openmausbot 0.1.89 → 0.1.91

package/dist-server/server/drivers/{boxagent.js → boatagent.js}

@@ -1,9 +1,9 @@
 import { newEventId, newId } from "../contracts.js";
+import { boatCredential, boatProviderApi } from "../included-services.js";
 import { appendNative } from "./native.js";
 import { OMB_ASK_TOOL, answerWithoutPreamble, askQuestionSummary, capAnswerEcho, ombAskProtocolPrompt, parseOmbAskQuestions, questionChoices, stripOmbAskBlock, } from "../../shared/ask-question.js";
+// "boxAgent" is Boat's historical driver kind (catalog and wire); keep it.
 const DRIVER_KIND = "boxAgent";
-// overridable so tests and a dev backend can be pointed at instead of the live provider
-const BOX_API = process.env.OMB_BOX_API || "https://ascii.dev/api/box/v1";
 const MODELS = {
     default: "claude-fable-5",
     options: [
@@ -15,14 +15,19 @@ const MODELS = {
 /** Any fence whose info string names the ask protocol, even when its body
  * does not parse: the marker for "the model tried to ask and failed". */
 const ASK_FENCE_ANY = /(^|\n)[ \t]{0,3}(`{3,}|~{3,})[ \t]*omb-ask\b/;
-/** The box runs every harness boat.dev ships (claude-code, codex, pi, opencode,
+/** The boat runs every harness boat.dev ships (claude-code, codex, pi, opencode,
  * prime-agent, kimi). Which one a model id belongs to comes from the public
  * catalog, `GET /api/provider-models` at the API root: an object keyed by
  * harness, each with its `models`. A bot that arrives here from another engine
- * carries that engine's model id, so this is what lets it keep its model. */
+ * carries that engine's model id, so this is what lets it keep its model. The
+ * root is the API in use (Boat, or Cloud Pro's relay), so it is cached per root. */
 let catalog = null;
-async function loadCatalog() {
-    const root = BOX_API.replace(/\/api\/box\/v1\/?$/, "");
+let catalogRoot = "";
+async function loadCatalog(api) {
+    const root = api.replace(/\/api\/box\/v1\/?$/, "");
+    if (catalog && catalogRoot === root)
+        return;
+    catalogRoot = root;
     catalog = await fetch(`${root}/api/provider-models`, { signal: AbortSignal.timeout(15_000) })
         .then((res) => (res.ok ? res.json() : null))
         .catch(() => null);
@@ -44,7 +49,7 @@ function decodeConfig(raw) {
         ...(typeof o.askTimeoutMs === "number" ? { askTimeoutMs: o.askTimeoutMs } : {}),
     };
 }
-export const BoxAgentDriver = {
+export const BoatAgentDriver = {
     driverKind: DRIVER_KIND,
     metadata: { displayName: "Computer", supportsMultipleInstances: false },
     models: MODELS,
@@ -52,7 +57,11 @@ export const BoxAgentDriver = {
     defaultConfig: () => decodeConfig({}),
     async create(input) {
         const { instanceId, config } = input;
-        const token = input.environment.BOX_TOKEN ?? process.env.BOX_TOKEN ?? "";
+        // The person's own token (instanceConfigs injects it), else Cloud Pro's
+        // included one, with the one base URL each may be sent to. Resolved per
+        // request, like every other Boat call.
+        const ownToken = input.environment.BOX_TOKEN ?? process.env.BOX_TOKEN;
+        const account = () => boatCredential(ownToken);
         const listeners = new Set();
         const active = new Map();
         /** One open ask per thread: the turn-held transport's pending card. The
@@ -74,9 +83,10 @@ export const BoxAgentDriver = {
             createdAt: new Date().toISOString(),
         });
         const api = async (path, opts = {}) => {
-            const res = await fetch(`${BOX_API}${path}`, {
+            const credential = account();
+            const res = await fetch(`${credential?.api ?? boatProviderApi()}${path}`, {
                 ...opts,
-                headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...opts.headers },
+                headers: { authorization: `Bearer ${credential?.token ?? ""}`, "content-type": "application/json", ...opts.headers },
                 signal: opts.signal ?? AbortSignal.timeout(30_000),
             });
             const body = await res.json().catch(() => null);
@@ -89,7 +99,7 @@ export const BoxAgentDriver = {
             const { threadId } = turn;
             const computer = turn.integrations?.computer;
             const boxId = computer && (!computer.kind || computer.kind === "box") ? computer.boxId : undefined;
-            if (!token)
