openmausbot 0.1.86 → 0.1.87

package/dist-server/server/box.js

@@ -1,4 +1,4 @@
-// Box (box.ascii.dev) provider — the bot's cloud computer. Ported from
+// Box (boat.dev) provider — the bot's cloud computer. Ported from
 // agentcal-api src/providers/box.js, reshaped per-bot instead of
 // per-customer: every bot gets one persistent box (deterministic name),
 // stop pauses billing while the disk survives, and Join always mints a
@@ -134,7 +134,7 @@ function boxDeletionOperation(body, boxId, expectedOperationId) {
     return { id, kind: "box", targetId: boxId, status: status };
 }
 function deletionBlockedError(boxId) {
-    return Object.assign(new Error(`ascii.dev accepted deletion of ${boxId}, but the deletion operation is blocked — check ascii.dev and retry`), { status: 409 });
+    return Object.assign(new Error(`boat.dev accepted deletion of ${boxId}, but the deletion operation is blocked — check boat.dev and retry`), { status: 409 });
 }
 function boxDeleteProvedAbsent(result) {
     return result.status === 404 || result.status === 410;
@@ -194,7 +194,7 @@ async function reconcileRecordedBoxDeletion(cfg, initial, pollDelaysMs = []) {
         return "confirmed";
     }
     if (inspected.identity.name !== record.name) {
-        throw Object.assign(new Error("A cloud computer being deleted no longer has its remembered name — repair it in ascii.dev before continuing"), { status: 503 });
+        throw Object.assign(new Error("A cloud computer being deleted no longer has its remembered name — repair it in boat.dev before continuing"), { status: 503 });
     }
     return record.phase === "blocked" ? "blocked" : "pending";
 }
@@ -251,7 +251,7 @@ async function confirmAcceptedBoxDeletion(cfg, record, acceptedBody, pollDelaysM
             finishRecordedBoxDeletion(record.boxId);
             return "confirmed";
         }
-        throw Object.assign(new Error(`ascii.dev returned an invalid deletion receipt for ${record.boxId}; its deletion fence was kept`), { status: 503 });
+        throw Object.assign(new Error(`boat.dev returned an invalid deletion receipt for ${record.boxId}; its deletion fence was kept`), { status: 503 });
     }
     const next = operation.status === "blocked"
         ? markBoxDeletionBlocked(record.boxId, operation)
@@ -270,7 +270,7 @@ async function requestRecordedBoxDeletion(cfg, identity, pollDelaysMs = BOX_DELE
         });
     }
     catch (error) {
-        throw Object.assign(new Error("Could not confirm whether ascii.dev accepted the delete. The computer was kept fenced; retry Delete to reconcile it"), { status: 503, cause: error });
+        throw Object.assign(new Error("Could not confirm whether boat.dev accepted the delete. The computer was kept fenced; retry Delete to reconcile it"), { status: 503, cause: error });
     }
     if (boxDeleteProvedAbsent(removed)) {
         finishRecordedBoxDeletion(identity.boxId);
@@ -305,12 +305,12 @@ export async function boxNameFor(botId) {
 export async function boxNameMatchesBot(botId, name) {
     return name === await boxNameFor(botId) || name === legacyBoxNameFor(botId);
 }
-export async function runCommand(cfg, boxId, command, { timeoutMs = 120_000 } = {}) {
+export async function runCommand(cfg, boxId, command, { timeoutMs = 120_000, signal } = {}) {
     assertBoxNotDeleting(boxId);
     const res = await boxFetch(cfg, `/boxes/${boxId}/commands`, {
         method: "POST",
         body: JSON.stringify({ command }),
-        signal: AbortSignal.timeout(timeoutMs),
+        signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
     });
     const body = await res.json().catch(() => null);
     return {
@@ -367,12 +367,12 @@ async function waitReady(cfg, boxId, budgetMs = 90_000) {
 const boxIdCache = new Map();
 function boxInventoryProblem(status, body) {
     if (status === 401 || status === 403) {
-        return "ascii.dev rejected the Box API key — update it in Settings → Connections";
+        return "boat.dev rejected the Box API key — update it in Settings → Connections";
     }
     if (status === 429)
-        return "ascii.dev is rate-limiting this account — wait a minute and refresh";
+        return "boat.dev is rate-limiting this account — wait a minute and refresh";
     const message = typeof body?.message === "string" ? body.message.trim() : "";
-    return message ? `ascii.dev could not list cloud computers: ${message}` : `ascii.dev could not list cloud computers (${status})`;
+    return message ? `boat.dev could not list cloud computers: ${message}` : `boat.dev could not list cloud computers (${status})`;
 }
 function safeBoxState(value) {
     if (typeof value !== "string")
@@ -391,7 +391,7 @@ async function listBoxPages(cfg) {
             listed = await boxJson(cfg, path, { signal: AbortSignal.timeout(20_000) });
         }
         catch {
-            return { ok: false, problem: "Could not reach ascii.dev to list cloud computers — check your connection and refresh" };
+            return { ok: false, problem: "Could not reach boat.dev to list cloud computers — check your connection and refresh" };
         }
         if (!listed.ok || !Array.isArray(listed.body?.boxes)) {
             return { ok: false, problem: boxInventoryProblem(listed.status, listed.body), credentialRejected: listed.status === 401 || listed.status === 403 };
