openmausbot 0.1.85 → 0.1.86

package/dist-server/server/cli.js

@@ -23,6 +23,7 @@
 // This module only exports; openmausbot.ts is the entry that runs main(), so
 // bundling this file into other entries (pair-cli.ts) never runs it twice.
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -30,6 +31,10 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
 import { parseAllowList } from "./account-signin.js";
+import { appendAdminAction, flushAdminActivity, sharedSignIn } from "./admin-activity.js";
+import { bindDecisionRetention, decisionRetentionDays } from "./decision-log.js";
+import { hostedWorkspaceConfigured } from "./enterprise.js";
+import { resolveLoopbackTrust } from "./request-auth.js";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
 import { runServiceCommand } from "./service-cli.js";
@@ -295,11 +300,23 @@ export function serverVersion(here = HERE) {
 }
 const message = (error) => (error instanceof Error ? error.message : String(error));
 // ── talking to a running server (loopback = owner) ────────────────────
+/** Set only inside `openmausbot serve` on a service-trust server: the secret
+ * it handed the server it started, which opens that server's pairing route. */
+let serveOwnerToken;
 async function api(port, path, init = {}) {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, { method: init.method, body: init.body, headers: { "content-type": "application/json" }, signal: AbortSignal.timeout(3000) });
+    // x-openmausbot-cli names the tool in the admin activity log; on loopback
+    // it is the owner either way, so it grants nothing.
+    const headers = { "content-type": "application/json", "x-openmausbot-cli": "1", ...(serveOwnerToken ? { "x-openmausbot-cli-owner": serveOwnerToken } : {}) };
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, { method: init.method, body: init.body, headers, signal: AbortSignal.timeout(3000) });
     const body = await res.json().catch(() => ({}));
     return { status: res.status, body };
 }
+/** What to do when a server treats this command as a local service rather
+ * than its owner (OMB_LOOPBACK_TRUST=service, or a hosted workspace). */
+export const SERVICE_TRUST_HELP = "This server does not treat commands on this computer as its owner (OMB_LOOPBACK_TRUST=service, or a hosted workspace), so it will not pair devices or list sessions for them. Sign in as an admin and use Settings → Remote access, let people sign in with their email (openmausbot access add you@example.com), or restart the server with OMB_LOOPBACK_TRUST=owner.";
+function refusedAsService(status, body) {
+    return status === 403 && typeof body?.error === "string" && /shared server|Sign in through the workspace portal/.test(body.error);
+}
 async function serverUp(port, pid) {
     try {
         const { status, body } = await api(port, "/api/health");
@@ -472,6 +489,8 @@ async function mintPairing(port, options) {
     if (options.client)
         request.scopes = ["client"];
     const { status, body } = await api(port, "/api/auth/pairing", { method: "POST", body: JSON.stringify(request) });
+    if (refusedAsService(status, body))
+        throw new Error(SERVICE_TRUST_HELP);
     if (status !== 200)
         throw new Error(`server refused to mint a pairing code: ${typeof body?.error === "string" ? body.error : status}`);
     const url = options.publicUrl ? `${options.publicUrl}/pair#code=${body.code}` : typeof body.url === "string" ? body.url : null;
@@ -547,6 +566,10 @@ export async function runSessions(options) {
     }
     if (options.revoke) {
         const { status, body } = await api(options.port, `/api/auth/sessions/${encodeURIComponent(options.revoke)}`, { method: "DELETE" });
+        if (refusedAsService(status, body)) {
+            console.error(SERVICE_TRUST_HELP);
+            return 1;
+        }
         if (status !== 200) {
             console.error(`could not revoke: ${typeof body?.error === "string" ? body.error : status}`);
             return 1;
@@ -554,7 +577,15 @@ export async function runSessions(options) {
         console.log(`revoked ${options.revoke}: that device is signed out and its stream is closed`);
         return 0;
     }
-    const { body } = await api(options.port, "/api/auth/sessions");
+    const { status, body } = await api(options.port, "/api/auth/sessions");
+    if (refusedAsService(status, body)) {
+        console.error(SERVICE_TRUST_HELP);
+        return 1;
+    }
+    if (status !== 200) {
+        console.error(`could not list sessions: ${typeof body?.error === "string" ? body.error : status}`);
+        return 1;
+    }
     const sessions = Array.isArray(body?.sessions) ? body.sessions : [];
     if (options.json) {
         console.log(JSON.stringify(sessions, null, 2));
@@ -623,9 +654,24 @@ export async function runAccess(options, io = defaultIo()) {
     const admins = list(Reflect.get(current, "admins"));
     const members = list(Reflect.get(current, "members"));
     const overridden = process.env.OMB_SIGNIN_EMAILS !== undefined || process.env.OMB_SIGNIN_MEMBER_EMAILS !== undefined;
-    const write = (next) => {
+    const write = async (next) => {
         mkdirSync(options.dataDir, { recursive: true, mode: 0o700 });
         writeFileAtomic(file, `${JSON.stringify({ ...raw, signIn: next }, null, 2)}\n`, { mode: 0o600 });
+        // The same row Settings → People writes, named for the command line,
+        // pruned by the same window the server would use — kept, like the
+        // server's, only where more than one person signs in.