+            if (!account())
                 throw new Error('box not configured — add {"box":{"token":"…"}} to ~/.openmausbot/config.json');
             if (!boxId) {
                 throw new Error("this bot has no computer yet — open the Computer panel and provision one");
@@ -112,15 +122,14 @@ export const BoxAgentDriver = {
                 .filter((s) => s !== undefined)
                 .join("\n");
             const postPrompt = async (promptText) => {
-                if (!catalog)
-                    await loadCatalog();
+                await loadCatalog(account()?.api ?? boatProviderApi());
                 const started = await api(`/boxes/${boxId}/prompt`, {
                     method: "POST",
                     body: JSON.stringify({ ...providerFor(model), prompt: promptText }),
                 });
                 appendNative(threadId, { dir: "out", source: "box.prompt", msg: { model, prompt: promptText, response: started } });
                 // real shape (2026-08): {type:"prompt.queued", promptId, promptRun:{id,…},
-                // id:<box id>} — never fall back to the bare id, it's the box's
+                // id:<boat id>} — never fall back to the bare id, it's the boat's
                 return started?.promptRun?.id ?? started?.prompt?.id ?? started?.promptId ?? null;
             };
             const promptId = await postPrompt(prompt);
@@ -149,7 +158,7 @@ export const BoxAgentDriver = {
                 const seen = new Set();
                 let lastText = "";
                 let pendingText = "";
-                /** Why the box could not answer (login expired, model refused, …). */
+                /** Why the boat could not answer (login expired, model refused, …). */
                 let problem = null;
                 /** Emit unflushed deltas as assistant_text and reset pendingText.
                  * The omb-ask block is protocol, not prose: it streamed raw (the
@@ -229,7 +238,7 @@ export const BoxAgentDriver = {
                         return { ok: ok && !cancelled, stopReason: cancelled ? "interrupted" : stopReason };
                     }
                     // The turn is still open, so this prompt continues it: same turnId,
-                    // same accounting, and the answer reaches the box the way the ask
+                    // same accounting, and the answer reaches the boat the way the ask
                     // contract promised — Q:/A: blocks, capped for echo.
                     const continuation = [
                         capAnswerEcho(answerWithoutPreamble(reply)),
@@ -238,7 +247,7 @@ export const BoxAgentDriver = {
                     ].join("\n");
                     const nextPromptId = await postPrompt(continuation);
                     // Stop can land while the continuation POST is in flight: the
-                    // interrupt inside cancel() then hits a box with no active run,
+                    // interrupt inside cancel() then hits a boat with no active run,
                     // and the continuation would start after it. Interrupt the run
                     // that just started before ending the turn.
                     if (cancelled) {
@@ -247,9 +256,9 @@ export const BoxAgentDriver = {
                     }
                     return await settleRun(nextPromptId);
                 };
-                /** Poll one box run to its settle. */
+                /** Poll one boat run to its settle. */
                 const settleRun = async (runPromptId) => {
-                    const startedAt = Date.now(); // one 30-min ceiling per box run, ask chains included
+                    const startedAt = Date.now(); // one 30-min ceiling per boat run, ask chains included
                     lastText = "";
                     pendingText = "";
                     problem = null;
@@ -354,8 +363,8 @@ export const BoxAgentDriver = {
             return { turnId };
         };
         const snapshot = async () => {
-            if (!token) {
-                return { state: "unavailable", reason: 'no Box token — add {"box":{"token":"…"}} to ~/.openmausbot/config.json' };
+            if (!account()) {
+                return { state: "unavailable", reason: 'no Boat token — add {"box":{"token":"…"}} to ~/.openmausbot/config.json' };
             }
             try {
                 await api("/me");

