openmausbot 0.1.85 → 0.1.86

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -3,6 +3,8 @@
 import { Ajv } from "ajv";
 import { Ajv2020 } from "ajv/dist/2020.js";
 import formats from "ajv-formats";
+import { stripControlPlaneEnv } from "../config.js";
+import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
@@ -21,6 +23,14 @@ function object(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function aborted() { return new Error("MCP operation cancelled"); }
+/** These servers are a chat-runtime bot's tools, the counterpart of an engine
+ * CLI's children: the operator's control-plane secrets never ride along. What
+ * the server entry itself names is a deliberate grant and is applied last. */
+export function chatMcpEnvironment(serverEnv, source = process.env) {
+    const env = { ...source, PATH: augmentedPath() };
+    stripControlPlaneEnv(env);
+    return { ...env, ...serverEnv };
+}
 class ChatMcpClient {
     child;
     buffer = "";
@@ -31,8 +41,11 @@ class ChatMcpClient {
     pending = new Map();
     constructor(server) {
         try {
+            // The desktop shell inherits Finder's bare PATH, where `npx`-style
+            // servers cannot find `node` and exit at once. Widen it the way the
+            // Claude and Codex drivers do; a PATH the user set on the server wins.
             this.child = spawnCli(server.command, server.args, {
-                stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...server.env },
+                stdio: ["pipe", "pipe", "pipe"], env: chatMcpEnvironment(server.env),
             });
         }
         catch {
@@ -64,7 +77,9 @@ class ChatMcpClient {
             entry.reject(new Error("MCP session closed"));
         this.pending.clear();
         this.buffer = "";
-        this.closing = killCliTree(this.child, 500).then((stopped) => {
+        // Confirm within the codebase-default grace: Windows reaps the tree via
+        // taskkill /T, which can exceed shorter budgets on a loaded machine.
+        this.closing = killCliTree(this.child, 5_000).then((stopped) => {
             if (!stopped)
                 throw new Error("MCP server shutdown could not be confirmed; execution outcome may be uncertain");
         });

