { redactSecretsInText } from "./redact.js";
 import { DATA_DIR } from "./config.js";
 export const WORKSPACES_DIR = join(DATA_DIR, "workspaces");
 export const TASK_WORKSPACES_DIR = join(DATA_DIR, "task-workspaces");
+/** MCP support does not imply native filesystem tools or a local working directory. */
+export function supportsWorkspaceFiles(driverKind) {
+    return !["grok", "openai-compat", "minimax", "boxAgent"].includes(driverKind);
+}
 /** Default task files are private to the thread, outside the bot's shared
  * memory folder. This is directory organization, not a shell sandbox. */
 export function ensureTaskWorkspace(botId, threadId) {
@@ -519,9 +523,15 @@ export function memorySystemPrompt(botId, opts = {}) {
     const memory = loadMemory(botId);
     const memoryFile = join(workspaceDir(botId), "MEMORY.md");
     const topicDir = join(workspaceDir(botId), "memory");
+    if (opts.fileTools === false && !opts.managedWrites) {
+        if (!memory)
+            return "";
+        return ` Your saved memory is supplied as context; this turn has no memory editing tools.\n\nYour memory (MEMORY.md):\n${memory.text}${memory.truncated ? " [Only the initial memory excerpt is visible.]" : ""}`;
+    }
     const writeGuidance = opts.managedWrites
         ? " This memory is shared across your independent threads. Use memory_update for every change to MEMORY.md, never direct file tools or whole-file overwrites." +
-            " Append new facts, or replace/remove an exact unique old_text passage. If it conflicts, read the current file and retry only your intended change."
+            " Append new facts, or replace/remove an exact unique old_text passage. If it conflicts, " +
+            (opts.fileTools === false ? "use session_search to find the current passage" : "read the current file") + " and retry only your intended change."
         : " When you learn something worth keeping, update it with your file tools; remove notes that turn out to be wrong.";
     const guidance = ` Your private long-term memory file is ${JSON.stringify(memoryFile)}.` +
         " It stays separate from a custom project working folder." +
@@ -533,7 +543,7 @@ export function memorySystemPrompt(botId, opts = {}) {
         return guidance;
     const truncatedNote = memory.truncated
         ? ` [MEMORY.md is ${memory.lines} lines and ${memory.bytes} bytes; only the first ${MEMORY_MAX_LINES} lines / ${MEMORY_MAX_BYTES} bytes are shown above and the rest is not visible to you. ${opts.managedWrites
-            ? "Consolidate it now with memory_update: replace or remove older entries, or move detail to a memory/<topic>.md file."
+            ? "Consolidate it now with memory_update: replace or remove older entries" + (opts.fileTools === false ? "." : ", or move detail to a memory/<topic>.md file.")
             : "Trim it with your file tools: merge or remove older entries, or move detail to a memory/<topic>.md file."}]`
         : "";
     return `${guidance}\n\nYour memory (MEMORY.md):\n${memory.text}${truncatedNote}`;