openmausbot 0.1.89 → 0.1.90

package/dist-server/server/bot-profile.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { BOT_AVATAR_CROPS, botAvatarCropSchema, botAvatarUrlSchema } from "../shared/bot-avatar.js";
+import { AVATAR_ZOOM_MAX, AVATAR_ZOOM_MIN, BOT_AVATAR_CROPS, botAvatarCropSchema, botAvatarUrlSchema, } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS, fitsOnOneLine } from "../shared/bot-profile.js";
 import { MASCOT_BODY_IDS, mascotBodySchema } from "../shared/mascot-bodies.js";
 // Shared with the package format, which checks the same rule on names it
@@ -13,6 +13,9 @@ export const BOT_PROFILE_PATCH_FIELDS = [
     "notifications",
     "avatarUrl",
     "avatarCrop",
+    "avatarZoom",
+    "avatarFocusX",
+    "avatarFocusY",
     "mascotBody",
     "voice",
     "speakReplies",
@@ -46,6 +49,9 @@ export const profilePatchSchema = z.object({
     })
         .optional(),
     avatarCrop: botAvatarCropSchema.optional(),
+    avatarZoom: z.number({ error: "avatarZoom must be a number from 1 to 3" }).finite().min(AVATAR_ZOOM_MIN).max(AVATAR_ZOOM_MAX).optional(),
+    avatarFocusX: z.number({ error: "avatarFocusX must be a number from 0 to 1" }).finite().min(0).max(1).optional(),
+    avatarFocusY: z.number({ error: "avatarFocusY must be a number from 0 to 1" }).finite().min(0).max(1).optional(),
     mascotBody: mascotBodySchema.optional(),
     voice: z
         .string({ error: "voice must be a string" })

package/dist-server/server/channel-queue.js

@@ -7,6 +7,7 @@
 // never saw.
 import { newId } from "./contracts.js";
 import { chatFollowups, saveChatFollowup, settleChatFollowups } from "./message-db.js";
+import { drainCoalesceHead, DRAIN_COALESCE_MAX_ITEMS } from "./admission.js";
 const queues = new Map(); // threadId -> waiting sends
 export function restoreChannelMessages() {
     queues.clear();
@@ -16,7 +17,14 @@ export function restoreChannelMessages() {
         const entry = queues.get(row.threadId) ?? { groupId: row.ownerId, items: [] };
         if (entry.groupId !== row.ownerId)
             throw new Error("queued task belongs to another channel");
-        entry.items.push({ ...row.payload, id: row.id, mode: row.payload.mode ?? "chat" });
+        entry.items.push({
+            ...row.payload,
+            id: row.id,
+            mode: row.payload.mode ?? "chat",
+            // rows queued before timestamps were kept read as queued at restore
+            // time: the burst was still live when the restart interrupted it
+            queuedAt: row.payload.queuedAt ?? Date.now(),
+        });
         queues.set(row.threadId, entry);
     }
 }
@@ -33,6 +41,7 @@ export function queueChannelMessage(groupId, threadId, text, options = {}) {
         via: options.via,
         sender: options.sender,
         trigger: options.trigger,
+        queuedAt: Date.now(),
     };
     saveChatFollowup({ id: item.id, kind: "channel", ownerId: groupId, threadId, payload: item });
     entry.items.push(item);
@@ -66,10 +75,11 @@ export function cancelChannelMessage(groupId, queueId) {
 /** Atomically lift a channel thread's whole queue out for a live steer. The
  * entry leaves first so a room that settles while the adapter is still
  * thinking can never also drain the same words as a follow-up turn. Only
- * the HEAD can be lifted: the success path steers and settles items[0], so
- * a request naming a later item must not lift the queue at all (it would
- * steer and delete a different message's words). The caller must either
- * restore the held queue or settle its head. */
+ * the HEAD can be lifted (the chip the UI offers Steer on): the success
+ * path steers and settles the head GROUP — the leading coalesced run — as
+ * one, so a request naming a later item must not lift the queue at all (it
+ * would steer and delete words the requester did not name). The caller must
+ * either restore the held queue or settle its head group. */
 export function holdChannelQueue(groupId, threadId, queueId) {
     const entry = queues.get(threadId);
     if (!entry || entry.groupId !== groupId || entry.items[0]?.id !== queueId)
@@ -106,11 +116,13 @@ export function resolveHeldReplyTarget(held, resolve) {
     }
 }
 /** Mark a held queue's head delivered — its words were folded into the
- * running turn — and re-queue the rest for the room's normal one-at-a-time
- * drain. A restart must not replay the steered head as a fresh follow-up. */
+ * running turn — the whole head group steers as one — and re-queue the
+ * rest for the room's one-coalesced-item-per-turn drain. A restart must