@@ -401,15 +401,15 @@ async function listBoxPages(cfg) {
         if (next === undefined || next === null || next === "")
             return { ok: true, boxes };
         if (typeof next !== "string" || next.length > 4_096) {
-            return { ok: false, problem: "ascii.dev returned an invalid cloud computer page cursor" };
+            return { ok: false, problem: "boat.dev returned an invalid cloud computer page cursor" };
         }
         if (seenCursors.has(next)) {
-            return { ok: false, problem: "ascii.dev repeated a cloud computer page cursor — refresh and try again" };
+            return { ok: false, problem: "boat.dev repeated a cloud computer page cursor — refresh and try again" };
         }
         seenCursors.add(next);
         cursor = next;
     }
-    return { ok: false, problem: "ascii.dev returned too many cloud computer pages — narrow the account inventory and refresh" };
+    return { ok: false, problem: "boat.dev returned too many cloud computer pages — narrow the account inventory and refresh" };
 }
 /**
  * One account listing for Settings and deletion guards. Only boxes
@@ -469,12 +469,12 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
                 continue;
             const matchingRows = candidates.filter((candidate) => candidate?.id === recovery.boxId);
             if (matchingRows.length > 1) {
-                return invalidInventory("ascii.dev returned a conflicting id for an OpenMaus-managed cloud computer — refresh or repair it in ascii.dev");
+                return invalidInventory("boat.dev returned a conflicting id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
             }
             if (matchingRows.length === 1) {
                 const listedName = typeof matchingRows[0]?.name === "string" ? matchingRows[0].name : "";
                 if (listedName !== namedOwner.currentName && listedName !== namedOwner.legacyName) {
-                    return invalidInventory("A remembered cloud computer no longer has its OpenMausBot owner name — repair it in ascii.dev before continuing");
+                    return invalidInventory("A remembered cloud computer no longer has its OpenMausBot owner name — repair it in boat.dev before continuing");
                 }
                 continue;
             }
@@ -490,7 +490,7 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
             }
             if (inspected.identity.name !== namedOwner.currentName
                 && inspected.identity.name !== namedOwner.legacyName) {
-                return invalidInventory("A remembered cloud computer no longer has its OpenMausBot owner name — repair it in ascii.dev before continuing");
+                return invalidInventory("A remembered cloud computer no longer has its OpenMausBot owner name — repair it in boat.dev before continuing");
             }
             const directCandidate = {
                 id: inspected.identity.boxId,
@@ -522,11 +522,11 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
             }
             const matchingRows = candidates.filter((candidate) => candidate?.id === deletion.boxId);
             if (matchingRows.length > 1) {
-                return invalidInventory("ascii.dev returned a conflicting id for a cloud computer being deleted");
+                return invalidInventory("boat.dev returned a conflicting id for a cloud computer being deleted");
             }
             if (matchingRows.length === 1) {
                 if (matchingRows[0]?.name !== deletion.name) {
-                    return invalidInventory("A cloud computer being deleted no longer has its remembered name — repair it in ascii.dev before continuing");
+                    return invalidInventory("A cloud computer being deleted no longer has its remembered name — repair it in boat.dev before continuing");
                 }
                 if (getBoxDeletion(deletion.boxId)?.phase === "accepted") {
                     matchingRows[0] = { ...matchingRows[0], state: "removing" };
@@ -574,11 +574,11 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
             continue;
         const boxId = typeof candidate.id === "string" ? candidate.id : "";
         if (!BOX_ID.test(boxId)) {
-            return invalidInventory("ascii.dev returned an invalid id for an OpenMaus-managed cloud computer — refresh or repair it in ascii.dev");
+            return invalidInventory("boat.dev returned an invalid id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
         }
         const existing = ownedBoxByBot.get(owner.botId);
         if (existing && existing !== boxId) {
-            return invalidInventory("ascii.dev returned conflicting cloud computers for one OpenMaus bot — repair them in ascii.dev before continuing");
+            return invalidInventory("boat.dev returned conflicting cloud computers for one OpenMaus bot — repair them in boat.dev before continuing");
         }
         ownedBoxByBot.set(owner.botId, boxId);
     }
@@ -602,7 +602,7 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         else if (LEGACY_MANAGED_BOX_NAME.test(name)) {
             // Pre-scope names have no installation provenance. A live local bot is
             // the only safe ownership proof; unmatched legacy rows stay provider-
-            // managed until the person handles them in ascii.dev directly.