package/dist-server/server/drivers/claude.js

@@ -322,6 +322,7 @@ export const STATIC_CLAUDE_MODELS = {
     options: [
         { id: "claude-fable-5-1", label: "Claude Fable 5.1" },
         { id: "claude-fable-5", label: "Claude Fable 5" },
+        { id: "claude-opus-5-5", label: "Claude Opus 5.5", contextWindow: 1_000_000 },
         { id: "claude-opus-5", label: "Claude Opus 5" },
         { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
         { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" },
@@ -724,10 +725,13 @@ function decodeConfig(raw) {
     const configDir = typeof o.configDir === "string" ? o.configDir.trim() : undefined;
     if (configDir)
         resolveClaudeConfigDir(configDir);
+    if (o.managedModels !== undefined && (o.managed !== true || !Array.isArray(o.managedModels) || !o.managedModels.length || o.managedModels.some(model => typeof model !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(model))))
+        throw new Error("Invalid hosted Claude models.");
     return {
         cli: typeof o.cli === "string" ? o.cli : "claude",
         ...(configDir ? { configDir } : {}),
         ...(o.managed === true ? { managed: true } : {}),
+        ...(o.managedModels ? { managedModels: o.managedModels } : {}),
         permissionMode: mode ?? "acceptEdits",
         ...(tools !== undefined ? { tools } : {}),
         ...(disallowedTools !== undefined ? { disallowedTools } : {}),
@@ -821,7 +825,7 @@ export const ClaudeDriver = {
         if (inheritsUserConfig(catalogEnv)) {
             console.error(`claude (${instanceId}): OMB_CLAUDE_INHERIT_USER_CONFIG=1 — bots inherit this machine's Claude Code MCP servers, skills, hooks and CLAUDE.md on every turn; remove it unless a bot needs a user-scope server`);
         }
-        let models = STATIC_CLAUDE_MODELS;
+        let models = config.managedModels ? { default: config.managedModels[0], options: config.managedModels.map(id => ({ id, label: id })) } : STATIC_CLAUDE_MODELS;
         const refreshModels = async () => {
             if (config.managed)
                 return;
@@ -932,6 +936,8 @@ export const ClaudeDriver = {
         // is a fresh sendTurn, and the attempt cap must survive across launches
         const retryState = new Map();
         const sendTurn = async (turn, logicalTurnId) => {
+            if (config.managedModels && (!turn.model || !config.managedModels.includes(turn.model)))
+                throw new Error("This model is not assigned to this workspace.");
             if (config.managed && (!turn.model || turn.model.includes("::") || !config.configDir ||
                 !input.environment.ANTHROPIC_API_KEY || !input.environment.ANTHROPIC_BASE_URL)) {
                 throw new Error("Company model access is unavailable. Reconnect your organization; personal billing will not be used.");
@@ -1224,6 +1230,8 @@ export const ClaudeDriver = {
                     clearTimeout(live.idleTimer);
                 live.turn = { turnId, input: turn, retryAbort, settled: false, sawStreamDelta: false };
                 active.set(threadId, { stop: () => {
+                        if (live.turn)
+                            live.turn.stopRequested = true;
                         closeSession(threadId, "interrupted");
                         retry.cancelled = true;
                         retryAbort.abort();
@@ -1235,8 +1243,9 @@ export const ClaudeDriver = {
                     ? promptMsg
                     : claudeUserMessage(withVolatileNote(turn.text, volatile), turn.images);
                 live.volatile = volatile;
+                const running = live.turn;
                 const written = await writeUser(live, threadId, message);
-                if (!written) {
+                if (!written && !running?.stopRequested) {
                     active.delete(threadId);
                     live.turn = null;
                     closeSession(threadId, "stdin write failed");
@@ -1610,7 +1619,10 @@ export const ClaudeDriver = {
                 // a turn still running when the process died is a failed turn; a
                 // process that exited between turns (idle close, contract change)
                 // is just a session ending
-                if (session.turn && !session.turn.settled) {
+                if (session.turn?.stopRequested && !session.turn.settled) {
+                    settle(false, "interrupted");
+                }
+                else if (session.turn && !session.turn.settled) {
                     // A retained process may be running a later user turn. Its close
                     // handler must retry that request, not the process's first prompt.
                     const { turnId, input: turn, retryAbort } = session.turn;
@@ -1794,6 +1806,8 @@ export const ClaudeDriver = {
                 void session.finishClose();
             });
             const stop = () => {
+                if (session.turn)
+                    session.turn.stopRequested = true;
                 // taskkill is asynchronous on Windows. Retire steering and approvals
                 // now, before a still-connected child can submit more work.
                 closeSession(threadId, "interrupted");
@@ -1807,7 +1821,8 @@ export const ClaudeDriver = {
             // stdin stays OPEN: that is what keeps the session alive for a
             // mid-turn steer or the next turn; closeSession() ends it.
             if (!(await writeUser(session, threadId, promptMsg))) {
-                settle(false, "stdin_write_failed");
+                if (!session.turn?.stopRequested)
+                    settle(false, "stdin_write_failed");
                 closeSession(threadId, "stdin write failed");
             }
             return { turnId };
@@ -1844,9 +1859,9 @@ export const ClaudeDriver = {
          * `claude -p "prompt"` shape is not safe for review. No tools or MCP
          * servers are mounted in this isolated process. */
         const generateReview = (prompt, signal) => new Promise((resolve, reject) => {
-            const child = spawnCli(config.cli, ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"], {
+            const child = spawnCli(config.cli, ["-p", "--model", config.managedModels?.[0] ?? "claude-haiku-4-5", "--output-format", "text"], {
                 stdio: ["pipe", "pipe", "pipe"],
-                env: environment("claude-haiku-4-5"),
+                env: environment(config.managedModels?.[0] ?? "claude-haiku-4-5"),
             });
             let stdout = "";
             let stderr = "";