package/dist-server/server/drivers/builtIn.js

@@ -1,5 +1,5 @@
 import { AntigravityDriver } from "./antigravity.js";
-import { BoxAgentDriver } from "./boxagent.js";
+import { BoatAgentDriver } from "./boatagent.js";
 import { ClaudeDriver } from "./claude.js";
 import { CodexDriver } from "./codex.js";
 import { GrokDriver } from "./grok.js";
@@ -32,7 +32,7 @@ export const BUILT_IN_DRIVERS = [
     ClaudeDriver,
     CodexDriver,
     AntigravityDriver,
-    BoxAgentDriver,
+    BoatAgentDriver,
     MinimaxDriver,
     MistralDriver,
 ];

package/dist-server/server/drivers/{chat-box-tools.js → chat-boat-tools.js}

@@ -1,4 +1,4 @@
-import { isolatedRemoteCommand, runCommand, screenshotBox } from "../box.js";
+import { isolatedRemoteCommand, runCommand, screenshotBoat } from "../boat.js";
 import { createControlClient, CONTROL_REFUSAL_PLAIN } from "../control-client.js";
 const coordinate = { type: "integer", minimum: 0, maximum: 32767 };
 const tool = (name, description, properties = {}, required = []) => ({ name, description, inputSchema: { type: "object", properties, required, additionalProperties: false } });
@@ -19,7 +19,7 @@ const buttons = { left: 1, middle: 2, right: 3 };
 const scrollButtons = { up: 4, down: 5, left: 6, right: 7 };
 /** Uses only the leased descriptor supplied by the harness. Schema validation
  * and user approval happen in the shared chat tool executor before this call. */
-export class ChatBoxClient {
+export class ChatBoatClient {
     closed = false;
     control;
     descriptor;
@@ -45,7 +45,7 @@ export class ChatBoxClient {
         const config = { box: { token: this.descriptor.token } };
         const id = this.descriptor.boxId;
         if (name === "screenshot") {
-            const shot = await screenshotBox(config, "", id, { signal, nativeSize: true });
+            const shot = await screenshotBoat(config, "", id, { signal, nativeSize: true });
             signal.throwIfAborted();
             return { content: [{ type: "image", mimeType: "image/jpeg", data: shot.png }] };
         }

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -7,7 +7,7 @@ import { stripControlPlaneEnv } from "../config.js";
 import { augmentedPath } from "../env-path.js";
 import { killCliTree, spawnCli } from "../procs.js";
 import { chatImage } from "./chat-images.js";
-import { ChatBoxClient } from "./chat-box-tools.js";
+import { ChatBoatClient } from "./chat-boat-tools.js";
 /** The transport cannot safely continue this turn. A dispatched operation may
  * already have taken effect, so callers must not retry it through a new round. */
 export class ChatToolSessionError extends Error {
@@ -314,7 +314,7 @@ export async function mountChatTools(integrations, signal, computerUse = false)
                 throw aborted();
             // Every mounted MCP server can return images when the caller enables
             // image delivery, including custom servers. Text stays bounded below.
-            const client = "boxId" in descriptor ? new ChatBoxClient(descriptor) : new ChatMcpClient(descriptor, computerUse);
+            const client = "boxId" in descriptor ? new ChatBoatClient(descriptor) : new ChatMcpClient(descriptor, computerUse);
             clients.push(client);
             return { name, client, tools: await client.tools(signal) };
         }));

