openmausbot 0.1.89 → 0.1.91

package/dist-server/server/{box.js → boat.js}

@@ -1,11 +1,11 @@
-// Box (boat.dev) provider — the bot's cloud computer. Ported from
+// Boat (boat.dev) provider — the bot's cloud computer. Ported from
 // agentcal-api src/providers/box.js, reshaped per-bot instead of
-// per-customer: every bot gets one persistent box (deterministic name),
+// per-customer: every bot gets one persistent boat (deterministic name),
 // stop pauses billing while the disk survives, and Join always mints a
 // FRESH desktop URL (stream tokens rotate on every state change — never
 // persist one).
 //
-// Substrate facts (probed by agentcal 2026-07-24 on a live box):
+// Substrate facts (probed by agentcal 2026-07-24 on a live boat):
 //   - REST only: POST /boxes/{id}/commands runs shell synchronously.
 //   - stop→archived ~5s, resume→idle ~8s; disk persists, tmux does not.
 //   - X11 desktop with Chrome + Ghostty; passwordless sudo; node 24.
@@ -13,12 +13,13 @@
 import { createHash } from "node:crypto";
 import { DATA_DIR } from "./config.js";
 import { loadEnvironmentId } from "./environment.js";
-import { adoptResolvedBox, beginBoxCreate, boxCreateRecoverySnapshot, discardBoxCreate, rememberCreatedBox, resolveBoxCreate, retireDeletedBoxCreate, } from "./box-create-idempotency.js";
-import { boxDeletionSnapshot, getBoxDeletion, hasPendingBoxDeletionForBot, markBoxDeletionAccepted, markBoxDeletionBlocked, prepareBoxDeletion, retireBoxDeletion, } from "./box-delete-journal.js";
+import { boatCredential, boatProviderApi } from "./included-services.js";
+import { adoptResolvedBoat, beginBoatCreate, boatCreateRecoverySnapshot, discardBoatCreate, rememberCreatedBoat, resolveBoatCreate, retireDeletedBoatCreate, } from "./boat-create-idempotency.js";
+import { boatDeletionSnapshot, getBoatDeletion, hasPendingBoatDeletionForBot, markBoatDeletionAccepted, markBoatDeletionBlocked, prepareBoatDeletion, retireBoatDeletion, } from "./boat-delete-journal.js";
 const shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
 export const MAX_REMOTE_COMMAND_LENGTH = 4_000;
 /** Run an owner-supplied console command without inheriting provider or
- * account credentials from the box's environment. */
+ * account credentials from the boat's environment. */
 export function isolatedRemoteCommand(command) {
     return [
         "exec env -i",
@@ -34,24 +35,24 @@ export function isolatedRemoteCommand(command) {
         shellQuote(command),
     ].join(" ");
 }
-// overridable so tests can point at a stub instead of the live provider
-const BOX_API = process.env.OMB_BOX_API || "https://ascii.dev/api/box/v1";
+// Boat's provider surface keeps its historical Box-era names: env OMB_BOX_API,
+// base path /api/box/v1, REST paths /boxes/*, and the box_ token prefix.
 const READY = new Set(["idle", "ready", "running"]);
 const SLEEPING = new Set(["archived", "archiving", "stopped", "stopping"]);
-const DEFAULT_BOX_TTL_SECONDS = 8 * 60 * 60;
-const TRIAL_BOX_TTL_SECONDS = 2 * 60 * 60;
-const BOX_CREATE_IN_PROGRESS_RETRY_DELAYS_MS = [250, 750, 1_500];
-const BOX_DELETE_OPERATION_POLL_DELAYS_MS = [0, 100, 250, 500, 1_000, 2_000];
-const BOX_INVENTORY_PAGE_SIZE = 200;
-// Current self-serve accounts top out below 2,000 boxes. Keep the walk
+const DEFAULT_BOAT_TTL_SECONDS = 8 * 60 * 60;
+const TRIAL_BOAT_TTL_SECONDS = 2 * 60 * 60;
+const BOAT_CREATE_IN_PROGRESS_RETRY_DELAYS_MS = [250, 750, 1_500];
+const BOAT_DELETE_OPERATION_POLL_DELAYS_MS = [0, 100, 250, 500, 1_000, 2_000];
+const BOAT_INVENTORY_PAGE_SIZE = 200;
+// Current self-serve accounts top out below 2,000 boats. Keep the walk
 // bounded anyway: a broken or adversarial cursor must not hold Settings open.
-const MAX_BOX_INVENTORY_PAGES = 10;
-const LEGACY_MANAGED_BOX_NAME = /^ogb-[a-z0-9]{1,8}-[a-f0-9]{6}$/;
-const SCOPED_MANAGED_BOX_NAME = /^ogb-[a-f0-9]{12}-[a-z0-9]{1,8}-[a-f0-9]{6}$/;
-const BOX_ID = /^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/;
-const BOX_DELETE_OPERATION_ID = /^bdop_[a-f0-9]{32}$/;
-const BOX_DELETE_OPERATION_STATES = new Set(["pending", "processing", "blocked", "completed"]);
-const BOX_STATES = new Set([
+const MAX_BOAT_INVENTORY_PAGES = 10;
+const LEGACY_MANAGED_BOAT_NAME = /^ogb-[a-z0-9]{1,8}-[a-f0-9]{6}$/;
+const SCOPED_MANAGED_BOAT_NAME = /^ogb-[a-f0-9]{12}-[a-z0-9]{1,8}-[a-f0-9]{6}$/;
+const BOAT_ID = /^bx_[23456789abcdefghjkmnpqrstuvwxyz]{8}$/;
+const BOAT_DELETE_OPERATION_ID = /^bdop_[a-f0-9]{32}$/;
+const BOAT_DELETE_OPERATION_STATES = new Set(["pending", "processing", "blocked", "completed"]);
+const BOAT_STATES = new Set([
     "init",
     "idle",
     "ready",
@@ -68,26 +69,26 @@ const BOX_STATES = new Set([
     "error",
 ]);
 // Provider listings are account-wide. Hash the durable local environment id
-// into every new name so another OpenMausBot installation using the same Box
+// into every new name so another OpenMausBot installation using the same Boat
 // account cannot mistake this installation's computers for abandoned ones.
 // The environment UUID itself never leaves the local data directory.
-let scopedBoxPrefixCache = null;
+let scopedBoatPrefixCache = null;
 /** Resolve only after server startup has migrated the legacy data directory
  * and acquired its writer lease. A static-import side effect here used to
  * create the new directory too early and suppress that migration. */
-function scopedBoxPrefix() {
-    if (scopedBoxPrefixCache)
-        return scopedBoxPrefixCache;
+function scopedBoatPrefix() {
+    if (scopedBoatPrefixCache)
+        return scopedBoatPrefixCache;
     const scope = createHash("sha256")
         .update(loadEnvironmentId(DATA_DIR))
         .digest("hex")
         .slice(0, 12);
-    scopedBoxPrefixCache = `ogb-${scope}-`;
-    return scopedBoxPrefixCache;
+    scopedBoatPrefixCache = `ogb-${scope}-`;
+    return scopedBoatPrefixCache;
 }
-/** Decide lifecycle work before a turn mounts Box. Auto may observe and
- * attach an already-ready Box, but only explicit Cloud may create or wake. */
-export function boxTurnLifecycleAction({ explicitCloud, canMount, state, }) {
+/** Decide lifecycle work before a turn mounts Boat. Auto may observe and
+ * attach an already-ready Boat, but only explicit Cloud may create or wake. */
+export function boatTurnLifecycleAction({ explicitCloud, canMount, state, }) {
     if (!canMount)
         return "none";
     if (state && READY.has(state))
@@ -99,60 +100,64 @@ export function boxTurnLifecycleAction({ explicitCloud, canMount, state, }) {
 /** Keep one provider account for the whole logical operation. Settings may
  * replace the shared config object after an async request has started; every
  * follow-up (rename, readiness, cleanup, etc.) must keep using the credential
- * that selected or created the Box in the first place. */
-function snapshotBoxConfig(cfg) {
+ * that selected or created the Boat in the first place. */
+function snapshotBoatConfig(cfg) {
     return { box: cfg.box ? { token: cfg.box.token } : undefined };
 }
-function boxFetch(cfg, path, opts = {}) {
-    return fetch(`${BOX_API}${path}`, {
+/** The base URL follows the credential in use (included-services.ts): an own
+ * token goes to Boat (OMB_BOX_API points it at a stub in tests), Cloud Pro's
+ * included token only to its relay. */
+function boatFetch(cfg, path, opts = {}) {
+    const account = boatAccount(cfg);
+    return fetch(`${account?.api ?? boatProviderApi()}${path}`, {
         ...opts,
         headers: {
-            authorization: `Bearer ${cfg.box?.token}`,
+            authorization: `Bearer ${account?.token}`,
             "content-type": "application/json",
             ...opts.headers,
         },
     });
 }
-async function boxJson(cfg, path, opts = {}) {
-    const res = await boxFetch(cfg, path, opts);
+async function boatJson(cfg, path, opts = {}) {
+    const res = await boatFetch(cfg, path, opts);
     const body = await res.json().catch(() => null);
     return { ok: res.ok && body?.ok !== false, status: res.status, body };
 }
 /** Accept only the immutable identity fields needed to follow a delete. Any
- * malformed success envelope falls back to a direct Box read instead of
+ * malformed success envelope falls back to a direct Boat read instead of
  * authorizing journal retirement. */
-function boxDeletionOperation(body, boxId, expectedOperationId) {
+function boatDeletionOperation(body, boxId, expectedOperationId) {
     const operation = body?.operation;
     const id = typeof operation?.id === "string" ? operation.id : "";
     const status = typeof operation?.status === "string" ? operation.status : "";
-    if (!BOX_DELETE_OPERATION_ID.test(id)
+    if (!BOAT_DELETE_OPERATION_ID.test(id)
         || (expectedOperationId !== undefined && id !== expectedOperationId)
         || operation?.kind !== "box"
         || operation?.targetId !== boxId
-        || !BOX_DELETE_OPERATION_STATES.has(status))
+        || !BOAT_DELETE_OPERATION_STATES.has(status))
         return null;
     return { id, kind: "box", targetId: boxId, status: status };
 }
 function deletionBlockedError(boxId) {
     return Object.assign(new Error(`boat.dev accepted deletion of ${boxId}, but the deletion operation is blocked — check boat.dev and retry`), { status: 409 });
 }
-function boxDeleteProvedAbsent(result) {
+function boatDeleteProvedAbsent(result) {
     return result.status === 404 || result.status === 410;
 }
 /** Retire the create receipt before the deletion fence. If that first durable
- * write fails, the fence remains and no caller can reuse a Box whose ownership
+ * write fails, the fence remains and no caller can reuse a Boat whose ownership
  * recovery is uncertain. */
-function finishRecordedBoxDeletion(boxId) {
-    retireDeletedBoxCreate(boxId);
-    forgetBoxId(boxId);
-    retireBoxDeletion(boxId);
+function finishRecordedBoatDeletion(boxId) {
+    retireDeletedBoatCreate(boxId);
+    forgetBoatId(boxId);
+    retireBoatDeletion(boxId);
 }
 /** Reconcile one durable deletion against the exact provider operation/Box.