+            // managed until the person handles them in boat.dev directly.
             owner = ownerByLegacyName.get(name) ?? null;
             if (!owner)
                 continue;
@@ -615,17 +615,17 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         // deterministic name), silently skipping a malformed/duplicated identity
         // could let bot deletion mistake provider corruption for absence.
         if (!BOX_ID.test(boxId)) {
-            return invalidInventory("ascii.dev returned an invalid id for an OpenMaus-managed cloud computer — refresh or repair it in ascii.dev");
+            return invalidInventory("boat.dev returned an invalid id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
         }
         if ((boxIdCounts.get(boxId) ?? 0) !== 1 || seenBoxIds.has(boxId)) {
-            return invalidInventory("ascii.dev returned a conflicting id for an OpenMaus-managed cloud computer — refresh or repair it in ascii.dev");
+            return invalidInventory("boat.dev returned a conflicting id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
         }
         if (legacyOwner && owner && options.adoptLegacy !== false) {
             try {
                 adoptResolvedBox(owner.botId, boxId);
             }
             catch {
-                return invalidInventory("OpenMausBot could not safely remember this legacy cloud computer's owner — repair it in ascii.dev before continuing");
+                return invalidInventory("OpenMausBot could not safely remember this legacy cloud computer's owner — repair it in boat.dev before continuing");
             }
         }
         seenBoxIds.add(boxId);
@@ -663,7 +663,7 @@ export async function inspectBoxIdentity(cfg, boxId) {
         return {
             available: false,
             identity: null,
-            problem: "Could not reach ascii.dev to verify a remembered cloud computer",
+            problem: "Could not reach boat.dev to verify a remembered cloud computer",
         };
     }
     if (inspected.status === 404 || inspected.status === 410) {
@@ -676,7 +676,7 @@ export async function inspectBoxIdentity(cfg, boxId) {
     const returnedId = typeof candidate?.id === "string" ? candidate.id : "";
     const name = typeof candidate?.name === "string" ? candidate.name : "";
     if (returnedId !== boxId || name.length === 0 || name.length > 100 || /[\r\n]/.test(name)) {
-        return { available: false, identity: null, problem: "ascii.dev returned an invalid cloud computer identity" };
+        return { available: false, identity: null, problem: "boat.dev returned an invalid cloud computer identity" };
     }
     return { available: true, identity: { boxId, name, state: safeBoxState(candidate.state) }, problem: null };
 }
@@ -717,7 +717,7 @@ const QUIESCE_BROWSER = [
 async function stopBox(cfg, boxId) {
     assertBoxNotDeleting(boxId);
     // Browser shutdown is best-effort, but the provider stop is not: Settings
-    // must never say a computer is sleeping when ascii.dev rejected the action.
+    // must never say a computer is sleeping when boat.dev rejected the action.
     await runCommand(cfg, boxId, QUIESCE_BROWSER, { timeoutMs: 5_000 }).catch(() => null);
     const stopped = await boxJson(cfg, `/boxes/${boxId}/stop`, { method: "POST" });
     if (!stopped.ok)
@@ -753,7 +753,7 @@ export async function sleepManagedBox(cfg, owners, boxId, claim) {
     }
 }
 /** Permanent Settings action. The caller must echo the exact freshly-listed
- * machine name as well as its id; ascii.dev independently requires the id in
+ * machine name as well as its id; boat.dev independently requires the id in
  * its confirmation header. */
 export async function deleteManagedBox(cfg, owners, boxId, confirmName, claim, options = {}) {
     cfg = snapshotBoxConfig(cfg);
@@ -812,7 +812,7 @@ export async function findBox(cfg, botId) {
         if (direct?.ok && directBox?.id === cachedId && directBox.state !== "error")
             return directBox;
         if (direct?.ok && directBox?.id !== cachedId) {
-            throw Object.assign(new Error("ascii.dev returned an invalid cloud computer identity"), { status: 503 });
+            throw Object.assign(new Error("boat.dev returned an invalid cloud computer identity"), { status: 503 });
         }
         boxIdCache.delete(botId); // gone or broken — fall back to the listing
     }
@@ -826,7 +826,7 @@ export async function findBox(cfg, botId) {
     // discoverable only for this exact local bot id.