package/dist-server/server/drivers/claude.js

@@ -7,7 +7,7 @@
 // Integrations become MCP servers on the CLI:
 //   - Composio Sessions (connected apps → tools) over streamable HTTP
 //   - the bot's cloud computer (boat.dev) via server/computer-proxy.ts
-//     — screenshot/exec/open_url, the CUA-on-the-box bridge
+//     — screenshot/exec/open_url, the CUA-on-the-boat bridge
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer as createNetServer } from "node:net";
@@ -328,6 +328,7 @@ export const STATIC_CLAUDE_MODELS = {
         { id: "claude-fable-5", label: "Claude Fable 5" },
         { id: "claude-opus-5-5", label: "Claude Opus 5.5", contextWindow: 1_000_000 },
         { id: "claude-opus-5", label: "Claude Opus 5" },
+        { id: "claude-sonnet-5-5", label: "Claude Sonnet 5.5", contextWindow: 1_000_000 },
         { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
         { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" },
     ],
@@ -435,7 +436,7 @@ function askQuestions(ask) {
 function askSummary(ask) {
     const questions = askQuestions(ask);
     if (questions)
-        return askQuestionSummary(questions).slice(0, 300);
+        return askQuestionSummary(questions);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
 /** Where the hook helper reads this thread's current turn token. Stable per
@@ -752,6 +753,109 @@ function firstText(content) {
     }
     return "";
 }
+/** A turn's own cost from the CLI's total_cost_usd, which is not a per-turn
+ * figure: it is "cumulative across turns in streaming-input sessions — each
+ * result carries the running total so far" (2.1.282), and a retained process
+ * runs turn after turn. So a turn costs the growth since the total its
+ * process reported for the turn before — or, for a process's first turn,
+ * since the total the CLI restored on --resume (see restoredCostBase). With
+ * no known start (null) the turn keeps its whole figure. A total that went
+ * down is not the same count, so it is taken whole too rather than booked as
+ * a negative cost. Rounding to 1e-10 USD removes only the float noise of the
+ * subtraction. */
+export function turnCostFromRunningTotal(total, previous) {
+    if (total === null)
+        return null;
+    if (previous === null || total < previous)
+        return total;
+    return Number((total - previous).toFixed(10));
+}
+export function claudeCostSnapshot(total, modelUsage) {
+    if (typeof total !== "number" || !Number.isFinite(total))
+        return null;
+    const count = (value) => (typeof value === "number" && Number.isFinite(value) ? value : 0);
+    const models = {};
+    if (modelUsage && typeof modelUsage === "object" && !Array.isArray(modelUsage)) {
+        for (const [model, raw] of Object.entries(modelUsage)) {
+            if (!raw || typeof raw !== "object")
+                continue;
+            const u = raw;
+            models[model] = [count(u.inputTokens), count(u.cacheReadInputTokens), count(u.cacheCreationInputTokens), count(u.outputTokens)];
+        }
+    }
+    return { total, models };
+}
+/** The running total a resumed session already carried before this
+ * process's first turn. On --resume the CLI (2.1.282) restores the session's
+ * cost from an earlier state — not always the latest one this driver saw —
+ * so that turn's total_cost_usd and modelUsage include the earlier turns.
+ * The restored state is the earlier state that sits inside the new counts
+ * and leaves exactly this turn's own usage: in one model (usage leaves out
+ * side calls such as a Haiku title) or summed over all models (a turn split
+ * between two); nothing restored is 0. When no state fits exactly — the CLI
+ * saved work that never reported a result, like an interrupted turn — the
+ * latest state inside the new counts stands, so that work is booked once,
+ * with this turn. Either way the latest state wins, not the highest total:
+ * a resume that went back to an older state leaves later, lower totals. */
+export function restoredCostBase(earlier, current, usage) {
+    const turn = [usage.input, usage.cacheRead, usage.cacheWrite, usage.output];
+    const nothing = { total: 0, models: {} };
+    let exact = null;
+    let inside = 0;
+    // oldest first: the session's states in the order they were recorded
+    for (const state of [nothing, ...earlier]) {
+        const within = Object.entries(state.models).every(([model, counts]) => counts.every((n, i) => n <= (current.models[model]?.[i] ?? 0)));
+        if (!within)
+            continue;
+        inside = state.total;
+        const growth = Object.entries(current.models).map(([model, counts]) => counts.map((n, i) => n - (state.models[model]?.[i] ?? 0)));
+        const isTurn = (counts) => counts.every((n, i) => n === turn[i]);
+        const summed = turn.map((_, i) => growth.reduce((sum, counts) => sum + counts[i], 0));
+        if (growth.some(isTurn) || isTurn(summed))
+            exact = state.total;
+    }
+    return exact ?? inside;
+}
+/** Each Claude session's latest cost states, so the first turn after a
+ * --resume can tell what the CLI restored — after an app restart too. Small
+ * by design: a few states for the most recent sessions. */
+const COST_HISTORY_FILE = join(DATA_DIR, "claude-cost-history.json");
