openmausbot 0.1.85 → 0.1.87

package/dist-server/server/drivers/prompt-split.js

@@ -0,0 +1,87 @@
+// The stable/volatile prompt split, shared by the drivers that deliver it.
+// The stable half is everything that must stay byte-identical for a
+// provider's cached prefix (or a spawned CLI's session contract) to
+// survive; the volatile half (memory, mentions, outstanding teammate
+// work, recent work) legitimately changes mid-conversation and reaches
+// the model inside the turn that changed it, after the cacheable prefix.
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { DATA_DIR } from "../config.js";
+import { writeFileAtomic } from "../atomic.js";
+/** Read the split off a turn. Both halves must be present: a driver that
+ * receives only the unsplit system field was called through a path that
+ * never split it. */
+export function promptHalves(turn) {
+    const { systemStable, systemVolatile } = turn;
+    if (typeof systemStable !== "string" || typeof systemVolatile !== "string") {
+        return { stable: null, volatile: "" };
+    }
+    return { stable: systemStable, volatile: systemVolatile };
+}
+export const VOLATILE_CONTEXT_NOTE_PREFIX = "Context from OpenMausBot updated since this conversation started; it replaces any earlier copy:";
+export const VOLATILE_CONTEXT_CLEARED_NOTE = "The OpenMausBot context notes from earlier in this conversation (memory, mentions, outstanding teammate work) have been cleared; the standing instructions still apply.";
+/** The labelled block that carries a changed volatile half inside a user
+ * turn. A half that is empty and always was needs no note; one that was
+ * cleared announces the removal so the model stops relying on it. */
+export function volatileContextNote(volatile, hadVolatile) {
+    const text = volatile.trim();
+    if (text)
+        return VOLATILE_CONTEXT_NOTE_PREFIX + "\n\n" + text;
+    return hadVolatile ? VOLATILE_CONTEXT_CLEARED_NOTE : "";
+}
+/** Prepend a delivered note to the turn text: the one composition shape
+ * every split-aware driver uses. */
+export function withContextNote(note, text) {
+    if (!note)
+        return text;
+    return text ? note + "\n\n" + text : note;
+}
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const EMPTY_FINGERPRINT = digest("");
+export function promptSplitFingerprints(stable, volatile) {
+    return { stable: digest(stable), volatile: digest(volatile) };
+}
+const receiptPath = (scope, key) => join(DATA_DIR, "prompt-split", digest(JSON.stringify([scope, key])) + ".json");
+/** Which halves a native session (an ACP session id, a pi session file)
+ * last carried. Unknown - never tracked, or tracked before this file
+ * existed - reads as null, and the caller re-delivers the full prompt
+ * once. */
+export function readPromptSplitReceipt(scope, key) {
+    try {
+        const raw = JSON.parse(readFileSync(receiptPath(scope, key), "utf8"));
+        if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+            const record = raw;
+            if (typeof record.stable === "string" && typeof record.volatile === "string") {
+                return { stable: record.stable, volatile: record.volatile };
+            }
+        }
+    }
+    catch {
+        /* a missing or corrupt receipt is simply unknown */
+    }
+    return null;
+}
+export function writePromptSplitReceipt(scope, key, receipt) {
+    mkdirSync(join(DATA_DIR, "prompt-split"), { recursive: true });
+    writeFileAtomic(receiptPath(scope, key), JSON.stringify(receipt), { mode: 0o600 });
+}
+/** Compose the prompt for a session that persists its own history (ACP
+ * agents, pi): the full system block rides only when this native session
+ * has not carried it - or carried a different one, which re-delivers the
+ * current copy the way a pre-split turn always did - and a changed
+ * volatile half rides as a labelled note. Otherwise the turn text goes
+ * through bare, so an ordinary memory write neither appends a second copy
+ * of the prompt to the session nor re-prices its cached prefix.
+ * perTurnVolatile marks a turn whose volatile half describes this very
+ * turn (a mention): its note is delivered even when the text is unchanged. */
+export function splitSessionPrompt(stable, volatile, previous, fullSystem, text, perTurnVolatile = false) {
+    const receipt = promptSplitFingerprints(stable, volatile);
+    if (previous === null || previous.stable !== receipt.stable) {
+        return { text: fullSystem ? fullSystem + "\n\n" + text : text, receipt };
+    }
+    const note = previous.volatile === receipt.volatile && !perTurnVolatile
+        ? ""
+        : volatileContextNote(volatile, previous.volatile !== EMPTY_FINGERPRINT);
+    return { text: withContextNote(note, text), receipt };
+}