+        if (!sharedSignIn({ admins, members }) && !sharedSignIn(next) && !hostedWorkspaceConfigured())
+            return;
+        const decisions = raw.decisions && typeof raw.decisions === "object" ? raw.decisions.retentionDays : undefined;
+        bindDecisionRetention(() => decisionRetentionDays(typeof decisions === "number" ? decisions : undefined));
+        const changed = ["admins", "members"].filter((key) => next[key].join(",") !== (key === "admins" ? admins : members).join(","));
+        appendAdminAction(options.dataDir, {
+            category: "people", action: "people.update", target: { kind: "settings" }, actor: { kind: "cli" },
+            changed: changed.map((key) => `signIn.${key}`),
+            before: Object.fromEntries(changed.map((key) => [`signIn.${key}`, key === "admins" ? admins : members])),
+            after: Object.fromEntries(changed.map((key) => [`signIn.${key}`, next[key]])),
+        });
+        await flushAdminActivity(options.dataDir);
     };
     if (options.accessAction === "list") {
         if (!admins.length && !members.length) {
@@ -651,11 +697,11 @@ export async function runAccess(options, io = defaultIo()) {
             io.error(`${entry} is not on the list`);
             return 1;
         }
-        write({ admins: without(admins), members: without(members) });
+        await write({ admins: without(admins), members: without(members) });
         io.log(`${entry} can no longer sign in (existing sessions stay until they expire or are revoked with \`openmausbot sessions revoke\`)`);
         return 0;
     }
-    write(options.chatOnly ? { admins: without(admins), members: [...without(members), entry] } : { admins: [...without(admins), entry], members: without(members) });
+    await write(options.chatOnly ? { admins: without(admins), members: [...without(members), entry] } : { admins: [...without(admins), entry], members: without(members) });
     io.log(`${entry} can sign in at /pair with an emailed code (${options.chatOnly ? "chat and approvals" : "full access"})`);
     if (overridden)
         io.log("note: OMB_SIGNIN_EMAILS / OMB_SIGNIN_MEMBER_EMAILS are set in the environment and win over this list while the server runs");
@@ -883,6 +929,16 @@ export async function runServe(options, log = console.log) {
     };
     if (options.local)
         delete env.OMB_PUBLIC_URL;
+    // A service-trust server refuses session-less local admin requests, this
+    // CLI's included. Hand the server we start a per-launch secret over its
+    // stdin (not its environment, which every engine it starts inherits) so
+    // this process alone can still print the pairing code.
