openmausbot 0.1.89 → 0.1.91

package/dist-server/server/config.js

@@ -13,6 +13,8 @@ import { isModelVariant } from "./contracts.js";
 import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-icon.js";
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
+import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
+import { cloudHomeConfigured } from "./cloud-home.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -87,7 +89,8 @@ const roomConfigSchema = z.object({
         .min(MIN_ROOM_TURN_TIMEOUT_MINUTES)
         .max(MAX_ROOM_TURN_TIMEOUT_MINUTES),
     /** Room handoff tree lifetime. Active execution pauses this clock; the
-     * hard cap is wall-clock and bounds trees that never stop executing. */
+     * hard cap is the maximum stall window, measured wall-clock from the
+     * tree's last durable progress. */
     handoffLifetimeMinutes: z.number().int().min(1).max(MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
     handoffMinRunwayMinutes: z.number().int().min(1).max(MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
     handoffHardCapMinutes: z.number().int().min(1).max(7 * MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
@@ -95,8 +98,14 @@ const roomConfigSchema = z.object({
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) &&
     (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) <=
         (rooms.handoffHardCapMinutes ?? DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES), { message: "rooms handoff bounds must satisfy handoffMinRunwayMinutes <= handoffLifetimeMinutes <= handoffHardCapMinutes" });
+/** Isolation for bot desktops. Migration note (issue #1654): switching
+ * modes changes lease keys and vm-home directories, so desktops cold-start
+ * under the new mode — a pool seat lives in vm-homes/pool-N — while the old
+ * mode's workspaces stay on disk until removed. maxInstances caps per-bot
+ * desktops in per-bot mode, or the pool's seat count in pool mode; it is
+ * not a total across modes. Default stays "shared". */
 const localVmConfigSchema = z.object({
-    mode: z.enum(["shared", "per-bot"]).optional(),
+    mode: z.enum(["shared", "per-bot", "pool"]).optional(),
     maxInstances: z
         .number()
         .int()
@@ -247,6 +256,10 @@ const featureConfigSchema = z.object({
     skillAuthoring: z.boolean().optional(),
     /** Show each tool run in the transcript. Off unless explicitly enabled. */
     showToolCalls: z.boolean().optional(),
+    /** Run a routine inside the conversation it reports to, instead of a hidden
+     * thread. Off unless explicitly enabled. The run still starts from its own
+     * instructions, but the messages stay in that chat. */
+    routinesInConversation: z.boolean().optional(),
     /** Experimental built-in browser. Off until explicitly enabled; each bot
      * also has its own switch. */
     browser: z.boolean().optional(),
@@ -260,8 +273,23 @@ const featureConfigSchema = z.object({
     claudeUserMcp: z.boolean().optional(),
     /** LLM-generated titles for new bot threads. Off until explicitly
      * enabled; a one-shot that fails or answers junk leaves the first-message
-     * snippet in place — see llmThreadTitlesEnabled. */
+    * snippet in place — see llmThreadTitlesEnabled. */
     llmThreadTitles: z.boolean().optional(),
+    /** Before each turn, passages from the bot's own memory files and earlier
+     * conversations that share words with the message ride into the turn.
+     * Read-only; on unless explicitly switched off — see autoRecallEnabled. */
+    autoRecall: z.boolean().optional(),
+    /** Idle release for computer claims (#1653): a desktop seat that stays
+     * screen-quiet for 90 seconds is released to waiting turns while its
+     * holder's turn still lives; the previous holder re-claims directly
+     * for 10 minutes and yields to an occupied seat. Off until baked; see
+     * computerClaimIdleReleaseEnabled for how to enable it by hand. */
+    computerClaimIdleRelease: z.boolean().optional(),
+    /** Consented cloud overflow for local computer waits (#1655): a wait
+     * may offer a per-second-billed cloud seat, but only through an explicit
+     * consent card or a configured allowlist — never a silent Auto default.