package/dist-server/server/drivers/codex-mcp-names.js

@@ -0,0 +1,44 @@
+// MCP server names the user already declared in their own Codex config.
+//
+// Custom MCP servers reach codex as `-c mcp_servers.<name>.…` overrides, and
+// codex merges an override into any same-named table in config.toml. A stdio
+// command laid over a remote `url` entry is "invalid configuration": codex
+// falls back to defaults, config/read fails, and the whole turn dies before
+// the model is even asked. Mounting a colliding server under a name of its
+// own keeps both definitions usable.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const HEADER = /^[ \t]*\[[ \t]*mcp_servers[ \t]*\.[ \t]*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([A-Za-z0-9_-]+))[ \t]*[.\]]/gm;
+/** Names declared as `[mcp_servers.<name>]` (or a sub-table of one). Inline
+ * tables are not scanned; a collision there still surfaces as codex's own
+ * configuration error. */
+export function mcpServerNamesInToml(toml) {
+    const names = new Set();
+    for (const match of toml.matchAll(HEADER)) {
+        const name = match[1] !== undefined ? match[1].replace(/\\(.)/g, "$1") : match[2] ?? match[3];
+        if (name)
+            names.add(name);
+    }
+    return names;
+}
+/** Server names in the config.toml of the Codex home this child will use. */
+export function codexConfigMcpServerNames(env) {
+    const codexHome = env.CODEX_HOME || join(env.HOME || env.USERPROFILE || homedir(), ".codex");
+    try {
+        return mcpServerNamesInToml(readFileSync(join(codexHome, "config.toml"), "utf8"));
+    }
+    catch {
+        return new Set();
+    }
+}
+/** The name to mount a custom server under: its own, unless the user's Codex
+ * config already has a server by that name. */
+export function mountedMcpServerName(name, taken) {
+    if (!taken.has(name))
+        return name;
+    let candidate = `${name}_openmausbot`;
+    for (let i = 2; taken.has(candidate); i++)
+        candidate = `${name}_openmausbot${i}`;
+    return candidate;
+}

package/dist-server/server/drivers/codex.js

@@ -11,6 +11,7 @@
 // and preserves that history or reports a failed resume.
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
+import { codexConfigMcpServerNames, mountedMcpServerName } from "./codex-mcp-names.js";
 import { stripWorkspaceCredentialEnv } from "../config.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { isHarnessOwnedMcpEnvName } from "../mcp-registry.js";
@@ -128,6 +129,14 @@ export function managedCodexArgs(config) {
 const QUESTION_TIMEOUT_NOTE = "No answer was given — use your best judgment.";
 const DENY_TIMEOUT_NOTE = "OpenMausBot: nobody answered this permission request in time. Skip this action and finish what you can without it.";
 const skippedSseServers = new Set();
+const renamedMcpServers = new Set();
+/** Logged once per name: the rename is deliberate, not a lost server. */
+function noteRenamedMcpServer(name, mountName) {
+    if (renamedMcpServers.has(name))
+        return;
+    renamedMcpServers.add(name);
+    console.error(`codex: MCP server ${JSON.stringify(name)} is also declared in Codex's own config.toml — mounted as ${JSON.stringify(mountName)} for this bot so the two do not merge`);
+}
 function noteSkippedSseServer(name) {
     if (skippedSseServers.has(name))
         return;
@@ -593,6 +602,11 @@ export const CodexDriver = {
                 if (turn.integrations?.browser) {
                     mountMcpServer(appServerArgs, env, "browser", turn.integrations.browser);
                 }
+                // A custom server named like one in the user's own config.toml would
+                // be merged with it by the `-c` override — a stdio command over a
+                // remote url is "invalid configuration" and kills the turn before the
+                // model is asked. Such a server mounts under a name of its own.
+                const declaredInCodexConfig = codexConfigMcpServerNames(env);
                 for (const [name, server] of Object.entries(turn.integrations?.custom ?? {})) {
                     // codex speaks streamable HTTP to a remote server, not the older
                     // SSE transport: such an entry still reaches Claude bots, and is
@@ -601,7 +615,10 @@ export const CodexDriver = {
                         noteSkippedSseServer(name);
                         continue;
                     }
-                    mountMcpServer(appServerArgs, env, name, server, false);
+                    const mountName = mountedMcpServerName(name, declaredInCodexConfig);
+                    if (mountName !== name)
+                        noteRenamedMcpServer(name, mountName);
+                    mountMcpServer(appServerArgs, env, mountName, server, false);
                 }
                 if (turn.integrations?.phone) {
                     const bridge = turn.integrations.phone;
@@ -1288,10 +1305,15 @@ export const CodexDriver = {
                         });
                         effectiveConfig = configured?.config;
                     }
-                    catch {
+                    catch (error) {
                         // Do not expose a possibly secret-bearing native config error or
-                        // overwrite unknown instructions with an empty fallback.
-                        throw new Error("Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
+                        // overwrite unknown instructions with an empty fallback. A config
+                        // codex itself rejected is the one case worth naming: the person
+                        // can act on it, and the message carries no credential.
+                        const invalid = error instanceof CodexRpcError && /^invalid configuration\b/i.test(error.message);
+                        throw new Error(invalid
+                            ? "Codex rejected its configuration as invalid. Check ~/.codex/config.toml (or CODEX_HOME) for a broken entry, then retry."
+                            : "Could not read Codex configuration; cannot safely update bot instructions. Retry after checking Codex.");
                     }
                     const developerInstructions = codexDeveloperInstructions(effectiveConfig, turn.system ?? "");
                     let approvalParams;

