openmausbot 0.1.85 → 0.1.87

package/dist-server/server/cli.js

@@ -23,6 +23,7 @@
 // This module only exports; openmausbot.ts is the entry that runs main(), so
 // bundling this file into other entries (pair-cli.ts) never runs it twice.
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -30,6 +31,10 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
 import { parseAllowList } from "./account-signin.js";
+import { appendAdminAction, flushAdminActivity, sharedSignIn } from "./admin-activity.js";
+import { bindDecisionRetention, decisionRetentionDays } from "./decision-log.js";
+import { hostedWorkspaceConfigured } from "./enterprise.js";
+import { resolveLoopbackTrust } from "./request-auth.js";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
 import { runServiceCommand } from "./service-cli.js";
@@ -246,7 +251,7 @@ fleet   many client workspaces on one Linux server, each its own account,
         --dry-run always prints. Install the package permanently first.
         init --operator USER also installs the fleet agent, a root service
         on a Unix socket only USER may open, so the workspace running as
-        USER manages the others from Settings → Workspaces.
+        USER manages the others from Settings → Installations.
 
 --tailscale  serve over your tailnet: Tailscale terminates HTTPS and the
              link uses this machine's MagicDNS name (needs Tailscale signed in
@@ -295,11 +300,23 @@ export function serverVersion(here = HERE) {
 }
 const message = (error) => (error instanceof Error ? error.message : String(error));
 // ── talking to a running server (loopback = owner) ────────────────────
+/** Set only inside `openmausbot serve` on a service-trust server: the secret
+ * it handed the server it started, which opens that server's pairing route. */
+let serveOwnerToken;
 async function api(port, path, init = {}) {
-    const res = await fetch(`http://127.0.0.1:${port}${path}`, { method: init.method, body: init.body, headers: { "content-type": "application/json" }, signal: AbortSignal.timeout(3000) });
+    // x-openmausbot-cli names the tool in the admin activity log; on loopback
+    // it is the owner either way, so it grants nothing.
+    const headers = { "content-type": "application/json", "x-openmausbot-cli": "1", ...(serveOwnerToken ? { "x-openmausbot-cli-owner": serveOwnerToken } : {}) };
+    const res = await fetch(`http://127.0.0.1:${port}${path}`, { method: init.method, body: init.body, headers, signal: AbortSignal.timeout(3000) });
     const body = await res.json().catch(() => ({}));
     return { status: res.status, body };
 }
+/** What to do when a server treats this command as a local service rather
+ * than its owner (OMB_LOOPBACK_TRUST=service, or a hosted workspace). */
+export const SERVICE_TRUST_HELP = "This server does not treat commands on this computer as its owner (OMB_LOOPBACK_TRUST=service, or a hosted workspace), so it will not pair devices or list sessions for them. Sign in as an admin and use Settings → Remote access, let people sign in with their email (openmausbot access add you@example.com), or restart the server with OMB_LOOPBACK_TRUST=owner.";
+function refusedAsService(status, body) {
+    return status === 403 && typeof body?.error === "string" && /shared server|Sign in through the workspace portal/.test(body.error);
+}
 async function serverUp(port, pid) {
     try {
         const { status, body } = await api(port, "/api/health");
@@ -385,7 +402,7 @@ function startupPreferences(options) {
 async function showPhonePairing(options, origin, log) {
     const ready = !!origin && await verifyPhoneEndpoint(options.port, origin);
     if (!ready) {
-        log("Phone access is not reachable yet. Your local workspace is ready; no phone pairing code was created.");
+        log("Phone access is not reachable yet. OpenMausBot is ready on this computer; no phone pairing code was created.");
         log("Check the HTTPS connection, then run openmausbot pair again with the same --data-dir and --port.");
         return false;
     }
@@ -472,6 +489,8 @@ async function mintPairing(port, options) {
     if (options.client)
         request.scopes = ["client"];
     const { status, body } = await api(port, "/api/auth/pairing", { method: "POST", body: JSON.stringify(request) });
+    if (refusedAsService(status, body))
+        throw new Error(SERVICE_TRUST_HELP);
     if (status !== 200)
         throw new Error(`server refused to mint a pairing code: ${typeof body?.error === "string" ? body.error : status}`);
     const url = options.publicUrl ? `${options.publicUrl}/pair#code=${body.code}` : typeof body.url === "string" ? body.url : null;
@@ -547,6 +566,10 @@ export async function runSessions(options) {