     const expected = listed.boxes.filter((candidate) => candidate?.name === name || candidate?.name === legacyName);
     if (expected.some((candidate) => !BOX_ID.test(candidate?.id))) {
-        throw Object.assign(new Error("ascii.dev returned an invalid cloud computer identity"), { status: 503 });
+        throw Object.assign(new Error("boat.dev returned an invalid cloud computer identity"), { status: 503 });
     }
     const found = expected.find((candidate) => candidate.name === name && candidate.state !== "error")
         ?? expected.find((candidate) => candidate.name === legacyName && candidate.state !== "error")
@@ -834,7 +834,7 @@ export async function findBox(cfg, botId) {
     if (found) {
         const duplicateId = listed.boxes.filter((candidate) => candidate?.id === found.id).length !== 1;
         if (duplicateId) {
-            throw Object.assign(new Error("ascii.dev returned a conflicting cloud computer identity"), { status: 503 });
+            throw Object.assign(new Error("boat.dev returned a conflicting cloud computer identity"), { status: 503 });
         }
         if (found.name === legacyName)
             adoptResolvedBox(botId, found.id);
@@ -872,14 +872,14 @@ export async function verifyToken(token) {
             return {
                 ok: false,
                 message: token.startsWith("box_")
-                    ? "ascii.dev rejected that token — it may have been revoked or expired. Copy a fresh one from your ascii.dev account."
-                    : "That doesn't look like a box API key: they start with box_. Copy the API key from your ascii.dev account (an account or session token won't work here).",
+                    ? "boat.dev rejected that token — it may have been revoked or expired. Copy a fresh one from your boat.dev account."
+                    : "That doesn't look like a box API key: they start with box_. Copy the API key from your boat.dev account (an account or session token won't work here).",
             };
         }
-        return { ok: false, message: `ascii.dev returned ${res.status} for that token — try again in a moment.` };
+        return { ok: false, message: `boat.dev returned ${res.status} for that token — try again in a moment.` };
     }
     catch {
-        return { ok: false, message: "Couldn't reach ascii.dev to check that token — check your connection and retry." };
+        return { ok: false, message: "Couldn't reach boat.dev to check that token — check your connection and retry." };
     }
 }
 /** Turn a provider refusal into something a person can act on. The
@@ -891,17 +891,17 @@ export function boxErrorMessage(status, what, body) {
     const link = typeof body?.error?.details?.billingUrl === "string" ? body.error.details.billingUrl : "";
     if (status === 402) {
         // e.g. "Start the $20/month Box plan to create sandboxes."
-        return [theirs || "ascii.dev needs a paid Box plan before it will create a computer.", link].filter(Boolean).join(" ");
+        return [theirs || "boat.dev needs a paid Box plan before it will create a computer.", link].filter(Boolean).join(" ");
     }
     if (status === 401 || status === 403) {
-        return "your box token was rejected by ascii.dev — open App Settings and paste a current token (it starts with box_)";
+        return "your box token was rejected by boat.dev — open App Settings and paste a current token (it starts with box_)";
     }
     if (status === 429) {
-        return theirs || "ascii.dev is rate-limiting this account — wait a minute and try again";
+        return theirs || "boat.dev is rate-limiting this account — wait a minute and try again";
     }
     return theirs ? `${what} failed: ${theirs}` : `${what} failed (${status})`;
 }
-/** ascii.dev trial accounts reject the normal eight-hour auto-stop with a
+/** boat.dev trial accounts reject the normal eight-hour auto-stop with a
  * structured `trial_auto_stop_required` refusal. Retry that one condition
  * once at the provider's advertised maximum (or the documented two-hour
  * trial ceiling). Other create failures must retain their original error. */
@@ -922,7 +922,7 @@ function idempotentCreateInProgress(result) {
 }
 /** The keys this OpenMausBot already holds, as the environment its bots'
  * agents read on the box. The box is created with `noEnv: true`, so the
- * ascii.dev account's own logins never land in the guest: the box has exactly
+ * boat.dev account's own logins never land in the guest: the box has exactly
  * these and nothing else (see "Whose keys" in the Box integrated-agents docs). */
 export function boxCredentialEnv(cfg, env = process.env) {
     const out = {};
@@ -991,7 +991,7 @@ async function requestBoxCreate(cfg, botId, ttlSeconds, env) {
             });
         }
         catch (error) {
-            // A dropped response is ambiguous: ascii.dev may already have created
+            // A dropped response is ambiguous: boat.dev may already have created
             // the Box. One retry with the same key recovers it safely.
             if (ambiguousRetries++ === 0)
                 continue;
@@ -1084,7 +1084,7 @@ export async function provisionBox(cfg, botId, _botName) {
             assertBotBoxNotDeleting(botId);
             // Provider-side backstop: archives itself (billing pauses, disk
             // survives) if every stop path dies. Trial accounts get one narrower
-            // retry when ascii.dev reports their shorter TTL ceiling.