  * Account LIST omission is never evidence: it is eventually consistent. */
-async function reconcileRecordedBoxDeletion(cfg, initial, pollDelaysMs = []) {
+async function reconcileRecordedBoatDeletion(cfg, initial, pollDelaysMs = []) {
     let record = initial;
     if (record.phase === "accepted" && record.status === "completed") {
-        finishRecordedBoxDeletion(record.boxId);
+        finishRecordedBoatDeletion(record.boxId);
         return "confirmed";
     }
     if (record.phase === "accepted" && record.operationId) {
@@ -161,7 +166,7 @@ async function reconcileRecordedBoxDeletion(cfg, initial, pollDelaysMs = []) {
                 await new Promise((resolve) => setTimeout(resolve, delayMs));
             let polled;
             try {
-                polled = await boxJson(cfg, `/deletion-operations/${record.operationId}`, {
+                polled = await boatJson(cfg, `/deletion-operations/${record.operationId}`, {
                     signal: AbortSignal.timeout(20_000),
                 });
             }
@@ -170,27 +175,27 @@ async function reconcileRecordedBoxDeletion(cfg, initial, pollDelaysMs = []) {
             }
             if (!polled.ok)
                 break;
-            const operation = boxDeletionOperation(polled.body, record.boxId, record.operationId);
+            const operation = boatDeletionOperation(polled.body, record.boxId, record.operationId);
             if (!operation)
                 break;
             if (operation.status === "blocked") {
-                record = markBoxDeletionBlocked(record.boxId, operation);
+                record = markBoatDeletionBlocked(record.boxId, operation);
                 break;
             }
-            record = markBoxDeletionAccepted(record.boxId, operation);
+            record = markBoatDeletionAccepted(record.boxId, operation);
             if (operation.status === "completed") {
-                finishRecordedBoxDeletion(record.boxId);
+                finishRecordedBoatDeletion(record.boxId);
                 return "confirmed";
             }
         }
     }
     // A direct immutable-id 404/410 is the only alternate completion proof.
     // A live identity keeps the fence even when the operation endpoint is down.
-    const inspected = await inspectBoxIdentity(cfg, record.boxId);
+    const inspected = await inspectBoatIdentity(cfg, record.boxId);
     if (!inspected.available)
         return record.phase === "blocked" ? "blocked" : "pending";
     if (!inspected.identity) {
-        finishRecordedBoxDeletion(record.boxId);
+        finishRecordedBoatDeletion(record.boxId);
         return "confirmed";
     }
     if (inspected.identity.name !== record.name) {
@@ -201,30 +206,30 @@ async function reconcileRecordedBoxDeletion(cfg, initial, pollDelaysMs = []) {
 /** Prove that a replacement token can see every durable deletion target
  * before Settings swaps credentials. Unlike normal reconciliation, a bare
  * 404 is not completion proof here: it may simply be a different account. */
-export async function verifyBoxDeletionCredential(cfg) {
-    cfg = snapshotBoxConfig(cfg);
-    for (const initial of boxDeletionSnapshot()) {
+export async function verifyBoatDeletionCredential(cfg) {
+    cfg = snapshotBoatConfig(cfg);
+    for (const initial of boatDeletionSnapshot()) {
         let record = initial;
         let operationAuthorized = false;
         if (record.phase === "accepted" && record.operationId) {
             let polled = null;
             try {
-                polled = await boxJson(cfg, `/deletion-operations/${record.operationId}`, {
+                polled = await boatJson(cfg, `/deletion-operations/${record.operationId}`, {
                     signal: AbortSignal.timeout(20_000),
                 });
             }
             catch {
-                // The exact Box identity below can still prove account continuity.
+                // The exact Boat identity below can still prove account continuity.
             }
             if (polled?.ok) {
-                const operation = boxDeletionOperation(polled.body, record.boxId, record.operationId);
+                const operation = boatDeletionOperation(polled.body, record.boxId, record.operationId);
                 if (operation) {
                     operationAuthorized = true;
                     record = operation.status === "blocked"
-                        ? markBoxDeletionBlocked(record.boxId, operation)
-                        : markBoxDeletionAccepted(record.boxId, operation);
+                        ? markBoatDeletionBlocked(record.boxId, operation)
+                        : markBoatDeletionAccepted(record.boxId, operation);
                     if (operation.status === "completed") {
-                        finishRecordedBoxDeletion(record.boxId);
+                        finishRecordedBoatDeletion(record.boxId);
                         continue;
                     }
                 }
@@ -232,39 +237,39 @@ export async function verifyBoxDeletionCredential(cfg) {
         }
         if (operationAuthorized)
             continue;
-        const inspected = await inspectBoxIdentity(cfg, record.boxId);
+        const inspected = await inspectBoatIdentity(cfg, record.boxId);
         if (inspected.available && inspected.identity?.name === record.name)
             continue;
         if (!inspected.available) {
-            throw Object.assign(new Error(`${inspected.problem ?? "a deleting cloud computer could not be verified"}. Retry with the Box account that owns it`), { status: 503 });
+            throw Object.assign(new Error(`${inspected.problem ?? "a deleting cloud computer could not be verified"}. Retry with the Boat account that owns it`), { status: 503 });
         }
-        throw Object.assign(new Error("that Box token cannot access the cloud computers whose deletion is still being reconciled"), { status: 409 });
+        throw Object.assign(new Error("that Boat token cannot access the cloud computers whose deletion is still being reconciled"), { status: 409 });
     }
 }
 /** Bind a successful DELETE response to the durable target before polling.
  * A malformed receipt leaves the prepared fence intact. */
-async function confirmAcceptedBoxDeletion(cfg, record, acceptedBody, pollDelaysMs = BOX_DELETE_OPERATION_POLL_DELAYS_MS) {
-    const operation = boxDeletionOperation(acceptedBody, record.boxId);
+async function confirmAcceptedBoatDeletion(cfg, record, acceptedBody, pollDelaysMs = BOAT_DELETE_OPERATION_POLL_DELAYS_MS) {
+    const operation = boatDeletionOperation(acceptedBody, record.boxId);
     if (!operation) {
-        const inspected = await inspectBoxIdentity(cfg, record.boxId);
+        const inspected = await inspectBoatIdentity(cfg, record.boxId);
         if (inspected.available && !inspected.identity) {
-            finishRecordedBoxDeletion(record.boxId);
+            finishRecordedBoatDeletion(record.boxId);
             return "confirmed";
         }
         throw Object.assign(new Error(`boat.dev returned an invalid deletion receipt for ${record.boxId}; its deletion fence was kept`), { status: 503 });
     }
     const next = operation.status === "blocked"
-        ? markBoxDeletionBlocked(record.boxId, operation)
-        : markBoxDeletionAccepted(record.boxId, operation);
-    return reconcileRecordedBoxDeletion(cfg, next, pollDelaysMs);
+        ? markBoatDeletionBlocked(record.boxId, operation)
+        : markBoatDeletionAccepted(record.boxId, operation);
+    return reconcileRecordedBoatDeletion(cfg, next, pollDelaysMs);
 }
 /** Send (or explicitly retry) DELETE only after the immutable target is on
  * disk. The returned pending state always has a validated operation receipt. */
-async function requestRecordedBoxDeletion(cfg, identity, pollDelaysMs = BOX_DELETE_OPERATION_POLL_DELAYS_MS) {
-    const deletion = prepareBoxDeletion(identity);
+async function requestRecordedBoatDeletion(cfg, identity, pollDelaysMs = BOAT_DELETE_OPERATION_POLL_DELAYS_MS) {
+    const deletion = prepareBoatDeletion(identity);
     let removed;
     try {
-        removed = await boxJson(cfg, `/boxes/${identity.boxId}`, {
+        removed = await boatJson(cfg, `/boxes/${identity.boxId}`, {
             method: "DELETE",
             headers: { "X-Ascii-Confirm-Delete": identity.boxId },
         });
@@ -272,42 +277,42 @@ async function requestRecordedBoxDeletion(cfg, identity, pollDelaysMs = BOX_DELE
     catch (error) {
         throw Object.assign(new Error("Could not confirm whether boat.dev accepted the delete. The computer was kept fenced; retry Delete to reconcile it"), { status: 503, cause: error });
     }
-    if (boxDeleteProvedAbsent(removed)) {
-        finishRecordedBoxDeletion(identity.boxId);
+    if (boatDeleteProvedAbsent(removed)) {
+        finishRecordedBoatDeletion(identity.boxId);
         return "confirmed";
     }
     if (!removed.ok) {
-        markBoxDeletionBlocked(identity.boxId);
-        throw Object.assign(new Error(boxErrorMessage(removed.status, "box delete", removed.body)), { status: removed.status });
+        markBoatDeletionBlocked(identity.boxId);
+        throw Object.assign(new Error(boatErrorMessage(removed.status, "boat delete", removed.body, usesIncludedBoat(cfg))), { status: removed.status });
     }
-    const confirmation = await confirmAcceptedBoxDeletion(cfg, deletion, removed.body, pollDelaysMs);
+    const confirmation = await confirmAcceptedBoatDeletion(cfg, deletion, removed.body, pollDelaysMs);
     if (confirmation === "blocked")
         throw deletionBlockedError(identity.boxId);
     return confirmation;
 }
-function boxBotNameParts(botId) {
+function boatBotNameParts(botId) {
     const prefix = botId.slice(0, 8).toLowerCase().replace(/[^a-z0-9]/g, "") || "bot";
     const hash = createHash("sha256").update(botId).digest("hex").slice(0, 6);
     return { prefix, hash };
 }
-function legacyBoxNameFor(botId) {
-    const { prefix, hash } = boxBotNameParts(botId);
+function legacyBoatNameFor(botId) {
+    const { prefix, hash } = boatBotNameParts(botId);
     return `ogb-${prefix}-${hash}`;
 }
 // Deterministic per installation and bot. The bot hash kills truncated-id
 // collisions; the environment scope prevents cross-install ownership claims.
