openmausbot 0.1.88 → 0.1.90

package/dist-server/server/config.js

@@ -13,6 +13,7 @@ import { isModelVariant } from "./contracts.js";
 import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-icon.js";
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
+import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -87,7 +88,8 @@ const roomConfigSchema = z.object({
         .min(MIN_ROOM_TURN_TIMEOUT_MINUTES)
         .max(MAX_ROOM_TURN_TIMEOUT_MINUTES),
     /** Room handoff tree lifetime. Active execution pauses this clock; the
-     * hard cap is wall-clock and bounds trees that never stop executing. */
+     * hard cap is the maximum stall window, measured wall-clock from the
+     * tree's last durable progress. */
     handoffLifetimeMinutes: z.number().int().min(1).max(MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
     handoffMinRunwayMinutes: z.number().int().min(1).max(MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
     handoffHardCapMinutes: z.number().int().min(1).max(7 * MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
@@ -95,8 +97,14 @@ const roomConfigSchema = z.object({
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) &&
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) <=
         (rooms.handoffHardCapMinutes ?? DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES), { message: "rooms handoff bounds must satisfy handoffMinRunwayMinutes <= handoffLifetimeMinutes <= handoffHardCapMinutes" });
+/** Isolation for bot desktops. Migration note (issue #1654): switching
+ * modes changes lease keys and vm-home directories, so desktops cold-start
+ * under the new mode — a pool seat lives in vm-homes/pool-N — while the old
+ * mode's workspaces stay on disk until removed. maxInstances caps per-bot
+ * desktops in per-bot mode, or the pool's seat count in pool mode; it is
+ * not a total across modes. Default stays "shared". */
 const localVmConfigSchema = z.object({
-    mode: z.enum(["shared", "per-bot"]).optional(),
+    mode: z.enum(["shared", "per-bot", "pool"]).optional(),
     maxInstances: z
         .number()
         .int()
@@ -247,6 +255,10 @@ const featureConfigSchema = z.object({
     skillAuthoring: z.boolean().optional(),
     /** Show each tool run in the transcript. Off unless explicitly enabled. */
     showToolCalls: z.boolean().optional(),
+    /** Run a routine inside the conversation it reports to, instead of a hidden
+     * thread. Off unless explicitly enabled. The run still starts from its own
+     * instructions, but the messages stay in that chat. */
+    routinesInConversation: z.boolean().optional(),
     /** Experimental built-in browser. Off until explicitly enabled; each bot
      * also has its own switch. */
     browser: z.boolean().optional(),
@@ -260,8 +272,23 @@ const featureConfigSchema = z.object({
     claudeUserMcp: z.boolean().optional(),
     /** LLM-generated titles for new bot threads. Off until explicitly
      * enabled; a one-shot that fails or answers junk leaves the first-message
-     * snippet in place — see llmThreadTitlesEnabled. */
+    * snippet in place — see llmThreadTitlesEnabled. */
     llmThreadTitles: z.boolean().optional(),
+    /** Before each turn, passages from the bot's own memory files and earlier
+     * conversations that share words with the message ride into the turn.
+     * Read-only; on unless explicitly switched off — see autoRecallEnabled. */
+    autoRecall: z.boolean().optional(),
+    /** Idle release for computer claims (#1653): a desktop seat that stays
+     * screen-quiet for 90 seconds is released to waiting turns while its
+     * holder's turn still lives; the previous holder re-claims directly
+     * for 10 minutes and yields to an occupied seat. Off until baked; see