package/dist-server/server/enterprise.js

@@ -8,10 +8,11 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 // Neutral hook point for the source-available enterprise layer.
 //
-// The layer lives in ../enterprise (its own LICENSE) and is loaded only if that
+// The layer lives in enterprise/ (its own LICENSE) and is loaded only if that
 // folder is present: delete it and this file still compiles, the server still
 // starts, and /api/edition reports the open-source edition. Core never imports
-// the layer statically, so the bundle and the packaged app carry no trace of it.
+// the layer statically; a build ships it as its own bundled file beside the
+// server (see enterpriseLayerDirs for where it is looked up).
 // The layer's only obligation is `register()`, which turns OMB_LICENSE_KEY into
 // entitlements; core keeps the resulting status and answers `entitled()`.
 import { existsSync } from "node:fs";
@@ -25,7 +26,28 @@ const layerSchema = z.object({
     features: z.array(z.string().min(1)),
     expiresAt: z.string().nullable(),
 });
-const DEFAULT_DIR = join(SERVER_ROOT, "..", "enterprise");
+/** Days before expiry that the startup log, /api/edition and Settings start
+ * saying so, and days after it that the features keep working while the
+ * operator renews. The key and its verification are unchanged: the layer
+ * accepts a key that expired less than the grace period ago. */
+export const LICENSE_WARN_DAYS = 30;
+export const LICENSE_GRACE_DAYS = 7;
+const DAY_MS = 24 * 60 * 60_000;
+/** Where the layer may be, in order. An explicit OMB_ENTERPRISE_DIR is the
+ * only place looked at when set. Otherwise: beside the server root (a
+ * checkout, where server/ and enterprise/ are siblings, and the npm package,
+ * which copies the bundled layer to <package>/enterprise), then inside it
+ * (the Docker image and the packaged desktop ship dist-server/ alone, and
+ * scripts/bundle-server.mjs writes the layer to dist-server/enterprise). */
+export function enterpriseLayerDirs(env = process.env, serverRoot = SERVER_ROOT) {
+    if (env.OMB_ENTERPRISE_DIR)
+        return [env.OMB_ENTERPRISE_DIR];
+    return [join(serverRoot, "..", "enterprise"), join(serverRoot, "enterprise")];
+}
+/** Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts. */
+function layerEntry(dir) {
+    return [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+}
 let current = { edition: "oss", features: [] };
 let workspaceAccessFactory;
 export function hostedWorkspaceConfigured(env = process.env) {
@@ -53,6 +75,26 @@ export function hostedWorkspaceConfiguration(env = process.env) {
         return null;
     }
 }
+/** Who decides who may use this workspace, for Settings → People and
+ * Remote access. On a portal-membership workspace the organisation's Admin
+ * does, and `peopleUrl` opens its People page for this workspace (identifiers
+ * only; Admin authorizes its own visitor). A hosted workspace never issues
+ * pairing codes or email sign-in: people come in through the portal. */
+export function workspaceMembership(env = process.env) {
+    const hosted = hostedWorkspaceConfiguration(env);
+    const pairingCodes = !hostedWorkspaceConfigured(env);
+    if (!hosted?.portalMembership)
+        return { authority: "local", pairingCodes };
+    const people = new URL("/people", hosted.admin);
+    people.search = new URLSearchParams({ workspace: hosted.workspace }).toString();
+    return { authority: "portal", pairingCodes, peopleUrl: people.href };
+}
+/** An operator may authorize new Full tasks only on a dedicated,
+ * portal-managed server. This is not an HTTP setting or a desktop grant. */
+export function sharedWorkspaceFullAccessConfigured(env = process.env) {
+    return env.OMB_SHARED_WORKSPACE_FULL_ACCESS === "1" && env.OMB_DESKTOP_PARENT !== "1" &&
+        hostedWorkspaceConfiguration(env)?.portalMembership === true;
+}
 /** No enterprise import or portal dependency enters the core bundle. A
  * configured server without this hook must refuse hosted access, not fall
  * back to legacy email or QR credentials. */
@@ -69,12 +111,11 @@ function oss(notice) {
  * degrades to the open-source edition with a notice that says what to fix. */
 export async function loadEnterpriseLayer(options = {}) {
     workspaceAccessFactory = undefined;
-    const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
+    const dirs = options.dir ? [options.dir] : enterpriseLayerDirs(options.env, options.serverRoot);
     const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
-    // Source in a checkout, a compiled bundle in an image: same convention as proxy-paths.ts.