+const COST_HISTORY_SESSIONS = 100;
+const COST_HISTORY_STATES = 8;
+function isCostSnapshot(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const { total, models } = value;
+    return typeof total === "number" && !!models && typeof models === "object" &&
+        Object.values(models).every((counts) => Array.isArray(counts) && counts.length === 4 && counts.every((n) => typeof n === "number"));
+}
+function readCostHistory() {
+    try {
+        const parsed = JSON.parse(readFileSync(COST_HISTORY_FILE, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return Object.fromEntries(Object.entries(parsed).map(([id, states]) => [id, Array.isArray(states) ? states.filter(isCostSnapshot) : []]));
+    }
+    catch {
+        return {};
+    }
+}
+function recordCostState(sessionId, state) {
+    const history = readCostHistory();
+    const states = [...(history[sessionId] ?? []), state].slice(-COST_HISTORY_STATES);
+    // most recent session last, so the oldest ones are dropped first
+    delete history[sessionId];
+    history[sessionId] = states;
+    const ids = Object.keys(history);
+    for (const id of ids.slice(0, Math.max(0, ids.length - COST_HISTORY_SESSIONS)))
+        delete history[id];
+    try {
+        writeFileAtomic(COST_HISTORY_FILE, JSON.stringify(history), { mode: 0o600 });
+    }
+    catch {
+        // a lost state only means a later resume keeps its whole figure
+    }
+}
 /** Claude's stream-json input accepts the same image source blocks as the
  * Anthropic Messages API. Keep the old string form for text-only turns so a
  * CLI update cannot disturb the overwhelmingly common path. */
@@ -1155,7 +1259,7 @@ export const ClaudeDriver = {
             mcpServers.ogb = { command: process.execPath, args: [PERM_PROXY_PATH, socketPath], env: { ...NODE_ENV_FLAG }, alwaysLoad: true };
             allowed.push("mcp__ogb");
             // The MCP config carries credentials — a Composio consumer key in a
-            // header, the box token in the computer proxy's env, the comms token in
+            // header, the boat token in the computer proxy's env, the comms token in
             // the agents proxy's env. On argv every one of those is world-readable
             // through `ps` for the life of the turn, to any local process. The CLI
             // accepts a FILE for this flag, so the secrets go in a 0600 file that
@@ -1414,11 +1518,12 @@ export const ClaudeDriver = {
                 idleTimer: null,
                 closing: false,
                 stderr: "",
+                costTotal: undefined,
             };
             sessions.set(threadId, session);
             // settles the TURN, not the process: the CLI stays for the next
             // message until it has been quiet for SESSION_IDLE_MS
-            const settle = (ok, stopReason, cost = null, usage) => {
+            const settle = (ok, stopReason, total = null, usage) => {
                 const t = session.turn;
                 if (!t || t.settled)
                     return;
@@ -1450,11 +1555,31 @@ export const ClaudeDriver = {
                 // retry resumes on a fresh process; healthy sibling sessions stay warm.
                 if (stopReason === "update_required")
                     closeSession(threadId, "update required");
+                // `total` is the CLI's running total for this process; the harness
+                // books turn.completed.cost as this turn's own spend
+                const cost = turnCostFromRunningTotal(total, session.costTotal ?? null);
+                if (total !== null)
+                    session.costTotal = total;
                 emit({ ...base(threadId, t.turnId), type: "turn.completed", ok, stopReason, cost, ...(usage ? { usage } : {}) });
                 if (session.child.exitCode === null && !session.closing)
                     armIdle(threadId);
             };
             const currentTurnId = () => session.turn?.turnId ?? turnId;
+            // The process's first result with a cost says what --resume restored,
+            // which its turns are measured from; every result is kept for a later
+            // resume. A result without one (an API error) decides nothing yet.
+            const noteCostState = (total, modelUsage, usage) => {
+                const state = claudeCostSnapshot(total, modelUsage);
+                if (!state)
+                    return;
+                if (session.costTotal === undefined) {
+                    session.costTotal = session.sessionId
+                        ? restoredCostBase(readCostHistory()[session.sessionId] ?? [], state, usage)
+                        : null;
+                }
+                if (session.sessionId)
+                    recordCostState(session.sessionId, state);
+            };
             const handleLine = (line) => {
                 if (session.closing)
                     return;
@@ -1575,11 +1700,19 @@ export const ClaudeDriver = {
                         // and deny approvals while that user turn is still running.
                         if (o.origin?.kind === "task-notification")
                             break;
-                        // result.usage is this invocation's total — one process per turn,
-                        // so it is the turn's figure. cache reads count as input: they