package/dist-server/server/drivers/grok.js

@@ -2,8 +2,9 @@ import { createOpenAIChatRuntime } from "./openai-chat.js";
 const DRIVER_KIND = "grok";
 const DEFAULT_URL = "https://api.x.ai/v1";
 const MODELS = {
-    default: "grok-4",
+    default: "grok-4.7",
     options: [
+        { id: "grok-4.7", label: "Grok 4.7", contextWindow: 500_000 },
         { id: "grok-4", label: "Grok 4" },
         { id: "grok-4-fast", label: "Grok 4 Fast" },
         { id: "grok-3-mini", label: "Grok 3 Mini" },

package/dist-server/server/drivers/openai-compat.js

@@ -28,9 +28,12 @@ function decodeConfig(raw) {
     const config = (raw ?? {});
     if (config.tools !== undefined && typeof config.tools !== "boolean")
         throw new Error("tools must be a boolean");
+    if (config.managedModels !== undefined && (!Array.isArray(config.managedModels) || !config.managedModels.length || config.managedModels.some(model => typeof model !== "string" || !model.trim())))
+        throw new Error("Invalid managed models.");
     const envUrl = process.env.OPENAI_COMPAT_URL;
     return {
         ...(config.tools !== undefined ? { tools: config.tools } : {}),
+        ...(config.managedModels ? { managedModels: config.managedModels } : {}),
         url: (typeof config.url === "string" && config.url ? config.url : envUrl || "https://openrouter.ai/api/v1")
             .replace(/\/+$/, ""),
         apiKeyEnv: typeof config.apiKeyEnv === "string" && config.apiKeyEnv
@@ -74,15 +77,19 @@ export const OpenAICompatDriver = {
             process.env[config.apiKeyEnv] ??
             process.env.OPENAI_COMPAT_API_KEY ??
             "";
-        let catalog = config.model
-            ? {
-                default: config.model,
-                options: DEFAULT_MODELS.options.some((model) => model.id === config.model)
-                    ? DEFAULT_MODELS.options
-                    : [{ id: config.model, label: config.model, custom: true }, ...DEFAULT_MODELS.options],
-            }
-            : DEFAULT_MODELS;
+        let catalog = config.managedModels
+            ? { default: config.managedModels[0], options: config.managedModels.map(id => ({ id, label: id })) }
+            : config.model
+                ? {
+                    default: config.model,
+                    options: DEFAULT_MODELS.options.some((model) => model.id === config.model)
+                        ? DEFAULT_MODELS.options
+                        : [{ id: config.model, label: config.model, custom: true }, ...DEFAULT_MODELS.options],
+                }
+                : DEFAULT_MODELS;
         const fetchModels = async () => {
+            if (config.managedModels)
+                return;
             if (!apiKey)
                 return;
             try {