-export async function boxNameFor(botId) {
-    const { prefix, hash } = boxBotNameParts(botId);
-    return `${scopedBoxPrefix()}${prefix}-${hash}`;
+export async function boatNameFor(botId) {
+    const { prefix, hash } = boatBotNameParts(botId);
+    return `${scopedBoatPrefix()}${prefix}-${hash}`;
 }
 /** Credential restoration must accept both current installation-scoped names
  * and durable pre-scope names that the ownership journal may have adopted. */
-export async function boxNameMatchesBot(botId, name) {
-    return name === await boxNameFor(botId) || name === legacyBoxNameFor(botId);
+export async function boatNameMatchesBot(botId, name) {
+    return name === await boatNameFor(botId) || name === legacyBoatNameFor(botId);
 }
 export async function runCommand(cfg, boxId, command, { timeoutMs = 120_000, signal } = {}) {
-    assertBoxNotDeleting(boxId);
-    const res = await boxFetch(cfg, `/boxes/${boxId}/commands`, {
+    assertBoatNotDeleting(boxId);
+    const res = await boatFetch(cfg, `/boxes/${boxId}/commands`, {
         method: "POST",
         body: JSON.stringify({ command }),
         signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
@@ -324,13 +329,13 @@ export async function runCommand(cfg, boxId, command, { timeoutMs = 120_000, sig
 //   1) VNC (POST /desktop?vnc=1) — plain WebSocket, survives P2P-blocking
 //      networks; answers {provisioning:true} first, so poll for the URL.
 //   2) WebRTC stream (POST /desktop) as fallback — STUN-only, can hang.
-// The desktopUrl stored on the box object is NOT usable on its own.
+// The desktopUrl stored on the boat object is NOT usable on its own.
 async function mintDesktopUrl(cfg, boxId, { vncBudgetMs = 60_000 } = {}) {
-    assertBoxNotDeleting(boxId);
+    assertBoatNotDeleting(boxId);
     const t0 = Date.now();
     while (Date.now() - t0 < vncBudgetMs) {
-        assertBoxNotDeleting(boxId);
-        const { body } = await boxJson(cfg, `/boxes/${boxId}/desktop?vnc=1`, { method: "POST" });
+        assertBoatNotDeleting(boxId);
+        const { body } = await boatJson(cfg, `/boxes/${boxId}/desktop?vnc=1`, { method: "POST" });
         const url = body?.desktopUrl ?? body?.url;
         if (url)
             return url;
@@ -338,68 +343,88 @@ async function mintDesktopUrl(cfg, boxId, { vncBudgetMs = 60_000 } = {}) {
             break;
         await new Promise((r) => setTimeout(r, 3000));
     }
-    const { body } = await boxJson(cfg, `/boxes/${boxId}/desktop`, { method: "POST" });
+    const { body } = await boatJson(cfg, `/boxes/${boxId}/desktop`, { method: "POST" });
     return body?.desktopUrl ?? body?.url ?? null;
 }
 async function waitReady(cfg, boxId, budgetMs = 90_000) {
-    assertBoxNotDeleting(boxId);
+    assertBoatNotDeleting(boxId);
     const t0 = Date.now();
+    // Boat's words for the last failed resume, if the wait runs out on them.
+    let resumeFailure = null;
     while (Date.now() - t0 < budgetMs) {
-        assertBoxNotDeleting(boxId);
-        const { body } = await boxJson(cfg, `/boxes/${boxId}`);
+        assertBoatNotDeleting(boxId);
+        const { body } = await boatJson(cfg, `/boxes/${boxId}`);
         const state = body?.box?.state;
         if (READY.has(state))
             return body.box;
         if (state === "error")
             return null;
-        // an archiving box can't resume until the snapshot lands — nudge after
-        if (state === "archived")
-            await boxJson(cfg, `/boxes/${boxId}/resume`, { method: "POST" });
+        // an archiving boat can't resume until the snapshot lands — nudge after.
+        // A refusal (a plan limit, say) is final: report it now. A server error
+        // is retried on the next poll, as Boat asks; 409 is a state race with a
+        // wake already under way.
+        if (state === "archived") {
+            const resumed = await boatJson(cfg, `/boxes/${boxId}/resume`, { method: "POST" });
+            if (resumed.ok)
+                resumeFailure = null;
+            else if (resumed.status !== 409) {
+                const message = boatErrorMessage(resumed.status, "waking the cloud computer", resumed.body, usesIncludedBoat(cfg));
+                if (resumed.status < 500)
+                    throw new Error(message);
+                resumeFailure = message;
+            }
+        }
         await new Promise((r) => setTimeout(r, 2500));
     }
+    if (resumeFailure)
+        throw new Error(resumeFailure);
     return null;
 }
-// Resolving a bot's box means LISTing every box in the account, so it is
+// Resolving a bot's boat means LISTing every boat in the account, so it is
 // the most expensive thing on any hot path. The name is deterministic, so
 // once we know the id we can go straight at it — the cache is refreshed
-// whenever the direct read fails (deleted/renamed box) and always carries
+// whenever the direct read fails (deleted/renamed boat) and always carries
 // the live state so callers can still see "archived".
-const boxIdCache = new Map();
-function boxInventoryProblem(status, body) {
+const boatIdCache = new Map();
+function boatInventoryProblem(status, body, included = false) {
     if (status === 401 || status === 403) {
-        return "boat.dev rejected the Box API key — update it in Settings → Connections";
+        return included ? INCLUDED_BOAT_UNAVAILABLE : "boat.dev rejected the Boat API key — update it in Settings → Connections";
     }
     if (status === 429)
         return "boat.dev is rate-limiting this account — wait a minute and refresh";
     const message = typeof body?.message === "string" ? body.message.trim() : "";
     return message ? `boat.dev could not list cloud computers: ${message}` : `boat.dev could not list cloud computers (${status})`;
 }
-function safeBoxState(value) {
+function safeBoatState(value) {
     if (typeof value !== "string")
         return "unknown";
     const state = value.toLowerCase();
-    return BOX_STATES.has(state) ? state : "unknown";
+    return BOAT_STATES.has(state) ? state : "unknown";
 }
-async function listBoxPages(cfg) {
-    const boxes = [];
+async function listBoatPages(cfg) {
+    const boats = [];
     const seenCursors = new Set();
     let cursor = null;
-    for (let page = 0; page < MAX_BOX_INVENTORY_PAGES; page += 1) {
-        const path = `/boxes?limit=${BOX_INVENTORY_PAGE_SIZE}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`;
+    for (let page = 0; page < MAX_BOAT_INVENTORY_PAGES; page += 1) {
+        const path = `/boxes?limit=${BOAT_INVENTORY_PAGE_SIZE}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`;
         let listed;
         try {
-            listed = await boxJson(cfg, path, { signal: AbortSignal.timeout(20_000) });
+            listed = await boatJson(cfg, path, { signal: AbortSignal.timeout(20_000) });
         }
         catch {
             return { ok: false, problem: "Could not reach boat.dev to list cloud computers — check your connection and refresh" };
         }
         if (!listed.ok || !Array.isArray(listed.body?.boxes)) {
-            return { ok: false, problem: boxInventoryProblem(listed.status, listed.body), credentialRejected: listed.status === 401 || listed.status === 403 };
+            return {
+                ok: false,
+                problem: boatInventoryProblem(listed.status, listed.body, usesIncludedBoat(cfg)),
+                credentialRejected: listed.status === 401 || listed.status === 403,
+            };
         }
-        boxes.push(...listed.body.boxes);
+        boats.push(...listed.body.boxes);
         const next = listed.body?.pageInfo?.nextCursor;
         if (next === undefined || next === null || next === "")
-            return { ok: true, boxes };
+            return { ok: true, boats };
         if (typeof next !== "string" || next.length > 4_096) {
             return { ok: false, problem: "boat.dev returned an invalid cloud computer page cursor" };
         }
@@ -412,7 +437,7 @@ async function listBoxPages(cfg) {
     return { ok: false, problem: "boat.dev returned too many cloud computer pages — narrow the account inventory and refresh" };
 }
 /**
- * One account listing for Settings and deletion guards. Only boxes
+ * One account listing for Settings and deletion guards. Only boats
  * carrying OpenMausBot's exact deterministic name shape leave this boundary;
  * provider desktop links, IPs, environment details and other raw fields never
  * reach the renderer. Only names scoped to this installation may become
@@ -420,12 +445,12 @@ async function listBoxPages(cfg) {
  * ownership; foreign-install and ownerless legacy rows remain invisible and
  * therefore cannot become deletion targets.