+            // retry when boat.dev reports their shorter TTL ceiling.
             const createRes = await createBox(cfg, botId, credentialEnv);
             if (!createRes.ok || !createRes.body?.box?.id) {
                 throw new Error(boxErrorMessage(createRes.status, "box create", createRes.body));
@@ -1134,13 +1134,13 @@ export async function provisionBox(cfg, botId, _botName) {
         }
         catch (cleanupError) {
             const cleanupMessage = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
-            throw new Error(`${originalMessage}. The new computer's deletion was not confirmed: ${cleanupMessage}. Check box ${box.id} in ascii.dev.`);
+            throw new Error(`${originalMessage}. The new computer's deletion was not confirmed: ${cleanupMessage}. Check box ${box.id} in boat.dev.`);
         }
         if (cleanupConfirmation === "confirmed")
             throw error;
         boxIdCache.delete(botId);
-        throw Object.assign(new Error(`${originalMessage}. ascii.dev accepted deletion of the new computer, but it is still pending; `
-            + `its recovery record was kept, along with its deletion fence. Check box ${box.id} in ascii.dev.`, { cause: error }), { status: 503 });
+        throw Object.assign(new Error(`${originalMessage}. boat.dev accepted deletion of the new computer, but it is still pending; `
+            + `its recovery record was kept, along with its deletion fence. Check box ${box.id} in boat.dev.`, { cause: error }), { status: 503 });
     }
 }
 /** Wake the bot's box and return a FRESH desktop URL. */
@@ -1216,16 +1216,16 @@ export const PANEL_FRAME_QUALITY = 85;
 // ffmpeg's -q:v runs 2 (best) to 31; 3 lands near JPEG quality 85.
 const PANEL_FRAME_FFMPEG_Q = 3;
 /** The shell that captures one panel frame on the box. Exported for tests. */
-export function panelShotCommand({ width = PANEL_FRAME_WIDTH, quality = PANEL_FRAME_QUALITY } = {}) {
+export function panelShotCommand({ width = PANEL_FRAME_WIDTH, quality = PANEL_FRAME_QUALITY, framePath = PANEL_PATH, nativeSize = false } = {}) {
     return [
         "export DISPLAY=${DISPLAY:-:0}",
-        `f=${PANEL_PATH}`,
+        `f=${shellQuote(framePath)}`,
         // a stale frame must not pass `test -s` when every capture tool fails
         'rm -f "$f"',
         'w=$(xdotool getdisplaygeometry 2>/dev/null | cut -d" " -f1)',
         'case "$w" in ""|*[!0-9]*) w=0;; esac',
         `scrot -o -p -q ${quality} "$f" 2>/dev/null || import -window root -quality ${quality} "$f" 2>/dev/null || ffmpeg -y -f x11grab -draw_mouse 1 -i "$DISPLAY" -frames:v 1 -q:v ${PANEL_FRAME_FFMPEG_Q} "$f" >/dev/null 2>&1`,
-        `if [ "$w" -gt ${width} ] 2>/dev/null && command -v convert >/dev/null 2>&1; then convert "$f" -resize ${width}x -quality ${quality} "$f" 2>/dev/null || true; fi`,
+        ...(nativeSize ? [] : [`if [ "$w" -gt ${width} ] 2>/dev/null && command -v convert >/dev/null 2>&1; then convert "$f" -resize ${width}x -quality ${quality} "$f" 2>/dev/null || true; fi`]),
         'test -s "$f" && echo captured',
     ].join("; ");
 }
@@ -1237,11 +1237,11 @@ const MAX_FRAME_BYTES = 8 * 1024 * 1024;
 const FRAME_TOO_LARGE = "the box frame exceeds the 8 MB limit";
 /** Read a file off the box as base64 — raw artifact bytes when the API
  * supports it (33% less transfer, no JSON envelope), else the files API. */
-async function readFileBase64(cfg, boxId, path) {
+async function readFileBase64(cfg, boxId, path, signal) {
     let bytes = null;
     let tooLarge = false;
     try {
-        const res = await boxFetch(cfg, `/boxes/${boxId}/artifacts?path=${encodeURIComponent(path)}`);
+        const res = await boxFetch(cfg, `/boxes/${boxId}/artifacts?path=${encodeURIComponent(path)}`, { signal });
         if (res.ok) {
             const declaredLength = res.headers.get("content-length");
             if (declaredLength !== null && Number(declaredLength) > MAX_FRAME_BYTES)
@@ -1258,7 +1258,8 @@ async function readFileBase64(cfg, boxId, path) {
     }
     if (bytes?.length)
         return bytes.toString("base64");
-    const { ok, body } = await boxJson(cfg, `/boxes/${boxId}/files?path=${encodeURIComponent(path)}&encoding=base64`);
+    signal?.throwIfAborted();
+    const { ok, body } = await boxJson(cfg, `/boxes/${boxId}/files?path=${encodeURIComponent(path)}&encoding=base64`, { signal });
     const content = body?.content;