package/dist-server/server/enterprise.js

@@ -8,10 +8,11 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 // Neutral hook point for the source-available enterprise layer.
 //
-// The layer lives in ../enterprise (its own LICENSE) and is loaded only if that
+// The layer lives in enterprise/ (its own LICENSE) and is loaded only if that
 // folder is present: delete it and this file still compiles, the server still
 // starts, and /api/edition reports the open-source edition. Core never imports
-// the layer statically, so the bundle and the packaged app carry no trace of it.
+// the layer statically; a build ships it as its own bundled file beside the
+// server (see enterpriseLayerDirs for where it is looked up).
 // The layer's only obligation is `register()`, which turns OMB_LICENSE_KEY into
 // entitlements; core keeps the resulting status and answers `entitled()`.
 import { existsSync } from "node:fs";
@@ -25,7 +26,28 @@ const layerSchema = z.object({
     features: z.array(z.string().min(1)),
     expiresAt: z.string().nullable(),
 });
-const DEFAULT_DIR = join(SERVER_ROOT, "..", "enterprise");
+/** Days before expiry that the startup log, /api/edition and Settings start
+ * saying so, and days after it that the features keep working while the
+ * operator renews. The key and its verification are unchanged: the layer
+ * accepts a key that expired less than the grace period ago. */
+export const LICENSE_WARN_DAYS = 30;
+export const LICENSE_GRACE_DAYS = 7;
+const DAY_MS = 24 * 60 * 60_000;
+/** Where the layer may be, in order. An explicit OMB_ENTERPRISE_DIR is the
+ * only place looked at when set. Otherwise: beside the server root (a
+ * checkout, where server/ and enterprise/ are siblings, and the npm package,
+ * which copies the bundled layer to <package>/enterprise), then inside it
+ * (the Docker image and the packaged desktop ship dist-server/ alone, and
+ * scripts/bundle-server.mjs writes the layer to dist-server/enterprise). */
+export function enterpriseLayerDirs(env = process.env, serverRoot = SERVER_ROOT) {
+    if (env.OMB_ENTERPRISE_DIR)
+        return [env.OMB_ENTERPRISE_DIR];
+    return [join(serverRoot, "..", "enterprise"), join(serverRoot, "enterprise")];
+}
+/** Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts. */
+function layerEntry(dir) {
+    return [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+}
 let current = { edition: "oss", features: [] };
 let workspaceAccessFactory;
 export function hostedWorkspaceConfigured(env = process.env) {
@@ -53,6 +75,26 @@ export function hostedWorkspaceConfiguration(env = process.env) {
         return null;
     }
 }
+/** Who decides who may use this workspace, for Settings → People and
+ * Remote access. On a portal-membership workspace the organisation's Admin
+ * does, and `peopleUrl` opens its People page for this workspace (identifiers
+ * only; Admin authorizes its own visitor). A hosted workspace never issues
+ * pairing codes or email sign-in: people come in through the portal. */
+export function workspaceMembership(env = process.env) {
+    const hosted = hostedWorkspaceConfiguration(env);
+    const pairingCodes = !hostedWorkspaceConfigured(env);
+    if (!hosted?.portalMembership)
+        return { authority: "local", pairingCodes };
+    const people = new URL("/people", hosted.admin);
+    people.search = new URLSearchParams({ workspace: hosted.workspace }).toString();
+    return { authority: "portal", pairingCodes, peopleUrl: people.href };
+}
+/** An operator may authorize new Full tasks only on a dedicated,
+ * portal-managed server. This is not an HTTP setting or a desktop grant. */
+export function sharedWorkspaceFullAccessConfigured(env = process.env) {
+    return env.OMB_SHARED_WORKSPACE_FULL_ACCESS === "1" && env.OMB_DESKTOP_PARENT !== "1" &&
+        hostedWorkspaceConfiguration(env)?.portalMembership === true;
+}
 /** No enterprise import or portal dependency enters the core bundle. A
  * configured server without this hook must refuse hosted access, not fall
  * back to legacy email or QR credentials. */
@@ -69,12 +111,11 @@ function oss(notice) {
  * degrades to the open-source edition with a notice that says what to fix. */
 export async function loadEnterpriseLayer(options = {}) {
     workspaceAccessFactory = undefined;
-    const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
+    const dirs = options.dir ? [options.dir] : enterpriseLayerDirs(options.env, options.serverRoot);
     const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
