openmausbot 0.1.89 → 0.1.91

package/dist-server/permission-proxy.js

@@ -5,7 +5,7 @@ import { randomUUID } from "node:crypto";
 // shared/ask-question.ts
 var MAX_QUESTIONS = 6;
 var MAX_OPTIONS = 12;
-var MAX_QUESTION_TEXT = 400;
+var MAX_QUESTION_TEXT = 8e3;
 var MAX_LABEL = 120;
 var MAX_DESCRIPTION = 400;
 var MAX_CUSTOM_ANSWER = 2e3;

package/dist-server/server/admission.js

@@ -7,6 +7,52 @@
 // gather state, call admit(), and apply the returned decision with their own
 // side effects. Anything that can settle a turn (an awaited steer, a slow
 // disk) belongs to the caller, which re-reads state and asks again.
+// ── L2: ordering and batching on drain ─────────────────────────────────
+// M2's drain rule: a sender's CONTIGUOUS burst inside a short window is one
+// item; senders never merge, and a pause past the window reads as separate
+// messages. The window is measured between consecutive queued items, so a
+// rolling burst stays whole while hours-apart texts split.
+/** How late one queued text may follow the previous one and still join the
+ * same drained turn. Two minutes covers a person typing a burst in pieces;
+ * anything slower is already a separate thought, not a continuation. */
+export const DRAIN_COALESCE_WINDOW_MS = 120_000;
+/** The most items one drained head group may carry. Room turns read the
+ * transcript through the room-context window (its last N messages), so a
+ * group larger than that window would append lines the responder never
+ * sees; the excess stays queued and drains with the next turn instead.
+ * The 1:1 drain carries every group item in its prompt directly, so it
+ * passes no cap. */
+export const DRAIN_COALESCE_MAX_ITEMS = 30;
+/** The leading run of queued items that drain together: consecutive items
+ * with the same merge identity, each arriving within the coalescing window
+ * of the one before it. Pure and shape-agnostic — each queue supplies its
+ * own identity (sender + provenance kind) and timestamp accessors, and the
+ * first item always drains, so an empty identity never strands a queue.
+ * `maxItems`, when given, stops the group before it outgrows a bound the
+ * consuming turn can actually carry. */
+export function drainCoalesceHead(items, identityOf, queuedAtOf, maxItems) {
+    const head = [];
+    let previousIdentity;
+    let previousAt;
+    for (const item of items) {
+        if (maxItems !== undefined && head.length >= maxItems)
+            break;
+        const identity = identityOf(item);
+        const at = queuedAtOf(item);
+        // The gap must be non-negative AND inside the window: a regressed
+        // timestamp (clock skew, a rewritten row) is not "within the window".
+        const gap = at - (previousAt ?? at);
+        if (head.length === 0 || (identity === previousIdentity && gap >= 0 && gap <= DRAIN_COALESCE_WINDOW_MS)) {
+            head.push(item);
+        }
+        else {
+            break;
+        }
+        previousIdentity = identity;
+        previousAt = at;
+    }
+    return head;
+}
 /** The shared admission decision. Pure: same surface, message, and state
  * always return the same decision, with no side effects. */
 export function admit(surface, message = {}, state = {}) {

package/dist-server/server/{box-create-idempotency.js → boat-create-idempotency.js}