+     * Off until baked; see cloudOverflowEnabled for how to enable it by hand. */
+    cloudOverflow: z.boolean().optional(),
 });
 /** First-run progress. Kept in the workspace config rather than a browser so
  * it survives cleared site data and is shared by every paired client. Hint
@@ -376,6 +404,8 @@ const appConfigSchema = z.object({
     /** Project key used for Sessions, catalog and agent tools. userId/sessionId
      * are non-secret local identifiers used to reuse one Composio Session. */
     composio: z.object({ apiKey: optionalText, userId: optionalText, sessionId: optionalText }).optional(),
+    /** Historical config section name "box" (the persisted config.json key); the
+     * provider is Boat now and the key is kept for compatibility. */
     box: z.object({ token: optionalText }).optional(),
     vps: vpsConfigSchema.optional(),
     /** Optional OpenCode key; persisted write-only and passed only to its child. */
@@ -400,6 +430,24 @@ const appConfigSchema = z.object({
             .optional(),
         model: optionalText,
     }).optional(),
+    /** The decision model (server/decider): a fast classifier that picks
+     * things for bots, starting with who answers a room message. `key` is
+     * write-only like every credential; `baseUrl` points at a Jev-compatible
+     * server instead of TypeSafe's (an operator setting with no UI); `jobs`
+     * switches each decision on or off. Not `decisions`: that section is the
+     * authorization log's retention. */
+    decider: z.object({
+        enabled: z.boolean().optional(),
+        provider: z.enum(["jev", "off"]).optional(),
+        key: optionalText,
+        baseUrl: z
+            .string()
+            .trim()
+            .max(2048)
+            .refine((value) => !value || /^https?:\/\//i.test(value), "the decision model address must start with http:// or https://")
+            .optional(),
+        jobs: z.object({ roomRouting: z.boolean().optional() }).optional(),
+    }).optional(),
     /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
     imageGen: z.object({
         provider: z.enum(["openai", "xai", "custom"]).optional(),
@@ -429,10 +477,26 @@ const appConfigSchema = z.object({
         compactAt: z.number().positive().max(10_000_000).optional(),
         autoCompact: z.boolean().optional(),
     }).optional(),
+    /** Memory upkeep timing, for bots with Memory upkeep switched on. */
+    memory: z.object({
+        /** Quiet time after a turn before its facts are captured (ms). */
+        captureQuietMs: z.number().int().min(1_000).max(24 * 60 * 60_000).optional(),
+        /** Local hour (0-23) after which the nightly tidy-up runs. */
+        tidyHour: z.number().int().min(0).max(23).optional(),
+    }).strict().optional(),
     threads: threadsConfigSchema.optional(),
     /** The authorization decision log (server/decision-log.ts): days of month
      * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
     decisions: z.object({ retentionDays: z.number().int().min(1).max(3650).optional() }).strict().optional(),
+    /** #1655 cloud-overflow settings. perSecondCostUsd is the operator's own
+     * verified rate: with no price configured the feature stays inert rather
+     * than show an invented one. allowlistedThreads carries standing consent
+     * for exact thread ids. */
+    cloudOverflow: z.object({
+        perSecondCostUsd: z.number().positive().max(10).optional(),
+        idleStopMs: z.number().int().positive().max(24 * 60 * 60_000).optional(),
+        allowlistedThreads: z.array(z.string().min(1)).max(1000).optional(),
+    }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     onboarding: onboardingConfigSchema.optional(),
@@ -541,8 +605,9 @@ export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
 /** Room handoff tree budgets in milliseconds. The tree lifetime pauses
- * while a node is actively executing; the hard cap is wall-clock and bounds
- * trees that never stop. Read when the server starts. */
+ * while a node is actively executing; the hard cap is the maximum stall
+ * window, measured wall-clock from the tree's last durable progress. Read
+ * when the server starts. */
 export function roomHandoffLimits(cfg) {
     return {
         lifetimeMs: (cfg.rooms?.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) * 60_000,
@@ -578,13 +643,34 @@ export function localVmMaxInstances(cfg) {
 export function skillAuthoringEnabled(cfg) {
     return cfg.features?.skillAuthoring !== false;
 }
+/** Automatic recall is read-only, so it is on unless switched off. */
+export function autoRecallEnabled(cfg) {
+    return cfg.features?.autoRecall !== false;
+}
+export const DEFAULT_CAPTURE_QUIET_MS = 2 * 60_000;
+export const DEFAULT_TIDY_HOUR = 3;
+export function captureQuietMs(cfg) {
+    return cfg.memory?.captureQuietMs ?? DEFAULT_CAPTURE_QUIET_MS;
+}
+export function tidyHour(cfg) {
+    return cfg.memory?.tidyHour ?? DEFAULT_TIDY_HOUR;
+}
 export function showToolCallsEnabled(cfg) {
     return cfg.features?.showToolCalls === true;
 }
+/** A routine's turns are posted in the conversation that receives its card.
