openmausbot 0.1.85 → 0.1.86

package/dist-server/server/usage-ledger.js

@@ -24,7 +24,15 @@ function monthKey(at) {
 export function usageFileFor(dataDir, at) {
     return join(dataDir, DIR, `${monthKey(at)}.jsonl`);
 }
-/** Append one settled turn. Fire-and-forget; see the module comment. */
+/** Identifies one row: a thread runs one turn at a time, so a bot cannot
+ * settle two turns on the same thread in the same millisecond. Lets the
+ * spend cap tell a booked row it already counted from memory apart from the
+ * same row read back from the file. */
+export function usageRowKey(row) {
+    return `${row.at}|${row.threadId}|${row.botId}`;
+}
+/** Append one settled turn. Fire-and-forget (see the module comment): the
+ * returned promise never rejects, and says whether the row reached disk. */
 export function appendUsage(dataDir, row) {
     const record = {
         ...row,
@@ -34,10 +42,14 @@ export function appendUsage(dataDir, row) {
         ...(typeof row.cachedInput === "number" ? { cachedInput: clean(row.cachedInput) } : {}),
         costUsd: finiteOrNull(row.costUsd),
     };
+    // A cost is labelled with where it came from; an unpriced row carries no label.
+    if (record.costUsd === null)
+        delete record.costSource;
+    else
+        record.costSource = row.costSource === "estimated" ? "estimated" : "reported";
     const previous = writeQueues.get(dataDir) ?? Promise.resolve();
-    const queued = previous
-        .then(() => write(dataDir, record))
-        .catch(() => {
+    const attempt = previous.then(() => write(dataDir, record));
+    const queued = attempt.then(() => undefined, () => {
         /* bookkeeping must never take down the turn */
     });
     writeQueues.set(dataDir, queued);
@@ -45,6 +57,7 @@ export function appendUsage(dataDir, row) {
         if (writeQueues.get(dataDir) === queued)
             writeQueues.delete(dataDir);
     });
+    return attempt.then(() => true, () => false);
 }
 async function write(dataDir, record) {
     await mkdir(join(dataDir, DIR), { recursive: true, mode: 0o700 });
@@ -165,7 +178,13 @@ function groupOf(row, groupBy) {
     }
 }
 function emptyGroup(key, label) {
-    return { key, label, turns: 0, input: 0, output: 0, cachedInput: 0, costUsd: null, unpriced: 0, billableUsd: null };
+    return { key, label, turns: 0, input: 0, output: 0, cachedInput: 0, costUsd: null, estimatedUsd: null, unpriced: 0, billableUsd: null };
+}
+/** Where a row's cost came from, for rows old and new; null when it has none. */
+export function costSourceOf(row) {
+    if (finiteOrNull(row.costUsd) === null)
+        return null;
+    return row.costSource === "estimated" ? "estimated" : "reported";
 }
 function add(group, row, prices) {
     group.turns += 1;
@@ -175,8 +194,11 @@ function add(group, row, prices) {
     const cost = finiteOrNull(row.costUsd);
     if (cost === null)
         group.unpriced += 1;
-    else
+    else {
         group.costUsd = (group.costUsd ?? 0) + cost;
+        if (costSourceOf(row) === "estimated")
+            group.estimatedUsd = (group.estimatedUsd ?? 0) + cost;
+    }
     const billable = prices ? billableFor(row, prices) : null;
     if (billable !== null)
         group.billableUsd = (group.billableUsd ?? 0) + billable;
@@ -207,7 +229,7 @@ export function summarizeUsage(rows, groupBy, prices = null) {
     }
     return { groups: ordered, total };
 }
-function csvCell(value) {
+export function csvCell(value) {
     if (value === null)
         return "";
     const text = String(value);
@@ -218,7 +240,7 @@ function csvCell(value) {
 }
 /** One line per turn, spreadsheet-ready; a billable column when a price list is given. */
 export function usageCsv(rows, prices = null) {
-    const header = ["time", "bot", "model", "engine", "triggered_by", "input_tokens", "output_tokens", "cached_input_tokens", "cost_usd", ...(prices ? ["billable_usd"] : []), "thread"];
+    const header = ["time", "bot", "model", "engine", "triggered_by", "input_tokens", "output_tokens", "cached_input_tokens", "cost_usd", "cost_source", ...(prices ? ["billable_usd"] : []), "thread"];
     const lines = [header.join(",")];
     for (const row of rows) {
         lines.push([
@@ -231,6 +253,7 @@ export function usageCsv(rows, prices = null) {
             clean(row.output),
             clean(row.cachedInput),
             finiteOrNull(row.costUsd),
+            costSourceOf(row),
             ...(prices ? [billableFor(row, prices)] : []),
             row.threadId,
         ].map(csvCell).join(","));