     if (ok && typeof content === "string" && content) {
         if (Buffer.byteLength(content, "base64") > MAX_FRAME_BYTES)
@@ -1269,7 +1270,7 @@ async function readFileBase64(cfg, boxId, path) {
 }
 /** `knownBoxId` skips box resolution entirely — the screen poller holds
  * the id for the whole turn and must not re-resolve it every frame. */
-export async function screenshotBox(cfg, botId, knownBoxId) {
+export async function screenshotBox(cfg, botId, knownBoxId, options) {
     cfg = snapshotBoxConfig(cfg);
     let boxId = knownBoxId;
     if (!boxId) {
@@ -1280,11 +1281,12 @@ export async function screenshotBox(cfg, botId, knownBoxId) {
             throw new Error(`box is ${box.state}`);
         boxId = box.id;
     }
-    const out = await runCommand(cfg, boxId, SHOT_CMD, { timeoutMs: 60_000 });
+    const framePath = options?.nativeSize ? PANEL_PATH + ".model.jpg" : PANEL_PATH;
+    const out = await runCommand(cfg, boxId, options?.nativeSize ? panelShotCommand({ framePath, nativeSize: true }) : SHOT_CMD, { timeoutMs: 60_000, signal: options?.signal });
     if (!/captured/.test(out.stdout)) {
         throw new Error(out.stderr.slice(0, 200) || "screen capture failed on the box");
     }
-    const data = await readFileBase64(cfg, boxId, PANEL_PATH);
+    const data = await readFileBase64(cfg, boxId, framePath, options?.signal);
     if (!data)
         throw new Error("could not read the frame back from the box");
     return { png: data, format: "jpeg" };

package/dist-server/server/browser-proxy.js

@@ -69,8 +69,9 @@ export async function browserProxyRequest(frame, connection) {
         return { jsonrpc: "2.0", id, result: payload.result };
     }
     catch (error) {
-        return failure(id, message.method, error instanceof Error && !/fetch failed|abort|timeout/i.test(error.message)
-            ? error.message : "Browser connection was interrupted. Do not repeat the action until its state is checked.");
+        const detail = error instanceof Error && !/fetch failed|abort|timeout/i.test(error.message)
+            ? error.message : "Browser connection was interrupted. Do not repeat the action until its state is checked.";
+        return failure(id, message.method, detail + " This failure does not establish that all browsers are unavailable. Inspect available connections with select_computer if that tool is present. Keep the requested computer and account; do not bypass a permission refusal or human takeover, and do not repeat an uncertain action without checking its result.");
     }
 }
 function run() {

package/dist-server/server/browser-runtime.js

@@ -279,11 +279,47 @@ export class BrowserRuntime {
                 // The model sees slimmed schemas and text-only, bounded results; the
                 // launch/session parameters OMB owns never reach the engine from a call.
                 const request = method === "tools/call" ? stripHarnessOwnedArguments(params) : params;
-                const result = await entry.client.rpc(method, request);
+                let result = await entry.client.rpc(method, request);
                 beforeDispatch?.(); // A turn revoked while the tool ran receives no result.
                 if (method === "tools/list")
                     return slimBrowserToolList(result);
                 const toolName = request && typeof request === "object" && typeof request.name === "string" ? request.name : undefined;
+                if (toolName === "agent_browser_open" && result && typeof result === "object" &&
+                    result.isError !== true) {
+                    // Navigation alone does not prove that the requested page loaded.
+                    // Observe in the same scoped session, without replaying the action.
+                    beforeDispatch?.();
+                    if (this.gate(session).owner !== null)
+                        throw new Error(BROWSER_CONTROL_REFUSAL);
+                    let observation;
+                    try {
+                        observation = await entry.client.rpc("tools/call", {
+                            name: "agent_browser_snapshot", arguments: { compact: true },
+                        });
+                    }
+                    catch (error) {
+                        // A tool-level refusal does not undo the completed navigation.
+                        // Transport failures still engage the uncertainty/recovery gate.
