openmausbot 0.1.86 → 0.1.88

package/dist-server/server/vps-computer.js

@@ -6,7 +6,8 @@ import { spawn } from "node:child_process";
 import { createConnection, createServer } from "node:net";
 import { BASE_IMAGE, CUA_DRIVER_VERSION, CUA_SOCKET, IMAGE as CUA_IMAGE, cuaExecArgs, dockerSecurityIsHardened, imageLabelsMatch, managedImageDockerfile, wholeScreenshot, BASE_IMAGE_DIGEST, BASE_IMAGE_LABEL, DRIVER_LABEL, IMAGE_LAYER_LABEL, IMAGE_LAYER_VERSION, MANAGED_LABEL, } from "./container-computer.js";
 import { DATA_DIR, isValidSshAlias, vpsSshAlias } from "./config.js";
-import { augmentedPath, resolveCliSpawn } from "./env-path.js";
+import { augmentedPath } from "./env-path.js";
+import { killCliTree, spawnCli } from "./procs.js";
 import { prepareVpsSsh } from "./vps-ssh.js";
 import { loadEnvironmentId } from "./environment.js";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
@@ -28,7 +29,9 @@ function vpsEnvironmentId() {
 // SIGTERM must give ssh + docker time to tear down the remote exec before the
 // SIGKILL escalation; 1s was routinely too short over a WAN round-trip, and an
 // orphaned remote exec keeps the driver socket busy for the next command.
-const COMMAND_TIMEOUT_KILL_GRACE_MS = 5_000;
+const COMMAND_TIMEOUT_TERM_GRACE_MS = 5_000;
+// killCliTree also waits up to one second for the forced group exit.
+const COMMAND_TIMEOUT_KILL_GRACE_MS = COMMAND_TIMEOUT_TERM_GRACE_MS + 1_000;
 const CONTAINER_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]+$/;
 const CONTAINER_ID = /^[a-f0-9]{12,64}$/i;
 const FULL_CONTAINER_ID = /^[a-f0-9]{64}$/i;
@@ -63,20 +66,32 @@ function snapshotVpsConfig(cfg) {
 export function vpsLifecycleBusy() {
     return lifecycleLocks.size > 0;
 }
-// A held lock means a lifecycle mutation (worst case: a 10-minute image
-// build) is running. Waiting it out would wedge Sleep and the screenshot
-// poll behind it, so acquisition fails fast instead.
+// Sleep, remove and preview requests must not queue behind a potentially
+// 10-minute image build. Turn preparation may instead wait through a normal
+// preview, whose bounded duration is accounted for below.
 const LOCK_ACQUIRE_TIMEOUT_MS = 5_000;
 // The panel polls status every 4-6s and the screen poller re-checks it before
 // every frame; each full status is several docker-over-SSH processes. Same
 // pattern as container-computer's screenshotStatusCache, and the same TTL.
 const STATUS_CACHE_TTL_MS = 10_000;
 const statusCache = new Map();
+const pendingStatuses = new Map();
+const pendingProvisions = new Map();
 const SCREENSHOT_BUDGET_MS = 45_000;
 const SCREENSHOT_CLEANUP_BUDGET_MS = 10_000;
+// Turn preparation may wait for a normal preview to finish; destructive
+// actions retain the short acquisition limit. Overlapping provisions share
+// one operation below, so they never queue behind their own image build.
+const PREPARATION_LOCK_TIMEOUT_MS = SCREENSHOT_BUDGET_MS + LOCK_ACQUIRE_TIMEOUT_MS;
 const pendingScreenshots = new Map();
 const viewerConnections = new Map();
 const desktopTunnels = new Map();
+function invalidateVpsStatus(key) {
+    statusCache.delete(key);
+    // Detach old polls as well: an inspection begun before a mutation must
+    // neither be joined nor republish its old result after that mutation.
+    pendingStatuses.delete(key);
+}
 /** Whether a turn may prepare or start the VPS container rather than only
  * reuse a running one. Explicit Cloud always may; Auto only when the person
  * switched on Start VPS automatically — except for unattended runs. A
@@ -216,11 +231,10 @@ function tailCollector() {
 }
 export function defaultRunner(args, options = {}) {
     return new Promise((resolve, reject) => {
-        const command = resolveCliSpawn("docker", args);
         // docker's SSH transport runs the first `ssh` on PATH: the app's shim,
         // which shares one connection across every command of this VPS.
         const ssh = prepareVpsSsh(DATA_DIR, augmentedPath());
-        const child = spawn(command.command, command.args, {
+        const child = spawnCli("docker", args, {
             shell: false,
             env: { ...process.env, PATH: ssh.path },
             stdio: ["pipe", "pipe", "pipe"],
@@ -228,31 +242,33 @@ export function defaultRunner(args, options = {}) {
         const stdout = tailCollector();
         const stderr = tailCollector();
         let settled = false;
-        let timedOut = false;
-        let killTimer;
+        let failure = null;
         let timeout;
         const settle = (finish) => {
             if (settled)
                 return;
             settled = true;
             clearTimeout(timeout);
-            if (killTimer)
-                clearTimeout(killTimer);
             finish();
         };
-        timeout = setTimeout(() => {
-            if (settled)
+        const fail = (error) => {
+            if (settled || failure)
                 return;