package/dist-server/server/workspace-backup-policy.js

@@ -22,7 +22,14 @@ export function restoredWorkspaceConfig(portable, destination) {
 }
 /** Exact app-owned authentication paths, not a scan of user document text. */
 export function excludedWorkspaceAuthPath(path) {
-    return /^(?:(?:providers|caddy|chrome-profile|\.agent-browser)(?:\/|$)|workspace-credentials\.json$|browser-engine-key$)/.test(path) ||
-        /^(?:config\.json|webhooks\.json|workspace-credentials\.json|browser-engine-key|sessions\.json|tunnel-account\.json)\.\d+(?:\.[0-9a-f-]+)?\.tmp$/.test(path) ||
+    return /^(?:(?:providers|caddy|chrome-profile|\.agent-browser)(?:\/|$)|workspace-credentials\.json$|external-runtimes\.json$|browser-engine-key$)/.test(path) ||
+        /^(?:config\.json|webhooks\.json|workspace-credentials\.json|external-runtimes\.json|browser-engine-key|sessions\.json|tunnel-account\.json)\.\d+(?:\.[0-9a-f-]+)?\.tmp$/.test(path) ||
         /^(?:vm-home|vm-homes\/[^/]+)\/\.browser-profiles(?:\/|$)/.test(path);
 }
+/** Per-turn engine hook bearers (`hook-tokens/<digest>.token`, written by the
+ * Claude driver). They are dead once their turn settles, so they are never
+ * exported. Unlike the saved auth paths above they are not refused on import:
+ * v0.1.85 did export them, and such a backup must still restore, without them. */
+export function ephemeralWorkspaceTokenPath(path) {
+    return /^hook-tokens(?:\/|$)/.test(path);
+}

package/dist-server/server/workspace-backup.js

@@ -11,7 +11,7 @@ import { fromMarkdown } from "mdast-util-from-markdown";
 import { writeFileAtomic } from "./atomic.js";
 import { escapeAttribute, splitTranscriptAttachments } from "../src/lib/composer-attachments.js";
 import { WORKSPACE_BACKUP_CLIENT_KEYS } from "../shared/workspace-backup-client.js";
-import { excludedWorkspaceAuthPath, portableWorkspaceConfig, restoredWorkspaceConfig } from "./workspace-backup-policy.js";
+import { ephemeralWorkspaceTokenPath, excludedWorkspaceAuthPath, portableWorkspaceConfig, restoredWorkspaceConfig } from "./workspace-backup-policy.js";
 export const MAX_WORKSPACE_BACKUP_BYTES = 10 * 1024 ** 3;
 export const MAX_WORKSPACE_BACKUP_FILES = 100_000;
 export const MAX_WORKSPACE_BACKUP_UPLOAD_BYTES = MAX_WORKSPACE_BACKUP_BYTES + 256 * 1024 ** 2;
@@ -311,7 +311,7 @@ export async function createWorkspaceBackup(dataDir, options) {
                 if (!prefix && excluded(name))
                     continue;
                 const path = prefix ? `${prefix}/${name}` : name;
-                if (excludedWorkspaceAuthPath(path))
+                if (excludedWorkspaceAuthPath(path) || ephemeralWorkspaceTokenPath(path))
                     continue;
                 // Do not silently skip noncanonical source spellings: reject them so
                 // a case-sensitive host cannot export auth paths active on Windows/Mac.
@@ -781,9 +781,12 @@ function prepareRestore(dataDir, id, manifest) {
     folder(prepared);
     // Keep the authenticated original staging tree intact for reinspection and
     // recovery. Only this installation copy has paths/scheduling adapted.
-    for (const entry of manifest.entries.filter((entry) => entry.type === "directory"))
+    // An archive from a release that exported per-turn hook tokens still
+    // restores; the dead tokens themselves are never installed.
+    const installed = manifest.entries.filter((entry) => !ephemeralWorkspaceTokenPath(entry.path));
+    for (const entry of installed.filter((entry) => entry.type === "directory"))
         folder(join(prepared, entry.path));
-    for (const entry of manifest.entries) {
+    for (const entry of installed) {
         const destination = join(prepared, entry.path);
         if (entry.type === "file")
             copyRegular(join(job, "staged", "data", entry.path), destination);