  */
-export async function listManagedBoxes(cfg, owners, options = {}) {
-    cfg = snapshotBoxConfig(cfg);
-    if (!boxConfigured(cfg)) {
+export async function listManagedBoats(cfg, owners, options = {}) {
+    cfg = snapshotBoatConfig(cfg);
+    if (!boatConfigured(cfg)) {
         return { configured: false, available: false, problem: null, instances: [] };
     }
-    const listed = await listBoxPages(cfg);
+    const listed = await listBoatPages(cfg);
     if (!listed.ok) {
         return {
             configured: true,
@@ -436,8 +461,8 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         };
     }
     const namedOwners = await Promise.all(owners.map(async (owner) => ({
-        currentName: await boxNameFor(owner.botId),
-        legacyName: legacyBoxNameFor(owner.botId),
+        currentName: await boatNameFor(owner.botId),
+        legacyName: legacyBoatNameFor(owner.botId),
         owner,
     })));
     const invalidInventory = (problem) => ({
@@ -451,12 +476,12 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
     // authoritative direct endpoint so Settings can still display and delete
     // the computer. Credential replacement probes deliberately opt out: their
     // token must be judged only by the account inventory it can list.
-    let candidates = [...listed.boxes];
+    let candidates = [...listed.boats];
     if (options.adoptLegacy !== false) {
         const namedOwnerByBotId = new Map(namedOwners.map((entry) => [entry.owner.botId, entry]));
         let recoveries;
         try {
-            recoveries = boxCreateRecoverySnapshot();
+            recoveries = boatCreateRecoverySnapshot();
         }
         catch {
             return invalidInventory("OpenMausBot could not safely read its cloud computer recovery records");
@@ -478,14 +503,14 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
                 }
                 continue;
             }
-            const inspected = await inspectBoxIdentity(cfg, recovery.boxId);
+            const inspected = await inspectBoatIdentity(cfg, recovery.boxId);
             if (!inspected.available) {
                 return invalidInventory(inspected.problem ?? "A remembered cloud computer could not be verified");
             }
             if (!inspected.identity) {
                 // Direct 404/410 is stronger than an eventually-consistent LIST row.
                 candidates = candidates.filter((candidate) => candidate?.id !== recovery.boxId);
-                retireDeletedBoxCreate(recovery.boxId);
+                retireDeletedBoatCreate(recovery.boxId);
                 continue;
             }
             if (inspected.identity.name !== namedOwner.currentName
@@ -501,7 +526,7 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         }
         let deletions;
         try {
-            deletions = boxDeletionSnapshot();
+            deletions = boatDeletionSnapshot();
         }
         catch {
             return invalidInventory("OpenMausBot could not safely read its cloud computer deletion records");
@@ -509,7 +534,7 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         for (const deletion of deletions) {
             let state;
             try {
-                state = await reconcileRecordedBoxDeletion(cfg, deletion, [0]);
+                state = await reconcileRecordedBoatDeletion(cfg, deletion, [0]);
             }
             catch (error) {
                 return invalidInventory(error instanceof Error ? error.message : "A cloud computer deletion could not be verified");
@@ -528,13 +553,13 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
                 if (matchingRows[0]?.name !== deletion.name) {
                     return invalidInventory("A cloud computer being deleted no longer has its remembered name — repair it in boat.dev before continuing");
                 }
-                if (getBoxDeletion(deletion.boxId)?.phase === "accepted") {
+                if (getBoatDeletion(deletion.boxId)?.phase === "accepted") {
                     matchingRows[0] = { ...matchingRows[0], state: "removing" };
                     candidates = candidates.map((candidate) => candidate?.id === deletion.boxId ? matchingRows[0] : candidate);
                 }
                 continue;
             }
-            const current = getBoxDeletion(deletion.boxId);
+            const current = getBoatDeletion(deletion.boxId);
             if (!current)
                 continue;
             if (current.phase === "accepted") {
@@ -543,7 +568,7 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
             }
             // A prepared request may have lost its response, and a blocked request
             // is retryable. Keep the exact row actionable only after a direct read.
-            const inspected = await inspectBoxIdentity(cfg, current.boxId);
+            const inspected = await inspectBoatIdentity(cfg, current.boxId);
             if (!inspected.available || !inspected.identity || inspected.identity.name !== current.name) {
                 return invalidInventory(inspected.problem ?? "A cloud computer deletion target could not be verified");
             }
@@ -556,15 +581,15 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
     }
     const ownerByCurrentName = new Map(namedOwners.map(({ currentName, owner }) => [currentName, owner]));
     const ownerByLegacyName = new Map(namedOwners.map(({ legacyName, owner }) => [legacyName, owner]));
-    const boxIdCounts = new Map();
+    const boatIdCounts = new Map();
     for (const candidate of candidates) {
         if (!candidate || typeof candidate !== "object")
             continue;
         const boxId = typeof candidate.id === "string" ? candidate.id : "";
-        if (BOX_ID.test(boxId))
-            boxIdCounts.set(boxId, (boxIdCounts.get(boxId) ?? 0) + 1);
+        if (BOAT_ID.test(boxId))
+            boatIdCounts.set(boxId, (boatIdCounts.get(boxId) ?? 0) + 1);
     }
-    const ownedBoxByBot = new Map();
+    const ownedBoatByBot = new Map();
     for (const candidate of candidates) {
         if (!candidate || typeof candidate !== "object")
             continue;
@@ -573,18 +598,18 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         if (!owner)
             continue;
         const boxId = typeof candidate.id === "string" ? candidate.id : "";
-        if (!BOX_ID.test(boxId)) {
+        if (!BOAT_ID.test(boxId)) {
             return invalidInventory("boat.dev returned an invalid id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
         }
-        const existing = ownedBoxByBot.get(owner.botId);
+        const existing = ownedBoatByBot.get(owner.botId);
         if (existing && existing !== boxId) {
             return invalidInventory("boat.dev returned conflicting cloud computers for one OpenMaus bot — repair them in boat.dev before continuing");
         }
-        ownedBoxByBot.set(owner.botId, boxId);
+        ownedBoatByBot.set(owner.botId, boxId);
     }
     const instances = [];
-    const seenBoxIds = new Set();
-    const scopedPrefix = scopedBoxPrefix();
+    const seenBoatIds = new Set();
+    const scopedPrefix = scopedBoatPrefix();
     for (const candidate of candidates) {
         if (!candidate || typeof candidate !== "object")
             continue;
@@ -592,14 +617,14 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         const name = typeof candidate.name === "string" ? candidate.name : "";
         let owner = null;
         let legacyOwner = false;
-        if (SCOPED_MANAGED_BOX_NAME.test(name)) {
+        if (SCOPED_MANAGED_BOAT_NAME.test(name)) {
             // A valid OMB name for another environment is account-visible but not
             // ours to display or mutate.
             if (!name.startsWith(scopedPrefix))
                 continue;
             owner = ownerByCurrentName.get(name) ?? null;
         }
-        else if (LEGACY_MANAGED_BOX_NAME.test(name)) {
+        else if (LEGACY_MANAGED_BOAT_NAME.test(name)) {
             // Pre-scope names have no installation provenance. A live local bot is
             // the only safe ownership proof; unmatched legacy rows stay provider-
             // managed until the person handles them in boat.dev directly.
@@ -614,25 +639,25 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
         // Once a row names this installation (or a live bot through its legacy
         // deterministic name), silently skipping a malformed/duplicated identity
         // could let bot deletion mistake provider corruption for absence.
-        if (!BOX_ID.test(boxId)) {
+        if (!BOAT_ID.test(boxId)) {
             return invalidInventory("boat.dev returned an invalid id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
         }
-        if ((boxIdCounts.get(boxId) ?? 0) !== 1 || seenBoxIds.has(boxId)) {
+        if ((boatIdCounts.get(boxId) ?? 0) !== 1 || seenBoatIds.has(boxId)) {
             return invalidInventory("boat.dev returned a conflicting id for an OpenMaus-managed cloud computer — refresh or repair it in boat.dev");
         }
         if (legacyOwner && owner && options.adoptLegacy !== false) {
             try {
-                adoptResolvedBox(owner.botId, boxId);
+                adoptResolvedBoat(owner.botId, boxId);
             }
             catch {
                 return invalidInventory("OpenMausBot could not safely remember this legacy cloud computer's owner — repair it in boat.dev before continuing");
             }
         }
-        seenBoxIds.add(boxId);
+        seenBoatIds.add(boxId);
         instances.push({
             boxId,
             name,
-            state: safeBoxState(candidate.state),
+            state: safeBoatState(candidate.state),
             ownerBotId: owner?.botId ?? null,
             ownerName: owner?.name ?? null,
             orphaned: owner === null,
@@ -646,18 +671,18 @@ export async function listManagedBoxes(cfg, owners, options = {}) {
     });
     return { configured: true, available: true, problem: null, instances };
 }
-/** Direct identity proof for a Box remembered in the local create journal.
+/** Direct identity proof for a Boat remembered in the local create journal.