+ * not replay the steered words as a fresh follow-up. */
 export function settleHeldChannelQueueHead(held) {
-    const [head, ...rest] = held.items;
-    settleChatFollowups([head.id], null);
+    const head = headChannelGroup(held.items);
+    const rest = held.items.slice(head.length);
+    settleChatFollowups(head.map((item) => item.id), null);
     if (rest.length === 0)
         return;
     const existing = queues.get(held.threadId);
@@ -122,27 +134,55 @@ export function settleHeldChannelQueueHead(held) {
     });
 }
 /**
- * Start at most one follow-up per idle channel. Starting it synchronously
- * marks the channel working again; its completion calls this drain for the
- * next item. Removing first makes repeated settle notifications harmless.
+ * Start at most one follow-up per idle channel: the leading coalesced
+ * group — one sender's contiguous in-window burst — runs as ONE item.
+ * Starting it synchronously marks the channel working again; its completion
+ * calls this drain for the next group. Removing first makes repeated settle
+ * notifications harmless.
  */
 export function drainChannelMessages(isWorking, run) {
     for (const [threadId, entry] of queues) {
         if (isWorking(entry.groupId))
             continue;
-        const item = entry.items[0];
-        if (!item) {
+        if (entry.items.length === 0) {
             queues.delete(threadId);
             continue;
         }
-        settleChatFollowups([item.id], "dispatching");
-        entry.items.shift();
+        const group = headChannelGroup(entry.items);
+        const ids = group.map((item) => item.id);
+        settleChatFollowups(ids, "dispatching");
+        entry.items.splice(0, group.length);
         if (entry.items.length === 0)
             queues.delete(threadId);
-        const running = run({ ...item, groupId: entry.groupId, threadId });
-        void Promise.resolve(running).then(() => settleChatFollowups([item.id], null), () => settleChatFollowups([item.id], "interrupted")).catch((error) => console.warn("channel-queue: could not settle durable follow-up", error));
+        const running = run({ groupId: entry.groupId, threadId, items: group });
+        void Promise.resolve(running).then(() => settleChatFollowups(ids, null), () => settleChatFollowups(ids, "interrupted")).catch((error) => console.warn("channel-queue: could not settle durable follow-up", error));
     }
 }
+/** The leading run of queued room messages that drain as one item: same
+ * sender, same provenance shape, each within the coalescing window of the
+ * one before it, bounded at the room-context window — a room turn reads
+ * the burst through that window, so a longer run would append lines the
+ * responder never sees; the excess stays queued for the next turn. Manual
+ * head-steer folds and settles exactly this group into the live turn. */
+export function headChannelGroup(items) {
+    return drainCoalesceHead(items, coalesceIdentity, (item) => item.queuedAt, DRAIN_COALESCE_MAX_ITEMS);
+}
+/** A queued room message's coalescing identity: WHO sent it, with the
+ * provenance shape as part of the identity. A person's texts merge only
+ * with that same person's; an API send has no person behind it, so it never
+ * merges with anything, and neither does a goal (its coordinator routing
+ * is per-send). Unattributed local sends (the loopback owner typing in the
+ * room composer) are one identity — the transcript already names them all
+ * the same. */
+function coalesceIdentity(item) {
+    if (item.via === "api")
+        return `api:${item.id}`;
+    if (item.mode !== "chat")
+        return `mode:${item.mode}:${item.id}`;
+    if (item.sender)
+        return `person:${item.sender.id ?? item.sender.name}`;
+    return "person:local";
+}
 /** Test helper. */
 export function _queuedChannelCount(threadId) {
     return queues.get(threadId)?.items.length ?? 0;

package/dist-server/server/checkpoints.js

@@ -10,8 +10,8 @@
 //
 // Restore is redo-friendly on purpose: it commits a safety point, then moves
 // the index and work tree back with `git restore --source` + `git clean -fd`
-// while HEAD stays put — so the state that was just replaced is itself a
-// checkpoint, and "undo the undo" is one more restore. Ignored/excluded files
+// while HEAD keeps the safety point — so the state just replaced is the one
+// retained checkpoint, and "undo the undo" is one more restore. Ignored/excluded files
 // (node_modules, .env, media) are never snapshotted and never removed by one.