+     * computerClaimIdleReleaseEnabled for how to enable it by hand. */
+    computerClaimIdleRelease: z.boolean().optional(),
+    /** Consented cloud overflow for local computer waits (#1655): a wait
+     * may offer a per-second-billed cloud seat, but only through an explicit
+     * consent card or a configured allowlist — never a silent Auto default.
+     * Off until baked; see cloudOverflowEnabled for how to enable it by hand. */
+    cloudOverflow: z.boolean().optional(),
 });
 /** First-run progress. Kept in the workspace config rather than a browser so
  * it survives cleared site data and is shared by every paired client. Hint
@@ -295,6 +322,10 @@ const defaultModelSelectionSchema = z.object({
     effort: z.enum(EFFORT_LEVELS).optional(),
     variant: z.string().refine(isModelVariant, "invalid model variant").optional(),
 }).refine((selection) => selection.variant === undefined || selection.effort === undefined, "choose either a model variant or an effort level");
+const automaticRecoverySchema = z.object({
+    enabled: z.boolean(),
+    backup: defaultModelSelectionSchema.optional(),
+}).strict().refine((recovery) => !recovery.enabled || recovery.backup !== undefined, { message: "Choose a backup model before enabling automatic recovery", path: ["backup"] });
 const threadsConfigSchema = z.object({
     maxConcurrentPerBot: z.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS),
     /** Cap each per-thread events/ and native/ NDJSON log at this many
@@ -327,6 +358,7 @@ const appConfigSchema = z.object({
      * addresses or `@domain` entries; admins get every scope, members chat only. */
     signIn: z.object({ admins: z.array(z.string().max(320)).max(500).optional(), members: z.array(z.string().max(320)).max(5000).optional() }).optional(),
     defaultModelSelection: defaultModelSelectionSchema.optional(),
+    automaticRecovery: automaticRecoverySchema.optional(),
     newBotDefaults: newBotDefaultsSchema.optional(),
     newBots: newBotsConfigSchema.optional(),
     /** CLI-only launch preferences. Never enable remote access implicitly. */
@@ -371,6 +403,8 @@ const appConfigSchema = z.object({
     /** Project key used for Sessions, catalog and agent tools. userId/sessionId
      * are non-secret local identifiers used to reuse one Composio Session. */
     composio: z.object({ apiKey: optionalText, userId: optionalText, sessionId: optionalText }).optional(),
+    /** Historical config section name "box" (the persisted config.json key); the
+     * provider is Boat now and the key is kept for compatibility. */
     box: z.object({ token: optionalText }).optional(),
     vps: vpsConfigSchema.optional(),
     /** Optional OpenCode key; persisted write-only and passed only to its child. */
@@ -424,10 +458,26 @@ const appConfigSchema = z.object({
         compactAt: z.number().positive().max(10_000_000).optional(),
         autoCompact: z.boolean().optional(),
     }).optional(),
+    /** Memory upkeep timing, for bots with Memory upkeep switched on. */
+    memory: z.object({
+        /** Quiet time after a turn before its facts are captured (ms). */
+        captureQuietMs: z.number().int().min(1_000).max(24 * 60 * 60_000).optional(),
+        /** Local hour (0-23) after which the nightly tidy-up runs. */
+        tidyHour: z.number().int().min(0).max(23).optional(),
+    }).strict().optional(),
     threads: threadsConfigSchema.optional(),
     /** The authorization decision log (server/decision-log.ts): days of month
      * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
     decisions: z.object({ retentionDays: z.number().int().min(1).max(3650).optional() }).strict().optional(),