-            timedOut = true;
-            killTimer = setTimeout(() => {
-                if (settled)
-                    return;
-                child.kill("SIGKILL");
-                settle(() => reject(new Error("Docker-over-SSH command timed out")));
-            }, COMMAND_TIMEOUT_KILL_GRACE_MS);
-            killTimer.unref?.();
-            child.kill("SIGTERM");
-        }, options.timeoutMs ?? 120_000);
+            failure = error;
+            clearTimeout(timeout);
+            // Docker launches ssh, which can retain these pipes after Docker exits.
+            // Only this command's private process group is ours to stop; persistent
+            // SSH masters detach from it and may serve other commands. Hold callers'
+            // lifecycle ownership until the bounded tree cleanup has completed.
+            const cleaned = () => {
+                child.stdin.destroy();
+                child.stdout.destroy();
+                child.stderr.destroy();
+                settle(() => reject(error));
+            };
+            void killCliTree(child, COMMAND_TIMEOUT_TERM_GRACE_MS).then(cleaned, cleaned);
+        };
+        timeout = setTimeout(() => fail(new Error("Docker-over-SSH command timed out")), options.timeoutMs ?? 120_000);
         timeout.unref?.();
         child.stdout.setEncoding("utf8");
         child.stderr.setEncoding("utf8");
@@ -263,18 +279,14 @@ export function defaultRunner(args, options = {}) {
             stderr.push(chunk);
         });
         child.stdin.on("error", (error) => {
-            if (timedOut)
-                return;
-            settle(() => reject(new Error(`Docker-over-SSH stdin failed: ${error.message}`)));
+            fail(new Error(`Docker-over-SSH stdin failed: ${error.message}`));
         });
         child.on("error", (error) => {
-            settle(() => reject(new Error(`Docker-over-SSH could not start: ${error.message}`)));
+            fail(new Error(`Docker-over-SSH could not start: ${error.message}`));
         });
         child.on("close", (code, signal) => {
-            if (timedOut) {
-                settle(() => reject(new Error("Docker-over-SSH command timed out")));
+            if (failure)
                 return;
-            }
             settle(() => {
                 if (code === 0)
                     return resolve({ stdout: stdout.text(), stderr: stderr.text() });
@@ -286,7 +298,7 @@ export function defaultRunner(args, options = {}) {
             child.stdin.end(options.input);
         }
         catch (error) {
-            settle(() => reject(new Error(`Docker-over-SSH stdin failed: ${error instanceof Error ? error.message : String(error)}`)));
+            fail(new Error(`Docker-over-SSH stdin failed: ${error instanceof Error ? error.message : String(error)}`));
         }
     });
 }
@@ -531,15 +543,30 @@ export async function vpsComputerStatus(cfg, botId, runner = defaultRunner) {
     if (cacheable) {
         // A capture already checks this exact target. Let it finish instead of
         // opening another six SSH connections while its readiness check is cold.
-        await pendingScreenshots.get(key)?.catch(() => { });
+        const capture = pendingScreenshots.get(key);
+        if (capture)
+            await capture.catch(() => { });
         const cached = statusCache.get(key);
         if (cached && cached.expiresAt > Date.now())
             return cached.status;
+        const pending = pendingStatuses.get(key);
+        if (pending)
+            return pending;
     }
-    const status = await computeVpsComputerStatus(cfg, botId, runner);
+    const inspection = computeVpsComputerStatus(cfg, botId, runner);
     if (cacheable)
-        statusCache.set(key, { status, expiresAt: Date.now() + STATUS_CACHE_TTL_MS });
-    return status;
+        pendingStatuses.set(key, inspection);
+    try {
+        const status = await inspection;
+        if (cacheable && pendingStatuses.get(key) === inspection && !lifecycleLocks.has(key)) {
+            statusCache.set(key, { status, expiresAt: Date.now() + STATUS_CACHE_TTL_MS });
+        }
+        return status;
+    }
+    finally {
+        if (cacheable && pendingStatuses.get(key) === inspection)
+            pendingStatuses.delete(key);
+    }
 }
 const VPS_INVENTORY_LIMIT = 256;
 const VPS_INVENTORY_STATES = new Set([
@@ -761,14 +788,32 @@ async function prepareVpsImage(alias, runner) {
  * Backoff doubles 0.5s→4s because each poll is a real SSH connection, and
  * between polls only ONE cheap exec (`cua-driver status`) asks whether the
  * driver answers yet — the full multi-invocation status runs again only when
- * that predicate flips, and once more at the deadline, so the returned state
- * is always a complete inspection. */
+ * that predicate flips. Every command, including the diagnostic tail, is
+ * clamped to the readiness phase's deadline and transport cleanup allowance. */