 //
 // Failure policy: checkpointing is best-effort convenience, never load-bearing.
@@ -25,7 +25,7 @@
 // service, and the snapshot-before-every-turn cadence follows Cline.
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join, parse, resolve } from "node:path";
 import { DATA_DIR } from "./config.js";
@@ -119,8 +119,9 @@ Thumbs.db
 *.gguf
 `;
 // gpgsign off: the user's global config may demand signing, and a shadow
-// commit must never block on a passphrase prompt. gc off: background gc in
-// a repo we treat as disposable only risks lock contention with snapshots.
+// commit must never block on a passphrase prompt. Automatic GC stays off:
+// explicit GC runs inside the same serialization as snapshot/restore, after
+// their source objects are no longer needed.
 const GITCONFIG = "[commit]\n\tgpgsign = false\n[core]\n\tautocrlf = false\n[gc]\n\tauto = 0\n";
 /** One failed git call disables checkpoints for that bot until restart —
  * a broken shadow repo must cost the user one log line, not a failed turn. */
@@ -261,6 +262,28 @@ async function ensureShadow(cwd, env, shadow, signal) {
     }
     mkdirSync(join(shadow, ".git", "info"), { recursive: true });
     writeFileSync(join(shadow, ".git", "info", "exclude"), EXCLUDES);
+    // Cargo and other tools can put caches outside conventional target/ or
+    // build/ paths. Honor the standard tag even for previously indexed caches.
+    const tags = (await runGit(["ls-files", "--cached", "--others", "--exclude-standard", "-z", "--", "**/CACHEDIR.TAG"], cwd, env, signal)).split("\0");
+    const cachePatterns = new Set();
+    for (const tag of tags) {
+        if (!tag.includes("/") || /[\r\n]/.test(tag))
+            continue;
+        try {
+            const path = join(cwd, tag);
+            const stat = lstatSync(path);
+            if (!stat.isFile() || stat.size > 4096)
+                continue;
+            if (!readFileSync(path, "utf8").startsWith("Signature: 8a477f597d28d172789f06886806bc55"))
+                continue;
+            const directory = tag.slice(0, -"CACHEDIR.TAG".length);
+            cachePatterns.add("/" + directory.replace(/[\\*?[\]#! ]/g, "\\$&"));
+        }
+        catch {
+            // A disappearing/unreadable tag is not evidence that a path is a cache.
+        }
+    }
+    writeFileSync(join(shadow, ".git", "info", "exclude"), EXCLUDES + [...cachePatterns].join("\n") + "\n");
     try {
         await runGit(["rev-parse", "--verify", "HEAD"], cwd, env, signal);
     }
@@ -269,23 +292,43 @@ async function ensureShadow(cwd, env, shadow, signal) {
         await runGit(["commit", "--no-verify", "--allow-empty", "-m", "checkpoint base"], cwd, env, signal);
     }
 }
-/** Stage everything and commit if anything actually changed. `complete`
- * records whether every path was indexable: ordinary snapshots may keep the
- * useful subset, but restore must not delete files its safety point missed. */
+/** Capture fully before advancing HEAD. A partial add must never replace
+ * the last usable checkpoint or authorize removal of its objects. */
 async function commitAll(cwd, env, label, signal) {
-    // --ignore-errors skips files git cannot index (unreadable, FIFOs) instead
-    // of aborting — but still exits 1 when it skipped an unreadable file, so
-    // the exit code is retained even though a partial snapshot remains useful.
-    // Restore treats an incomplete safety point as a hard stop before touching
-    // the work tree.