package/dist-server/shared/mention-boundary.js

@@ -0,0 +1,15 @@
+// Keep mention recognition identical in the renderer and server routing.
+// Deliberately allow only opening punctuation/Markdown markers here: `/@bot`
+// remains a URL path, while `(@bot)`, `【@bot】`, and `**@bot**` are tags.
+const OPENING_MENTION_BOUNDARY = /[(*_~[{<'"\u2018\u201c\u3008\u300a\u300c\u300e\u3010\uff08]/u;
+/** Return whether an at-sign starts a standalone mention at this offset. */
+export function isMentionBoundary(text, at) {
+    if (at === 0)
+        return true;
+    const before = text[at - 1];
+    return /\s/u.test(before) || OPENING_MENTION_BOUNDARY.test(before);
+}
+/** A matched name must not be the prefix of a longer Unicode word. */
+export function isMentionNameContinuation(value) {
+    return value !== undefined && /^[\p{L}\p{N}\p{M}_]/u.test(value);
+}

package/dist-server/shared/routines.js

@@ -1 +1,7 @@
-export {};
+/** The statuses both failure indicators count: a run that went wrong and has
+ * not been acknowledged. One home so the sidebar dot, the errors pill, the
+ * logs filter and the bulk-seen sweep cannot drift apart. */
+export const ROUTINE_PROBLEM_STATUSES = ["failed", "missed"];
+export function isRoutineProblemRun(run) {
+    return ROUTINE_PROBLEM_STATUSES.includes(run.status);
+}

package/dist-server/shared/team-backup.js

@@ -25,6 +25,8 @@ const task = z.object({
     titleFromFirstMessage: z.literal(true).optional(),
     openedBy: z.object({ botId: key, name, at: timestamp, kind: z.enum(["pair", "work"]).optional() }).optional(),
     closedBy: z.object({ botId: key, name, at: timestamp }).optional(),
+    /** Only true travels. Absence is unpinned, including backups from before pins. */
+    pinned: z.literal(true).optional(),
     activeLeafId: key.nullable(),
     messages: z.array(message).max(100_000),
 });

package/dist-server/src/lib/composer-attachments.js

@@ -691,3 +691,19 @@ export async function intakeFiles(_files, _opts) {
         notice: pathless && failed ? `${pathless} (${failed})` : (pathless ?? failed),
     };
 }
+/**
+ * Whether the composer may pull keyboard focus back into its textarea after an
+ * attachment lands. The draft was the writer's place when focus is still there,
+ * has fallen to the page (a disabled element drops it), or sits on a control
+ * inside the composer such as the paperclip button after the file dialog. A
+ * focused control elsewhere — a dialog, the thread list — is left alone.
+ */
+export function composerShouldRefocus(active, input) {
+    if (!active || active === input)
+        return true;
+    const root = input.ownerDocument;
+    if (active === root.body || active === root.documentElement)
+        return true;
+    const composer = input.closest("[data-tour=composer]");
+    return Boolean(composer?.contains(active));
+}