 async function waitForVpsReady(cfg, botId, runner, budgetMs = 60_000) {
     const alias = vpsSshAlias(cfg);
     const deadline = Date.now() + budgetMs;
-    let status = await computeVpsComputerStatus(cfg, botId, runner);
+    let budgetExpired = false;
+    const boundedRunner = async (args, options = {}) => {
+        // Include transport termination in the readiness phase's budget; a
+        // final failed probe or diagnostic tail must not keep its lock past it.
+        const remaining = deadline - Date.now() - COMMAND_TIMEOUT_KILL_GRACE_MS;
+        if (remaining <= 0) {
+            budgetExpired = true;
+            throw new Error("VPS desktop readiness timed out");
+        }
+        try {
+            return await runner(args, { ...options, timeoutMs: Math.min(options.timeoutMs ?? 120_000, remaining) });
+        }
+        catch (error) {
+            if (Date.now() >= deadline - COMMAND_TIMEOUT_KILL_GRACE_MS)
+                budgetExpired = true;
+            throw error;
+        }
+    };
+    let status = await computeVpsComputerStatus(cfg, botId, boundedRunner);
     let delayMs = 500;
-    while (!status.ready && alias && Date.now() < deadline) {
+    while (!status.ready && alias && !budgetExpired && Date.now() < deadline) {
         if (!status.daemonUp ||
             !status.image ||
             !status.imageMatches ||
@@ -785,14 +830,24 @@ async function waitForVpsReady(cfg, botId, runner, budgetMs = 60_000) {
         });
         delayMs = Math.min(delayMs * 2, 4_000);
         const container = status.container_id ?? status.container_name;
-        const driverAnswers = await runner(vpsDockerArgs(alias, cuaExecArgs(["status", "--socket", CUA_SOCKET], { container })), { timeoutMs: 10_000 }).then(() => true, () => false);
+        const driverAnswers = await boundedRunner(vpsDockerArgs(alias, cuaExecArgs(["status", "--socket", CUA_SOCKET], { container })), { timeoutMs: 10_000 }).then(() => true, () => false);
+        if (budgetExpired)
+            break;
         if (!driverAnswers && Date.now() < deadline)
             continue;
-        status = await computeVpsComputerStatus(cfg, botId, runner);
+        status = await computeVpsComputerStatus(cfg, botId, boundedRunner);
     }
+    if (budgetExpired)
+        return {
+            ...status,
+            ready: false,
+            desktopReady: false,
+            desktop_error: "VPS desktop readiness timed out",
+            problem: "The VPS desktop did not become ready in time — retry when the connection recovers",
+        };
     return status;
 }
-async function withVpsLifecycleLock(key, operation) {
+async function withVpsLifecycleLock(key, operation, acquireTimeoutMs = LOCK_ACQUIRE_TIMEOUT_MS) {
     const previous = lifecycleLocks.get(key);
     let release;
     const current = new Promise((resolve) => {
@@ -804,7 +859,7 @@ async function withVpsLifecycleLock(key, operation) {
         const acquired = await Promise.race([
             previous.then(() => true),
             new Promise((resolve) => {
-                acquireTimer = setTimeout(() => resolve(false), LOCK_ACQUIRE_TIMEOUT_MS);
+                acquireTimer = setTimeout(() => resolve(false), acquireTimeoutMs);
                 acquireTimer.unref?.();
             }),
         ]);
@@ -849,6 +904,7 @@ export async function removeManagedVpsComputer(cfg, owners, containerName, confi
     }
     const key = `${alias}:${containerName}`;
     return withVpsLifecycleLock(key, async () => {
+        invalidateVpsStatus(key);
         const scan = await scanManagedVpsComputers(cfg, owners, runner);
         const inventory = scan.inventory;
         if (!inventory.available) {
@@ -874,13 +930,14 @@ export async function removeManagedVpsComputer(cfg, owners, containerName, confi
             await runner(vpsDockerArgs(alias, ["rm", "-f", containerId]), { timeoutMs: 2 * 60_000 });
         }
         catch (error) {
+            invalidateVpsStatus(key);
             const detail = (error instanceof Error ? error.message : String(error))
                 .replace(/[\r\n\t]+/g, " ")
                 .trim()
                 .slice(0, 200);
             throw Object.assign(new Error(`The VPS refused to remove this computer${detail ? `: ${detail}` : ""}`), { status: 502 });
         }
-        statusCache.delete(key);
+        invalidateVpsStatus(key);
         viewerConnections.delete(key);
         if (instance.ownerBotId)
             stopDesktopTunnel(instance.ownerBotId);
@@ -893,14 +950,19 @@ export async function vpsComputerAction(action, cfg, botId, runner = defaultRunn
     if (!alias)
         throw Object.assign(new Error("VPS is not configured — add an SSH config alias in App Settings → Connections"), { status: 409 });
     const key = `${alias}:${vpsContainerName(botId)}`;
+    const pending = action === "provision" ? pendingProvisions.get(key) : undefined;