-    let complete = true;
-    await runGit(["add", "-A", "--ignore-errors", "."], cwd, env, signal).catch(() => {
-        complete = false;
-    });
-    if (await hasStagedChanges(cwd, env, signal)) {
-        await runGit(["commit", "--no-verify", "-m", label], cwd, env, signal);
+    const previous = (await runGit(["rev-parse", "HEAD"], cwd, env, signal)).trim();
+    try {
+        // Rebuild only the shadow index so newly ignored/cache-tagged files stop
+        // pinning old blobs; no user index or work-tree file is changed.
+        await runGit(["read-tree", "--empty"], cwd, env, signal);
+        await runGit(["add", "-A", "--ignore-errors", "."], cwd, env, signal);
+    }
+    catch {
+        return { hash: previous, complete: false };
+    }
+    const changed = await hasStagedChanges(cwd, env, signal);
+    const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
+    const count = (await runGit(["rev-list", "--count", "HEAD"], cwd, env, signal)).trim();
+    if (!changed && Number(count) <= 2)
+        return { hash: previous, complete: true };
+    const tree = (await runGit(["write-tree"], cwd, env, signal)).trim();
+    const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
+    // Parent only the empty marker, never the previous snapshot: keeping the
+    // previous commit as an ancestor would retain every old tree indefinitely.
+    const hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
+    await runGit(["update-ref", "HEAD", hash, previous], cwd, env, signal);
+    return { hash, complete: true };
+}
+async function collectObsolete(cwd, env) {
+    // No caller may still need the previous tree. In particular, restore runs
+    // this only AFTER using its source; the safety checkpoint stays reachable.
+    try {
+        await runGit(["reflog", "expire", "--expire=now", "--all"], cwd, env);
+        await runGit(["gc", "--prune=now", "--quiet"], cwd, env);
+    }
+    catch {
+        // A busy/full disk must not hide an otherwise usable restore point.
+        console.warn("checkpoint cleanup deferred; the latest restore point is preserved");
     }
-    return { hash: (await runGit(["rev-parse", "HEAD"], cwd, env, signal)).trim(), complete };
 }
 /** Snapshot the folder. Returns the checkpoint hash, or null when the
  * feature is off for this bot, git is missing, or the folder is refused.
@@ -305,7 +348,11 @@ export async function snapshot(botId, cwd, label, signal) {
         return await serialize(shadow, async () => {
             const env = gitEnv(shadow, worktree);
             await ensureShadow(worktree, env, shadow, signal);
-            return (await commitAll(worktree, env, label, signal)).hash;
+            const result = await commitAll(worktree, env, label, signal);
+            if (!result.complete)
+                return null;
+            await collectObsolete(worktree, env);
+            return result.hash;
         });
     }
     catch (e) {
@@ -314,45 +361,42 @@ export async function snapshot(botId, cwd, label, signal) {
         return null;
     }
 }
-/** Paths that differ between two checkpoints of the same bot+folder, from
- * `git diff --name-status` against the shadow repo. Null when the hashes
- * are equal, the folder is refused or checkpoints are off, or git fails —
- * the digest then simply omits its file list. Never throws (turn path). */
-export async function diffStat(botId, cwd, fromHash, toHash, signal) {
-    if (signal?.aborted)
+/** Diff the settled workspace without replacing its pre-turn restore point.