-                        // are billed (at the cache rate) and they fill the window — but
-                        // they are reported separately too, so the UI can show how much
-                        // of the figure was context re-read rather than new text.
+                        // result.usage is this turn's own figure, "per-turn in
+                        // streaming-input sessions" (2.1.282) even on a retained process.
+                        // cache reads count as input: they are billed (at the cache rate)
+                        // and they fill the window — but they are reported separately
+                        // too, so the UI can show how much of the figure was context
+                        // re-read rather than new text. total_cost_usd is instead the
+                        // process's running total; settle() books this turn's share.
+                        noteCostState(o.total_cost_usd, o.modelUsage, {
+                            input: o.usage?.input_tokens || 0,
+                            cacheRead: o.usage?.cache_read_input_tokens || 0,
+                            cacheWrite: o.usage?.cache_creation_input_tokens || 0,
+                            output: o.usage?.output_tokens || 0,
+                        });
                         settle(o.is_error !== true, session.turn?.authFailed
                             ? "auth_required"
                             : session.turn?.updateRequired
@@ -1877,10 +2010,11 @@ export const ClaudeDriver = {
          * summaries can contain paths, commands, or secrets, so the generic
          * `claude -p "prompt"` shape is not safe for review. No tools or MCP
          * servers are mounted in this isolated process. */
-        const generateReview = (prompt, signal) => new Promise((resolve, reject) => {
-            const child = spawnCli(config.cli, ["-p", "--model", config.managedModels?.[0] ?? "claude-haiku-4-5", "--output-format", "text"], {
+        const generateReview = (prompt, signal, onUsage) => new Promise((resolve, reject) => {
+            const model = config.managedModels?.[0] ?? "claude-haiku-4-5";
+            const child = spawnCli(config.cli, ["-p", "--model", model, "--output-format", onUsage ? "json" : "text"], {
                 stdio: ["pipe", "pipe", "pipe"],
-                env: environment(config.managedModels?.[0] ?? "claude-haiku-4-5"),
+                env: environment(model),
             });
             let stdout = "";
             let stderr = "";
@@ -1919,6 +2053,37 @@ export const ClaudeDriver = {
             });
             child.on("error", (error) => finish(error));
             child.on("close", (code) => {
+                if (settled)
+                    return;
+                if (onUsage) {
+                    try {
+                        const result = JSON.parse(stdout);
+                        if (!result || result.type !== "result")
+                            throw new Error("Claude text generation returned no result");
+                        const count = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+                        const cachedInput = count(result.usage?.cache_read_input_tokens);
+                        const inputs = [count(result.usage?.input_tokens), cachedInput, count(result.usage?.cache_creation_input_tokens)]
+                            .filter((value) => value !== undefined);
+                        const models = result.modelUsage && typeof result.modelUsage === "object" && !Array.isArray(result.modelUsage)
+                            ? Object.keys(result.modelUsage) : [];
+                        onUsage({
+                            model: models.length === 1 ? models[0] : models.find(candidate => candidate === model || candidate.startsWith(`${model}-`)) ?? model,
+                            input: inputs.length ? inputs.reduce((sum, value) => sum + value, 0) : undefined,
+                            output: count(result.usage?.output_tokens),
+                            cachedInput,
+                            costUsd: count(result.total_cost_usd),
+                        });
+                        if (result.is_error === true)
+                            throw new Error(typeof result.result === "string" && result.result.trim() ? result.result : stderr.trim() || "Claude text generation failed");
+                        if (typeof result.result !== "string")
+                            throw new Error("Claude text generation returned no text");
+                        stdout = result.result;
+                    }
+                    catch (error) {
+                        finish(error instanceof Error ? error : new Error(String(error)));
+                        return;
+                    }
+                }
                 if (code === 0)
                     finish();
                 else
@@ -2000,7 +2165,7 @@ export const ClaudeDriver = {
                     return () => listeners.delete(listener);
                 },
             },
-            generateText: (prompt, options) => generateReview(prompt, options?.signal),
+            generateText: (prompt, options) => generateReview(prompt, options?.signal, options?.onUsage),
             reviewPermission: generateReview,
             dispose: async () => {
                 try {