+                        if (error instanceof TransportError)
+                            throw error;
+                        observation = { isError: true, content: [] };
+                    }
+                    beforeDispatch?.();
+                    const navigation = result;
+                    const page = observation;
+                    const observed = page?.isError !== true && Array.isArray(page?.content) && page.content.some((item) => item && typeof item === "object" && item.type === "text" &&
+                        typeof item.text === "string" && item.text.trim().length > 0);
+                    result = {
+                        content: [
+                            ...(Array.isArray(navigation.content) ? navigation.content : []),
+                            { type: "text", text: !observed
+                                    ? "Navigation returned, but page verification failed. Do not claim the requested page loaded and do not blindly repeat navigation."
+                                    : "Page observed after navigation. Check this result for redirects, sign-in requirements or page errors before reporting task success:" },
+                            ...(Array.isArray(page?.content) ? page.content : []),
+                        ],
+                        ...(!observed ? { isError: true } : {}),
+                    };
+                }
                 return shapeBrowserToolResult(result, { toolName, budget: this.options.resultBudget });
             }
             catch (error) {

package/dist-server/server/cli.js

@@ -251,7 +251,7 @@ fleet   many client workspaces on one Linux server, each its own account,
         --dry-run always prints. Install the package permanently first.
         init --operator USER also installs the fleet agent, a root service
         on a Unix socket only USER may open, so the workspace running as
-        USER manages the others from Settings → Workspaces.
+        USER manages the others from Settings → Installations.
 
 --tailscale  serve over your tailnet: Tailscale terminates HTTPS and the
              link uses this machine's MagicDNS name (needs Tailscale signed in
@@ -402,7 +402,7 @@ function startupPreferences(options) {
 async function showPhonePairing(options, origin, log) {
     const ready = !!origin && await verifyPhoneEndpoint(options.port, origin);
     if (!ready) {
-        log("Phone access is not reachable yet. Your local workspace is ready; no phone pairing code was created.");
+        log("Phone access is not reachable yet. OpenMausBot is ready on this computer; no phone pairing code was created.");
         log("Check the HTTPS connection, then run openmausbot pair again with the same --data-dir and --port.");
         return false;
     }

package/dist-server/server/command-allowlist.js

@@ -0,0 +1,154 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, isAbsolute, sep } from "node:path";
+import { writeFileAtomic } from "./atomic.js";
+import { redactSecretsInText } from "./redact.js";
+const MAX_COMMAND_BYTES = 16_384;
+const MAX_CWD_BYTES = 4_096;
+const MAX_RULES_PER_BOT = 200;
+const MAX_STORE_BYTES = 8 * 1024 * 1024;
+const BOT_ID = /^[\w-]{1,128}$/;
+const RULE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const record = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const invalid = (message) => Object.assign(new Error(message), { status: 400 });
+/** Validate without rewriting the command. Resolving a symlink, or folding
+ * `..` across one, could make a grant apply in a different directory. */
+export function validateCommandAllowlistCandidate(value) {
+    if (!record(value))
+        throw invalid("A command, absolute working directory and engine instance are required.");
+    const { command, cwd, providerInstanceId } = value;
+    if (typeof command !== "string" || !command.trim() || Buffer.byteLength(command) > MAX_COMMAND_BYTES ||
+        /[\p{Cc}\p{Cs}]/u.test(command.replace(/[\t\r\n]/g, ""))) {
+        throw invalid("The command must be nonempty text of at most 16384 bytes, without invalid control characters.");
+    }
+    if (redactSecretsInText(command) !== command) {
+        throw invalid("Commands containing credentials cannot be saved. Use an environment variable instead.");
+    }
+    if (typeof cwd !== "string" || !cwd || Buffer.byteLength(cwd) > MAX_CWD_BYTES ||
+        /[\p{Cc}\p{Cs}]/u.test(cwd) || !isAbsolute(cwd) || cwd.split(sep === "\\" ? /[\\/]/ : /\//).includes("..")) {
+        throw invalid("The working directory must be an absolute path without parent-directory segments.");
+    }
+    // On Windows, `\work` is rooted but still depends on the current drive.
+    if (process.platform === "win32" && !/^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/][^\\/]+(?:[\\/]|$))/.test(cwd)) {
+        throw invalid("The working directory must include its drive or network share.");
+    }
+    if (typeof providerInstanceId !== "string" || !providerInstanceId || providerInstanceId.trim() !== providerInstanceId ||
+        providerInstanceId.length > 200 || /[\p{Cc}\p{Cs}]/u.test(providerInstanceId)) {
+        throw invalid("A valid engine instance is required.");
+    }
+    // Keep directory spelling exact too. A false negative is preferable to
+    // treating two paths as equivalent without knowing the engine's filesystem.