+    if (pending)
+        return pending;
     const operation = async () => {
         // A mutation invalidates every cached poll answer, before and after: the
         // panel must never keep showing the pre-action world for a TTL.
-        statusCache.delete(key);
+        invalidateVpsStatus(key);
         try {
             const before = await computeVpsComputerStatus(cfg, botId, runner);
             if (!before.daemonUp)
                 throw Object.assign(new Error(before.problem ?? "Docker over SSH is not reachable"), { status: 409 });
+            if (action === "provision" && before.ready)
+                return before;
             // A real lifecycle change invalidates the remote endpoint. Provision
             // is also the turn-start idempotency path, so leave an already-running
             // viewer alone when no start/replacement will occur.
@@ -946,7 +1008,7 @@ export async function vpsComputerAction(action, cfg, botId, runner = defaultRunn
                     throw Object.assign(new Error("The VPS container name is occupied by a container OpenMausBot did not create — remove it on the VPS yourself"), { status: 409 });
                 }
                 await run(["rm", "-f", containerRef]);
-                return computeVpsComputerStatus(cfg, botId, runner);
+                return await computeVpsComputerStatus(cfg, botId, runner);
             }
             else {
                 if (before.container !== "running")
@@ -954,13 +1016,22 @@ export async function vpsComputerAction(action, cfg, botId, runner = defaultRunn
                 assertUsableContainer(before);
                 await run(["stop", containerRef]);
             }
-            return action === "stop" ? computeVpsComputerStatus(cfg, botId, runner) : waitForVpsReady(cfg, botId, runner);
+            return await (action === "stop" ? computeVpsComputerStatus(cfg, botId, runner) : waitForVpsReady(cfg, botId, runner));
         }
         finally {
-            statusCache.delete(key);
+            invalidateVpsStatus(key);
         }
     };
-    return withVpsLifecycleLock(key, operation);
+    const preparation = withVpsLifecycleLock(key, operation, action === "provision" ? PREPARATION_LOCK_TIMEOUT_MS : LOCK_ACQUIRE_TIMEOUT_MS);
+    if (action === "provision")
+        pendingProvisions.set(key, preparation);
+    try {
+        return await preparation;
+    }
+    finally {
+        if (pendingProvisions.get(key) === preparation)
+            pendingProvisions.delete(key);
+    }
 }
 /** Auto is intentionally read-only: it can attach only to an existing ready
  * container. It recomputes rather than reading the poll cache — routing a
@@ -976,7 +1047,7 @@ export async function inspectVpsForAuto(cfg, botId, runner = defaultRunner) {
     cfg = snapshotVpsConfig(cfg);
     const key = vpsLockKey(cfg, botId);
     return key
-        ? withVpsLifecycleLock(key, () => computeVpsComputerStatus(cfg, botId, runner))
+        ? withVpsLifecycleLock(key, () => computeVpsComputerStatus(cfg, botId, runner), PREPARATION_LOCK_TIMEOUT_MS)
         : computeVpsComputerStatus(cfg, botId, runner);
 }
 /** Open a temporary noVNC connection through the configured SSH alias. The
@@ -1116,9 +1187,26 @@ export async function vpsComputerScreenshot(cfg, botId, runner = defaultRunner)
         // poller runs every few seconds, and re-verifying the whole container
         // between frames multiplied every frame's SSH cost.
         const cached = cacheable ? statusCache.get(key) : undefined;
+        const pendingStatus = cacheable ? pendingStatuses.get(key) : undefined;
+        // A poll which started first already owns the inspection. Sharing its
+        // result must not extend this preview's own deadline; the poll remains
+        // independently owned if it is still checking when this preview expires.
+        let statusTimer;
         const status = cached && cached.expiresAt > Date.now()
             ? cached.status
-            : await computeVpsComputerStatus(cfg, botId, boundedRunner);
+            : pendingStatus
+                ? await Promise.race([
+                    pendingStatus,
+                    new Promise((_resolve, reject) => {
+                        statusTimer = setTimeout(() => {
+                            invalidateVpsStatus(key);
+                            reject(timeoutError());
+                        }, Math.max(0, workDeadline - Date.now()));
+                        statusTimer.unref?.();
+                    }),
+                ]).finally(() => { if (statusTimer)
+                    clearTimeout(statusTimer); })
+                : await computeVpsComputerStatus(cfg, botId, boundedRunner);
         // Status converts transport errors into displayable state. A deadline is
         // still a timeout, not evidence that this container became incompatible.
         if (budgetExpired) {