package/dist-server/server/drivers/native.js

@@ -11,7 +11,7 @@ export function appendNative(threadId, entry) {
     const file = join(NATIVE_DIR, `${threadId}.ndjson`);
     try {
         // The session-setup messages carry the credentials the agent is handed —
-        // the box and comms tokens ride inside session/new's mcpServers env, and
+        // the boat and comms tokens ride inside session/new's mcpServers env, and
         // an MCP header can carry a Composio key. These files are ordinary
         // 0644 files people paste into bug reports, so values are masked while
         // the shape stays intact.

package/dist-server/server/drivers/openai-chat.js

@@ -64,7 +64,7 @@ export function createOpenAIChatRuntime(options) {
         turnId,
         createdAt: new Date().toISOString(),
     });
-    const complete = async (messages, model, stream, signal, onDelta, tools = []) => {
+    const complete = async (messages, model, stream, signal, onDelta, tools = [], onUsage) => {
         // Idle timer that is renewed on every received chunk during streaming
         const timeoutController = new AbortController();
         let idleTimer = null;
@@ -99,6 +99,17 @@ export function createOpenAIChatRuntime(options) {
             }
             if (!stream || response.headers.get("content-type")?.includes("application/json")) {
                 const json = await response.json();
+                if (onUsage) {
+                    activeSignal.throwIfAborted();
+                    const count = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+                    onUsage({
+                        model: typeof json.model === "string" && json.model.trim() ? json.model : model,
+                        input: count(json.usage?.prompt_tokens),
+                        output: count(json.usage?.completion_tokens),
+                        cachedInput: count(json.usage?.prompt_tokens_details?.cached_tokens),
+                        costUsd: count(json.usage?.cost),
+                    });
+                }
                 const bodyError = providerError(json);
                 if (bodyError)
                     throw new ChatProtocolError(`provider returned a completion error: ${bodyError.slice(0, 200)}`);
@@ -619,7 +630,7 @@ export function createOpenAIChatRuntime(options) {
             provider: options.driverKind,
             capabilities: { ...(options.computerUse ? { computerMcp: options.tools !== false,
                     // Same gate as cloudComputerMcp: with tools off the runtime cannot
-                    // mount the leased Box descriptor either. The fleet invariant test
+                    // mount the leased Boat descriptor either. The fleet invariant test
                     // pins usesCloudComputer === (remoteAgent || cloudComputerMcp).
                     usesCloudComputer: options.tools !== false, cloudComputerMcp: options.tools !== false, localComputerMcp: options.tools !== false,
                     browserMcp: options.tools !== false, nativeImageInput: true, images: true } : {}),
@@ -661,9 +672,9 @@ export function createOpenAIChatRuntime(options) {
                 return () => listeners.delete(listener);
             },
         },
-        generateText: async (prompt, { signal } = {}) => {
+        generateText: async (prompt, { signal, onUsage } = {}) => {
             const model = options.generateModel?.() ?? options.models().default;
-            const { text, reasoning, toolCalls } = await complete([{ role: "user", content: prompt }], model, false, signal);
+            const { text, reasoning, toolCalls } = await complete([{ role: "user", content: prompt }], model, false, signal, undefined, [], onUsage);
             if (toolCalls.length)
                 throw new ChatProtocolError("provider returned tool calls to a text-only helper");
             return text.trim() ? text : reasoning;