     }
     if (options.revoke) {
         const { status, body } = await api(options.port, `/api/auth/sessions/${encodeURIComponent(options.revoke)}`, { method: "DELETE" });
+        if (refusedAsService(status, body)) {
+            console.error(SERVICE_TRUST_HELP);
+            return 1;
+        }
         if (status !== 200) {
             console.error(`could not revoke: ${typeof body?.error === "string" ? body.error : status}`);
             return 1;
@@ -554,7 +577,15 @@ export async function runSessions(options) {
         console.log(`revoked ${options.revoke}: that device is signed out and its stream is closed`);
         return 0;
     }
-    const { body } = await api(options.port, "/api/auth/sessions");
+    const { status, body } = await api(options.port, "/api/auth/sessions");
+    if (refusedAsService(status, body)) {
+        console.error(SERVICE_TRUST_HELP);
+        return 1;
+    }
+    if (status !== 200) {
+        console.error(`could not list sessions: ${typeof body?.error === "string" ? body.error : status}`);
+        return 1;
+    }
     const sessions = Array.isArray(body?.sessions) ? body.sessions : [];
     if (options.json) {
         console.log(JSON.stringify(sessions, null, 2));
@@ -623,9 +654,24 @@ export async function runAccess(options, io = defaultIo()) {
     const admins = list(Reflect.get(current, "admins"));
     const members = list(Reflect.get(current, "members"));
     const overridden = process.env.OMB_SIGNIN_EMAILS !== undefined || process.env.OMB_SIGNIN_MEMBER_EMAILS !== undefined;
-    const write = (next) => {
+    const write = async (next) => {
         mkdirSync(options.dataDir, { recursive: true, mode: 0o700 });
         writeFileAtomic(file, `${JSON.stringify({ ...raw, signIn: next }, null, 2)}\n`, { mode: 0o600 });
+        // The same row Settings → People writes, named for the command line,
+        // pruned by the same window the server would use — kept, like the
+        // server's, only where more than one person signs in.
+        if (!sharedSignIn({ admins, members }) && !sharedSignIn(next) && !hostedWorkspaceConfigured())
+            return;
+        const decisions = raw.decisions && typeof raw.decisions === "object" ? raw.decisions.retentionDays : undefined;
+        bindDecisionRetention(() => decisionRetentionDays(typeof decisions === "number" ? decisions : undefined));
+        const changed = ["admins", "members"].filter((key) => next[key].join(",") !== (key === "admins" ? admins : members).join(","));
+        appendAdminAction(options.dataDir, {
+            category: "people", action: "people.update", target: { kind: "settings" }, actor: { kind: "cli" },
+            changed: changed.map((key) => `signIn.${key}`),
+            before: Object.fromEntries(changed.map((key) => [`signIn.${key}`, key === "admins" ? admins : members])),
+            after: Object.fromEntries(changed.map((key) => [`signIn.${key}`, next[key]])),
+        });
+        await flushAdminActivity(options.dataDir);
     };
     if (options.accessAction === "list") {
         if (!admins.length && !members.length) {
@@ -651,11 +697,11 @@ export async function runAccess(options, io = defaultIo()) {
             io.error(`${entry} is not on the list`);
             return 1;
         }
-        write({ admins: without(admins), members: without(members) });
+        await write({ admins: without(admins), members: without(members) });
         io.log(`${entry} can no longer sign in (existing sessions stay until they expire or are revoked with \`openmausbot sessions revoke\`)`);
         return 0;
     }
-    write(options.chatOnly ? { admins: without(admins), members: [...without(members), entry] } : { admins: [...without(admins), entry], members: without(members) });
+    await write(options.chatOnly ? { admins: without(admins), members: [...without(members), entry] } : { admins: [...without(admins), entry], members: without(members) });
     io.log(`${entry} can sign in at /pair with an emailed code (${options.chatOnly ? "chat and approvals" : "full access"})`);
     if (overridden)
         io.log("note: OMB_SIGNIN_EMAILS / OMB_SIGNIN_MEMBER_EMAILS are set in the environment and win over this list while the server runs");
@@ -883,6 +929,16 @@ export async function runServe(options, log = console.log) {
     };
     if (options.local)
         delete env.OMB_PUBLIC_URL;
+    // A service-trust server refuses session-less local admin requests, this
+    // CLI's included. Hand the server we start a per-launch secret over its
+    // stdin (not its environment, which every engine it starts inherits) so
+    // this process alone can still print the pairing code.