+ * Staging is confined to the shadow index; the user's files and Git are untouched. */
+export async function diffWorkingTree(botId, cwd, fromHash, signal) {
+    if (signal?.aborted || !COMMIT_HASH.test(fromHash))
         return null;
-    if (fromHash === toHash)
-        return null;
-    if (disabledBots.has(botId))
-        return null;
-    if (!(await gitAvailable()))
-        return null;
-    if (refusalReason(cwd) !== null)
+    if (disabledBots.has(botId) || !(await gitAvailable()) || refusalReason(cwd) !== null)
         return null;
     try {
         const worktree = realpathSync(resolve(cwd));
         const shadow = shadowDir(botId, worktree);
         const env = gitEnv(shadow, worktree);
-        const out = await serialize(shadow, () => runGit(["diff", "--name-status", "--no-renames", "-z", fromHash, toHash], worktree, env, signal));
-        const diff = { changed: [], added: [], deleted: [] };
-        const fields = out.split("\0").filter((field) => field.length > 0);
-        for (let i = 0; i + 1 < fields.length; i += 2) {
-            const status = fields[i];
-            const path = fields[i + 1];
-            if (status.startsWith("A"))
-                diff.added.push(path);
-            else if (status.startsWith("D"))
-                diff.deleted.push(path);
-            else
-                diff.changed.push(path);
-        }
-        return diff;
+        return await serialize(shadow, async () => {
+            await ensureShadow(worktree, env, shadow, signal);
+            await runGit(["read-tree", "--empty"], worktree, env, signal);
+            await runGit(["add", "-A", "--ignore-errors", "."], worktree, env, signal);
+            const out = await runGit(["diff", "--cached", "--name-status", "--no-renames", "-z", fromHash], worktree, env, signal);
+            const diff = { changed: [], added: [], deleted: [] };
+            const fields = out.split("\0").filter((field) => field.length > 0);
+            for (let i = 0; i + 1 < fields.length; i += 2) {
+                const status = fields[i];
+                const path = fields[i + 1];
+                if (status.startsWith("A"))
+                    diff.added.push(path);
+                else if (status.startsWith("D"))
+                    diff.deleted.push(path);
+                else
+                    diff.changed.push(path);
+            }
+            return diff;
+        });
     }
     catch {
         return null;
     }
 }
-/** Every checkpoint for this bot+folder, newest first. Empty when nothing
+/** The latest usable checkpoint (plus legacy history until the next snapshot). Empty when nothing
  * was ever snapshotted (listing never creates the shadow repo). The empty
  * base marker is omitted — it is not a state anyone should return to. */
 export async function listCheckpoints(botId, cwd) {
@@ -422,6 +466,7 @@ export async function restore(botId, cwd, hash) {
             if (base === hash)
                 return { ok: false, error: "that is the empty base marker, not a checkpoint" };
             // safety point: whatever is about to be overwritten becomes restorable
+            await ensureShadow(worktree, env, shadow);
             const safety = await commitAll(worktree, env, "before restore");
             if (!safety.complete) {
                 return {
@@ -439,9 +484,10 @@ export async function restore(botId, cwd, hash) {
             // (unreadable files, add races) — never ignored/excluded files (no -x).
             await runGit(["restore", "--source", hash, "--staged", "--worktree", "--", "."], worktree, env);
             await runGit(["clean", "-fd"], worktree, env);
-            // record the post-restore state (also re-syncs the index with the
-            // deletions restore made), so the timeline shows the rollback
-            await commitAll(worktree, env, `restored ${hash.slice(0, 8)}`);
+            // Retain the pre-restore safety point, not another copy of the state
+            // now on disk. Reset only the shadow index so it cannot pin old blobs.
+            await runGit(["read-tree", "HEAD"], worktree, env);
+            await collectObsolete(worktree, env);
             return { ok: true };
         });
     }

package/dist-server/server/claim-idle.js

@@ -0,0 +1,33 @@
+/** Quiet-window policy for releasing a held seat while its turn lives.