-    const entry = [join(dir, "server", "index.ts"), join(dir, "server", "index.js")].find((candidate) => existsSync(candidate));
+    const entry = dirs.map(layerEntry).find((candidate) => candidate !== undefined);
     if (!entry) {
-        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dir}` : undefined);
+        return oss(licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dirs.join(" or ")}` : undefined);
     }
     try {
         const loaded = await import(__rewriteRelativeImportExtension(pathToFileURL(entry).href));
@@ -86,7 +127,9 @@ export async function loadEnterpriseLayer(options = {}) {
             throw new Error(`${entry} does not export register()`);
         if (!licenseKey)
             return oss("enterprise layer present but OMB_LICENSE_KEY is not set");
-        const registered = await register({ licenseKey });
+        // graceDays is additive: a layer that ignores it refuses an expired key
+        // at startup exactly as before.
+        const registered = await register({ licenseKey, graceDays: LICENSE_GRACE_DAYS });
         const layer = layerSchema.parse(registered);
         current = {
             edition: "enterprise",
@@ -100,27 +143,65 @@ export async function loadEnterpriseLayer(options = {}) {
         return oss(`enterprise layer disabled: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/** When the key stops being valid, or null for perpetual / open-source. */
+function expiryAt() {
+    if (current.edition !== "enterprise" || !current.expiresAt)
+        return null;
+    const at = new Date(current.expiresAt).getTime();
+    return Number.isFinite(at) ? at : null;
+}
 /** A license that expires while the server keeps running stops granting
- * features at that moment, not at the next restart. */
+ * features once its grace period ends, at that moment, not at the next restart. */
 function expired(now) {
-    if (current.edition !== "enterprise" || !current.expiresAt)
-        return false;
-    return now >= new Date(current.expiresAt).getTime();
+    const at = expiryAt();
+    return at !== null && now >= at + LICENSE_GRACE_DAYS * DAY_MS;
 }
 export function editionStatus(now = Date.now()) {
-    if (!expired(now))
+    const at = expiryAt();
+    if (at === null)
         return current;
+    if (expired(now)) {
+        return {
+            edition: "oss",
+            features: [],
+            notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+        };
+    }
+    const expiresInDays = Math.ceil((at - now) / DAY_MS);
+    if (now < at)
+        return { ...current, expiresInDays };
+    const graceEndsAt = new Date(at + LICENSE_GRACE_DAYS * DAY_MS).toISOString().slice(0, 10);
     return {
-        edition: "oss",
-        features: [],
-        notice: `enterprise layer disabled: OMB_LICENSE_KEY expired on ${current.expiresAt}; renew it to keep enterprise features`,
+        ...current,
+        expiresInDays,
+        graceEndsAt,
+        notice: `OMB_LICENSE_KEY expired on ${current.expiresAt}; enterprise features keep working until ${graceEndsAt} while it is renewed`,
     };
 }
+/** The edition as a non-admin session sees it: what is entitled, without
+ * the license's countdown, grace date or operator notice. */
+export function editionForMembers(status) {
+    const { expiresInDays: _days, graceEndsAt: _grace, notice: _notice, ...shared } = status;
+    return shared;
+}
 /** Feature gates in core ask this and nothing else. Unknown ids are simply not
  * granted, and the open-source edition always carries an empty feature list. */
 export function entitled(feature, now = Date.now()) {
     return !expired(now) && current.features.includes(feature);
 }
+/** The startup warning for a key that is about to lapse or already in its
+ * grace period; null when there is nothing to say. */
+export function licenseWarning(status) {
+    if (status.edition !== "enterprise" || !status.expiresAt || status.expiresInDays === undefined)
+        return null;
+    if (status.graceEndsAt) {
+        return `OMB_LICENSE_KEY expired on ${status.expiresAt}; enterprise features keep working until ${status.graceEndsAt} — renew the key before then`;
+    }
+    if (status.expiresInDays > LICENSE_WARN_DAYS)
+        return null;
+    const days = status.expiresInDays === 1 ? "1 day" : `${status.expiresInDays} days`;
+    return `OMB_LICENSE_KEY expires on ${status.expiresAt} (in ${days}); renew it before then to keep enterprise features`;
+}
 /** One line for the startup log. */
 export function describeEdition(status) {
     if (status.edition === "enterprise") {