package/dist-server/server/vps-container-mcp.js

@@ -5,6 +5,9 @@
 // mcp-bridge.ts, shared with the Local VM entry point.
 import { runMcpBridge } from "./mcp-bridge.js";
 import { vpsContainerMcpArgs, vpsDockerArgs } from "./vps-computer.js";
+import { DATA_DIR } from "./config.js";
+import { augmentedPath } from "./env-path.js";
+import { prepareVpsSsh } from "./vps-ssh.js";
 const [alias, containerName] = process.argv.slice(2);
 const sshAlias = alias ?? "";
 let args;
@@ -19,9 +22,13 @@ catch {
 // through `ps`, and the token guards a loopback endpoint.
 const controlUrl = process.env.OMB_CONTROL_URL ?? "";
 const controlToken = process.env.OMB_CONTROL_TOKEN ?? "";
+const ssh = prepareVpsSsh(DATA_DIR, augmentedPath());
 runMcpBridge({
     command: "docker",
     args,
+    // Keep tool calls and the watchdog on the same bounded, shared transport
+    // as startup and previews; otherwise only the panel gets the SSH defaults.
+    env: { ...process.env, PATH: ssh.path },
     label: "VPS Cua Driver",
     // The probe checks the TRANSPORT (SSH + daemon), deliberately not the
     // driver: a busy desktop mid-tool-call must never look dead, while an