+ *
+ * The policy is deliberately synchronous and clock-injected: like the
+ * claim map it serves, expiry is evaluated when a claim is touched
+ * (claim, blocker, owns) rather than by a timer, so the server's single
+ * thread decides every transition and tests pin time exactly. Slice
+ * #1655 reuses this window math for its own idle release; keep this
+ * module free of server imports. */
+/** Default quiet window: no screen activity for this long releases the seat. */
+export const COMPUTER_CLAIM_QUIET_MS = 90_000;
+/** Default reclaim window: the previous holder re-claims directly for this long. */
+export const COMPUTER_CLAIM_RECLAIM_MS = 10 * 60_000;
+export class IdleReleasePolicy {
+    quietMs;
+    reclaimMs;
+    constructor(quietMs = COMPUTER_CLAIM_QUIET_MS, reclaimMs = COMPUTER_CLAIM_RECLAIM_MS) {
+        if (!Number.isFinite(quietMs) || quietMs <= 0)
+            throw new Error("Idle release quiet window must be positive");
+        if (!Number.isFinite(reclaimMs) || reclaimMs <= 0)
+            throw new Error("Idle release reclaim window must be positive");
+        this.quietMs = quietMs;
+        this.reclaimMs = reclaimMs;
+    }
+    /** True once the seat has been quiet for the full window. Screen-poller
+     * frames never refresh the activity clock, so they cannot keep a seat. */
+    quietElapsed(lastActivityAt, now) {
+        return now - lastActivityAt >= this.quietMs;
+    }
+    /** True while a released seat's previous holder still re-claims directly. */
+    reclaimLive(releasedAt, now) {
+        return now < releasedAt + this.reclaimMs;
+    }
+}

package/dist-server/server/cloud-backend.js

@@ -1,6 +1,6 @@
 export const CLOUD_BACKEND_CHANGE_ERROR = "stop the active turn before changing the cloud backend";
 export const VPS_ALIAS_CHANGE_ERROR = "stop the active VPS turn before changing the SSH config alias";
-export const BOX_ACCOUNT_RESOURCES_ERROR = "remove this installation's cloud computers before changing or clearing the Box account";
+export const BOAT_ACCOUNT_RESOURCES_ERROR = "remove this installation's cloud computers before changing or clearing the Boat account";
 export const VPS_ALIAS_RESOURCES_ERROR = "remove this installation's VPS computers before changing or clearing the SSH config alias";
 export function cloudBackendChangeError(botBusy, activeVpsThread) {
     return botBusy || activeVpsThread ? CLOUD_BACKEND_CHANGE_ERROR : null;
@@ -8,14 +8,14 @@ export function cloudBackendChangeError(botBusy, activeVpsThread) {
 export function vpsAliasChangeError(currentAlias, nextAlias, activeVpsThread) {
     return activeVpsThread && currentAlias !== nextAlias ? VPS_ALIAS_CHANGE_ERROR : null;
 }
-/** An old Box account may be detached only when it owns no local resources.
+/** An old Boat account may be detached only when it owns no local resources.
  * Token rotation is safe when the replacement credential proves access to
  * the exact same provider identities. */
-export function boxAccountResourceChangeError(current, replacement) {
+export function boatAccountResourceChangeError(current, replacement) {
     if (current.length === 0)
         return null;
     if (!replacement || replacement.length !== current.length)
-        return BOX_ACCOUNT_RESOURCES_ERROR;
+        return BOAT_ACCOUNT_RESOURCES_ERROR;
     const identities = (rows) => rows
         .map(({ boxId, name }) => `${boxId}\u0000${name}`)
         .sort();
@@ -23,7 +23,7 @@ export function boxAccountResourceChangeError(current, replacement) {
     const replacementIdentities = identities(replacement);
     return currentIdentities.every((identity, index) => identity === replacementIdentities[index])
         ? null
-        : BOX_ACCOUNT_RESOURCES_ERROR;
+        : BOAT_ACCOUNT_RESOURCES_ERROR;
 }
 export function vpsAliasResourceChangeError(instanceCount) {
     return instanceCount > 0 ? VPS_ALIAS_RESOURCES_ERROR : null;

package/dist-server/server/cloud-home-start.js

@@ -0,0 +1,103 @@
+// Entry point of the OMB Cloud Pro home image (deploy/fly/Dockerfile).
+//
+// Starts as root only to hand a fresh Fly volume (mounted root-owned at
+// /data) to the unprivileged `maus` user, then drops privileges for good
+// and runs two children: the OpenMausBot server on 127.0.0.1:8799 (and its
+// webhook receiver on :8800) and the Caddy edge on 0.0.0.0:8080. The edge is
+// the only listener the network can reach, and it always forwards with
+// X-Forwarded-*, so request-auth.ts never grants a remote request loopback
+// trust. If either child exits, both stop and the machine restarts.