package/dist-server/server/external-runtime.js

@@ -0,0 +1,83 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+const MAX_FILE_BYTES = 1_048_576;
+const ID = /^[\w-]{1,128}$/;
+const fingerprint = (token) => createHash("sha256").update(token).digest("hex");
+const sameFingerprint = (left, right) => {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+};
+/** Read a bounded regular file through the descriptor whose permissions we
+ * checked. A pipe must not block the request loop, nor a pathname swap replace
+ * the checked file before the read. */
+function registrations(file) {
+    let fd;
+    try {
+        fd = openSync(file, constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK));
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_FILE_BYTES)
+            return [];
+        if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
+            console.warn("[comms] ignoring external runtime credentials: use a private file (chmod 600)");
+            return [];
+        }
+        const bytes = Buffer.alloc(stat.size + 1);
+        let count = 0;
+        for (;;) {
+            const read = readSync(fd, bytes, count, bytes.length - count, null);
+            if (!read)
+                break;
+            count += read;
+            if (count > stat.size)
+                return []; // changed while being read
+        }
+        const parsed = JSON.parse(bytes.subarray(0, count).toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return [];
+        return Object.entries(parsed).flatMap(([botId, value]) => {
+            if (!ID.test(botId) || !value || typeof value !== "object" || Array.isArray(value))
+                return [];
+            const { token, threadId } = value;
+            if (typeof token !== "string" || token.length < 32 || token.length > 4096 || /\s/.test(token))
+                return [];
+            if (typeof threadId !== "string" || !ID.test(threadId))
+                return [];
+            return [{ botId, tokenHash: fingerprint(token), threadId }];
+        });
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function resolveRegistration(file, tokenHash, botForId) {
+    const matches = registrations(file).filter(entry => sameFingerprint(entry.tokenHash, tokenHash));
+    // A copied secret must not select a different bot based on JSON key order.
+    if (matches.length !== 1)
+        return null;
+    const registration = matches[0];
+    const bot = botForId(registration.botId);
+    if (!bot || bot.hidden)
+        return null;
+    // There is no durable "main thread": bot.threadId is the UI selection and
+    // new tasks are prepended. Every grant needs an explicit binding.
+    const task = bot.tasks?.find(candidate => candidate.threadId === registration.threadId);
+    if (!task || task.archivedAt !== undefined)
+        return null;
+    return { botId: bot.id, threadId: task.threadId, tokenHash };
+}
+export function authorizeExternalRuntime(file, header, botForId) {
+    if (typeof header !== "string" || !/^Bearer \S{32,4096}$/.test(header))
+        return null;
+    return resolveRegistration(file, fingerprint(header.slice(7)), botForId);
+}
+/** Re-check after every body/approval/poll wait. The captured identity is not
+ * a lease: token rotation, rebinding, deletion and archive take effect now. */
+export function externalRuntimeIsActive(file, grant, botForId) {
+    const current = resolveRegistration(file, grant.tokenHash, botForId);
+    return current?.botId === grant.botId && current.threadId === grant.threadId;
+}

package/dist-server/server/fleet.js

@@ -250,7 +250,7 @@ export function initPlan(input) {
         ...(input.operator ? [{ kind: "run", argv: ["systemctl", "enable", "--now", "openmausbot-fleet.service"], why: `start the fleet agent for ${input.operator}` }] : []),
         { kind: "run", argv: ["systemctl", "reload", "caddy"], why: "start serving the workspaces folder" },
         { kind: "note", text: `point *.${registry.domain} at this server (a wildcard A/AAAA record); each workspace gets its own certificate when created` },
-        ...(input.operator ? [{ kind: "note", text: `the workspace running as ${input.operator} can now manage workspaces from Settings → Workspaces` }] : []),
+        ...(input.operator ? [{ kind: "note", text: `the installation running as ${input.operator} can now manage installations from Settings → Installations` }] : []),
     ];
     return { steps, registry };
 }