+    return { command, cwd, providerInstanceId };
+}
+/** Runtime metadata that cannot identify an exact scope never auto-allows. */
+export function commandAllowlistCandidate(value) {
+    try {
+        return validateCommandAllowlistCandidate(value);
+    }
+    catch {
+        return null;
+    }
+}
+function validateBotId(botId) {
+    if (typeof botId !== "string" || !BOT_ID.test(botId))
+        throw invalid("A valid bot id is required.");
+}
+function sameScope(left, right) {
+    return left.command === right.command && left.cwd === right.cwd && left.providerInstanceId === right.providerInstanceId;
+}
+/** Installation-local grants, deliberately separate from bot profiles and
+ * templates. Callers must also exclude this file from workspace backups.
+ * One server owns the store; a successful atomic save precedes publication. */
+export class CommandAllowlistStore {
+    rules = [];
+    unreadable = false;
+    filename;
+    constructor(filename) {
+        this.filename = filename;
+        try {
+            const stat = lstatSync(filename);
+            if (!stat.isFile() || stat.size > MAX_STORE_BYTES)
+                throw new Error("Invalid command rule store.");
+            const saved = JSON.parse(readFileSync(filename, "utf8"));
+            if (!record(saved) || saved.version !== 1 || !Array.isArray(saved.rules) ||
+                Object.keys(saved).some((key) => key !== "version" && key !== "rules"))
+                throw new Error("Invalid command rule store.");
+            const rules = [];
+            const ids = new Set();
+            const counts = new Map();
+            for (const row of saved.rules) {
+                if (!record(row) || typeof row.id !== "string" || !RULE_ID.test(row.id) || ids.has(row.id) ||
+                    typeof row.botId !== "string" || Object.keys(row).some((key) => !["id", "botId", "command", "cwd", "providerInstanceId"].includes(key))) {
+                    throw new Error("Invalid command rule store.");
+                }
+                validateBotId(row.botId);
+                const candidate = validateCommandAllowlistCandidate(row);
+                const count = (counts.get(row.botId) ?? 0) + 1;
+                if (count > MAX_RULES_PER_BOT)
+                    throw new Error("Too many saved command rules.");
+                counts.set(row.botId, count);
+                ids.add(row.id);
+                rules.push({ ...candidate, id: row.id, botId: row.botId });
+            }
+            this.rules = rules;
+        }
+        catch (error) {
+            // Missing means no grants. Any other read/validation failure disables
+            // all grants and forbids overwriting evidence of a damaged store.
+            if (error.code !== "ENOENT")
+                this.unreadable = true;
+        }
+    }
+    list(botId) {
+        validateBotId(botId);
+        return this.rules.filter((rule) => rule.botId === botId).map(({ botId: _botId, ...rule }) => rule);
+    }
+    add(botId, value) {
+        this.assertWritable();
+        validateBotId(botId);
+        const candidate = validateCommandAllowlistCandidate(value);
+        const existing = this.list(botId);
+        const duplicate = existing.find((rule) => sameScope(rule, candidate));
+        if (duplicate)
+            return duplicate;
+        if (existing.length >= MAX_RULES_PER_BOT)
+            throw invalid("A bot may save at most 200 commands.");
+        const rule = { ...candidate, id: randomUUID() };
+        this.save([...this.rules, { ...rule, botId }]);
+        return rule;
+    }
+    remove(botId, ruleId) {
+        this.assertWritable();
+        validateBotId(botId);
+        const next = this.rules.filter((rule) => rule.botId !== botId || rule.id !== ruleId);
+        if (next.length === this.rules.length)
+            return false;
+        this.save(next);
+        return true;
+    }
+    clear(botId) {
+        this.assertWritable();
+        validateBotId(botId);
+        const next = this.rules.filter((rule) => rule.botId !== botId);
+        if (next.length !== this.rules.length)
+            this.save(next);
+    }
+    matches(botId, value) {
+        if (this.unreadable || typeof botId !== "string" || !BOT_ID.test(botId))
+            return false;
+        const candidate = commandAllowlistCandidate(value);
+        return candidate !== null && this.rules.some((rule) => rule.botId === botId && sameScope(rule, candidate));
+    }
+    assertWritable() {
+        if (this.unreadable)
+            throw Object.assign(new Error("Saved command rules could not be read. Repair the rule store before changing them."), { status: 503 });
+    }
+    save(rules) {
+        const json = JSON.stringify({ version: 1, rules }, null, 2);
+        if (Buffer.byteLength(json) > MAX_STORE_BYTES)
+            throw invalid("The saved command rules exceed the storage limit.");
+        mkdirSync(dirname(this.filename), { recursive: true, mode: 0o700 });
+        writeFileAtomic(this.filename, json, { mode: 0o600 });
+        this.rules = rules;
+    }
+}