+    /** #1655 cloud-overflow settings. perSecondCostUsd is the operator's own
+     * verified rate: with no price configured the feature stays inert rather
+     * than show an invented one. allowlistedThreads carries standing consent
+     * for exact thread ids. */
+    cloudOverflow: z.object({
+        perSecondCostUsd: z.number().positive().max(10).optional(),
+        idleStopMs: z.number().int().positive().max(24 * 60 * 60_000).optional(),
+        allowlistedThreads: z.array(z.string().min(1)).max(1000).optional(),
+    }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     onboarding: onboardingConfigSchema.optional(),
@@ -536,8 +586,9 @@ export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
 /** Room handoff tree budgets in milliseconds. The tree lifetime pauses
- * while a node is actively executing; the hard cap is wall-clock and bounds
- * trees that never stop. Read when the server starts. */
+ * while a node is actively executing; the hard cap is the maximum stall
+ * window, measured wall-clock from the tree's last durable progress. Read
+ * when the server starts. */
 export function roomHandoffLimits(cfg) {
     return {
         lifetimeMs: (cfg.rooms?.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) * 60_000,
@@ -573,9 +624,26 @@ export function localVmMaxInstances(cfg) {
 export function skillAuthoringEnabled(cfg) {
     return cfg.features?.skillAuthoring !== false;
 }
+/** Automatic recall is read-only, so it is on unless switched off. */
+export function autoRecallEnabled(cfg) {
+    return cfg.features?.autoRecall !== false;
+}
+export const DEFAULT_CAPTURE_QUIET_MS = 2 * 60_000;
+export const DEFAULT_TIDY_HOUR = 3;
+export function captureQuietMs(cfg) {
+    return cfg.memory?.captureQuietMs ?? DEFAULT_CAPTURE_QUIET_MS;
+}
+export function tidyHour(cfg) {
+    return cfg.memory?.tidyHour ?? DEFAULT_TIDY_HOUR;
+}
 export function showToolCallsEnabled(cfg) {
     return cfg.features?.showToolCalls === true;
 }
+/** A routine's turns are posted in the conversation that receives its card.
+ * Off by default, so scheduled work stays in a hidden thread. */
+export function routinesInConversationEnabled(cfg) {
+    return cfg.features?.routinesInConversation === true;
+}
 /** Workspace-level gate for the experimental built-in browser. A bot's own
  * switch sits under it, so either can withhold the browser. */
 export function builtInBrowserEnabled(cfg) {
@@ -609,6 +677,43 @@ export function claudeUserMcpEnabled(cfg) {
 export function llmThreadTitlesEnabled(cfg) {
     return cfg.features?.llmThreadTitles === true;
 }
+/** Idle release for computer claims (#1653): a whole-turn desktop hold
+ * ends after a screen-quiet window (default 90 seconds, screen-poller
+ * frames excluded) instead of at turn settle, and the previous holder
+ * re-claims directly inside a reclaim window (default 10 minutes) while
+ * yielding to a seat another turn already holds. Off unless an explicit
+ * `true` — bake it as a maintainer-only flag first, exactly like
+ * sharedComputers: enable by hand in ~/.openmausbot/config.json
+ * (`{"features": {"computerClaimIdleRelease": true}}`) and restart. */
+export function computerClaimIdleReleaseEnabled(cfg) {
+    return cfg.features?.computerClaimIdleRelease === true;
+}
+/** Consented cloud overflow for local computer waits (#1655): while a turn
+ * waits for a local desktop, it may offer overflow to a per-second-billed
+ * cloud seat — never silently: the card names the cost, and only an
+ * explicit per-conversation consent or a configured allowlist thread may
+ * start the machine, which then hard-stops after an idle window. Off
+ * unless an explicit `true`, like computerClaimIdleRelease: enable by
+ * hand in ~/.openmausbot/config.json