+    const serviceTrust = resolveLoopbackTrust({ env, desktopManaged: false, hostedWorkspace: hostedWorkspaceConfigured(env) }).trust === "service";
+    const ownerToken = serviceTrust ? randomBytes(32).toString("base64url") : undefined;
+    if (ownerToken)
+        env.OMB_CLI_OWNER_STDIN = "1";
+    else
+        delete env.OMB_CLI_OWNER_STDIN;
     if (entry.staticDir)
         env.OMB_STATIC_DIR = entry.staticDir;
     if (entry.skillsDir && !process.env.OMB_SKILLS_DIR)
@@ -925,7 +981,12 @@ export async function runServe(options, log = console.log) {
             throw new SetupCancelled();
         if (publicUrl)
             env.OMB_PUBLIC_URL = publicUrl;
-        child = spawn(entry.command, entry.args, { env, stdio: ["ignore", logFd ?? "inherit", logFd ?? "inherit"] });
+        child = spawn(entry.command, entry.args, { env, stdio: [ownerToken ? "pipe" : "ignore", logFd ?? "inherit", logFd ?? "inherit"] });
+        if (ownerToken) {
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(`${ownerToken}\n`);
+            serveOwnerToken = ownerToken;
+        }
     }
     catch (error) {
         if ((tailscaleServing || (startupCancelled && tailscaleAttempted)) && tailscale)
@@ -1048,13 +1109,20 @@ export async function runServe(options, log = console.log) {
                     clearTimeout(timer);
             }
             if (!stopping && exited === null)
-                await showPhonePairing(options, publicUrl, log);
+                await showPhonePairing(options, publicUrl, log).catch((error) => log(`no pairing code: ${message(error)}`));
         }
         else if (options.pair && !options.guided) {
             log("");
-            log(await mintPairing(options.port, { label: options.label ? `${options.label} owner` : undefined, client: options.client, publicUrl: publicUrl ?? undefined }));
-            log("");
-            log("another device later:  openmausbot pair --label \"Kitchen iPad\"");
+            // A refused code is no reason to stop a server that is running fine.
+            try {
+                log(await mintPairing(options.port, { label: options.label ? `${options.label} owner` : undefined, client: options.client, publicUrl: publicUrl ?? undefined }));
+                log("");
+                log("another device later:  openmausbot pair --label \"Kitchen iPad\"");
+            }
+            catch (error) {
+                log(`no pairing code: ${message(error)}`);
+                log("start without one next time:  openmausbot serve --no-pair");
+            }
         }
         log(options.guided ? "\nKeep this terminal open while using your bots. Ctrl+C stops the server, not your saved work." : "stop with Ctrl+C");
         if (options.guided)
@@ -1062,6 +1130,7 @@ export async function runServe(options, log = console.log) {
         return await childExit;
     }
     finally {
+        serveOwnerToken = undefined;
         await stop();
         process.removeListener("SIGINT", onSignal);
         process.removeListener("SIGTERM", onSignal);

package/dist-server/server/composio.js

@@ -895,7 +895,7 @@ export async function listToolkits(cfg) {
             ? backendFingerprint("managed-catalog", broker.url, broker.token)
             : null;
     if (identity && toolkitCache?.identity === identity && Date.now() - toolkitCache.at < 10 * 60_000) {
-        return { cards: toolkitCache.cards, source: "api" };
+        return { cards: toolkitCache.cards, source: "api", pagination: toolkitCache.pagination };
     }
     if (backendKey || broker) {
         try {
@@ -907,6 +907,12 @@ export async function listToolkits(cfg) {
             const seenCursors = new Set();
             let cursor;
             let lastReportedPage;
+            let reportedTotalItems;
+            let reportedTotalPages;
+            // Why the walk ended. "limit" means the loop ran out of iterations;
+            // every early exit names itself so a stalled catalog can be logged
+            // instead of silently posing as the complete marketplace.
+            let stop = "limit";
             for (let page = 0; page < MAX_CONNECTED_ACCOUNT_PAGES; page += 1) {
                 const params = new URLSearchParams({ limit: "500", sort_by: "usage" });
                 if (cursor)
@@ -919,33 +925,51 @@ export async function listToolkits(cfg) {
                     : await brokerRequest(cursor ? `/v1/catalog?cursor=${encodeURIComponent(cursor)}` : "/v1/catalog", {
                         signal: AbortSignal.timeout(15_000),
                     });
-                if (!res.ok)
+                if (!res.ok) {
+                    stop = "http-error";
                     break;
+                }
                 const json = await res.json();
                 const pageItems = json.items ?? json.data ?? [];
-                if (!Array.isArray(pageItems))
+                if (!Array.isArray(pageItems)) {
+                    stop = "bad-page";
                     break;
+                }
                 items.push(...pageItems);
+                const pageTotalItems = Number(json.total_items);
+                if (Number.isFinite(pageTotalItems) && pageTotalItems > 0)
+                    reportedTotalItems = pageTotalItems;
                 // Composio reports current_page and total_pages beside next_cursor.