package/dist-server/server/drivers/pi.js

@@ -465,7 +465,7 @@ export const PiDriver = {
                 ensurePiInjectModel(turn.model, { ...process.env, ...input.environment });
             }
             // integrations → stdio MCP servers for the pi-mcp-extension. The config
-            // carries credentials (box token, composio key, comms token), so it goes
+            // carries credentials (boat token, composio key, comms token), so it goes
             // into a 0600 temp file removed when the turn settles — never on argv.
             const mcpServers = buildMcpServers(turn);
             let mcpTempDir = null;
@@ -476,7 +476,7 @@ export const PiDriver = {
                 }
                 catch (err) {
                     // A failed write must not leave the temp dir behind — a partial file
-                    // could still hold the box token / composio key / comms token.
+                    // could still hold the boat token / composio key / comms token.
                     try {
                         rmSync(mcpTempDir, { recursive: true, force: true });
                     }
@@ -488,7 +488,7 @@ export const PiDriver = {
             }
             const childArgs = mcpServers ? [...PI_ARGS, "-e", SPAWNED_PROXIES.piMcpExtension] : PI_ARGS;
             // spawnCli can throw synchronously (unresolvable CLI); if it does, the
-            // 0600 temp file with the box token / composio key / comms token must
+            // 0600 temp file with the boat token / composio key / comms token must
             // not be left on disk — settle() never runs because no child existed.
             const child = (() => {
                 try {

package/dist-server/server/group-goal-run.js

@@ -66,12 +66,14 @@ export function parseGroupGoalDecision(text) {
     }
     return { visibleText, decision: null };
 }
-/** Explicit room lead wins. Otherwise prefer an in-room Chief, then the
- * first active member. A goal run never recruits somebody outside the room. */
+/** Explicit room lead (or an Auto room's fallback) wins. Otherwise prefer
+ * an in-room Chief, then the first active member. A goal run never recruits
+ * somebody outside the room. */
 export function selectGroupGoalCoordinator(members, responder) {
     const active = members.filter((member) => !member.hidden);
-    if (responder.kind === "member") {
-        const explicit = active.find((member) => member.id === responder.botId);
+    const lead = responder.kind === "member" ? responder.botId : responder.kind === "auto" ? responder.fallbackBotId : undefined;
+    if (lead) {
+        const explicit = active.find((member) => member.id === lead);
         if (explicit)
             return explicit;
     }

package/dist-server/server/harness-capabilities.js

@@ -20,6 +20,8 @@ const ENVELOPE = {
     skillAuthoring: true,
     sharedComputers: true,
     voiceNotes: true,
+    // Not a tool it adds: a Cloud home only hides its Local VM shell.
+    cloudHome: false,
     botId: "",
 };
 /** Extra card lines for an engine switch, empty when nothing changes. */

package/dist-server/server/hosted-models.js

@@ -2,6 +2,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.js";
+import { cloudHomeConfigured } from "./cloud-home.js";
 import { hostedWorkspaceConfiguration } from "./enterprise.js";
 export const HOSTED_MODEL_POLICY_HEADER = "X-Omb-Hosted-Model-Policy";
 export const HOSTED_MODEL_SETUP_ERROR = "No company models are assigned to this workspace. Ask your administrator to enable model access in Admin.";
@@ -15,10 +16,14 @@ const catalogSchema = z.object({
 }).strict();
 const providerFor = { claude: "anthropic", codex: "openai", opencode: "openrouter" };
 /** Operator-only policy. An ordinary desktop has neither input and keeps its
- * personal providers. Partial policy configuration must never enable them. */
+ * personal providers. Partial policy configuration must never enable them.
+ * A Cloud home never routes to a model gateway: it ignores both inputs
+ * (cloud-home.ts), and its person signs in with their own engines. */
 export function hostedModelPolicy(dataDirectory, env = process.env) {
     if (env.OMB_HOSTED_MODELS === undefined && env.OMB_HOSTED_MODEL_TOKEN === undefined)
         return null;
+    if (cloudHomeConfigured(env))
+        return null;
     const hosted = hostedWorkspaceConfiguration(env);
     if (!hosted?.portalMembership || env.OMB_DESKTOP_PARENT === "1" || !/^omb_workspace_[A-Za-z0-9_-]{43}$/.test(env.OMB_HOSTED_MODEL_TOKEN ?? "")) {
         throw new Error("Hosted model access requires complete portal-managed configuration.");