package/dist-server/server/vps-ssh.js

@@ -10,10 +10,39 @@
 // that includes theirs first (so anything they set still wins) and fills in
 // connection sharing and fail-fast timeouts, plus an `ssh` shim docker finds
 // ahead of the real one that points at that config.
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { delimiter, join } from "node:path";
+import { delimiter, join, resolve } from "node:path";
 export const VPS_SSH_DIR = "ssh";
+function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/** macOS limits Unix socket paths to 104 bytes, including the terminator.
+ * OpenSSH also appends a temporary suffix while creating a master socket.
+ * A long application/test data path must not disable every SSH command. */
+function controlDirectory(sshDir) {
+    if (Buffer.byteLength(join(sshDir, `cm-${"0".repeat(40)}`)) <= 80)
+        return sshDir;
+    const uid = process.getuid();
+    const id = createHash("sha256").update(resolve(sshDir)).digest("hex").slice(0, 12);
+    // /tmp is intentionally used instead of tmpdir(): macOS TMPDIR is itself
+    // often too long for a control socket. Validate before chmod or use so an
+    // existing symlink/other user's directory cannot redirect the socket.
+    const dir = `/tmp/omb-ssh-${uid}-${id}`;
+    try {
+        mkdirSync(dir, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    const stat = lstatSync(dir);
+    if (!stat.isDirectory() || stat.uid !== uid)
+        throw new Error("The VPS SSH control directory is not private to this user");
+    chmodSync(dir, 0o700);
+    return dir;
+}
 function findExecutable(name, pathValue, exclude) {
     for (const dir of pathValue.split(delimiter)) {
         if (!dir || dir === exclude)
@@ -49,15 +78,15 @@ export function vpsSshConfigText(sshDir, userConfig = join(homedir(), ".ssh", "c
     return [
         "# Written by OpenMausBot for its VPS computer connections. Do not edit;",
         "# it is regenerated. Your own ~/.ssh/config is included first and wins.",
-        ...(existsSync(userConfig) ? [`Include ${userConfig}`] : []),
+        ...(existsSync(userConfig) ? [`Include ${JSON.stringify(userConfig)}`] : []),
         "Host *",
         "  ControlMaster auto",
-        `  ControlPath ${join(sshDir, "cm-%C")}`,
+        `  ControlPath ${JSON.stringify(join(sshDir.replace(/%/g, "%%"), "cm-%C"))}`,
         "  ControlPersist 10m",
         "  ServerAliveInterval 15",
         "  ServerAliveCountMax 3",
         "  ConnectTimeout 10",
-        ...(existsSync(systemConfig) ? [`Include ${systemConfig}`] : []),
+        ...(existsSync(systemConfig) ? [`Include ${JSON.stringify(systemConfig)}`] : []),
         "",
     ].join("\n");
 }
@@ -72,7 +101,7 @@ export function prepareVpsSsh(dataDir, pathValue, platform = process.platform) {
     mkdirSync(binDir, { recursive: true, mode: 0o700 });
     chmodSync(sshDir, 0o700);
     const configPath = join(sshDir, "config");
-    writeIfChanged(configPath, vpsSshConfigText(sshDir), 0o600);
+    writeIfChanged(configPath, vpsSshConfigText(controlDirectory(sshDir)), 0o600);
     const realSsh = findExecutable("ssh", pathValue, binDir);
     if (!realSsh)
         return { configPath, path: pathValue };
@@ -80,7 +109,7 @@ export function prepareVpsSsh(dataDir, pathValue, platform = process.platform) {
         "#!/bin/sh",
         "# Written by OpenMausBot. docker's SSH transport finds this ssh first, so",
         "# every VPS command shares one connection whether or not the alias says so.",
-        `exec ${JSON.stringify(realSsh)} -F ${JSON.stringify(configPath)} "$@"`,
+        `exec ${shellQuote(realSsh)} -F ${shellQuote(configPath)} "$@"`,
         "",
     ].join("\n");
     writeIfChanged(join(binDir, "ssh"), shim, 0o700);