+ * Off by default, so scheduled work stays in a hidden thread. */
+export function routinesInConversationEnabled(cfg) {
+    return cfg.features?.routinesInConversation === true;
+}
 /** Workspace-level gate for the experimental built-in browser. A bot's own
- * switch sits under it, so either can withhold the browser. */
-export function builtInBrowserEnabled(cfg) {
-    return cfg.features?.browser === true;
+ * switch sits under it, so either can withhold the browser. Off until the
+ * desktop's first-run welcome turns it on. A Cloud home (cloud-home.ts)
+ * skips that welcome, ships the browser in its image and has no other screen
+ * of its own, so there it is on unless the person switched it off. */
+export function builtInBrowserEnabled(cfg, env = process.env) {
+    const chosen = cfg.features?.browser;
+    return chosen === undefined ? cloudHomeConfigured(env) : chosen === true;
 }
 /** Opt-in computer sharing: the routes, the agent tools, the advertised
  * capability and the desktop connector. Off unless an explicit `true` turns
@@ -614,6 +700,43 @@ export function claudeUserMcpEnabled(cfg) {
 export function llmThreadTitlesEnabled(cfg) {
     return cfg.features?.llmThreadTitles === true;
 }
+/** Idle release for computer claims (#1653): a whole-turn desktop hold
+ * ends after a screen-quiet window (default 90 seconds, screen-poller
+ * frames excluded) instead of at turn settle, and the previous holder
+ * re-claims directly inside a reclaim window (default 10 minutes) while
+ * yielding to a seat another turn already holds. Off unless an explicit
+ * `true` — bake it as a maintainer-only flag first, exactly like
+ * sharedComputers: enable by hand in ~/.openmausbot/config.json
+ * (`{"features": {"computerClaimIdleRelease": true}}`) and restart. */
+export function computerClaimIdleReleaseEnabled(cfg) {
+    return cfg.features?.computerClaimIdleRelease === true;
+}
+/** Consented cloud overflow for local computer waits (#1655): while a turn
+ * waits for a local desktop, it may offer overflow to a per-second-billed
+ * cloud seat — never silently: the card names the cost, and only an
+ * explicit per-conversation consent or a configured allowlist thread may
+ * start the machine, which then hard-stops after an idle window. Off
+ * unless an explicit `true`, like computerClaimIdleRelease: enable by
+ * hand in ~/.openmausbot/config.json
+ * (`{"features": {"cloudOverflow": true}, "cloudOverflow": {"perSecondCostUsd": 0.0004}}`)
+ * and restart. */
+export function cloudOverflowEnabled(cfg) {
+    return cfg.features?.cloudOverflow === true;
+}
+/** The per-second rate shown on the card, or null when the operator has
+ * not set one: the offer fails closed rather than guess a price. */
+export function cloudOverflowPerSecondCostUsd(cfg) {
+    const cost = cfg.cloudOverflow?.perSecondCostUsd;
+    return typeof cost === "number" && Number.isFinite(cost) && cost > 0 ? cost : null;
+}
+/** How long a cloud seat may stay screen-quiet before it is stopped. */
+export function cloudOverflowIdleStopMs(cfg) {
+    return cfg.cloudOverflow?.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
+}
+/** Threads with standing consent, by exact thread id. */
+export function cloudOverflowAllowlistedThreads(cfg) {
+    return new Set(cfg.cloudOverflow?.allowlistedThreads ?? []);
+}
 /** Config sections no provider driver reads. A write that touches only
  * these must not rebuild the fleet: rebuilding disposes every engine child
  * and reloads it, seconds of work that would also interrupt in-flight
@@ -623,14 +746,18 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     "profile",
     "language",
     "tts",
+    // no engine reads it: the harness asks it before a turn starts
+    "decider",
     "imageGen",
     "vps",
     "rooms",
     "threads",
     "automaticRecovery",
     "context",
+    "memory",
     "localVm",
     "features",
+    "cloudOverflow",
     "browserProfiles",
     "onboarding",
 ]);
@@ -752,6 +879,7 @@ export function loadConfig() {
     cfg.composio = { ...cfg.composio };
     if (process.env.COMPOSIO_API_KEY !== undefined)
         cfg.composio.apiKey = process.env.COMPOSIO_API_KEY;
+    // BOX_TOKEN keeps its historical name; the provider is Boat.