@@ -3,6 +3,7 @@ import { linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "no
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
+// Persisted journal filenames keep their historical box-* names.
 const FILE = join(DATA_DIR, "box-create-requests.json");
 const LOCK_FILE = join(DATA_DIR, "box-create-requests.lock");
 const KEY_RETENTION_MS = 24 * 60 * 60 * 1_000;
@@ -12,7 +13,7 @@ const LOCK_RETRY_MS = 20;
 const MAX_REAPER_GENERATIONS = 128;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 const BOT_ID = /^[A-Za-z0-9_-]{1,120}$/;
-const BOX_ID = /^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/;
+const BOAT_ID = /^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/;
 const lockWait = new Int32Array(new SharedArrayBuffer(4));
 function isRequest(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -28,12 +29,12 @@ function isRequest(value) {
         && typeof request.createdAt === "number"
         && Number.isFinite(request.createdAt)
         && request.createdAt > 0
-        && (request.boxId === undefined || (typeof request.boxId === "string" && BOX_ID.test(request.boxId)))
+        && (request.boxId === undefined || (typeof request.boxId === "string" && BOAT_ID.test(request.boxId)))
         && (request.resolved === undefined || (request.resolved === true && typeof request.boxId === "string")));
 }
 function recoveryStateError(detail, cause) {
     return Object.assign(new Error(`Cloud computer creation is paused because its recovery state is ${detail}. `
-        + "Check boat.dev for an unnamed Box before repairing OpenMausBot's local state."), { status: 503, cause });
+        + "Check boat.dev for an unnamed Boat before repairing OpenMausBot's local state."), { status: 503, cause });
 }
 function loadFresh() {
     let raw;
@@ -57,17 +58,17 @@ function loadFresh() {
     }
     const identities = new Set();
     const keys = new Set();
-    const botsWithKnownBoxes = new Set();
+    const botsWithKnownBoats = new Set();
     for (const request of file.requests) {
         const identity = `${request.botId}\0${request.requestBody}`;
         if (identities.has(identity) || keys.has(request.idempotencyKey))
             throw recoveryStateError("invalid");
-        if (request.boxId && botsWithKnownBoxes.has(request.botId))
+        if (request.boxId && botsWithKnownBoats.has(request.botId))
             throw recoveryStateError("invalid");
         identities.add(identity);
         keys.add(request.idempotencyKey);
         if (request.boxId)
-            botsWithKnownBoxes.add(request.botId);
+            botsWithKnownBoats.add(request.botId);
     }
     return file.requests.map((request) => ({ ...request }));
 }
@@ -316,9 +317,9 @@ function withJournalLock(operation) {
     }
 }
 /** Record the exact provider request before it leaves the process. A known
- * Box wins over a changed body: once a provider resource exists, recovering
+ * Boat wins over a changed body: once a provider resource exists, recovering
  * and naming it is safer than issuing any second create request. */
-export function beginBoxCreate(botId, requestBody) {
+export function beginBoatCreate(botId, requestBody) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer creation");
     if (!requestBody || requestBody.length > 1_024)
@@ -335,7 +336,7 @@ export function beginBoxCreate(botId, requestBody) {
             }
             if (now - pending.createdAt >= KEY_RETENTION_MS) {
                 // Once the provider forgets the idempotency key, retrying it (or using
-                // a new key) may create a second billable Box. Absence cannot be
+                // a new key) may create a second billable Boat. Absence cannot be
                 // inferred from a lost response, so stop for manual reconciliation.
                 throw recoveryStateError("older than boat.dev's 24-hour retry window");
             }
@@ -354,8 +355,8 @@ export function beginBoxCreate(botId, requestBody) {
     });
 }
 /** Persist the returned identity before the caller attempts to rename it. */
-export function rememberCreatedBox(request, boxId) {
-    if (!BOX_ID.test(boxId))
+export function rememberCreatedBoat(request, boxId) {
+    if (!BOAT_ID.test(boxId))
         throw new Error("boat.dev returned an invalid cloud computer id");
     return withJournalLock((requests) => {
         const current = requests.find((candidate) => (candidate.botId === request.botId
@@ -365,16 +366,16 @@ export function rememberCreatedBox(request, boxId) {
             throw recoveryStateError("out of date");
         }
         const completed = { ...current, boxId };
-        // There can be an older rejected-TTL request for this bot. Once a Box is
+        // There can be an older rejected-TTL request for this bot. Once a Boat is
         // known, it is the only recovery authority we need to retain.
         save([...requests.filter((candidate) => candidate.botId !== request.botId), completed]);
         return { ...completed };