+    const serviceTrust = resolveLoopbackTrust({ env, desktopManaged: false, hostedWorkspace: hostedWorkspaceConfigured(env) }).trust === "service";
+    const ownerToken = serviceTrust ? randomBytes(32).toString("base64url") : undefined;
+    if (ownerToken)
+        env.OMB_CLI_OWNER_STDIN = "1";
+    else
+        delete env.OMB_CLI_OWNER_STDIN;
     if (entry.staticDir)
         env.OMB_STATIC_DIR = entry.staticDir;
     if (entry.skillsDir && !process.env.OMB_SKILLS_DIR)
@@ -925,7 +981,12 @@ export async function runServe(options, log = console.log) {
             throw new SetupCancelled();
         if (publicUrl)
             env.OMB_PUBLIC_URL = publicUrl;
-        child = spawn(entry.command, entry.args, { env, stdio: ["ignore", logFd ?? "inherit", logFd ?? "inherit"] });
+        child = spawn(entry.command, entry.args, { env, stdio: [ownerToken ? "pipe" : "ignore", logFd ?? "inherit", logFd ?? "inherit"] });
+        if (ownerToken) {
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(`${ownerToken}\n`);
+            serveOwnerToken = ownerToken;
+        }
     }
     catch (error) {
         if ((tailscaleServing || (startupCancelled && tailscaleAttempted)) && tailscale)
@@ -1048,13 +1109,20 @@ export async function runServe(options, log = console.log) {
                     clearTimeout(timer);
             }
             if (!stopping && exited === null)
-                await showPhonePairing(options, publicUrl, log);
+                await showPhonePairing(options, publicUrl, log).catch((error) => log(`no pairing code: ${message(error)}`));
         }
         else if (options.pair && !options.guided) {
             log("");
-            log(await mintPairing(options.port, { label: options.label ? `${options.label} owner` : undefined, client: options.client, publicUrl: publicUrl ?? undefined }));
-            log("");
-            log("another device later:  openmausbot pair --label \"Kitchen iPad\"");
+            // A refused code is no reason to stop a server that is running fine.