     cfg.box = { ...cfg.box };
     if (process.env.BOX_TOKEN !== undefined)
         cfg.box.token = process.env.BOX_TOKEN;
@@ -761,8 +889,16 @@ export function loadConfig() {
     cfg.tts = { ...cfg.tts };
     if (process.env.OMB_TTS_KEY !== undefined)
         cfg.tts.key = process.env.OMB_TTS_KEY;
+    // A preset ElevenLabs voice (Cloud Pro sets one) is only a default: a voice or
+    // another speech provider the person picked in Settings always wins.
+    const presetVoice = process.env.OMB_TTS_DEFAULT_VOICE?.trim();
+    if (presetVoice && !cfg.tts.voice?.trim() && (cfg.tts.provider ?? "elevenlabs") === "elevenlabs")
+        cfg.tts.voice = presetVoice;
     if (process.env.OMB_FISH_AUDIO_API_KEY !== undefined)
         cfg.tts.fishKey = process.env.OMB_FISH_AUDIO_API_KEY;
+    cfg.decider = { ...cfg.decider };
+    if (process.env.OMB_JEV_API_KEY !== undefined)
+        cfg.decider.key = process.env.OMB_JEV_API_KEY;
     cfg.imageGen = { ...cfg.imageGen };
     if (process.env.OMB_OPENAI_IMAGE_KEY !== undefined)
         cfg.imageGen.key = process.env.OMB_OPENAI_IMAGE_KEY;
@@ -798,6 +934,7 @@ export function syncCredentialEnv(patch) {
         [patch.opencodeGo?.apiKey, "OPENCODE_API_KEY"],
         [patch.tts?.key, "OMB_TTS_KEY"],
         [patch.tts?.fishKey, "OMB_FISH_AUDIO_API_KEY"],
+        [patch.decider?.key, "OMB_JEV_API_KEY"],
         [patch.imageGen?.key, "OMB_OPENAI_IMAGE_KEY"],
         [patch.imageGen?.customApiKey, "OMB_CUSTOM_IMAGE_KEY"],
     ];
@@ -844,10 +981,17 @@ export const WORKSPACE_CREDENTIAL_ENV = [
     "OPENCODE_API_KEY",
     "OMB_TTS_KEY",
     "OMB_FISH_AUDIO_API_KEY",
+    "OMB_JEV_API_KEY",
     "OMB_OPENAI_IMAGE_KEY",
     "OMB_CUSTOM_IMAGE_KEY",
     "COMPOSIO_API_KEY",
     "OMB_COMPOSIO_BROKER_TOKEN",
+    // Cloud Pro's included Boat, voice and decision relay tokens
+    // (included-services.ts), used only in-process by the Boat, voice and
+    // decider modules.
+    "OMB_CLOUD_BOAT_TOKEN",
+    "OMB_CLOUD_VOICE_TOKEN",
+    "OMB_CLOUD_DECIDER_TOKEN",
     // Harness-private filesystem hints are not credentials themselves, but
     // exposing them to a shell-capable agent points straight at app-owned
     // state. The built-in browser master is delivered privately in memory.
@@ -929,7 +1073,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -1138,6 +1282,9 @@ function injectedEnvironment(cfg, driver) {
         environment.set("OPENAI_COMPAT_API_KEY", cfg.openaiCompat.key);
     if (driver === "openai-compat" && cfg.openaiCompat?.url)
         environment.set("OPENAI_COMPAT_URL", cfg.openaiCompat.url);
+    // driverKind "boxAgent" and env BOX_TOKEN keep their historical names.