package/dist-server/server/group-thread-usage.js

@@ -0,0 +1,103 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+const finite = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
+const valid = (row) => Boolean(row && typeof row.threadId === "string" && typeof row.botId === "string" && typeof row.at === "string" && Number.isFinite(Date.parse(row.at)) && finite(row.input) && finite(row.output));
+function addRow(totals, row) {
+    const summary = totals.get(row.threadId) ?? { usage: { input: 0, output: 0, costUsd: null, turns: 0, cachedInput: 0 }, lastAt: -Infinity };
+    const total = summary.usage;
+    const input = Math.trunc(row.input), output = Math.trunc(row.output);
+    const cached = finite(row.cachedInput) ? Math.min(input, Math.trunc(row.cachedInput)) : undefined;
+    total.input += input;
+    total.output += output;
+    total.turns++;
+    if (cached === undefined)
+        delete total.cachedInput;
+    else if (total.cachedInput !== undefined)
+        total.cachedInput += cached;
+    if (finite(row.costUsd))
+        total.costUsd = (total.costUsd ?? 0) + row.costUsd;
+    const at = Date.parse(row.at);
+    if (at >= summary.lastAt) {
+        summary.lastAt = at;
+        total.lastTurn = { input, output, ...(cached === undefined ? {} : { cachedInput: cached }), costUsd: finite(row.costUsd) ? row.costUsd : null };
+        total.lastSpeaker = { botId: row.botId, name: typeof row.botName === "string" && row.botName ? row.botName : row.botId };
+    }
+    totals.set(row.threadId, summary);
+}
+/** Cache per-month/per-thread summaries, not the complete ledger in memory. */
+export class GroupUsageReader {
+    files = new Map();
+    signature = "";
+    totals = new Map();
+    dataDir;
+    constructor(dataDir) { this.dataDir = dataDir; }
+    /** Refresh only at startup or after ledger persistence, never on an SSE lookup. */
+    refresh() {
+        const dir = join(this.dataDir, "usage");
+        let names;
+        try {
+            names = readdirSync(dir).filter(name => /^\d{4}-\d{2}\.jsonl$/.test(name)).sort();
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            names = [];
+        }
+        const files = names.map(name => {
+            const stat = statSync(join(dir, name));
+            return { name, stamp: `${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}:${stat.ino}` };
+        });
+        const signature = JSON.stringify(files);
+        if (signature !== this.signature) {
+            const next = new Map();
+            for (const { name, stamp } of files) {
+                let entry = this.files.get(name);
+                if (entry?.stamp !== stamp) {
+                    const totals = new Map();
+                    for (const line of readFileSync(join(dir, name), "utf8").split("\n")) {
+                        try {
+                            const row = JSON.parse(line);
+                            if (valid(row))
+                                addRow(totals, row);
+                        }
+                        catch { /* incomplete or damaged row */ }
+                    }
+                    entry = { stamp, totals };
+                }
+                next.set(name, entry);
+            }
+            const summaries = new Map();
+            for (const entry of next.values()) {
+                for (const [threadId, part] of entry.totals) {
+                    const total = summaries.get(threadId);
+                    if (!total)
+                        summaries.set(threadId, structuredClone(part));
+                    else {
+                        total.usage.input += part.usage.input;
+                        total.usage.output += part.usage.output;
+                        total.usage.turns += part.usage.turns;
+                        if (total.usage.cachedInput === undefined || part.usage.cachedInput === undefined)
+                            delete total.usage.cachedInput;
+                        else
+                            total.usage.cachedInput += part.usage.cachedInput;
+                        if (part.usage.costUsd !== null)
+                            total.usage.costUsd = (total.usage.costUsd ?? 0) + part.usage.costUsd;
+                        if (part.lastAt >= total.lastAt) {
+                            total.lastAt = part.lastAt;
+                            total.usage.lastTurn = part.usage.lastTurn;
+                            total.usage.lastSpeaker = part.usage.lastSpeaker;
+                        }
+                    }
+                }
+            }
+            const totals = new Map([...summaries].map(([id, value]) => [id, value.usage]));
+            this.files = next;
+            this.totals = totals;
+            this.signature = signature;
+        }
+    }
+    forThread(threadId) {
+        const usage = this.totals.get(threadId);
+        return usage ? structuredClone(usage) : undefined;
+    }
+}