+            try {
+                log(await mintPairing(options.port, { label: options.label ? `${options.label} owner` : undefined, client: options.client, publicUrl: publicUrl ?? undefined }));
+                log("");
+                log("another device later:  openmausbot pair --label \"Kitchen iPad\"");
+            }
+            catch (error) {
+                log(`no pairing code: ${message(error)}`);
+                log("start without one next time:  openmausbot serve --no-pair");
+            }
         }
         log(options.guided ? "\nKeep this terminal open while using your bots. Ctrl+C stops the server, not your saved work." : "stop with Ctrl+C");
         if (options.guided)
@@ -1062,6 +1130,7 @@ export async function runServe(options, log = console.log) {
         return await childExit;
     }
     finally {
+        serveOwnerToken = undefined;
         await stop();
         process.removeListener("SIGINT", onSignal);
         process.removeListener("SIGTERM", onSignal);

package/dist-server/server/command-allowlist.js

@@ -0,0 +1,154 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, isAbsolute, sep } from "node:path";
+import { writeFileAtomic } from "./atomic.js";
+import { redactSecretsInText } from "./redact.js";
+const MAX_COMMAND_BYTES = 16_384;
+const MAX_CWD_BYTES = 4_096;
+const MAX_RULES_PER_BOT = 200;
+const MAX_STORE_BYTES = 8 * 1024 * 1024;
+const BOT_ID = /^[\w-]{1,128}$/;
+const RULE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const invalid = (message) => Object.assign(new Error(message), { status: 400 });
+/** Validate without rewriting the command. Resolving a symlink, or folding
+ * `..` across one, could make a grant apply in a different directory. */
+export function validateCommandAllowlistCandidate(value) {
+    if (!record(value))
+        throw invalid("A command, absolute working directory and engine instance are required.");
+    const { command, cwd, providerInstanceId } = value;
+    if (typeof command !== "string" || !command.trim() || Buffer.byteLength(command) > MAX_COMMAND_BYTES ||
+        /[\p{Cc}\p{Cs}]/u.test(command.replace(/[\t\r\n]/g, ""))) {
+        throw invalid("The command must be nonempty text of at most 16384 bytes, without invalid control characters.");
+    }
+    if (redactSecretsInText(command) !== command) {
+        throw invalid("Commands containing credentials cannot be saved. Use an environment variable instead.");
+    }
+    if (typeof cwd !== "string" || !cwd || Buffer.byteLength(cwd) > MAX_CWD_BYTES ||
+        /[\p{Cc}\p{Cs}]/u.test(cwd) || !isAbsolute(cwd) || cwd.split(sep === "\\" ? /[\\/]/ : /\//).includes("..")) {
+        throw invalid("The working directory must be an absolute path without parent-directory segments.");
+    }
+    // On Windows, `\work` is rooted but still depends on the current drive.
+    if (process.platform === "win32" && !/^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/][^\\/]+(?:[\\/]|$))/.test(cwd)) {
+        throw invalid("The working directory must include its drive or network share.");
+    }
+    if (typeof providerInstanceId !== "string" || !providerInstanceId || providerInstanceId.trim() !== providerInstanceId ||
+        providerInstanceId.length > 200 || /[\p{Cc}\p{Cs}]/u.test(providerInstanceId)) {
+        throw invalid("A valid engine instance is required.");
+    }
+    // Keep directory spelling exact too. A false negative is preferable to
+    // treating two paths as equivalent without knowing the engine's filesystem.
+    return { command, cwd, providerInstanceId };
+}
+/** Runtime metadata that cannot identify an exact scope never auto-allows. */
+export function commandAllowlistCandidate(value) {
+    try {
+        return validateCommandAllowlistCandidate(value);
+    }
+    catch {
+        return null;
+    }
+}
+function validateBotId(botId) {
+    if (typeof botId !== "string" || !BOT_ID.test(botId))
+        throw invalid("A valid bot id is required.");
+}
+function sameScope(left, right) {
+    return left.command === right.command && left.cwd === right.cwd && left.providerInstanceId === right.providerInstanceId;
+}
+/** Installation-local grants, deliberately separate from bot profiles and
+ * templates. Callers must also exclude this file from workspace backups.