package/dist-server/vps-container-mcp.js

@@ -15372,6 +15372,20 @@ var defaultModelSelectionSchema = external_exports.object({
   (selection) => selection.variant === void 0 || selection.effort === void 0,
   "choose either a model variant or an effort level"
 );
+var threadsConfigSchema = external_exports.object({
+  maxConcurrentPerBot: external_exports.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS),
+  /** Cap each per-thread events/ and native/ NDJSON log at this many
+   * bytes; absent (the default) keeps today's unbounded growth (#1280). */
+  eventLogMaxBytes: external_exports.number().int().min(MIN_THREAD_EVENT_LOG_BYTES).max(MAX_THREAD_EVENT_LOG_BYTES).optional(),
+  /** Days a closed or archived thread's event logs survive (#1280).
+   * Absent keeps them forever. */
+  eventLogRetentionDays: external_exports.number().int().min(1).max(3650).optional()
+}).strict();
+var threadsPatchSchema = threadsConfigSchema.extend({
+  maxConcurrentPerBot: threadsConfigSchema.shape.maxConcurrentPerBot.optional(),
+  eventLogMaxBytes: threadsConfigSchema.shape.eventLogMaxBytes.nullable(),
+  eventLogRetentionDays: threadsConfigSchema.shape.eventLogRetentionDays.nullable()
+});
 var appConfigSchema = external_exports.object({
   /** Verified by the dedicated domain endpoint, never a generic config patch. */
   customDomain: external_exports.string().optional(),
@@ -15464,15 +15478,10 @@ var appConfigSchema = external_exports.object({
     compactAt: external_exports.number().positive().max(1e7).optional(),
     autoCompact: external_exports.boolean().optional()
   }).optional(),
-  threads: external_exports.object({
-    maxConcurrentPerBot: external_exports.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS),
-    /** Cap each per-thread events/ and native/ NDJSON log at this many
-     * bytes; absent (the default) keeps today's unbounded growth (#1280). */
-    eventLogMaxBytes: external_exports.number().int().min(MIN_THREAD_EVENT_LOG_BYTES).max(MAX_THREAD_EVENT_LOG_BYTES).optional(),
-    /** Days a closed or archived thread's event logs survive (#1280).
-     * Absent keeps them forever. */
-    eventLogRetentionDays: external_exports.number().int().min(1).max(3650).optional()
-  }).strict().optional(),
+  threads: threadsConfigSchema.optional(),
+  /** The authorization decision log (server/decision-log.ts): days of month
+   * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
+  decisions: external_exports.object({ retentionDays: external_exports.number().int().min(1).max(3650).optional() }).strict().optional(),
   localVm: localVmConfigSchema.optional(),
   features: featureConfigSchema.optional(),
   onboarding: onboardingConfigSchema.optional(),
@@ -15489,7 +15498,7 @@ var appConfigSchema = external_exports.object({
 var storedAppConfigSchema = appConfigSchema.extend({
   browserProfiles: storedBrowserProfilesSchema.optional()
 });
-var appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true });
+var appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true }).extend({ threads: threadsPatchSchema.optional() });
 var jsonObjectSchema = external_exports.record(external_exports.string(), external_exports.json());
 var DATA_DIR = process.env.OMB_DATA_DIR ?? join2(homedir2(), ".openmausbot");
 var LEGACY_DATA_DIR = join2(homedir2(), ".opengrokbot");

package/enterprise/README.md

@@ -5,24 +5,42 @@ folder has its own [LICENSE](./LICENSE); everything outside it is Apache 2.0.
 
 **Delete this folder and you have the open-source edition.** Core only
 reaches the layer through one hook point, `server/enterprise.ts`, which
-loads `enterprise/server/index.ts` if it exists and otherwise reports the
-open-source edition. No core file imports anything from here.
+loads `enterprise/server/index.ts` (or the bundled `index.js`) if it exists
+and otherwise reports the open-source edition. No core file imports anything
+from here.
+
+Where core looks, in order: `OMB_ENTERPRISE_DIR` when it is set (and then
+only there); otherwise beside the server root (a checkout's `enterprise/`,
+the npm package's `<package>/enterprise/`), then inside it
+(`dist-server/enterprise/`, which is all the Docker image and the packaged
+desktop carry; `scripts/bundle-server.mjs` writes the bundled layer and this
+LICENSE there).
 
 ## How a deployment turns enterprise
 
 Set `OMB_LICENSE_KEY` on the server. The key is `omb1.<claims>.<signature>`:
 the claims are visible JSON (who it is for, which entitlements, when it
 expires), signed with an Ed25519 key whose public half is baked into
-`server/license.ts`. Verification is offline, and one build serves every
-customer, because the key decides the feature set rather than the code.
+`enterprise/server/license.ts`. Verification is offline, and one build serves
+every customer, because the key decides the feature set rather than the code.
 