-    // Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts.
-    const entry = [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+    const entry = dirs.map(layerEntry).find((candidate) => candidate !== undefined);
     if (!entry) {
-        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dir}` : undefined);
+        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dirs.join(" or ")}` : undefined);
     }
     try {
         const loaded = await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
@@ -86,7 +127,9 @@ export async function loadEnterpriseLayer(options = {}) {
             throw new Error(`${entry} does not export register()`);
         if (!licenseKey)
             return oss("enterprise layer present but OMB_LICENSE_KEY is not set");
-        const registered = await register({ licenseKey });
+        // graceDays is additive: a layer that ignores it refuses an expired key
+        // at startup exactly as before.
+        const registered = await register({ licenseKey, graceDays: LICENSE_GRACE_DAYS });
         const layer = layerSchema.parse(registered);
         current = {
             edition: "enterprise",
@@ -100,27 +143,65 @@ export async function loadEnterpriseLayer(options = {}) {
         return oss(`enterprise layer disabled: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/** When the key stops being valid, or null for perpetual / open-source. */
+function expiryAt() {
+    if (current.edition !== "enterprise" || !current.expiresAt)
+        return null;
+    const at = new Date(current.expiresAt).getTime();
+    return Number.isFinite(at) ? at : null;
+}
 /** A license that expires while the server keeps running stops granting
- * features at that moment, not at the next restart. */
+ * features once its grace period ends, at that moment, not at the next restart. */
 function expired(now) {
-    if (current.edition !== "enterprise" || !current.expiresAt)
-        return false;
-    return now >= new Date(current.expiresAt).getTime();
+    const at = expiryAt();
+    return at !== null && now >= at + LICENSE_GRACE_DAYS * DAY_MS;
 }
 export function editionStatus(now = Date.now()) {
-    if (!expired(now))
+    const at = expiryAt();
+    if (at === null)
         return current;
+    if (expired(now)) {
+        return {
+            edition: "oss",
+            features: [],
+            notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+        };
+    }
+    const expiresInDays = Math.ceil((at - now) / DAY_MS);
+    if (now < at)
+        return { ...current, expiresInDays };
+    const graceEndsAt = new Date(at + LICENSE_GRACE_DAYS * DAY_MS).toISOString().slice(0, 10);
     return {
-        edition: "oss",
-        features: [],
-        notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+        ...current,
+        expiresInDays,
+        graceEndsAt,
+        notice: `OMB_LICENSE_KEY expired on ${current.expiresAt}; enterprise features keep working until ${graceEndsAt} while it is renewed`,
     };
 }
+/** The edition as a non-admin session sees it: what is entitled, without
+ * the license's countdown, grace date or operator notice. */
+export function editionForMembers(status) {
+    const { expiresInDays: _days, graceEndsAt: _grace, notice: _notice, ...shared } = status;
+    return shared;
+}
 /** Feature gates in core ask this and nothing else. Unknown ids are simply not
  * granted, and the open-source edition always carries an empty feature list. */
 export function entitled(feature, now = Date.now()) {
     return !expired(now) && current.features.includes(feature);
 }
+/** The startup warning for a key that is about to lapse or already in its
+ * grace period; null when there is nothing to say. */
+export function licenseWarning(status) {
+    if (status.edition !== "enterprise" || !status.expiresAt || status.expiresInDays === undefined)
+        return null;
+    if (status.graceEndsAt) {
+        return `OMB_LICENSE_KEY expired on ${status.expiresAt}; enterprise features keep working until ${status.graceEndsAt} — renew the key before then`;
+    }
+    if (status.expiresInDays > LICENSE_WARN_DAYS)
+        return null;
+    const days = status.expiresInDays === 1 ? "1 day" : `${status.expiresInDays} days`;
+    return `OMB_LICENSE_KEY expires on ${status.expiresAt} (in ${days}); renew it before then to keep enterprise features`;
+}
 /** One line for the startup log. */
 export function describeEdition(status) {
     if (status.edition === "enterprise") {