                 // A broker that drops the cursor (or an upstream regression) can replay
                 // a page while minting fresh cursors, so trust page movement: once it
                 // stops advancing, the catalog is stuck and paging stops cleanly.
                 const reportedPage = Number(json.current_page);
                 if (Number.isFinite(reportedPage)) {
-                    if (lastReportedPage !== undefined && reportedPage <= lastReportedPage)
+                    if (lastReportedPage !== undefined && reportedPage <= lastReportedPage) {
+                        stop = "page-stuck";
                         break;
+                    }
                     lastReportedPage = reportedPage;
                 }
-                const reportedTotalPages = Number(json.total_pages);
+                const pageTotalPages = Number(json.total_pages);
+                if (Number.isFinite(pageTotalPages) && pageTotalPages > 0)
+                    reportedTotalPages = pageTotalPages;
                 if (lastReportedPage !== undefined &&
-                    Number.isFinite(reportedTotalPages) &&
-                    reportedTotalPages > 0 &&
-                    lastReportedPage >= reportedTotalPages) {
+                    Number.isFinite(pageTotalPages) &&
+                    pageTotalPages > 0 &&
+                    lastReportedPage >= pageTotalPages) {
+                    stop = "total-reached";
                     break;
                 }
                 const next = typeof json.next_cursor === "string" ? json.next_cursor.trim() : "";
-                if (!next || seenCursors.has(next))
+                if (!next) {
+                    stop = "end";
+                    break;
+                }
+                if (seenCursors.has(next)) {
+                    stop = "cursor-repeated";
                     break;
+                }
                 seenCursors.add(next);
                 cursor = next;
             }
@@ -959,8 +983,22 @@ export async function listToolkits(cfg) {
                     domain: null,
                 }));
                 const uniqueCards = cards.filter((card, index) => card.slug && cards.findIndex((candidate) => candidate.slug === card.slug) === index);
-                toolkitCache = { at: Date.now(), cards: uniqueCards, identity: identity };
-                return { cards: uniqueCards, source: "api" };
+                const shortOfReportedTotal = reportedTotalItems !== undefined && uniqueCards.length < reportedTotalItems;
+                // Trust reported page counts even when the walk ends "cleanly": an
+                // endpoint that stops at page 1 of 4 without a cursor is still partial.
+                const pagingStoppedEarly = lastReportedPage !== undefined
+                    && reportedTotalPages !== undefined
+                    && lastReportedPage < reportedTotalPages;
+                const pagination = { items: uniqueCards.length, stalled: shortOfReportedTotal || pagingStoppedEarly };
+                if (reportedTotalItems !== undefined)
+                    pagination.totalItems = reportedTotalItems;
+                if (pagination.stalled) {
+                    console.warn(`[composio] marketplace catalog paging stopped early (${stop}) after ${uniqueCards.length} toolkits`
+                        + (reportedTotalItems !== undefined ? ` of ~${reportedTotalItems}` : "")
+                        + "; serving a partial marketplace");
+                }
+                toolkitCache = { at: Date.now(), cards: uniqueCards, identity: identity, pagination };
+                return { cards: uniqueCards, source: "api", pagination };
             }
         }
         catch {

package/dist-server/server/config.js

@@ -294,6 +294,22 @@ const defaultModelSelectionSchema = z.object({
     effort: z.enum(EFFORT_LEVELS).optional(),
     variant: z.string().refine(isModelVariant, "invalid model variant").optional(),
 }).refine((selection) => selection.variant === undefined || selection.effort === undefined, "choose either a model variant or an effort level");
+const threadsConfigSchema = z.object({
+    maxConcurrentPerBot: z.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS),
+    /** Cap each per-thread events/ and native/ NDJSON log at this many
+     * bytes; absent (the default) keeps today's unbounded growth (#1280). */
+    eventLogMaxBytes: z.number().int().min(MIN_THREAD_EVENT_LOG_BYTES).max(MAX_THREAD_EVENT_LOG_BYTES).optional(),
+    /** Days a closed or archived thread's event logs survive (#1280).