+ * One server owns the store; a successful atomic save precedes publication. */
+export class CommandAllowlistStore {
+    rules = [];
+    unreadable = false;
+    filename;
+    constructor(filename) {
+        this.filename = filename;
+        try {
+            const stat = lstatSync(filename);
+            if (!stat.isFile() || stat.size > MAX_STORE_BYTES)
+                throw new Error("Invalid command rule store.");
+            const saved = JSON.parse(readFileSync(filename, "utf8"));
+            if (!record(saved) || saved.version !== 1 || !Array.isArray(saved.rules) ||
+                Object.keys(saved).some((key) => key !== "version" && key !== "rules"))
+                throw new Error("Invalid command rule store.");
+            const rules = [];
+            const ids = new Set();
+            const counts = new Map();
+            for (const row of saved.rules) {
+                if (!record(row) || typeof row.id !== "string" || !RULE_ID.test(row.id) || ids.has(row.id) ||
+                    typeof row.botId !== "string" || Object.keys(row).some((key) => !["id", "botId", "command", "cwd", "providerInstanceId"].includes(key))) {
+                    throw new Error("Invalid command rule store.");
+                }
+                validateBotId(row.botId);
+                const candidate = validateCommandAllowlistCandidate(row);
+                const count = (counts.get(row.botId) ?? 0) + 1;
+                if (count > MAX_RULES_PER_BOT)
+                    throw new Error("Too many saved command rules.");
+                counts.set(row.botId, count);
+                ids.add(row.id);
+                rules.push({ ...candidate, id: row.id, botId: row.botId });
+            }
+            this.rules = rules;
+        }
+        catch (error) {
+            // Missing means no grants. Any other read/validation failure disables
+            // all grants and forbids overwriting evidence of a damaged store.
+            if (error.code !== "ENOENT")
+                this.unreadable = true;
+        }
+    }
+    list(botId) {
+        validateBotId(botId);
+        return this.rules.filter((rule) => rule.botId === botId).map(({ botId: _botId, ...rule }) => rule);
+    }
+    add(botId, value) {
+        this.assertWritable();
+        validateBotId(botId);
+        const candidate = validateCommandAllowlistCandidate(value);
+        const existing = this.list(botId);
+        const duplicate = existing.find((rule) => sameScope(rule, candidate));
+        if (duplicate)
+            return duplicate;
+        if (existing.length >= MAX_RULES_PER_BOT)
+            throw invalid("A bot may save at most 200 commands.");
+        const rule = { ...candidate, id: randomUUID() };
+        this.save([...this.rules, { ...rule, botId }]);
+        return rule;
+    }
+    remove(botId, ruleId) {
+        this.assertWritable();
+        validateBotId(botId);
+        const next = this.rules.filter((rule) => rule.botId !== botId || rule.id !== ruleId);
+        if (next.length === this.rules.length)
+            return false;
+        this.save(next);
+        return true;
+    }
+    clear(botId) {
+        this.assertWritable();
+        validateBotId(botId);
+        const next = this.rules.filter((rule) => rule.botId !== botId);
+        if (next.length !== this.rules.length)
+            this.save(next);
+    }
+    matches(botId, value) {
+        if (this.unreadable || typeof botId !== "string" || !BOT_ID.test(botId))
+            return false;
+        const candidate = commandAllowlistCandidate(value);
+        return candidate !== null && this.rules.some((rule) => rule.botId === botId && sameScope(rule, candidate));
+    }
+    assertWritable() {
+        if (this.unreadable)
+            throw Object.assign(new Error("Saved command rules could not be read. Repair the rule store before changing them."), { status: 503 });
+    }
+    save(rules) {
+        const json = JSON.stringify({ version: 1, rules }, null, 2);
+        if (Buffer.byteLength(json) > MAX_STORE_BYTES)
+            throw invalid("The saved command rules exceed the storage limit.");
+        mkdirSync(dirname(this.filename), { recursive: true, mode: 0o700 });
+        writeFileAtomic(this.filename, json, { mode: 0o600 });
+        this.rules = rules;
+    }
+}

package/dist-server/server/composio.js

@@ -895,7 +895,7 @@ export async function listToolkits(cfg) {
             ? backendFingerprint("managed-catalog", broker.url, broker.token)
             : null;
     if (identity && toolkitCache?.identity === identity && Date.now() - toolkitCache.at < 10 * 60_000) {
-        return { cards: toolkitCache.cards, source: "api" };
+        return { cards: toolkitCache.cards, source: "api", pagination: toolkitCache.pagination };
     }
     if (backendKey || broker) {
         try {
@@ -907,6 +907,12 @@ export async function listToolkits(cfg) {
             const seenCursors = new Set();
             let cursor;
             let lastReportedPage;
+            let reportedTotalItems;
+            let reportedTotalPages;
+            // Why the walk ended. "limit" means the loop ran out of iterations;
+            // every early exit names itself so a stalled catalog can be logged
+            // instead of silently posing as the complete marketplace.