     });
 }
 /** Mark the recovery record safe only after the deterministic provider rename
- * succeeds. Keeping the resolved Box ID still lets a later retry recover from
+ * succeeds. Keeping the resolved Boat ID still lets a later retry recover from
  * an eventually-consistent account listing without blocking bot deletion. */
-export function resolveBoxCreate(request) {
+export function resolveBoatCreate(request) {
     return withJournalLock((requests) => {
         const current = requests.find((candidate) => (candidate.botId === request.botId
             && candidate.requestBody === request.requestBody
@@ -388,8 +389,8 @@ export function resolveBoxCreate(request) {
     });
 }
 /** Read-only deletion guard. Both a key-only request with an ambiguous
- * provider outcome and a known-but-not-yet-named Box must keep its bot owner. */
-export function hasUnresolvedBoxCreate(botId) {
+ * provider outcome and a known-but-not-yet-named Boat must keep its bot owner. */
+export function hasUnresolvedBoatCreate(botId) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer creation");
     return withJournalLock((requests) => (requests.some((request) => request.botId === botId && request.resolved !== true)));
@@ -398,30 +399,30 @@ export function hasUnresolvedBoxCreate(botId) {
  * lock-protected read can prove a remembered provider id even while the
  * account-wide LIST endpoint is eventually consistent. Provider request
  * bodies and idempotency keys never cross this boundary. */
-export function boxCreateRecoverySnapshot() {
+export function boatCreateRecoverySnapshot() {
     return withJournalLock((requests) => requests.map((request) => ({
         botId: request.botId,
         ...(request.boxId ? { boxId: request.boxId } : {}),
         resolved: request.resolved === true,
     })));
 }
-/** Persist ownership discovered from a pre-journal deterministic Box name.
+/** Persist ownership discovered from a pre-journal deterministic Boat name.
  * The provider listing proves which live bot owns the exact immutable id, but
  * it must never steal an identity remembered for another bot. It supersedes
  * stale attempts for the same bot, is idempotent, and fails closed on a true
  * cross-bot conflict. */
-export function adoptResolvedBox(botId, boxId) {
+export function adoptResolvedBoat(botId, boxId) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer ownership");
-    if (!BOX_ID.test(boxId))
+    if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for ownership");
     withJournalLock((requests) => {
-        const sameBox = requests.find((request) => request.boxId === boxId);
-        if (sameBox && sameBox.botId !== botId) {
+        const sameBoat = requests.find((request) => request.boxId === boxId);
+        if (sameBoat && sameBoat.botId !== botId) {
             throw recoveryStateError("conflicted with another bot's remembered cloud computer");
         }
-        const adopted = sameBox
-            ? { ...sameBox, resolved: true }
+        const adopted = sameBoat
+            ? { ...sameBoat, resolved: true }
             : {
                 botId,
                 requestBody: JSON.stringify({ adopted: "legacy-name", boxId }),
@@ -434,19 +435,19 @@ export function adoptResolvedBox(botId, boxId) {
         if (retained.length >= MAX_REQUESTS)
             throw recoveryStateError("full");
         if (requests.filter((request) => request.botId === botId).length === 1
-            && sameBox?.resolved === true
-            && sameBox.botId === botId)
+            && sameBoat?.resolved === true
+            && sameBoat.botId === botId)
             return;
         // A successfully listed deterministic legacy name resolves any older
         // key-only/remembered attempt for this bot. Keeping those stale rows would
-        // leave deletion permanently blocked after the adopted Box is removed.
+        // leave deletion permanently blocked after the adopted Boat is removed.
         save([...retained, adopted]);
     });
 }
-/** Retire only the durable identity for a Box the provider has confirmed was
+/** Retire only the durable identity for a Boat the provider has confirmed was
  * deleted. Callers must never use this for a failed or ambiguous deletion. */
-export function retireDeletedBoxCreate(boxId) {
-    if (!BOX_ID.test(boxId))
+export function retireDeletedBoatCreate(boxId) {
+    if (!BOAT_ID.test(boxId))
         throw new Error("invalid deleted cloud computer id");
     withJournalLock((requests) => {
         const next = requests.filter((request) => request.boxId !== boxId);
@@ -454,7 +455,7 @@ export function retireDeletedBoxCreate(boxId) {
             save(next);
     });
 }
-export function discardBoxCreate(request) {
+export function discardBoatCreate(request) {
     withJournalLock((requests) => {
         const next = requests.filter((candidate) => candidate.idempotencyKey !== request.idempotencyKey);
         if (next.length !== requests.length)