+ * (`{"features": {"cloudOverflow": true}, "cloudOverflow": {"perSecondCostUsd": 0.0004}}`)
+ * and restart. */
+export function cloudOverflowEnabled(cfg) {
+    return cfg.features?.cloudOverflow === true;
+}
+/** The per-second rate shown on the card, or null when the operator has
+ * not set one: the offer fails closed rather than guess a price. */
+export function cloudOverflowPerSecondCostUsd(cfg) {
+    const cost = cfg.cloudOverflow?.perSecondCostUsd;
+    return typeof cost === "number" && Number.isFinite(cost) && cost > 0 ? cost : null;
+}
+/** How long a cloud seat may stay screen-quiet before it is stopped. */
+export function cloudOverflowIdleStopMs(cfg) {
+    return cfg.cloudOverflow?.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
+}
+/** Threads with standing consent, by exact thread id. */
+export function cloudOverflowAllowlistedThreads(cfg) {
+    return new Set(cfg.cloudOverflow?.allowlistedThreads ?? []);
+}
 /** Config sections no provider driver reads. A write that touches only
  * these must not rebuild the fleet: rebuilding disposes every engine child
  * and reloads it, seconds of work that would also interrupt in-flight
@@ -622,9 +727,12 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     "vps",
     "rooms",
     "threads",
+    "automaticRecovery",
     "context",
+    "memory",
     "localVm",
     "features",
+    "cloudOverflow",
     "browserProfiles",
     "onboarding",
 ]);
@@ -746,6 +854,7 @@ export function loadConfig() {
     cfg.composio = { ...cfg.composio };
     if (process.env.COMPOSIO_API_KEY !== undefined)
         cfg.composio.apiKey = process.env.COMPOSIO_API_KEY;
+    // BOX_TOKEN keeps its historical name; the provider is Boat.
     cfg.box = { ...cfg.box };
     if (process.env.BOX_TOKEN !== undefined)
         cfg.box.token = process.env.BOX_TOKEN;
@@ -755,6 +864,11 @@ export function loadConfig() {
     cfg.tts = { ...cfg.tts };
     if (process.env.OMB_TTS_KEY !== undefined)
         cfg.tts.key = process.env.OMB_TTS_KEY;
+    // A preset ElevenLabs voice (Cloud Pro sets one) is only a default: a voice or
+    // another speech provider the person picked in Settings always wins.
+    const presetVoice = process.env.OMB_TTS_DEFAULT_VOICE?.trim();
+    if (presetVoice && !cfg.tts.voice?.trim() && (cfg.tts.provider ?? "elevenlabs") === "elevenlabs")
+        cfg.tts.voice = presetVoice;
     if (process.env.OMB_FISH_AUDIO_API_KEY !== undefined)
         cfg.tts.fishKey = process.env.OMB_FISH_AUDIO_API_KEY;
     cfg.imageGen = { ...cfg.imageGen };
@@ -923,7 +1037,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -953,6 +1067,9 @@ export function saveConfig(patch, options = {}) {
         disk.customDomain = checkedPatch.customDomain;
     if (checkedPatch.signIn !== undefined)
         disk.signIn = checkedPatch.signIn;
+    // Replace the section so clearing a backup cannot revive the old selection.
+    if (checkedPatch.automaticRecovery !== undefined)
+        disk.automaticRecovery = checkedPatch.automaticRecovery;
     // A selection is replaced as one value, so changing engines also clears
     // an effort level omitted from the new selection.
     if (checkedPatch.defaultModelSelection !== undefined) {
@@ -1129,6 +1246,7 @@ function injectedEnvironment(cfg, driver) {
         environment.set("OPENAI_COMPAT_API_KEY", cfg.openaiCompat.key);
     if (driver === "openai-compat" && cfg.openaiCompat?.url)
         environment.set("OPENAI_COMPAT_URL", cfg.openaiCompat.url);
+    // driverKind "boxAgent" and env BOX_TOKEN keep their historical names.
     if (driver === "boxAgent" && cfg.box?.token)
         environment.set("BOX_TOKEN", cfg.box.token);
     if (driver === "opencodeGo" && cfg.opencodeGo?.apiKey)