+    // Only the person's own token: without one the driver itself falls back
+    // to Cloud Pro's included token, which never enters an environment map.
     if (driver === "boxAgent" && cfg.box?.token)
         environment.set("BOX_TOKEN", cfg.box.token);
     if (driver === "opencodeGo" && cfg.opencodeGo?.apiKey)

package/dist-server/server/container-computer.js

@@ -69,6 +69,19 @@ export function perBotLocalVmTarget(botId) {
         label: digest,
     };
 }
+/** A pool-mode seat (issue #1654): one of N desktops shared by every
+ * conversation, addressed by seat index. Identities stay disjoint from the
+ * shared singleton and from per-bot digests, so discovery, labels, and lease
+ * lanes never confuse the three modes. */
+export function poolLocalVmTarget(seat) {
+    return {
+        key: `pool:${seat}`,
+        containerName: `${CONTAINER}-p${seat}`,
+        workspaceDir: join(DATA_DIR, "vm-homes", `pool-${seat}`),
+        viewerPort: null,
+        label: `pool-${seat}`,
+    };
+}
 /** Only provisioning creates this durable directory; idle removal keeps it. */
 export function localVmWorkspaceExists(target) {
     try {

package/dist-server/server/control-client.js

@@ -1,8 +1,8 @@
 // The proxy-side half of computer control. The harness keeps the record of
 // who is driving (server/computer-control.ts); the per-turn computer
 // processes consult it through this client before acting, because the
-// action paths themselves never traverse the harness — a box click goes
-// straight to the box's REST API, and a Local VM / VPS click rides a
+// action paths themselves never traverse the harness — a boat click goes
+// straight to the boat's REST API, and a Local VM / VPS click rides a
 // transparent stdio bridge into Cua Driver.
 //
 // Failure posture: CLOSED once configured. A missing/expired turn capability

package/dist-server/server/decider/index.js

@@ -0,0 +1,238 @@
+import { deciderCredential } from "../included-services.js";
+import { jevBackend } from "./jev.js";
+import { appendDeciderLog, stateHash } from "./log.js";
+import { KEY_CHECK_QUESTION, KEY_CHECK_STATE, relayAccepts, relaySeam } from "./relay.js";
+export { DECIDER_JOBS } from "./types.js";
+/** Used when a caller passes no timeout. Room routing passes its own. */
+export const DEFAULT_DECIDER_TIMEOUT_MS = 1_500;
+/** The Settings key check is one tiny call a person is waiting on. */
+export const KEY_CHECK_TIMEOUT_MS = 10_000;
+const MIN_TIMEOUT_MS = 50;
+const MAX_TIMEOUT_MS = 30_000;
+/** A request the switches never let through. */
+const offBackend = {
+    id: "off",
+    decide: async () => ({ ok: false, reason: "disabled" }),
+};
+const BACKENDS = { jev: jevBackend };
+export function deciderProvider(cfg) {
+    const provider = cfg.decider?.provider ?? "jev";
+    return provider in BACKENDS ? provider : "off";
+}
+/** The key a call uses and the one base URL it goes to: the person's own
+ * (a draft being tested, else the config value or the desktop's encrypted
+ * store handed over as env) with `decider.baseUrl` or Jev's own, else Cloud
+ * Pro's included token with the Admin's relay, but only where the relay
+ * accepts that seam: any other job has only an own key. Resolved on every
+ * call. */
+function deciderAccount(cfg, seam, draft) {
+    const account = deciderCredential(draft?.trim() || cfg.decider?.key, cfg.decider?.baseUrl);
+    return account?.included && seam && !relaySeam(seam) ? null : account;
+}
+/** A key is on file, or Cloud Pro includes decisions here. */
+export function deciderConfigured(cfg) {
+    return Boolean(deciderAccount(cfg));
+}
+/** Cloud Pro includes decisions on this machine, whatever key is saved:
+ * what clearing an own key falls back to. */
+export function deciderIncludedHere() {
+    return deciderCredential(undefined, undefined)?.included === true;
+}
+/** The master switch as it takes effect: off while there is no key. With an
+ * own key it is on once switched on (saving the key does that); with Cloud
+ * Pro's included decisions it is on until someone switches it off. */
+export function deciderEnabled(cfg) {