+            let stop = "limit";
             for (let page = 0; page < MAX_CONNECTED_ACCOUNT_PAGES; page += 1) {
                 const params = new URLSearchParams({ limit: "500", sort_by: "usage" });
                 if (cursor)
@@ -919,33 +925,51 @@ export async function listToolkits(cfg) {
                     : await brokerRequest(cursor ? `/v1/catalog?cursor=${encodeURIComponent(cursor)}` : "/v1/catalog", {
                         signal: AbortSignal.timeout(15_000),
                     });
-                if (!res.ok)
+                if (!res.ok) {
+                    stop = "http-error";
                     break;
+                }
                 const json = await res.json();
                 const pageItems = json.items ?? json.data ?? [];
-                if (!Array.isArray(pageItems))
+                if (!Array.isArray(pageItems)) {
+                    stop = "bad-page";
                     break;
+                }
                 items.push(...pageItems);
+                const pageTotalItems = Number(json.total_items);
+                if (Number.isFinite(pageTotalItems) && pageTotalItems > 0)
+                    reportedTotalItems = pageTotalItems;
                 // Composio reports current_page and total_pages beside next_cursor.
                 // A broker that drops the cursor (or an upstream regression) can replay
                 // a page while minting fresh cursors, so trust page movement: once it
                 // stops advancing, the catalog is stuck and paging stops cleanly.
                 const reportedPage = Number(json.current_page);
                 if (Number.isFinite(reportedPage)) {
-                    if (lastReportedPage !== undefined && reportedPage <= lastReportedPage)
+                    if (lastReportedPage !== undefined && reportedPage <= lastReportedPage) {
+                        stop = "page-stuck";
                         break;
+                    }
                     lastReportedPage = reportedPage;
                 }
-                const reportedTotalPages = Number(json.total_pages);
+                const pageTotalPages = Number(json.total_pages);
+                if (Number.isFinite(pageTotalPages) && pageTotalPages > 0)
+                    reportedTotalPages = pageTotalPages;
                 if (lastReportedPage !== undefined &&
-                    Number.isFinite(reportedTotalPages) &&
-                    reportedTotalPages > 0 &&
-                    lastReportedPage >= reportedTotalPages) {
+                    Number.isFinite(pageTotalPages) &&
+                    pageTotalPages > 0 &&
+                    lastReportedPage >= pageTotalPages) {
+                    stop = "total-reached";
                     break;
                 }
                 const next = typeof json.next_cursor === "string" ? json.next_cursor.trim() : "";
-                if (!next || seenCursors.has(next))
+                if (!next) {
+                    stop = "end";
+                    break;
+                }
+                if (seenCursors.has(next)) {
+                    stop = "cursor-repeated";
                     break;
+                }
                 seenCursors.add(next);
                 cursor = next;
             }
@@ -959,8 +983,22 @@ export async function listToolkits(cfg) {
                     domain: null,
                 }));
                 const uniqueCards = cards.filter((card, index) => card.slug && cards.findIndex((candidate) => candidate.slug === card.slug) === index);
-                toolkitCache = { at: Date.now(), cards: uniqueCards, identity: identity };
-                return { cards: uniqueCards, source: "api" };
+                const shortOfReportedTotal = reportedTotalItems !== undefined && uniqueCards.length < reportedTotalItems;
+                // Trust reported page counts even when the walk ends "cleanly": an
+                // endpoint that stops at page 1 of 4 without a cursor is still partial.