package/dist-server/server/workspace-backup-policy.js

@@ -22,10 +22,22 @@ export function restoredWorkspaceConfig(portable, destination) {
 }
 /** Exact app-owned authentication paths, not a scan of user document text. */
 export function excludedWorkspaceAuthPath(path) {
+    // Machine/provider-specific execution grants are not portable template data.
+    if (/^command-allowlist\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path))
+        return true;
     return /^(?:(?:providers|caddy|chrome-profile|\.agent-browser)(?:\/|$)|workspace-credentials\.json$|external-runtimes\.json$|browser-engine-key$)/.test(path) ||
         /^(?:config\.json|webhooks\.json|workspace-credentials\.json|external-runtimes\.json|browser-engine-key|sessions\.json|tunnel-account\.json)\.\d+(?:\.[0-9a-f-]+)?\.tmp$/.test(path) ||
         /^(?:vm-home|vm-homes\/[^/]+)\/\.browser-profiles(?:\/|$)/.test(path);
 }
+/** The Organization library files Electron main downloads and verifies
+ * (docs/desktop-library.md): the catalog, a catalog write in progress, and the
+ * cached release files. Main fetches them again from Admin, and sign-out
+ * deletes them, so a backup never keeps an Organization's package bytes. The
+ * runtime's own `org-library/state.json` and `presets.json` are backed up. Like
+ * the hook tokens below, an archive that holds them still restores. */
+export function redownloadedOrgLibraryPath(path) {
+    return /^org-library\/(?:catalog\.json(?:\.[0-9a-f-]{36}\.tmp)?$|blobs(?:\/|$))/.test(path);
+}
 /** Per-turn engine hook bearers (`hook-tokens/<digest>.token`, written by the
  * Claude driver). They are dead once their turn settles, so they are never
  * exported. Unlike the saved auth paths above they are not refused on import:

package/dist-server/server/workspace-backup.js

@@ -6,12 +6,13 @@ import { isAbsolute, join, parse, posix, relative, resolve, win32 } from "node:p
 import { homedir } from "node:os";
 import { backup, DatabaseSync } from "node:sqlite";
 import { pipeline } from "node:stream/promises";
+import { Worker } from "node:worker_threads";
 import * as tar from "tar";
 import { fromMarkdown } from "mdast-util-from-markdown";
 import { writeFileAtomic } from "./atomic.js";
 import { escapeAttribute, splitTranscriptAttachments } from "../src/lib/composer-attachments.js";
 import { WORKSPACE_BACKUP_CLIENT_KEYS } from "../shared/workspace-backup-client.js";
-import { ephemeralWorkspaceTokenPath, excludedWorkspaceAuthPath, portableWorkspaceConfig, restoredWorkspaceConfig } from "./workspace-backup-policy.js";
+import { ephemeralWorkspaceTokenPath, excludedWorkspaceAuthPath, portableWorkspaceConfig, redownloadedOrgLibraryPath, restoredWorkspaceConfig } from "./workspace-backup-policy.js";
 export const MAX_WORKSPACE_BACKUP_BYTES = 10 * 1024 ** 3;
 export const MAX_WORKSPACE_BACKUP_FILES = 100_000;
 export const MAX_WORKSPACE_BACKUP_UPLOAD_BYTES = MAX_WORKSPACE_BACKUP_BYTES + 256 * 1024 ** 2;
@@ -77,8 +78,7 @@ function jobPath(dataDir, id) {
     }
     return path;
 }
-function newJob(dataDir) {
-    const id = randomUUID();
+function newJob(dataDir, id = randomUUID()) {
     const directory = jobPath(dataDir, id);
     mkdirSync(directory, { mode: 0o700 });
     return { id, directory };
@@ -265,13 +265,50 @@ function databaseCounts(path) {
         db.close();
     }
 }
+/** The existing maintenance gate owns exclusivity until this worker has exited.
+ * Keep synchronous file validation/fsync intact, but off the request thread. */
 export async function createWorkspaceBackup(dataDir, options) {
+    const source = new URL("./workspace-backup.worker.ts", import.meta.url);
+    // Assign ownership before the worker can create staging, including crashes
+    // too early to send a job-created message back to this process.
+    const jobId = randomUUID();
+    let worker;
+    let completed = false;
+    try {
+        worker = new Worker(existsSync(source) ? source : new URL("./workspace-backup.worker.js", import.meta.url), {
+            workerData: { dataDir, options, jobId }, execArgv: [],
+        });
+        const result = await new Promise((resolveBackup, reject) => {
+            const failed = () => reject(new Error("The backup worker stopped before completing. Try again."));
+            worker.once("message", (reply) => {
+                if (reply.result)
+                    resolveBackup(reply.result);
+                else if (reply.error)
+                    reject(new Error(reply.error));
+                else
+                    failed();
+            });
+            worker.once("error", failed);
+            worker.once("exit", failed);
+        });
+        completed = true;
+        return result;
+    }
+    finally {
+        await worker?.terminate();
+        // Reuse the guarded deletion path: never sweep other jobs or recovery.
+        if (!completed && entryExists(join(dataDir, ".backups", jobId)))
+            removeWorkspaceBackupJob(dataDir, jobId);
+    }
+}
+/** Worker implementation; application callers use createWorkspaceBackup. */
+export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
     if (Object.hasOwn(options, "credentials"))
         throw new Error("Workspace backups do not transfer credentials.");
     assertLocalAuthOutsideSnapshot(dataDir);
     const salt = randomBytes(16);
     const key = await passwordKey(options.password, salt);
-    const job = newJob(dataDir);
+    const job = newJob(dataDir, jobId);
     const snapshot = join(job.directory, "snapshot");
     folder(join(snapshot, "data"));
     const entries = [];
@@ -311,7 +348,7 @@ export async function createWorkspaceBackup(dataDir, options) {
                 if (!prefix && excluded(name))
                     continue;
                 const path = prefix ? `${prefix}/${name}` : name;
-                if (excludedWorkspaceAuthPath(path) || ephemeralWorkspaceTokenPath(path))
+                if (excludedWorkspaceAuthPath(path) || ephemeralWorkspaceTokenPath(path) || redownloadedOrgLibraryPath(path))
                     continue;
                 // Do not silently skip noncanonical source spellings: reject them so
                 // a case-sensitive host cannot export auth paths active on Windows/Mac.

package/dist-server/server/workspace-backup.worker.js

@@ -0,0 +1,10 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { createWorkspaceBackupSnapshot } from "./workspace-backup.js";
+const { dataDir, options, jobId } = workerData;
+try {
+    // Same snapshot and cleanup implementation; never send password/options back.
+    parentPort.postMessage({ result: await createWorkspaceBackupSnapshot(dataDir, options, jobId) });
+}
+catch (error) {
+    parentPort.postMessage({ error: error instanceof Error ? error.message : "The workspace backup could not finish." });
+}

package/dist-server/server/workspace.js

@@ -18,7 +18,7 @@ export const WORKSPACES_DIR = join(DATA_DIR, "workspaces");
 export const TASK_WORKSPACES_DIR = join(DATA_DIR, "task-workspaces");
 /** MCP support does not imply native filesystem tools or a local working directory. */
 export function supportsWorkspaceFiles(driverKind) {
-    return !["grok", "openai-compat", "minimax", "boxAgent"].includes(driverKind);
+    return !["grok", "openai-compat", "minimax", "mistral", "boxAgent"].includes(driverKind);
 }
 /** Default task files are private to the thread, outside the bot's shared
  * memory folder. This is directory organization, not a shell sandbox. */

package/dist-server/shared/approval-mode.js

@@ -21,7 +21,7 @@ export function supportsApprovalMode(driverKind, mode) {
     // engines could never stop asking — not by its own level, and not through
     // a Chief's delegated Full access either.
     return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo", "qwenAgent", "geminiAgent",
-        "openai-compat", "grok", "minimax"].includes(driverKind ?? "");
+        "openai-compat", "grok", "minimax", "mistral"].includes(driverKind ?? "");
 }
 /** A Full/Custom grant belongs to one provider's tool semantics. Other
  * modes carry across only when the destination actually implements them.