package/dist-server/server/{box-delete-journal.js → boat-delete-journal.js}

@@ -3,6 +3,7 @@ import { linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "no
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
+// Persisted journal filenames keep their historical box-* names.
 const FILE = join(DATA_DIR, "box-delete-requests.json");
 const LOCK_FILE = join(DATA_DIR, "box-delete-requests.lock");
 const MAX_RECORDS = 4_096;
@@ -11,7 +12,7 @@ const LOCK_RETRY_MS = 20;
 const MAX_REAPER_GENERATIONS = 128;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 const BOT_ID = /^[A-Za-z0-9_-]{1,120}$/;
-const BOX_ID = /^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/;
+const BOAT_ID = /^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/;
 const OPERATION_ID = /^bdop_[a-f0-9]{32}$/;
 const PROVIDER_STATUSES = new Set(["pending", "processing", "blocked", "completed"]);
 const lockWait = new Int32Array(new SharedArrayBuffer(4));
@@ -29,7 +30,7 @@ function isRecord(value) {
         return false;
     const record = value;
     if (typeof record.boxId !== "string"
-        || !BOX_ID.test(record.boxId)
+        || !BOAT_ID.test(record.boxId)
         || !validName(record.name)
         || !(record.ownerBotId === null || (typeof record.ownerBotId === "string" && BOT_ID.test(record.ownerBotId)))
         || !["prepared", "accepted", "blocked"].includes(record.phase)
@@ -49,7 +50,7 @@ function isRecord(value) {
 }
 function stateError(detail, cause) {
     return Object.assign(new Error(`Cloud computer deletion is paused because its recovery state is ${detail}. `
-        + "Check the Box provider before repairing OpenMausBot's local state."), { status: 503, cause });
+        + "Check the Boat provider before repairing OpenMausBot's local state."), { status: 503, cause });
 }
 function clone(record) {
     return { ...record };
@@ -76,12 +77,12 @@ function loadFresh() {
         || journal.records.length > MAX_RECORDS
         || !journal.records.every(isRecord))
         throw stateError("invalid");
-    const boxIds = new Set();
+    const boatIds = new Set();
     const operationIds = new Set();
     for (const record of journal.records) {
-        if (boxIds.has(record.boxId))
+        if (boatIds.has(record.boxId))
             throw stateError("invalid");
-        boxIds.add(record.boxId);
+        boatIds.add(record.boxId);
         if (record.operationId) {
             if (operationIds.has(record.operationId))
                 throw stateError("invalid");
@@ -319,7 +320,7 @@ function withJournalLock(operation) {
     }
 }
 function validateIdentity(identity) {
-    if (!BOX_ID.test(identity.boxId))
+    if (!BOAT_ID.test(identity.boxId))
         throw new Error("invalid cloud computer id for deletion");
     if (!validName(identity.name))
         throw new Error("invalid cloud computer name for deletion");
@@ -344,7 +345,7 @@ function parseOperation(boxId, value, expectedStatus) {
 }
 /** Write the immutable target before sending DELETE to the provider. Existing
  * in-flight work wins; a blocked operation may be explicitly retried. */
-export function prepareBoxDeletion(identity) {
+export function prepareBoatDeletion(identity) {
     validateIdentity(identity);
     return withJournalLock((records) => {
         const existing = records.find((record) => record.boxId === identity.boxId);
@@ -368,14 +369,14 @@ export function prepareBoxDeletion(identity) {
         return clone(prepared);
     });
 }
-/** Bind a provider receipt to the exact immutable Box target. A caller cannot
- * accidentally attach another Box's operation to this deletion fence. */
-export function markBoxDeletionAccepted(boxId, value) {
-    if (!BOX_ID.test(boxId))
+/** Bind a provider receipt to the exact immutable Boat target. A caller cannot
+ * accidentally attach another Boat's operation to this deletion fence. */
+export function markBoatDeletionAccepted(boxId, value) {
+    if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for deletion");
     const operation = parseOperation(boxId, value);
     if (operation.status === "blocked") {
-        throw new Error("blocked cloud computer deletion must use markBoxDeletionBlocked");
+        throw new Error("blocked cloud computer deletion must use markBoatDeletionBlocked");
     }
     const acceptedStatus = operation.status;
     return withJournalLock((records) => {
@@ -412,8 +413,8 @@ export function markBoxDeletionAccepted(boxId, value) {
 /** Record an explicit provider block without discarding the target. The
  * target remains fenced from normal use; only a deliberate deletion retry
  * may prepare the same immutable target again. */
-export function markBoxDeletionBlocked(boxId, value) {
-    if (!BOX_ID.test(boxId))
+export function markBoatDeletionBlocked(boxId, value) {
+    if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for deletion");
     const operation = value === undefined ? null : parseOperation(boxId, value, "blocked");
     return withJournalLock((records) => {
@@ -438,30 +439,30 @@ export function markBoxDeletionBlocked(boxId, value) {
     });
 }
 /** A fresh, lock-protected copy suitable for server reconciliation. */
-export function boxDeletionSnapshot() {
+export function boatDeletionSnapshot() {
     return withJournalLock((records) => records.map(clone));
 }
-export const listBoxDeletions = boxDeletionSnapshot;
-export function getBoxDeletion(boxId) {
-    if (!BOX_ID.test(boxId))
+export const listBoatDeletions = boatDeletionSnapshot;
+export function getBoatDeletion(boxId) {
+    if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for deletion");
     return withJournalLock((records) => {
         const record = records.find((candidate) => candidate.boxId === boxId);
         return record ? clone(record) : null;
     });
 }
-export function isBoxDeletionPending(boxId) {
-    return getBoxDeletion(boxId) !== null;
+export function isBoatDeletionPending(boxId) {
+    return getBoatDeletion(boxId) !== null;
 }
-export function hasPendingBoxDeletionForBot(botId) {
+export function hasPendingBoatDeletionForBot(botId) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer deletion");
     return withJournalLock((records) => records.some((record) => record.ownerBotId === botId));
 }
 /** Remove a record only after direct absence or a completed target-bound
- * provider operation proves the immutable Box identity is gone. */
-export function retireBoxDeletion(boxId) {
-    if (!BOX_ID.test(boxId))
+ * provider operation proves the immutable Boat identity is gone. */
+export function retireBoatDeletion(boxId) {
+    if (!BOAT_ID.test(boxId))
         throw new Error("invalid deleted cloud computer id");
     withJournalLock((records) => {
         const next = records.filter((record) => record.boxId !== boxId);