+                const pagingStoppedEarly = lastReportedPage !== undefined
+                    && reportedTotalPages !== undefined
+                    && lastReportedPage < reportedTotalPages;
+                const pagination = { items: uniqueCards.length, stalled: shortOfReportedTotal || pagingStoppedEarly };
+                if (reportedTotalItems !== undefined)
+                    pagination.totalItems = reportedTotalItems;
+                if (pagination.stalled) {
+                    console.warn(`[composio] marketplace catalog paging stopped early (${stop}) after ${uniqueCards.length} toolkits`
+                        + (reportedTotalItems !== undefined ? ` of ~${reportedTotalItems}` : "")
+                        + "; serving a partial marketplace");
+                }
+                toolkitCache = { at: Date.now(), cards: uniqueCards, identity: identity, pagination };
+                return { cards: uniqueCards, source: "api", pagination };
             }
         }
         catch {

package/dist-server/server/computer-wait.js

@@ -7,8 +7,17 @@
 // that, name the holder as a bot running a thread, and keep the same words
 // on every surface (chat chip, room chip, the gate's refusal) so a person
 // who has read it once recognises it everywhere.
-/** Whole minutes, or seconds under one minute, for the give-up notice. */
-const minutes = (ms) => ms >= 60_000 ? `${Math.round(ms / 60_000)} minutes` : `${Math.round(ms / 1000)} seconds`;
+/** Whole minutes, or seconds under one minute, singular at exactly one. */
+const minutes = (ms) => {
+    const value = ms >= 60_000 ? Math.round(ms / 60_000) : Math.round(ms / 1000);
+    const unit = ms >= 60_000 ? "minute" : "second";
+    return `${value} ${unit}${value === 1 ? "" : "s"}`;
+};
+/** How long a wait lasted, for the resolution line: waits under a second
+ * are honest about being over in a blink instead of claiming "0 seconds". */
+export function computerWaitDuration(ms) {
+    return ms < 1_000 ? "under a second" : minutes(ms);
+}
 const holderPhrase = (holder) => holder.task ? `${holder.name} is running ${holder.task}` : `${holder.name} is using it`;
 /** The chip a turn shows while it is queued behind another turn's desktop. */
 export function computerWaitingText(holder) {
@@ -16,14 +25,18 @@ export function computerWaitingText(holder) {
         return "Waiting for its turn on this computer. Starts automatically when it is free.";
     return `Waiting for its turn on this computer — ${holderPhrase(holder)}. Starts automatically when that finishes.`;
 }
-/** The same chip once the wait landed and this turn holds the desktop. */
-export function computerFreeText() {
-    return "Computer free — continuing";
+/** The resolution appended once the wait landed and this turn holds the
+ * desktop: how long it waited, and who held it. The waiting chip stays as
+ * written — this line is the history beside it, not its replacement. */
+export function computerFreeAfterText(holder, waitedMs) {
+    const who = holder ? ` (${holder.task ? `${holder.name} · ${holder.task}` : holder.name} held it)` : "";
+    return `Computer free — continuing after waiting ${computerWaitDuration(waitedMs)}${who}`;
 }
-/** The same chip when the wait ended without the desktop: the turn was
- * stopped, or the claim was abandoned. */
-export function computerWaitEndedText() {
-    return "Stopped waiting for the computer";
+/** The resolution appended when the wait ended because the turn was stopped
+ * or its claim was cancelled. */
+export function computerStoppedWaitingText(holder, waitedMs) {
+    const who = holder ? ` — ${holderPhrase(holder)}` : "";
+    return `Stopped waiting for the computer after ${computerWaitDuration(waitedMs)}${who}.`;
 }
 /** The error after the wait ceiling: still names who holds it, and says
  * what a person can do — stop that turn, or move this one. */