+     * Absent keeps them forever. */
+    eventLogRetentionDays: z.number().int().min(1).max(3650).optional(),
+}).strict();
+/** PATCH threads: every knob is independently patchable, and null clears an
+ * event-log knob back to its absent (off) default. */
+const threadsPatchSchema = threadsConfigSchema.extend({
+    maxConcurrentPerBot: threadsConfigSchema.shape.maxConcurrentPerBot.optional(),
+    eventLogMaxBytes: threadsConfigSchema.shape.eventLogMaxBytes.nullable(),
+    eventLogRetentionDays: threadsConfigSchema.shape.eventLogRetentionDays.nullable(),
+});
 const appConfigSchema = z.object({
     /** Verified by the dedicated domain endpoint, never a generic config patch. */
     customDomain: z.string().optional(),
@@ -395,15 +411,10 @@ const appConfigSchema = z.object({
         compactAt: z.number().positive().max(10_000_000).optional(),
         autoCompact: z.boolean().optional(),
     }).optional(),
-    threads: z.object({
-        maxConcurrentPerBot: z.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS),
-        /** Cap each per-thread events/ and native/ NDJSON log at this many
-         * bytes; absent (the default) keeps today's unbounded growth (#1280). */
-        eventLogMaxBytes: z.number().int().min(MIN_THREAD_EVENT_LOG_BYTES).max(MAX_THREAD_EVENT_LOG_BYTES).optional(),
-        /** Days a closed or archived thread's event logs survive (#1280).
-         * Absent keeps them forever. */
-        eventLogRetentionDays: z.number().int().min(1).max(3650).optional(),
-    }).strict().optional(),
+    threads: threadsConfigSchema.optional(),
+    /** The authorization decision log (server/decision-log.ts): days of month
+     * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
+    decisions: z.object({ retentionDays: z.number().int().min(1).max(3650).optional() }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     onboarding: onboardingConfigSchema.optional(),
@@ -420,7 +431,8 @@ const appConfigSchema = z.object({
 const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
 });
-const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true });
+const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true })
+    .extend({ threads: threadsPatchSchema.optional() });
 const jsonObjectSchema = z.record(z.string(), z.json());
 /** Resolve a canonical profile record to its exact durable Electron
  * partition identity. Callers must never substitute the display/API id. */
@@ -520,6 +532,8 @@ export function roomHandoffLimits(cfg) {
         hardCapMs: (cfg.rooms?.handoffHardCapMinutes ?? DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES) * 60_000,
     };
 }
+/** Accepts a full config or a parsed patch: the concurrency limit may be
+ * read from either, and a patch may legitimately omit it. */
 export function maxConcurrentBotThreads(cfg) {
     return cfg.threads?.maxConcurrentPerBot ?? DEFAULT_MAX_CONCURRENT_BOT_THREADS;
 }
@@ -776,6 +790,8 @@ export const WORKSPACE_CREDENTIAL_ENV = [
     "XAI_API_KEY",
     "OMB_ANTHROPIC_API_KEY",
     "OMB_ANTHROPIC_API_URL",
+    "OMB_HOSTED_MODEL_TOKEN",
+    "OMB_HOSTED_MODELS",
     "OPENAI_COMPAT_API_KEY",
     "OPENAI_COMPAT_URL",
     "BOX_TOKEN",
@@ -792,10 +808,32 @@ export const WORKSPACE_CREDENTIAL_ENV = [
     "OMB_BROWSER_CONNECTION",
     "OMB_USER_DATA",
 ];
-/** Drop every workspace credential from a child-process env (in place). */
+/** Secrets of whoever operates this server, not of the workspace: the license
+ * key, a fleet container's installation credential, and everything a hosting
+ * control plane injects under `OMB_CLOUD_` (the readiness token, the bootstrap
+ * document and its gateway token). Only this process reads them. The prefix
+ * ends in an underscore on purpose: `OMB_CLOUDFLARED_PATH` is not one of them.