+    const account = deciderAccount(cfg);
+    if (!account || deciderProvider(cfg) === "off")
+        return false;
+    return account.included ? cfg.decider?.enabled !== false : cfg.decider?.enabled === true;
+}
+/** One job's own switch. Absent means on: turning the decider on turns on
+ * what it decides unless a job was switched off by hand. */
+export function deciderJobOn(cfg, job) {
+    return cfg.decider?.jobs?.[job] !== false;
+}
+/** Whether a job would be asked right now. Callers check this before they
+ * spend any effort building a request. */
+export function deciderReady(cfg, job) {
+    return deciderEnabled(cfg) && deciderJobOn(cfg, job) && Boolean(deciderAccount(cfg, job));
+}
+/** What Settings needs. Never the key, and not the base URL either: that is
+ * an operator setting with no UI. `included`: the decisions are Cloud Pro's,
+ * not a saved key. */
+export function describeDecider(cfg) {
+    const account = deciderAccount(cfg);
+    return {
+        provider: "jev",
+        configured: Boolean(account),
+        ...(account?.included ? { included: true } : {}),
+        enabled: deciderEnabled(cfg),
+        jobs: { roomRouting: deciderJobOn(cfg, "roomRouting") },
+    };
+}
+/** The config write a Settings save becomes.
+ *
+ * Owner rule: the switch is off while no key is saved, and saving a key is
+ * the "turn it on" — it switches the decider and its room job on, with no
+ * extra step. Clearing the key switches it off, unless Cloud Pro includes
+ * decisions here (`included`): then it falls back to them as it stands.
+ * Explicit values in the same patch win. Jobs merge per job, because
+ * saveConfig replaces a section's nested objects whole. Returns an error for
+ * a switch-on with no key and nothing included. */
+export function deciderSavePatch(patch, current, included = false) {
+    const next = { ...patch };
+    const savingKey = typeof patch.key === "string" && Boolean(patch.key.trim());
+    const clearingKey = typeof patch.key === "string" && !patch.key.trim();
+    if (typeof patch.key === "string")
+        next.key = patch.key.trim();
+    if (savingKey) {
+        next.enabled = patch.enabled ?? true;
+        next.jobs = { ...current?.jobs, roomRouting: true, ...patch.jobs };
+    }
+    else if (clearingKey) {
+        if (!included)
+            next.enabled = false;
+    }
+    else if (patch.jobs) {
+        next.jobs = { ...current?.jobs, ...patch.jobs };
+    }
+    if (next.enabled === true && !savingKey && !current?.key?.trim() && !included) {
+        return { ok: false, error: "Save a Jev API key before turning on fast decisions." };
+    }
+    return { ok: true, patch: next };
+}
+export function createDecider(deps) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const now = deps.now ?? (() => performance.now());
+    function gate(cfg, seam) {
+        if (deciderProvider(cfg) === "off")
+            return "disabled";
+        if (seam === "keyCheck")
+            return null;
+        if (!deciderConfigured(cfg))
+            return cfg.decider?.enabled === true ? "no_key" : "disabled";
+        if (!deciderEnabled(cfg))
+            return "disabled";
+        if (!deciderJobOn(cfg, seam))
+            return "job_off";
+        // Only the included token, and the relay does not take this job.
+        if (!deciderAccount(cfg, seam))
+            return "no_key";
+        return null;
+    }
+    async function call(seam, backend, request, options) {
+        const provider = backend.id === "off" ? undefined : backend.id;
+        if (options.signal?.aborted)
+            return { ok: false, ...(provider ? { provider } : {}), reason: "cancelled" };
+        const timeoutMs = Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, options.timeoutMs ?? DEFAULT_DECIDER_TIMEOUT_MS));
+        const controller = new AbortController();
+        const onAbort = () => controller.abort();
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        let timer;
+        // The race, not only the abort, bounds the call: a body that stalls
+        // after its headers must not hold a room turn past the budget.