package/dist-server/server/guarded-requests.js

@@ -0,0 +1,60 @@
+export function requestConflict(message = "The request no longer owns this conversation") {
+    return Object.assign(new Error(message), { status: 409, code: "guarded_request_changed" });
+}
+export function assertRequestTarget(current, expected) {
+    if (current.messageId !== expected.messageId || current.activeLeafId !== expected.expectedActiveLeafId ||
+        current.activeTurnId !== expected.expectedTurnId || current.executionId !== expected.expectedExecutionId)
+        throw requestConflict();
+}
+/** Never infer ownership from timestamps or the latest assistant text. */
+export function guardedRequestPath(messages, activeLeafId, sendId) {
+    const sources = messages.filter(message => message.sendId === sendId);
+    const source = sources[0];
+    if (sources.length !== 1 || !source || source.role !== "user" || source.kind !== "text" || source.steered || source.peerAsk) {
+        throw requestConflict("No unique acknowledged user request matches this sendId");
+    }
+    const byId = new Map(messages.map(message => [message.id, message]));
+    const path = [];
+    const seen = new Set();
+    let id = activeLeafId;
+    while (id) {
+        if (seen.has(id))
+            throw requestConflict();
+        seen.add(id);
+        const message = byId.get(id);
+        if (!message)
+            throw requestConflict();
+        path.unshift(message);
+        if (message.id === source.id)
+            break;
+        if (path.length >= 500)
+            throw Object.assign(new Error("Open this request in the workspace; its transcript exceeds the response limit"), { status: 413 });
+        id = message.parentId ?? null;
+    }
+    if (path[0]?.id !== source.id || path.slice(1).some(message => message.role === "user"))
+        throw requestConflict();
+    // An abandoned sibling can hold a detached result or approval. A caller
+    // must never receive it as the answer to the current branch.
+    const ancestors = new Set(path.map(message => message.id));
+    if (messages.some(message => message.parentId && ancestors.has(message.parentId) && !seen.has(message.id)))
+        throw requestConflict();
+    return path;
+}
+/** Used only for an explicit control-plane card, never the latest user. */
+export function requestSourceForCard(messages, messageId) {
+    const byId = new Map(messages.map(message => [message.id, message]));
+    const seen = new Set();
+    let message = byId.get(messageId);
+    while (message && !seen.has(message.id)) {
+        seen.add(message.id);
+        if (message.role === "user")
+            return message.peerAsk || message.steered || message.requestCancelled ? undefined : message.id;
+        message = message.parentId ? byId.get(message.parentId) : undefined;
+    }
+    return undefined;
+}
+export function requestNeedsInput(message) {
+    return Boolean((message.card?.requestId && !message.card.answered && !message.card.dismissed) ||
+        (message.connector && !message.connector.dismissed && !message.connector.resumed && message.connector.status !== "connected") ||
+        (message.secret && !message.secret.provided && !message.secret.dismissed));
+}

package/dist-server/server/harness/http.js

@@ -0,0 +1,61 @@
+const jsonHooks = new WeakMap();
+const parsedBodies = new WeakMap();
+/** Pass every JSON body sent on this response through `hook` first (it may
+ * return a narrowed copy). Set once a request is authenticated: index.ts
+ * narrows what a member is sent and notes what an admin change answered.
+ * Hooks added later run after earlier ones. */
+export function onJsonBody(res, hook) {
+    const previous = jsonHooks.get(res);
+    jsonHooks.set(res, previous ? (body) => hook(previous(body)) : hook);
+}
+/** The JSON body readBody parsed for this request, if it read one. */
+export function parsedBodyOf(req) {
+    return parsedBodies.get(req);
+}
+export function json(res, status, body) {
+    const hook = jsonHooks.get(res);
+    const data = JSON.stringify(hook ? hook(body) : body);
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(data);
+}
+export function readBody(req, limit = 1_000_000) {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        let bytes = 0;
+        let done = false;
+        const fail = (status, msg) => {
+            if (done)
+                return;
+            done = true;
+            const err = Object.assign(new Error(msg), { status });
+            reject(err);
+        };
+        req.on("data", (c) => {
+            if (done)
+                return;
+            bytes += typeof c === "string" ? Buffer.byteLength(c) : c.length;
+            if (bytes > limit) {
+                // Keep draining the socket, but stop retaining attacker-controlled
+                // bytes. Destroying the request here prevents the caller from
+                // receiving the useful 413 response.
+                return fail(413, "body too large");
+            }
+            data += c;
+        });
+        req.on("end", () => {
+            if (done)
+                return;
+            let body;
+            try {
+                body = data ? JSON.parse(data) : {};
+            }
+            catch {
+                return fail(400, "invalid JSON body");
+            }
+            done = true;
+            parsedBodies.set(req, body);
+            resolve(body);
+        });
+        req.on("error", (e) => fail(400, e instanceof Error ? e.message : String(e)));
+    });
+}

package/dist-server/server/harness/registry.js

@@ -228,6 +228,7 @@ export class ProviderRegistry {
                     modelVariants: inst.adapter.capabilities.modelVariants === true,
                     queueing: inst.adapter.capabilities.queueing === true,
                     localComputerMcp: inst.adapter.capabilities.localComputerMcp === true,
+                    cloudComputerMcp: inst.adapter.capabilities.cloudComputerMcp === true,
                     approvalReview: inst.reviewPermission !== undefined,
                 },
                 access: driver?.metadata.access ?? "subscription",