  * Unlike account LIST, this endpoint is not eventually consistent. Only the
  * immutable id, provider name and allowlisted lifecycle state cross this
  * boundary. */
-export async function inspectBoxIdentity(cfg, boxId) {
-    cfg = snapshotBoxConfig(cfg);
-    if (!BOX_ID.test(boxId)) {
+export async function inspectBoatIdentity(cfg, boxId) {
+    cfg = snapshotBoatConfig(cfg);
+    if (!BOAT_ID.test(boxId)) {
         return { available: false, identity: null, problem: "the remembered cloud computer id is invalid" };
     }
     let inspected;
     try {
-        inspected = await boxJson(cfg, `/boxes/${boxId}`, { signal: AbortSignal.timeout(20_000) });
+        inspected = await boatJson(cfg, `/boxes/${boxId}`, { signal: AbortSignal.timeout(20_000) });
     }
     catch {
         return {
@@ -670,7 +695,7 @@ export async function inspectBoxIdentity(cfg, boxId) {
         return { available: true, identity: null, problem: null };
     }
     if (!inspected.ok) {
-        return { available: false, identity: null, problem: boxInventoryProblem(inspected.status, inspected.body) };
+        return { available: false, identity: null, problem: boatInventoryProblem(inspected.status, inspected.body, usesIncludedBoat(cfg)) };
     }
     const candidate = inspected.body?.box;
     const returnedId = typeof candidate?.id === "string" ? candidate.id : "";
@@ -678,30 +703,30 @@ export async function inspectBoxIdentity(cfg, boxId) {
     if (returnedId !== boxId || name.length === 0 || name.length > 100 || /[\r\n]/.test(name)) {
         return { available: false, identity: null, problem: "boat.dev returned an invalid cloud computer identity" };
     }
-    return { available: true, identity: { boxId, name, state: safeBoxState(candidate.state) }, problem: null };
+    return { available: true, identity: { boxId, name, state: safeBoatState(candidate.state) }, problem: null };
 }
 function inventoryFailure(inventory) {
     const error = new Error(inventory.configured
         ? (inventory.problem ?? "Cloud computer inventory is unavailable")
-        : "Box is not configured — add its API key in Settings → Connections");
+        : "Boat is not configured — add its API key in Settings → Connections");
     error.status = inventory.configured ? 503 : 409;
     return error;
 }
 function deletionFenceError() {
     return Object.assign(new Error("this cloud computer is being deleted — wait for it to finish, or retry Delete if it needs attention"), { status: 409 });
 }
-function assertBoxNotDeleting(boxId) {
-    if (getBoxDeletion(boxId))
+function assertBoatNotDeleting(boxId) {
+    if (getBoatDeletion(boxId))
         throw deletionFenceError();
 }
-function assertBotBoxNotDeleting(botId) {
-    if (hasPendingBoxDeletionForBot(botId))
+function assertBotBoatNotDeleting(botId) {
+    if (hasPendingBoatDeletionForBot(botId))
         throw deletionFenceError();
 }
-async function revalidateManagedBox(cfg, owners, boxId) {
-    if (!BOX_ID.test(boxId))
+async function revalidateManagedBoat(cfg, owners, boxId) {
+    if (!BOAT_ID.test(boxId))
         throw Object.assign(new Error("invalid cloud computer id"), { status: 400 });
-    const inventory = await listManagedBoxes(cfg, owners);
+    const inventory = await listManagedBoats(cfg, owners);
     if (!inventory.available)
         throw inventoryFailure(inventory);
     const instance = inventory.instances.find((candidate) => candidate.boxId === boxId);
@@ -714,27 +739,28 @@ const QUIESCE_BROWSER = [
     'for name in chrome google-chrome chromium chromium-browser; do pid=$(pgrep -o -x "$name" 2>/dev/null || true); [ -z "$pid" ] || kill -TERM "$pid" 2>/dev/null || true; done',
     'for i in 1 2 3 4 5 6 7 8; do if ! pgrep -x chrome >/dev/null 2>&1 && ! pgrep -x google-chrome >/dev/null 2>&1 && ! pgrep -x chromium >/dev/null 2>&1 && ! pgrep -x chromium-browser >/dev/null 2>&1; then break; fi; sleep 0.25; done',
 ].join("; ");
-async function stopBox(cfg, boxId) {
-    assertBoxNotDeleting(boxId);
+async function stopBoat(cfg, boxId) {
+    assertBoatNotDeleting(boxId);
     // Browser shutdown is best-effort, but the provider stop is not: Settings
     // must never say a computer is sleeping when boat.dev rejected the action.
     await runCommand(cfg, boxId, QUIESCE_BROWSER, { timeoutMs: 5_000 }).catch(() => null);
-    const stopped = await boxJson(cfg, `/boxes/${boxId}/stop`, { method: "POST" });
-    if (!stopped.ok)
-        throw Object.assign(new Error(boxErrorMessage(stopped.status, "box sleep", stopped.body)), { status: stopped.status });
+    const stopped = await boatJson(cfg, `/boxes/${boxId}/stop`, { method: "POST" });
+    if (!stopped.ok) {
+        throw Object.assign(new Error(boatErrorMessage(stopped.status, "boat sleep", stopped.body, usesIncludedBoat(cfg))), { status: stopped.status });
+    }
 }
-function forgetBoxId(boxId) {
-    for (const [botId, cachedId] of boxIdCache) {
+function forgetBoatId(boxId) {
+    for (const [botId, cachedId] of boatIdCache) {
         if (cachedId === boxId)
-            boxIdCache.delete(botId);
+            boatIdCache.delete(botId);
     }
 }
 /** Explicit Settings action. Re-listing prevents a stale row from targeting a
- * renamed or foreign provider resource. This never wakes or joins a Box. */
-export async function sleepManagedBox(cfg, owners, boxId, claim) {
-    cfg = snapshotBoxConfig(cfg);
-    assertBoxNotDeleting(boxId);
-    const instance = await revalidateManagedBox(cfg, owners, boxId);
+ * renamed or foreign provider resource. This never wakes or joins a Boat. */
+export async function sleepManagedBoat(cfg, owners, boxId, claim) {
+    cfg = snapshotBoatConfig(cfg);
+    assertBoatNotDeleting(boxId);
+    const instance = await revalidateManagedBoat(cfg, owners, boxId);
     if (instance.inUse) {
         throw Object.assign(new Error("this cloud computer is in use — stop its bot's work first"), { status: 409 });
     }
@@ -744,8 +770,8 @@ export async function sleepManagedBox(cfg, owners, boxId, claim) {
     const release = claim?.(instance);
     try {
         if (!SLEEPING.has(instance.state))
-            await stopBox(cfg, instance.boxId);
-        forgetBoxId(instance.boxId);
+            await stopBoat(cfg, instance.boxId);
+        forgetBoatId(instance.boxId);
         return { ok: true };
     }
     finally {
@@ -755,23 +781,23 @@ export async function sleepManagedBox(cfg, owners, boxId, claim) {
 /** Permanent Settings action. The caller must echo the exact freshly-listed
  * machine name as well as its id; boat.dev independently requires the id in
  * its confirmation header. */
-export async function deleteManagedBox(cfg, owners, boxId, confirmName, claim, options = {}) {
-    cfg = snapshotBoxConfig(cfg);
-    const remembered = getBoxDeletion(boxId);
+export async function deleteManagedBoat(cfg, owners, boxId, confirmName, claim, options = {}) {
+    cfg = snapshotBoatConfig(cfg);
+    const remembered = getBoatDeletion(boxId);
     if (remembered) {
-        const reconciled = await reconcileRecordedBoxDeletion(cfg, remembered, [0]);
+        const reconciled = await reconcileRecordedBoatDeletion(cfg, remembered, [0]);
         if (reconciled === "confirmed")
             return { ok: true };
         // A validated accepted operation owns this target. Retrying DELETE would
         // create a second operation and weaken the only trustworthy receipt.
-        const current = getBoxDeletion(boxId);
+        const current = getBoatDeletion(boxId);
         if (current?.phase === "accepted") {
             return { ok: true, pending: true };
         }
         // Prepared (ambiguous request) and blocked records may be retried only by
         // this explicit Settings/bot-deletion path after fresh identity checks.
     }
-    const instance = await revalidateManagedBox(cfg, owners, boxId);
+    const instance = await revalidateManagedBoat(cfg, owners, boxId);
     if (instance.inUse) {
         throw Object.assign(new Error("this cloud computer is in use — stop its bot's work first"), { status: 409 });
     }
@@ -780,13 +806,13 @@ export async function deleteManagedBox(cfg, owners, boxId, confirmName, claim, o
     }
     const release = claim?.(instance);
     try {
-        const confirmation = await requestRecordedBoxDeletion(cfg, {
+        const confirmation = await requestRecordedBoatDeletion(cfg, {
             boxId: instance.boxId,
             name: instance.name,
             ownerBotId: instance.ownerBotId,
         }, options.pollDelaysMs);
         if (confirmation === "pending") {
-            forgetBoxId(instance.boxId);
+            forgetBoatId(instance.boxId);
             return { ok: true, pending: true };
         }
         return { ok: true };
@@ -795,72 +821,87 @@ export async function deleteManagedBox(cfg, owners, boxId, confirmName, claim, o
         release?.();
     }
 }
-export async function findBox(cfg, botId) {
-    cfg = snapshotBoxConfig(cfg);
-    assertBotBoxNotDeleting(botId);
-    const cachedId = boxIdCache.get(botId);
+export async function findBoat(cfg, botId) {
+    cfg = snapshotBoatConfig(cfg);
+    assertBotBoatNotDeleting(botId);
+    const cachedId = boatIdCache.get(botId);
     if (cachedId) {
         let direct = null;
         try {
-            direct = await boxJson(cfg, `/boxes/${cachedId}`);
+            direct = await boatJson(cfg, `/boxes/${cachedId}`);
         }
         catch {
             // A direct read can fail while the account listing still succeeds.
             // Fall through to the authoritative paginated lookup before deciding.
         }
-        const directBox = direct?.body?.box;
-        if (direct?.ok && directBox?.id === cachedId && directBox.state !== "error")
-            return directBox;
-        if (direct?.ok && directBox?.id !== cachedId) {
+        const directBoat = direct?.body?.box;
+        if (direct?.ok && directBoat?.id === cachedId && directBoat.state !== "error")
+            return directBoat;
+        if (direct?.ok && directBoat?.id !== cachedId) {
             throw Object.assign(new Error("boat.dev returned an invalid cloud computer identity"), { status: 503 });
         }
-        boxIdCache.delete(botId); // gone or broken — fall back to the listing
+        boatIdCache.delete(botId); // gone or broken — fall back to the listing
     }
-    const name = await boxNameFor(botId);
-    const legacyName = legacyBoxNameFor(botId);
-    const listed = await listBoxPages(cfg);
+    const name = await boatNameFor(botId);
+    const legacyName = legacyBoatNameFor(botId);
+    const listed = await listBoatPages(cfg);
     if (!listed.ok) {
         throw Object.assign(new Error(listed.problem), { status: 503 });
     }
     // Prefer the installation-scoped identity. A legacy name remains
     // discoverable only for this exact local bot id.