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                resolve({ ok: false, reason: "timeout" });
+            }, timeoutMs);
+        });
+        const started = now();
+        let outcome;
+        try {
+            const decided = Promise.resolve()
+                .then(() => backend.decide({ ...request, signal: controller.signal, fetch: fetchImpl }))
+                .catch(() => ({ ok: false, reason: "malformed" }));
+            outcome = await Promise.race([decided, timedOut]);
+        }
+        finally {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+        }
+        const latencyMs = Math.max(0, Math.round(now() - started));
+        if (!outcome.ok && outcome.reason !== "timeout" && options.signal?.aborted)
+            outcome = { ok: false, reason: "cancelled" };
+        if (provider && deps.dataDir) {
+            const first = outcome.ok ? Object.values(outcome.answers).find((answer) => answer.type === "choice") : undefined;
+            appendDeciderLog(deps.dataDir, {
+                at: new Date().toISOString(),
+                seam,
+                provider,
+                ok: outcome.ok,
+                ...(!outcome.ok ? { reason: outcome.reason, ...(outcome.status ? { status: outcome.status } : {}) } : {}),
+                ...(first ? { choice: first.choice } : {}),
+                pTop: first?.pTop ?? null,
+                margin: first?.margin ?? null,
+                latencyMs,
+                ...(outcome.ok && outcome.inputTokens !== undefined ? { inputTokens: outcome.inputTokens } : {}),
+                stateHash: stateHash(request.state),
+            });
+        }
+        if (!outcome.ok)
+            return { ok: false, ...(provider ? { provider } : {}), reason: outcome.reason, ...(outcome.status ? { status: outcome.status } : {}), latencyMs };
+        return {
+            ok: true,
+            provider: provider,
+            answers: outcome.answers,
+            latencyMs,
+            ...(outcome.inputTokens !== undefined ? { inputTokens: outcome.inputTokens } : {}),
+            ...(outcome.model ? { model: outcome.model } : {}),
+        };
+    }
+    async function ask(seam, state, questions, options = {}) {
+        try {
+            const cfg = deps.config();
+            const refused = gate(cfg, seam);
+            if (refused)
+                return { ok: false, reason: refused };
+            const provider = deciderProvider(cfg);
+            const backend = provider === "off" ? offBackend : BACKENDS[provider];
+            const account = deciderAccount(cfg, seam);
+            // Through the included token, only the exact requests the relay takes.
+            if (account.included && !relayAccepts(seam, state, questions))
+                return { ok: false, reason: "misconfigured" };
+            return await call(seam, backend, { key: account.token, baseUrl: account.api, state, questions }, options);
+        }
+        catch {
+            return { ok: false, reason: "malformed" };
+        }
+    }
+    const single = (result) => result.ok ? { ...result, answers: result.answers.answer } : result;
+    return {
+        ask,
+        async choose(seam, state, question, options) {
+            const asked = { answer: { type: "choice", instructions: question.instructions, options: question.options } };
+            return single(await ask(seam, state, asked, options));
+        },
+        async score(seam, state, question, options) {
+            return single(await ask(seam, state, { answer: { type: "score", instructions: question.instructions, levels: question.levels } }, options));
+        },
+        async yesNo(seam, state, instructions, options) {
+            return single(await ask(seam, state, { answer: { type: "yesno", instructions } }, options));
+        },
+        async testKey(input = {}, options = {}) {
+            try {
+                const cfg = deps.config();
+                // A draft or saved own key goes to Jev (or decider.baseUrl); with
+                // neither, Cloud Pro's included token goes to its relay.
+                const account = deciderAccount(cfg, "keyCheck", input.key);
+                if (!account)
+                    return { ok: false, reason: "no_key" };
+                const provider = deciderProvider(cfg);
+                const backend = provider === "off" ? offBackend : BACKENDS[provider];
+                const questions = { answer: { type: "yesno", instructions: KEY_CHECK_QUESTION } };
+                if (account.included && !relayAccepts("keyCheck", KEY_CHECK_STATE, questions))
+                    return { ok: false, reason: "misconfigured" };
+                return single(await call("keyCheck", backend, {
+                    key: account.token,
+                    baseUrl: account.api,
+                    state: KEY_CHECK_STATE,
+                    questions,
+                }, { timeoutMs: KEY_CHECK_TIMEOUT_MS, ...options }));
+            }
+            catch {
+                return { ok: false, reason: "malformed" };
+            }
+        },
+    };
+}