package/dist-server/server/external-runtime.js

@@ -0,0 +1,83 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+const MAX_FILE_BYTES = 1_048_576;
+const ID = /^[\w-]{1,128}$/;
+const fingerprint = (token) => createHash("sha256").update(token).digest("hex");
+const sameFingerprint = (left, right) => {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+};
+/** Read a bounded regular file through the descriptor whose permissions we
+ * checked. A pipe must not block the request loop, nor a pathname swap replace
+ * the checked file before the read. */
+function registrations(file) {
+    let fd;
+    try {
+        fd = openSync(file, constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK));
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_FILE_BYTES)
+            return [];
+        if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
+            console.warn("[comms] ignoring external runtime credentials: use a private file (chmod 600)");
+            return [];
+        }
+        const bytes = Buffer.alloc(stat.size + 1);
+        let count = 0;
+        for (;;) {
+            const read = readSync(fd, bytes, count, bytes.length - count, null);
+            if (!read)
+                break;
+            count += read;
+            if (count > stat.size)
+                return []; // changed while being read
+        }
+        const parsed = JSON.parse(bytes.subarray(0, count).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return [];
+        return Object.entries(parsed).flatMap(([botId, value]) => {
+            if (!ID.test(botId) || !value || typeof value !== "object" || Array.isArray(value))
+                return [];
+            const { token, threadId } = value;
+            if (typeof token !== "string" || token.length < 32 || token.length > 4096 || /\s/.test(token))
+                return [];
+            if (typeof threadId !== "string" || !ID.test(threadId))
+                return [];
+            return [{ botId, tokenHash: fingerprint(token), threadId }];
+        });
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function resolveRegistration(file, tokenHash, botForId) {
+    const matches = registrations(file).filter(entry => sameFingerprint(entry.tokenHash, tokenHash));
+    // A copied secret must not select a different bot based on JSON key order.
+    if (matches.length !== 1)
+        return null;
+    const registration = matches[0];
+    const bot = botForId(registration.botId);
+    if (!bot || bot.hidden)
+        return null;
+    // There is no durable "main thread": bot.threadId is the UI selection and
+    // new tasks are prepended. Every grant needs an explicit binding.
+    const task = bot.tasks?.find(candidate => candidate.threadId === registration.threadId);
+    if (!task || task.archivedAt !== undefined)
+        return null;
+    return { botId: bot.id, threadId: task.threadId, tokenHash };
+}
+export function authorizeExternalRuntime(file, header, botForId) {
+    if (typeof header !== "string" || !/^Bearer \S{32,4096}$/.test(header))
+        return null;
+    return resolveRegistration(file, fingerprint(header.slice(7)), botForId);
+}
+/** Re-check after every body/approval/poll wait. The captured identity is not
+ * a lease: token rotation, rebinding, deletion and archive take effect now. */
+export function externalRuntimeIsActive(file, grant, botForId) {
+    const current = resolveRegistration(file, grant.tokenHash, botForId);
+    return current?.botId === grant.botId && current.threadId === grant.threadId;
+}

package/dist-server/server/guarded-requests.js

@@ -0,0 +1,60 @@
+export function requestConflict(message = "The request no longer owns this conversation") {
+    return Object.assign(new Error(message), { status: 409, code: "guarded_request_changed" });
+}
+export function assertRequestTarget(current, expected) {
+    if (current.messageId !== expected.messageId || current.activeLeafId !== expected.expectedActiveLeafId ||
+        current.activeTurnId !== expected.expectedTurnId || current.executionId !== expected.expectedExecutionId)
+        throw requestConflict();
+}
+/** Never infer ownership from timestamps or the latest assistant text. */
+export function guardedRequestPath(messages, activeLeafId, sendId) {
+    const sources = messages.filter(message => message.sendId === sendId);
+    const source = sources[0];
+    if (sources.length !== 1 || !source || source.role !== "user" || source.kind !== "text" || source.steered || source.peerAsk) {
+        throw requestConflict("No unique acknowledged user request matches this sendId");
+    }
+    const byId = new Map(messages.map(message => [message.id, message]));
+    const path = [];
+    const seen = new Set();
+    let id = activeLeafId;
+    while (id) {
+        if (seen.has(id))
+            throw requestConflict();
+        seen.add(id);
+        const message = byId.get(id);
+        if (!message)
+            throw requestConflict();
+        path.unshift(message);
+        if (message.id === source.id)
+            break;
+        if (path.length >= 500)
+            throw Object.assign(new Error("Open this request in the workspace; its transcript exceeds the response limit"), { status: 413 });
+        id = message.parentId ?? null;
+    }
+    if (path[0]?.id !== source.id || path.slice(1).some(message => message.role === "user"))
+        throw requestConflict();
+    // An abandoned sibling can hold a detached result or approval. A caller
+    // must never receive it as the answer to the current branch.
+    const ancestors = new Set(path.map(message => message.id));
+    if (messages.some(message => message.parentId && ancestors.has(message.parentId) && !seen.has(message.id)))
+        throw requestConflict();
+    return path;
+}
+/** Used only for an explicit control-plane card, never the latest user. */
+export function requestSourceForCard(messages, messageId) {
+    const byId = new Map(messages.map(message => [message.id, message]));
+    const seen = new Set();
+    let message = byId.get(messageId);
+    while (message && !seen.has(message.id)) {
+        seen.add(message.id);
+        if (message.role === "user")
+            return message.peerAsk || message.steered || message.requestCancelled ? undefined : message.id;
+        message = message.parentId ? byId.get(message.parentId) : undefined;
+    }
+    return undefined;
+}
+export function requestNeedsInput(message) {
+    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed) ||
+        (message.connector && !message.connector.dismissed && !message.connector.resumed && message.connector.status !== "connected") ||
+        (message.secret && !message.secret.provided && !message.secret.dismissed));
+}