-    const expected = listed.boxes.filter((candidate) => candidate?.name === name || candidate?.name === legacyName);
-    if (expected.some((candidate) => !BOX_ID.test(candidate?.id))) {
+    const expected = listed.boats.filter((candidate) => candidate?.name === name || candidate?.name === legacyName);
+    if (expected.some((candidate) => !BOAT_ID.test(candidate?.id))) {
         throw Object.assign(new Error("boat.dev returned an invalid cloud computer identity"), { status: 503 });
     }
     const found = expected.find((candidate) => candidate.name === name && candidate.state !== "error")
         ?? expected.find((candidate) => candidate.name === legacyName && candidate.state !== "error")
         ?? null;
     if (found) {
-        const duplicateId = listed.boxes.filter((candidate) => candidate?.id === found.id).length !== 1;
+        const duplicateId = listed.boats.filter((candidate) => candidate?.id === found.id).length !== 1;
         if (duplicateId) {
             throw Object.assign(new Error("boat.dev returned a conflicting cloud computer identity"), { status: 503 });
         }
         if (found.name === legacyName)
-            adoptResolvedBox(botId, found.id);
-        boxIdCache.set(botId, found.id);
+            adoptResolvedBoat(botId, found.id);
+        boatIdCache.set(botId, found.id);
     }
     return found;
 }
-/** Ready-or-null without the LIST when we already know the box. */
-export async function readyBox(cfg, botId, budgetMs = 60_000) {
-    cfg = snapshotBoxConfig(cfg);
-    const box = await findBox(cfg, botId);
-    if (!box)
+/** Ready-or-null without the LIST when we already know the boat. */
+export async function readyBoat(cfg, botId, budgetMs = 60_000) {
+    cfg = snapshotBoatConfig(cfg);
+    const boat = await findBoat(cfg, botId);
+    if (!boat)
         return null;
-    if (READY.has(box.state))
-        return box;
-    return waitReady(cfg, box.id, budgetMs);
+    if (READY.has(boat.state))
+        return boat;
+    return waitReady(cfg, boat.id, budgetMs);
+}
+/** The Boat credential a request uses: the person's own token, else Cloud
+ * Pro's included one. Settings' own-key flows read cfg.box.token instead. */
+export function boatAccount(cfg) {
+    return boatCredential(cfg.box?.token);
+}
+export function boatConfigured(cfg) {
+    return Boolean(boatAccount(cfg));
+}
+function usesIncludedBoat(cfg) {
+    return boatAccount(cfg)?.included === true;
 }
-export function boxConfigured(cfg) {
-    return Boolean(cfg.box?.token);
+/** What Settings shows: configured-or-not, and whether that is Cloud Pro's
+ * included account rather than a saved key. Never the token. */
+export function describeBoatAccount(cfg) {
+    const account = boatAccount(cfg);
+    return { configured: Boolean(account), ...(account?.included ? { included: true } : {}) };
 }
 /** Ask the provider whether a token is real, before we let someone save
  * it. Without this the paste "succeeds", and the first sign of trouble is
- * a 401 in a different panel minutes later, with nothing to act on. */
+ * a 401 in a different panel minutes later, with nothing to act on. Only
+ * ever an own token, so only ever Boat itself. */
 export async function verifyToken(token) {
     try {
-        const res = await fetch(`${BOX_API}/boxes`, {
+        const res = await fetch(`${boatProviderApi()}/boxes`, {
             headers: { authorization: `Bearer ${token}` },
             signal: AbortSignal.timeout(20_000),
         });
@@ -868,7 +909,7 @@ export async function verifyToken(token) {
             return { ok: true };
         if (res.status === 401 || res.status === 403) {
             // the common mistake is pasting some other credential entirely —
-            // box API keys are prefixed, so say which thing is wrong
+            // boat API keys are prefixed, so say which thing is wrong
             return {
                 ok: false,
                 message: token.startsWith("box_")
@@ -882,18 +923,24 @@ export async function verifyToken(token) {
         return { ok: false, message: "Couldn't reach boat.dev to check that token — check your connection and retry." };
     }
 }
+/** A rejected Cloud Pro relay token: nothing the person pasted, so nothing
+ * for them to fix in Settings. */
+const INCLUDED_BOAT_UNAVAILABLE = "Cloud Pro's included cloud computers aren't available right now. Try again later.";
 /** Turn a provider refusal into something a person can act on. The
  * provider's own message is better than anything we can invent — it knows
  * the plan, the limit and the link — so prefer it and only fall back to
- * our own wording when it says nothing useful. */
-export function boxErrorMessage(status, what, body) {
+ * our own wording when it says nothing useful. `included`: the request used
+ * Cloud Pro's included token, not the person's own. */
+export function boatErrorMessage(status, what, body, included = false) {
     const theirs = typeof body?.message === "string" ? body.message.trim() : "";
     const link = typeof body?.error?.details?.billingUrl === "string" ? body.error.details.billingUrl : "";
     if (status === 402) {
-        // e.g. "Start the $20/month Box plan to create sandboxes."
-        return [theirs || "boat.dev needs a paid Box plan before it will create a computer.", link].filter(Boolean).join(" ");
+        // e.g. "Start the $20/month Boat plan to create sandboxes."
+        return [theirs || "boat.dev needs a paid Boat plan before it will create a computer.", link].filter(Boolean).join(" ");
     }
     if (status === 401 || status === 403) {
+        if (included)
+            return INCLUDED_BOAT_UNAVAILABLE;
         return "your box token was rejected by boat.dev — open App Settings and paste a current token (it starts with box_)";
     }
     if (status === 429) {
@@ -905,26 +952,26 @@ export function boxErrorMessage(status, what, body) {
  * structured `trial_auto_stop_required` refusal. Retry that one condition
  * once at the provider's advertised maximum (or the documented two-hour
  * trial ceiling). Other create failures must retain their original error. */
-function trialBoxTtlSeconds(body) {
+function trialBoatTtlSeconds(body) {
     const code = body?.error?.code ?? body?.code;
     if (code !== "trial_auto_stop_required")
         return null;
     const details = body?.error?.details ?? body?.details ?? {};
     for (const value of [details.maxTtlSeconds, details.maximumTtlSeconds, details.maxAutoStopSeconds]) {
-        if (Number.isInteger(value) && value > 0 && value <= DEFAULT_BOX_TTL_SECONDS)
+        if (Number.isInteger(value) && value > 0 && value <= DEFAULT_BOAT_TTL_SECONDS)
             return value;
     }
-    return TRIAL_BOX_TTL_SECONDS;
+    return TRIAL_BOAT_TTL_SECONDS;
 }
 function idempotentCreateInProgress(result) {
     const code = result.body?.error?.code ?? result.body?.code;
     return result.status === 409 && code === "idempotency_in_progress";
 }
 /** The keys this OpenMausBot already holds, as the environment its bots'
- * agents read on the box. The box is created with `noEnv: true`, so the
- * boat.dev account's own logins never land in the guest: the box has exactly
- * these and nothing else (see "Whose keys" in the Box integrated-agents docs). */
-export function boxCredentialEnv(cfg, env = process.env) {
+ * agents read on the boat. The boat is created with `noEnv: true`, so the
+ * boat.dev account's own logins never land in the guest: the boat has exactly
+ * these and nothing else (see "Whose keys" in the Boat integrated-agents docs). */
+export function boatCredentialEnv(cfg, env = process.env) {
     const out = {};
     const put = (name, value) => {
         if (typeof value === "string" && value.trim())
@@ -933,13 +980,13 @@ export function boxCredentialEnv(cfg, env = process.env) {
     // The workspace key only: an ANTHROPIC_API_KEY in the server's own env is
     // never the workspace key (see loadConfig), so it is not forwarded either.
     put("ANTHROPIC_API_KEY", cfg.anthropic?.key);
-    for (const name of BOX_FORWARDED_CREDENTIAL_ENV)
+    for (const name of BOAT_FORWARDED_CREDENTIAL_ENV)
         put(name, env[name]);
     return out;
 }
-/** Names the box's agents read (Claude Code, Codex, pi, OpenCode, Prime
+/** Names the boat's agents read (Claude Code, Codex, pi, OpenCode, Prime
  * Agent, Kimi), forwarded verbatim from this server's environment when set. */
-const BOX_FORWARDED_CREDENTIAL_ENV = [
+const BOAT_FORWARDED_CREDENTIAL_ENV = [
     "CLAUDE_CODE_OAUTH_TOKEN",
     "OPENAI_API_KEY",
     "OPENROUTER_API_KEY",
@@ -949,22 +996,22 @@ const BOX_FORWARDED_CREDENTIAL_ENV = [
     "KIMI_CODE_ACCESS_TOKEN",
     "KIMI_CODE_REFRESH_TOKEN",
 ];
-async function requestBoxCreate(cfg, botId, ttlSeconds, env) {
+async function requestBoatCreate(cfg, botId, ttlSeconds, env) {
     // The computer needs the user's desktop session, not the account owner's
     // host credentials. Keep provider-side env injection off; the only keys the
     // guest ever has are the ones this OpenMausBot forwards (`env`), which its
-    // agents need now that the turn runs on the box. The idempotency identity
+    // agents need now that the turn runs on the boat. The idempotency identity
     // stays the secret-free part: a trial-TTL retry must receive a different
     // key, and the journal on disk never carries a credential.
     const body = JSON.stringify({ ttlSeconds, noEnv: true });
     const wireBody = JSON.stringify({ ttlSeconds, noEnv: true, ...(Object.keys(env).length ? { env } : {}) });
-    let attempt = beginBoxCreate(botId, body);
+    let attempt = beginBoatCreate(botId, body);
     let request = attempt.request;
     let createdThisAttempt = attempt.startedNow;
-    // A previous process received the Box but died before naming it. Resolve
+    // A previous process received the Boat but died before naming it. Resolve
     // the durable identity directly; never issue a second create first.
     if (request.boxId) {
-        const recovered = await boxJson(cfg, `/boxes/${request.boxId}`, {
+        const recovered = await boatJson(cfg, `/boxes/${request.boxId}`, {
             signal: AbortSignal.timeout(20_000),
         });
         if (recovered.ok && recovered.body?.box?.id === request.boxId) {
@@ -973,8 +1020,8 @@ async function requestBoxCreate(cfg, botId, ttlSeconds, env) {
         if (recovered.status !== 404 && recovered.status !== 410) {
             return { ...recovered, request, createdThisAttempt: false };
         }
-        discardBoxCreate(request);
-        attempt = beginBoxCreate(botId, body);
+        discardBoatCreate(request);
+        attempt = beginBoatCreate(botId, body);
         request = attempt.request;
         createdThisAttempt = attempt.startedNow;
     }
@@ -983,7 +1030,7 @@ async function requestBoxCreate(cfg, botId, ttlSeconds, env) {
     let inProgressRetries = 0;
     for (;;) {
         try {
-            last = await boxJson(cfg, "/boxes", {
+            last = await boatJson(cfg, "/boxes", {
                 method: "POST",
                 headers: { "Idempotency-Key": request.idempotencyKey },
                 signal: AbortSignal.timeout(45_000),
@@ -992,18 +1039,18 @@ async function requestBoxCreate(cfg, botId, ttlSeconds, env) {
         }
         catch (error) {
             // A dropped response is ambiguous: boat.dev may already have created
-            // the Box. One retry with the same key recovers it safely.