package/dist-server/server/container-computer.js

@@ -7,6 +7,7 @@
 // typing, screenshots, accessibility, or window discovery.
 import { execFile } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
+import { lstatSync } from "node:fs";
 import { chmod, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -68,6 +69,28 @@ export function perBotLocalVmTarget(botId) {
         label: digest,
     };
 }
+/** A pool-mode seat (issue #1654): one of N desktops shared by every
+ * conversation, addressed by seat index. Identities stay disjoint from the
+ * shared singleton and from per-bot digests, so discovery, labels, and lease
+ * lanes never confuse the three modes. */
+export function poolLocalVmTarget(seat) {
+    return {
+        key: `pool:${seat}`,
+        containerName: `${CONTAINER}-p${seat}`,
+        workspaceDir: join(DATA_DIR, "vm-homes", `pool-${seat}`),
+        viewerPort: null,
+        label: `pool-${seat}`,
+    };
+}
+/** Only provisioning creates this durable directory; idle removal keeps it. */
+export function localVmWorkspaceExists(target) {
+    try {
+        return lstatSync(target.workspaceDir, { throwIfNoEntry: false })?.isDirectory() === true;
+    }
+    catch {
+        return false;
+    }
+}
 const LINUX_WHEELS = {
     x86_64: {
         url: "https://files.pythonhosted.org/packages/fa/d7/a43008a328a40c85e7bc706fc20235b9abedc75e28b413817655153157ff/cua_driver-0.20.0-py3-none-manylinux_2_31_x86_64.whl",

package/dist-server/server/contracts.js

@@ -12,6 +12,16 @@ export class ProviderError extends Error {
         this.code = code;
     }
 }
+/** The driver proved this attempt never reached a prompt or client-side action,
+ * and its owned process has stopped. The harness may safely recover it. */
+export class TurnNotStartedError extends Error {
+    turnId;
+    constructor(turnId, message) {
+        super(message);
+        this.name = "TurnNotStartedError";
+        this.turnId = turnId;
+    }
+}
 /** Variants are opaque provider IDs, not the cross-engine effort enum. */
 export function isModelVariant(value) {
     return typeof value === "string" && value.length > 0 && value.length <= 256 &&

package/dist-server/server/control-client.js

@@ -1,8 +1,8 @@
 // The proxy-side half of computer control. The harness keeps the record of
 // who is driving (server/computer-control.ts); the per-turn computer
 // processes consult it through this client before acting, because the
-// action paths themselves never traverse the harness — a box click goes
-// straight to the box's REST API, and a Local VM / VPS click rides a
+// action paths themselves never traverse the harness — a boat click goes
+// straight to the boat's REST API, and a Local VM / VPS click rides a
 // transparent stdio bridge into Cua Driver.
 //
 // Failure posture: CLOSED once configured. A missing/expired turn capability

package/dist-server/server/delegations.js

@@ -259,8 +259,10 @@ export function pendingDelegationSnapshot() {
     })));
 }
 /** How many handoffs one turn may queue. Small on purpose: this is the only
- * thing standing between a confused bot and a fan-out of real turns. */
-const MAX_QUEUED_PER_THREAD = 4;
+ * thing standing between a confused bot and a fan-out of real turns. Six,
+ * not four: a lead running a weekly check-in over a five-member team is the
+ * ordinary case, and hitting the cap there silently dropped one teammate. */
+const MAX_QUEUED_PER_THREAD = 6;
 /** Validate and enqueue a delegation. Pushes a "Delegated to @B: reason"
  * chip to the source thread so the user can see what was queued. */
 export function queueDelegation(bus, from, item, maxDepth, sourceThreadId = from.threadId) {
@@ -838,7 +840,13 @@ export function buildDelegationFailurePrompt(targetName, reason) {
         "Take over: tell the user what failed in plain terms, then decide the next step — retry with a narrower task, do the work yourself, or propose an alternative. Do not re-delegate the exact same task unchanged.",
     ].join("\n\n");
 }
-export const DELEGATION_WAKE_MAX_PER_WINDOW = 3;
+// Must not be smaller than MAX_QUEUED_PER_THREAD: every delegate reply is
+// one wake, so a fan-out that the queue cap allows has to be resumable
+// within the window. Three failed a five-member weekly check-in whose
+// replies all landed inside four minutes ("Delegation follow-up limit
+// reached"), while the same routine passed a week earlier only because the
+// replies happened to spread over twenty.
+export const DELEGATION_WAKE_MAX_PER_WINDOW = 6;
 export const DELEGATION_WAKE_WINDOW_MS = 5 * 60 * 1000;
 /** Bounded auto-wake budget per source thread. A delegation completion
  * wakes the source; if that source re-delegates and the new completion