+ * What an engine is meant to receive arrives under another name through its
+ * instance environment (the hosted model token as ANTHROPIC_API_KEY or
+ * OPENMAUSBOT_COMPANY_API_KEY), so nothing here is ever an engine's input. */
+export const CONTROL_PLANE_ENV = ["OMB_LICENSE_KEY", "OMB_INSTALLATION_CREDENTIAL"];
+export const CONTROL_PLANE_ENV_PREFIX = "OMB_CLOUD_";
+/** Drop every control-plane secret from a child-process env (in place). No
+ * driver allowlist re-admits these. Names compare case-insensitively because
+ * Windows environments do. */
+export function stripControlPlaneEnv(env) {
+    for (const key of Object.keys(env)) {
+        const name = key.toUpperCase();
+        if (name.startsWith(CONTROL_PLANE_ENV_PREFIX) || CONTROL_PLANE_ENV.includes(name))
+            delete env[key];
+    }
+}
+/** Drop every workspace credential, and every control-plane secret, from a
+ * child-process env (in place). */
 export function stripWorkspaceCredentialEnv(env) {
     for (const key of WORKSPACE_CREDENTIAL_ENV)
         delete env[key];
+    stripControlPlaneEnv(env);
 }
 /** Env names a provider CLI might read as its own billing identity. A spawned
  * engine keeps only what its driver explicitly allows: a foreign key riding
@@ -815,6 +853,14 @@ export const PROVIDER_CREDENTIAL_ENV = [
     "CURSOR_API_KEY",
     "CURSOR_AUTH_TOKEN",
 ];
+const configSaveListeners = new Set();
+/** Told, synchronously, what each saveConfig wrote: the file before and
+ * after. The admin activity log (server/admin-activity.ts) records the
+ * change for whoever's request made it. A listener must not throw. */
+export function onConfigSaved(listener) {
+    configSaveListeners.add(listener);
+    return () => { configSaveListeners.delete(listener); };
+}
 /** Merge a partial config into ~/.openmausbot/config.json (secrets never
  * echoed back — callers report configured-or-not booleans only). */
 export function saveConfig(patch, options = {}) {
@@ -828,20 +874,32 @@ export function saveConfig(patch, options = {}) {
     catch {
         /* first write */
     }
-    const checkedPatch = appConfigSchema.partial().parse(patch);
+    const checkedPatch = appConfigSchema.partial().extend({ threads: threadsPatchSchema.optional() }).parse(patch);
+    const before = configSaveListeners.size ? structuredClone(disk) : disk;
     // A write is the durable migration point. Preserve every other raw key in
     // config.json, but never write #567's mixed-case or duplicate profile ids
     // back after we have successfully recognized the legacy list.
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "localVm", "features", "budgets", "billing", "onboarding", "browserEngine"]) {
+    for (const key of ["xai", "anthropic", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
         const current = jsonObjectSchema.safeParse(disk[key]);
         const merged = current.success ? { ...current.data } : {};
+        // parseStoredConfig requires threads.maxConcurrentPerBot, so creating
+        // the section with only an event-log knob must still persist a valid
+        // concurrency default.
+        if (key === "threads" && !current.success)
+            merged.maxConcurrentPerBot = DEFAULT_MAX_CONCURRENT_BOT_THREADS;
         Object.assign(merged, section);
+        // null is the patch's explicit "remove this key" marker (today only the
+        // threads event-log knobs use it); a key the patch omits keeps its value.
+        for (const [sectionKey, sectionValue] of Object.entries(section)) {
+            if (sectionValue === null)
+                delete merged[sectionKey];
+        }
         disk[key] = merged;
     }
     if (checkedPatch.vps !== undefined)
@@ -920,6 +978,14 @@ export function saveConfig(patch, options = {}) {
     }
     mkdirSync(DATA_DIR, { recursive: true });
     writeFileAtomic(p, JSON.stringify(disk, null, 2), { mode: 0o600 });
+    for (const listener of configSaveListeners) {
+        try {
+            listener(before, disk);
+        }
+        catch (error) {
+            console.warn(`config: a save listener failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
 }
 /** Set one instance's `config.cli` ("" clears the override back to the
  * driver default). Creating the instance entry is fine — a config-less