 `GET /api/edition` reports the outcome:
 
 ```json
-{ "edition": "enterprise", "customer": "Acme", "features": ["sso", "whitelabel"], "expiresAt": "2027-09-02" }
-{ "edition": "oss", "features": [], "notice": "OMB_LICENSE_KEY expired on 2027-09-02; renew it to keep enterprise features" }
+{ "edition": "enterprise", "customer": "Acme", "features": ["budgets", "whitelabel"], "expiresAt": "2027-09-02", "expiresInDays": 12 }
+{ "edition": "enterprise", "customer": "Acme", "features": ["budgets", "whitelabel"], "expiresAt": "2027-09-02", "expiresInDays": -2, "graceEndsAt": "2027-09-09", "notice": "OMB_LICENSE_KEY expired on 2027-09-02; enterprise features keep working until 2027-09-09 while it is renewed" }
+{ "edition": "oss", "features": [], "notice": "enterprise layer disabled: OMB_LICENSE_KEY expired on 2027-09-02; renew it to keep enterprise features" }
 ```
 
+`expiresInDays` is present whenever the key has an expiry; a non-admin
+session's `/api/edition` leaves out `expiresInDays`, `graceEndsAt` and the
+notice. From 30 days
+before it, the server logs a warning at startup and admins see a banner in
+Settings. After the expiry date the features keep working for a 7-day grace
+period, with the notice above and a banner saying until when; then they stop,
+without a restart. The key format and its signature check do not change: the
+layer simply accepts a key that expired less than the grace period ago.
+
 A missing, altered, or expired key does not stop an ordinary standalone
 server: it runs the open-source edition and the notice says what to fix.
 A workspace explicitly configured for hosted sign-in fails closed for remote
@@ -31,12 +49,15 @@ must not silently fall back to standalone email or pairing credentials.
 
 ## Entitlement ids
 
-| id | grants |
-|---|---|
-| `whitelabel` | product name, tagline, accent colour, logo, favicon and support link from `brand.json` (below) |
-| `sso` | identity-header trust behind an OIDC proxy |
-| `admin` | Settings → Workspaces and the optional hosted workspace sign-in adapter |
-| `budgets` | per-bot and per-section spend limits |
+| id | grants | status |
+|---|---|---|
+| `whitelabel` | product name, tagline, accent colour, logo, favicon and support link from `brand.json` (below) | shipped |
+| `sso` | sign-in through a company identity provider | planned: nothing checks it yet |
+| `admin` | Settings → Workspaces and the optional hosted workspace sign-in adapter | shipped |
+| `budgets` | one monthly spend limit for the whole workspace, refusing new turns at the cap, with a warning percentage and admin notices (not per bot or per section) | shipped |
+| `billing` | sell prices per model: a billable column in Usage → History and its CSV, and per-model prices that replace list prices in cost estimates | shipped |
+
+[FEATURES](./FEATURES) is the authoritative list.
 
 Core gates a feature with `entitled("id")` from `server/enterprise.ts`.
 Unknown ids are carried in the key but grant nothing, so keys can be issued

package/enterprise/server/index.js

@@ -14579,9 +14579,6 @@ function verifyLicenseKey(key, options = {}) {
 // enterprise/server/workspace-access.ts
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 
-// server/enterprise.ts
-import { join as join2 } from "node:path";
-
 // server/proxy-paths.ts
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -14615,7 +14612,7 @@ var layerSchema = external_exports.object({
   features: external_exports.array(external_exports.string().min(1)),
   expiresAt: external_exports.string().nullable()
 });
-var DEFAULT_DIR = join2(SERVER_ROOT, "..", "enterprise");
+var DAY_MS = 24 * 60 * 6e4;
 function hostedWorkspaceConfiguration(env = process.env) {
   try {
     const origin = (raw) => {
@@ -14934,9 +14931,12 @@ function createWorkspaceAccess(options) {
 }
 
 // enterprise/server/index.ts
+var MAX_GRACE_DAYS = 14;
+var DAY_MS2 = 24 * 60 * 6e4;
 function register(options) {
   if (!options.licenseKey) return null;
-  const claims = verifyLicenseKey(options.licenseKey);
+  const graceDays = Math.min(MAX_GRACE_DAYS, Math.max(0, Number.isFinite(options.graceDays) ? options.graceDays : 0));
+  const claims = verifyLicenseKey(options.licenseKey, { now: new Date((options.now ?? Date.now()) - graceDays * DAY_MS2) });
   return { customer: claims.customer, features: claims.features, expiresAt: claims.expires };
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.85",
+  "version": "0.1.86",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",