+            // the Boat. One retry with the same key recovers it safely.
             if (ambiguousRetries++ === 0)
                 continue;
             throw error;
         }
         const boxId = last.body?.box?.id;
         if (last.ok && typeof boxId === "string" && boxId) {
-            request = rememberCreatedBox(request, boxId);
+            request = rememberCreatedBoat(request, boxId);
             return { ...last, request, createdThisAttempt };
         }
         if (idempotentCreateInProgress(last)) {
-            const delay = BOX_CREATE_IN_PROGRESS_RETRY_DELAYS_MS[inProgressRetries++];
+            const delay = BOAT_CREATE_IN_PROGRESS_RETRY_DELAYS_MS[inProgressRetries++];
             if (delay !== undefined) {
                 await new Promise((resolve) => setTimeout(resolve, delay));
                 continue;
@@ -1014,32 +1061,32 @@ async function requestBoxCreate(cfg, botId, ttlSeconds, env) {
             continue;
         // A 5xx or any idempotency conflict can follow a provider-side create;
         // keep its key for recovery. Only a definitive client rejection proves
-        // this request did not create a Box and may be replaced safely.
+        // this request did not create a Boat and may be replaced safely.
         if (last.status < 500 && last.status !== 409 && !last.ok)
-            discardBoxCreate(request);
+            discardBoatCreate(request);
         return { ...last, request, createdThisAttempt };
     }
 }
-async function createBox(cfg, botId, env) {
-    const first = await requestBoxCreate(cfg, botId, DEFAULT_BOX_TTL_SECONDS, env);
+async function createBoat(cfg, botId, env) {
+    const first = await requestBoatCreate(cfg, botId, DEFAULT_BOAT_TTL_SECONDS, env);
     if (first.ok)
         return first;
-    const trialTtl = trialBoxTtlSeconds(first.body);
-    return trialTtl === null ? first : requestBoxCreate(cfg, botId, trialTtl, env);
+    const trialTtl = trialBoatTtlSeconds(first.body);
+    return trialTtl === null ? first : requestBoatCreate(cfg, botId, trialTtl, env);
 }
 /** A prior explicit delete always wins over provisioning. Reconcile/retry the
  * old immutable target, then require a fresh provision request so one click
  * can never both erase and silently recreate the same computer. */
 async function finishPriorDeletionBeforeProvision(cfg, botId) {
-    const remembered = boxDeletionSnapshot().filter((record) => record.ownerBotId === botId);
+    const remembered = boatDeletionSnapshot().filter((record) => record.ownerBotId === botId);
     if (!remembered.length)
         return;
     for (const deletion of remembered) {
-        let state = await reconcileRecordedBoxDeletion(cfg, deletion, [0]);
+        let state = await reconcileRecordedBoatDeletion(cfg, deletion, [0]);
         if (state !== "confirmed") {
-            const current = getBoxDeletion(deletion.boxId);
+            const current = getBoatDeletion(deletion.boxId);
             if (current?.phase === "prepared" || current?.phase === "blocked") {
-                state = await requestRecordedBoxDeletion(cfg, {
+                state = await requestRecordedBoatDeletion(cfg, {
                     boxId: current.boxId,
                     name: current.name,
                     ownerBotId: current.ownerBotId,
@@ -1051,150 +1098,150 @@ async function finishPriorDeletionBeforeProvision(cfg, botId) {
     }
     throw Object.assign(new Error("the previous cloud computer deletion finished — retry to create a new computer"), { status: 409 });
 }
-/** Box state for the Computer panel. */
-export async function boxStatus(cfg, botId) {
-    cfg = snapshotBoxConfig(cfg);
-    if (!boxConfigured(cfg))
+/** Boat state for the Computer panel. */
+export async function boatStatus(cfg, botId) {
+    cfg = snapshotBoatConfig(cfg);
+    if (!boatConfigured(cfg))
         return { configured: false, box: null };
-    const box = await findBox(cfg, botId);
+    const boat = await findBoat(cfg, botId);
     return {
         configured: true,
-        box: box ? { boxId: box.id, state: box.state, desktopAvailable: box.desktopAvailable ?? null } : null,
+        box: boat ? { boxId: boat.id, state: boat.state, desktopAvailable: boat.desktopAvailable ?? null } : null,
     };
 }
 /**
- * Find-or-create the bot's persistent box, wait for ready, and mint a fresh
- * desktop URL. The box ships its own computer-use driver and agent runner.
+ * Find-or-create the bot's persistent boat, wait for ready, and mint a fresh
+ * desktop URL. The boat ships its own computer-use driver and agent runner.
  */
-export async function provisionBox(cfg, botId, _botName) {
-    const credentialEnv = boxCredentialEnv(cfg);
-    cfg = snapshotBoxConfig(cfg);
-    if (!boxConfigured(cfg)) {
+export async function provisionBoat(cfg, botId, _botName) {
+    const credentialEnv = boatCredentialEnv(cfg);
+    cfg = snapshotBoatConfig(cfg);
+    if (!boatConfigured(cfg)) {
         throw new Error('box provider not enabled — add {"box":{"token":"…"}} to ~/.openmausbot/config.json');
     }
     await finishPriorDeletionBeforeProvision(cfg, botId);
-    const vmName = await boxNameFor(botId);
-    let box = await findBox(cfg, botId);
+    const vmName = await boatNameFor(botId);
+    let boat = await findBoat(cfg, botId);
     let created = false;
     let createRequest = null;
     try {
-        if (!box) {
+        if (!boat) {
             // Deletion can be prepared by another process after the initial lookup.
             // Never create a replacement until the durable fence is reconciled.
-            assertBotBoxNotDeleting(botId);
+            assertBotBoatNotDeleting(botId);
             // Provider-side backstop: archives itself (billing pauses, disk
             // survives) if every stop path dies. Trial accounts get one narrower
             // retry when boat.dev reports their shorter TTL ceiling.
-            const createRes = await createBox(cfg, botId, credentialEnv);
+            const createRes = await createBoat(cfg, botId, credentialEnv);
             if (!createRes.ok || !createRes.body?.box?.id) {
-                throw new Error(boxErrorMessage(createRes.status, "box create", createRes.body));
+                throw new Error(boatErrorMessage(createRes.status, "boat create", createRes.body, usesIncludedBoat(cfg)));
             }
-            box = createRes.body.box;
+            boat = createRes.body.box;
             createRequest = createRes.request;
             created = createRes.createdThisAttempt;
-            const rename = await boxJson(cfg, `/boxes/${box.id}`, {
+            const rename = await boatJson(cfg, `/boxes/${boat.id}`, {
                 method: "PATCH",
                 body: JSON.stringify({ name: vmName }),
             });
             if (!rename.ok)
-                throw new Error(boxErrorMessage(rename.status, "box naming", rename.body));
+                throw new Error(boatErrorMessage(rename.status, "box naming", rename.body, usesIncludedBoat(cfg)));
             if (createRequest)
-                createRequest = resolveBoxCreate(createRequest);
+                createRequest = resolveBoatCreate(createRequest);
         }
-        const ready = await waitReady(cfg, box.id);
+        const ready = await waitReady(cfg, boat.id);
         if (!ready)
             throw new Error("box did not become ready within 90s — retry in a minute");
-        // Nothing to install: every box ships its own computer-use driver and
+        // Nothing to install: every boat ships its own computer-use driver and
         // registers it with every harness it runs.
-        const joinUrl = await mintDesktopUrl(cfg, box.id);
+        const joinUrl = await mintDesktopUrl(cfg, boat.id);
         if (!joinUrl)
             throw new Error("box desktop link could not be created");
-        return { boxId: box.id, machineName: vmName, reused: !created, state: ready.state, joinUrl };
+        return { boxId: boat.id, machineName: vmName, reused: !created, state: ready.state, joinUrl };
     }
     catch (error) {
-        if (!created || !box?.id)
+        if (!created || !boat?.id)
             throw error;
         const originalMessage = error instanceof Error ? error.message : String(error);
         // Capture the provider's current name when possible. Naming may be the
         // step that failed, so the desired deterministic name is only a fallback
         // for the durable fence, never proof of a later live identity.