+import { spawn } from "node:child_process";
+import { chownSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { cloudHomeConfiguration, cloudHomeHost, prepareCloudHomeVolume, withoutIgnoredCloudKeys } from "./cloud-home.js";
+const SERVICE_USER = "maus";
+/** uid/gid from /etc/passwd; Node has no getpwnam. */
+export function passwdIds(passwd, name) {
+    for (const line of passwd.split("\n")) {
+        const [user, , uid, gid] = line.split(":");
+        if (user === name && /^\d+$/.test(uid ?? "") && /^\d+$/.test(gid ?? ""))
+            return { uid: Number(uid), gid: Number(gid) };
+    }
+    return null;
+}
+/** The server child's environment: the operator's contract plus fixed
+ * ports and paths (Linux paths inside the image, so POSIX joins on every
+ * host that builds them, tests included), never a platform gateway's settings. The edge child gets
+ * only what it needs to route. */
+export function cloudHomeChildEnvironments(config, env, home) {
+    const server = {
+        ...withoutIgnoredCloudKeys(env), HOME: home, OMB_DATA_DIR: env.OMB_DATA_DIR || posix.join(home, ".openmausbot"),
+        OMB_PORT: "8799", OMB_WEBHOOK_PORT: "8800", OMB_PUBLIC_URL: config.publicOrigin,
+        OMB_WEBHOOK_PUBLIC_URL: env.OMB_WEBHOOK_PUBLIC_URL || config.publicOrigin,
+    };
+    const edge = {
+        PATH: env.PATH ?? "/usr/local/bin:/usr/bin:/bin", HOME: "/tmp/omb-edge",
+        XDG_DATA_HOME: "/tmp/omb-edge/data", XDG_CONFIG_HOME: "/tmp/omb-edge/config",
+        OMB_CLOUD_PUBLIC_HOST: cloudHomeHost(config),
+    };
+    return { server, edge };
+}
+export function startCloudHome(env = process.env) {
+    process.umask(0o077);
+    const config = cloudHomeConfiguration(env);
+    if (!config)
+        throw new Error("This image runs an OMB Cloud home machine; set its boot contract (docs/cloud-pro.md).");
+    // Logged here once: the server child never sees what they are about.
+    for (const warning of config.warnings)
+        console.warn(`cloud home: ${warning}`);
+    const home = env.HOME || "/data";
+    if (process.getuid?.() === 0) {
+        const ids = passwdIds(readFileSync("/etc/passwd", "utf8"), SERVICE_USER);
+        if (!ids)
+            throw new Error(`The ${SERVICE_USER} user is missing from this image.`);
+        // A new volume is a root-owned mount point. Only the mount point itself
+        // changes owner; anything inside keeps the owner it already has.
+        const stat = statSync(home);
+        if (stat.uid !== ids.uid || stat.gid !== ids.gid)
+            chownSync(home, ids.uid, ids.gid);
+        process.setgroups?.([]);
+        process.setgid(ids.gid);
+        process.setuid(ids.uid);
+    }
+    if (process.getuid?.() === 0)
+        throw new Error("The Cloud home must run as an unprivileged user.");
+    prepareCloudHomeVolume(home, config.machineId);
+    const here = dirname(fileURLToPath(import.meta.url));
+    const { server, edge } = cloudHomeChildEnvironments(config, env, home);
+    const children = [];
+    let stopping = false;
+    const stop = (failed) => {
+        if (stopping)
+            return;
+        stopping = true;
+        process.exitCode = failed ? 1 : 0;
+        for (const child of children)
+            if (child.exitCode === null)
+                child.kill("SIGTERM");
+        const force = setTimeout(() => { for (const child of children)
+            if (child.exitCode === null)
+                child.kill("SIGKILL"); }, 20_000);
+        force.unref();
+    };
+    const run = (command, args, childEnv) => {
+        const child = spawn(command, args, { env: childEnv, stdio: "inherit" });
+        children.push(child);
+        child.once("error", () => stop(true));
+        child.once("exit", () => stop(true));
+    };
+    run(process.execPath, [join(here, "index.js")], server);
+    run(env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy", ["run", "--config", env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile", "--adapter", "caddyfile"], edge);
+    process.once("SIGTERM", () => stop(false));
+    process.once("SIGINT", () => stop(false));
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+    try {
+        startCloudHome();
+    }
+    catch (error) {
+        console.error(`Cloud home startup failed: ${error instanceof Error ? error.message : String(error)}`);
+        process.exitCode = 1;
+    }
+}