-        const inspected = await inspectBoxIdentity(cfg, box.id);
+        const inspected = await inspectBoatIdentity(cfg, boat.id);
         if (inspected.available && !inspected.identity) {
-            retireDeletedBoxCreate(box.id);
-            boxIdCache.delete(botId);
+            retireDeletedBoatCreate(boat.id);
+            boatIdCache.delete(botId);
             throw error;
         }
         let cleanupConfirmation;
         try {
-            cleanupConfirmation = await requestRecordedBoxDeletion(cfg, {
-                boxId: box.id,
+            cleanupConfirmation = await requestRecordedBoatDeletion(cfg, {
+                boxId: boat.id,
                 name: inspected.identity?.name ?? vmName,
                 ownerBotId: botId,
             });
         }
         catch (cleanupError) {
             const cleanupMessage = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
-            throw new Error(`${originalMessage}. The new computer's deletion was not confirmed: ${cleanupMessage}. Check box ${box.id} in boat.dev.`);
+            throw new Error(`${originalMessage}. The new computer's deletion was not confirmed: ${cleanupMessage}. Check box ${boat.id} in boat.dev.`);
         }
         if (cleanupConfirmation === "confirmed")
             throw error;
-        boxIdCache.delete(botId);
+        boatIdCache.delete(botId);
         throw Object.assign(new Error(`${originalMessage}. boat.dev accepted deletion of the new computer, but it is still pending; `
-            + `its recovery record was kept, along with its deletion fence. Check box ${box.id} in boat.dev.`, { cause: error }), { status: 503 });
+            + `its recovery record was kept, along with its deletion fence. Check box ${boat.id} in boat.dev.`, { cause: error }), { status: 503 });
     }
 }
-/** Wake the bot's box and return a FRESH desktop URL. */
-export async function joinBox(cfg, botId) {
-    cfg = snapshotBoxConfig(cfg);
-    const box = await findBox(cfg, botId);
-    if (!box)
+/** Wake the bot's boat and return a FRESH desktop URL. */
+export async function joinBoat(cfg, botId) {
+    cfg = snapshotBoatConfig(cfg);
+    const boat = await findBoat(cfg, botId);
+    if (!boat)
         throw new Error("no computer yet — provision it first");
-    const ready = await waitReady(cfg, box.id);
+    const ready = await waitReady(cfg, boat.id);
     if (!ready)
         throw new Error("the box did not wake in time — try again");
-    // Provider archive/resume preserves disk but not processes; the box brings
+    // Provider archive/resume preserves disk but not processes; the boat brings
     // its own driver daemon back up, so there is nothing to reattach here.
-    return { joinUrl: await mintDesktopUrl(cfg, box.id), state: ready.state ?? null };
+    return { joinUrl: await mintDesktopUrl(cfg, boat.id), state: ready.state ?? null };
 }
 /** Mint a human-control URL without changing provider lifecycle or guest
  * processes. This is the only join path allowed while a bot turn is active. */
-export async function joinReadyBox(cfg, botId) {
-    cfg = snapshotBoxConfig(cfg);
-    const box = await findBox(cfg, botId);
-    if (!box)
+export async function joinReadyBoat(cfg, botId) {
+    cfg = snapshotBoatConfig(cfg);
+    const boat = await findBoat(cfg, botId);
+    if (!boat)
         throw Object.assign(new Error("no computer yet — provision it first"), { status: 409 });
-    if (!READY.has(box.state)) {
+    if (!READY.has(boat.state)) {
         throw Object.assign(new Error("the cloud computer is sleeping or starting — interrupt the bot before waking it"), { status: 409 });
     }
-    return { joinUrl: await mintDesktopUrl(cfg, box.id), state: box.state ?? null };
+    return { joinUrl: await mintDesktopUrl(cfg, boat.id), state: boat.state ?? null };
 }
-/** Archive the bot's box now (billing pauses, disk survives). */
-export async function sleepBox(cfg, botId) {
-    cfg = snapshotBoxConfig(cfg);
-    const box = await findBox(cfg, botId);
-    if (!box)
+/** Archive the bot's boat now (billing pauses, disk survives). */
+export async function sleepBoat(cfg, botId) {
+    cfg = snapshotBoatConfig(cfg);
+    const boat = await findBoat(cfg, botId);
+    if (!boat)
         throw new Error("no computer for this bot");
-    await stopBox(cfg, box.id);
-    forgetBoxId(box.id);
+    await stopBoat(cfg, boat.id);
+    forgetBoatId(boat.id);
     return { ok: true };
 }
 /** Owner-scoped shell for the Computer panel's console. */
-export async function execOnBox(cfg, botId, command) {
-    cfg = snapshotBoxConfig(cfg);
+export async function execOnBoat(cfg, botId, command) {
+    cfg = snapshotBoatConfig(cfg);
     if (command.length > MAX_REMOTE_COMMAND_LENGTH) {
         throw new RangeError(`command is too long (maximum ${MAX_REMOTE_COMMAND_LENGTH} characters)`);
     }
-    const box = await findBox(cfg, botId);
-    if (!box)
+    const boat = await findBoat(cfg, botId);
+    if (!boat)
         throw new Error("no computer for this bot yet");
-    const ready = await waitReady(cfg, box.id, 60_000);
+    const ready = await waitReady(cfg, boat.id, 60_000);
     if (!ready)
         throw new Error("box did not wake");
-    const out = await runCommand(cfg, box.id, isolatedRemoteCommand(command));
+    const out = await runCommand(cfg, boat.id, isolatedRemoteCommand(command));
     return { exitCode: out.exitCode, stdout: out.stdout.slice(-4000), stderr: out.stderr.slice(-2000) };
 }
 // Screenshot for the Computer panel + screen-in-chat. Two hops: capture
-// to a file on the box (scrot straight to JPEG — no ImageMagick startup
+// to a file on the boat (scrot straight to JPEG — no ImageMagick startup
 // unless a downscale is actually needed), then read the bytes back.
 // Base64 over command stdout is NOT reliable for the panel's full-size
 // frames (probed 2026-08-12: an otherwise-complete payload came back with
@@ -1203,7 +1250,7 @@ export async function execOnBox(cfg, botId, command) {
 // The frame is for a person: it fills the panel and opens in the chat's
 // image viewer, so it keeps the desktop's native size up to 1080p and a
 // quality where page text stays legible. (Sizing it is now the only say
-// OpenMausBot has over any frame off this box: the turn runs on the box's
+// OpenMausBot has over any frame off this box: the turn runs on the boat's
 // own agent, so the model's own captures never pass through here.) Only
 // wider displays are scaled down, with -resize rather than -thumbnail so
 // the resample is not the fast-and-blurry kind meant for icons. The
@@ -1215,7 +1262,7 @@ export const PANEL_FRAME_WIDTH = 1920;
 export const PANEL_FRAME_QUALITY = 85;
 // ffmpeg's -q:v runs 2 (best) to 31; 3 lands near JPEG quality 85.
 const PANEL_FRAME_FFMPEG_Q = 3;
-/** The shell that captures one panel frame on the box. Exported for tests. */
+/** The shell that captures one panel frame on the boat. Exported for tests. */
 export function panelShotCommand({ width = PANEL_FRAME_WIDTH, quality = PANEL_FRAME_QUALITY, framePath = PANEL_PATH, nativeSize = false } = {}) {
     return [
         "export DISPLAY=${DISPLAY:-:0}",
@@ -1230,18 +1277,18 @@ export function panelShotCommand({ width = PANEL_FRAME_WIDTH, quality = PANEL_FR
     ].join("; ");
 }
 const SHOT_CMD = panelShotCommand();
-// A compromised box can answer with an arbitrarily large "frame"; cap what
+// A compromised boat can answer with an arbitrarily large "frame"; cap what
 // the server ever buffers for one (raw bytes, before base64) so a single
 // response cannot exhaust memory.
 const MAX_FRAME_BYTES = 8 * 1024 * 1024;
 const FRAME_TOO_LARGE = "the box frame exceeds the 8 MB limit";
-/** Read a file off the box as base64 — raw artifact bytes when the API
+/** Read a file off the boat as base64 — raw artifact bytes when the API
  * supports it (33% less transfer, no JSON envelope), else the files API. */
 async function readFileBase64(cfg, boxId, path, signal) {
     let bytes = null;
     let tooLarge = false;
     try {
-        const res = await boxFetch(cfg, `/boxes/${boxId}/artifacts?path=${encodeURIComponent(path)}`, { signal });
+        const res = await boatFetch(cfg, `/boxes/${boxId}/artifacts?path=${encodeURIComponent(path)}`, { signal });
         if (res.ok) {
             const declaredLength = res.headers.get("content-length");
             if (declaredLength !== null && Number(declaredLength) > MAX_FRAME_BYTES)
@@ -1259,7 +1306,7 @@ async function readFileBase64(cfg, boxId, path, signal) {
     if (bytes?.length)
         return bytes.toString("base64");
     signal?.throwIfAborted();
-    const { ok, body } = await boxJson(cfg, `/boxes/${boxId}/files?path=${encodeURIComponent(path)}&encoding=base64`, { signal });
+    const { ok, body } = await boatJson(cfg, `/boxes/${boxId}/files?path=${encodeURIComponent(path)}&encoding=base64`, { signal });
     const content = body?.content;
     if (ok && typeof content === "string" && content) {
         if (Buffer.byteLength(content, "base64") > MAX_FRAME_BYTES)
@@ -1268,18 +1315,18 @@ async function readFileBase64(cfg, boxId, path, signal) {
     }
     return null;
 }
-/** `knownBoxId` skips box resolution entirely — the screen poller holds
+/** `knownBoatId` skips boat resolution entirely — the screen poller holds
  * the id for the whole turn and must not re-resolve it every frame. */
-export async function screenshotBox(cfg, botId, knownBoxId, options) {
-    cfg = snapshotBoxConfig(cfg);
-    let boxId = knownBoxId;
+export async function screenshotBoat(cfg, botId, knownBoatId, options) {
+    cfg = snapshotBoatConfig(cfg);
+    let boxId = knownBoatId;
     if (!boxId) {
-        const box = await findBox(cfg, botId);
-        if (!box)
+        const boat = await findBoat(cfg, botId);
+        if (!boat)
             throw new Error("no computer for this bot yet");
-        if (!READY.has(box.state))
-            throw new Error(`box is ${box.state}`);
-        boxId = box.id;
+        if (!READY.has(boat.state))
+            throw new Error(`box is ${boat.state}`);
+        boxId = boat.id;
     }
     const framePath = options?.nativeSize ? PANEL_PATH + ".model.jpg" : PANEL_PATH;
     const out = await runCommand(cfg, boxId, options?.nativeSize ? panelShotCommand({ framePath, nativeSize: true }) : SHOT_CMD, { timeoutMs: 60_000, signal: options?.signal });