openmausbot 0.1.90 → 0.1.91

package/dist-server/openmausbot.js

@@ -16318,6 +16318,25 @@ var init_proxy_paths = __esm({
   }
 });
 
+// server/enterprise.ts
+function hostedWorkspaceConfigured(env = process.env) {
+  return env.OMB_ADMIN_URL !== void 0 || env.OMB_ADMIN_WORKSPACE !== void 0 || env.OMB_ADMIN_MEMBERSHIP !== void 0;
+}
+var layerSchema, DAY_MS3;
+var init_enterprise = __esm({
+  "server/enterprise.ts"() {
+    "use strict";
+    init_zod();
+    init_proxy_paths();
+    layerSchema = external_exports.object({
+      customer: external_exports.string().min(1),
+      features: external_exports.array(external_exports.string().min(1)),
+      expiresAt: external_exports.string().nullable()
+    });
+    DAY_MS3 = 24 * 60 * 6e4;
+  }
+});
+
 // server/atomic.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { closeSync, fsyncSync, openSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
@@ -17530,7 +17549,7 @@ function displayText(value, multiline = false) {
 }
 function plainText(question, hidden, context) {
   const { input, output, signal } = context;
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     input.setRawMode?.(hidden);
     const rl = createInterface({ input, terminal: hidden });
     let finished = false;
@@ -17541,7 +17560,7 @@ function plainText(question, hidden, context) {
       rl.close();
       output.write("\n");
       if (error51) reject(error51);
-      else resolve12(answer ?? "");
+      else resolve13(answer ?? "");
     };
     const cancel = () => finish(void 0, signal.reason ?? new SetupCancelled());
     signal.addEventListener("abort", cancel, { once: true });
@@ -18817,6 +18836,62 @@ var init_cloud_overflow = __esm({
   }
 });
 
+// server/sessions.ts
+function daysMs(value, fallbackDays) {
+  const days = Number(value);
+  const ok = Number.isInteger(days) && days >= 1 && days <= 3650;
+  return (ok ? days : fallbackDays) * 24 * 60 * 6e4;
+}
+var PAIRING_CODE_TTL_MS, SESSION_TTL_MS, SESSION_MAX_AGE_MS, SESSION_RENEW_WHEN_LEFT_MS, STREAM_TICKET_TTL_MS, scopeSchema, sessionSchema, fileSchema;
+var init_sessions = __esm({
+  "server/sessions.ts"() {
+    "use strict";
+    init_zod();
+    init_atomic();
+    PAIRING_CODE_TTL_MS = 5 * 6e4;
+    SESSION_TTL_MS = daysMs(process.env.OMB_SESSION_TTL_DAYS, 30);
+    SESSION_MAX_AGE_MS = daysMs(process.env.OMB_SESSION_MAX_DAYS, 180);
+    SESSION_RENEW_WHEN_LEFT_MS = SESSION_TTL_MS / 2;
+    STREAM_TICKET_TTL_MS = 5 * 6e4;
+    scopeSchema = external_exports.enum(["admin", "client"]);
+    sessionSchema = external_exports.object({
+      id: external_exports.string().min(1),
+      tokenHash: external_exports.string().length(64),
+      label: external_exports.string().max(80),
+      scopes: external_exports.array(scopeSchema).min(1),
+      createdAt: external_exports.number(),
+      lastSeenAt: external_exports.number(),
+      expiresAt: external_exports.number(),
+      /** Set when the session came from an account sign-in rather than a code. */
+      userId: external_exports.string().max(256).optional(),
+      email: external_exports.string().max(320).optional(),
+      /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
+      membershipAuthority: external_exports.literal("portal").optional()
+    });
+    fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
+  }
+});
+
+// shared/cloud-home.ts
+var init_cloud_home = __esm({
+  "shared/cloud-home.ts"() {
+    "use strict";
+  }
+});
+
+// server/cloud-home.ts
+var CLOUD_PAIRING_NONCE_MS;
+var init_cloud_home2 = __esm({
+  "server/cloud-home.ts"() {
+    "use strict";
+    init_atomic();
+    init_enterprise();
+    init_sessions();
+    init_cloud_home();
+    CLOUD_PAIRING_NONCE_MS = 10 * 6e4;
+  }
+});
+
 // server/config.ts
 import { readFileSync as readFileSync3, mkdirSync as mkdirSync6, existsSync as existsSync6, renameSync as renameSync3 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
@@ -18996,6 +19071,8 @@ function loadConfig() {
   const presetVoice = process.env.OMB_TTS_DEFAULT_VOICE?.trim();
   if (presetVoice && !cfg.tts.voice?.trim() && (cfg.tts.provider ?? "elevenlabs") === "elevenlabs") cfg.tts.voice = presetVoice;
   if (process.env.OMB_FISH_AUDIO_API_KEY !== void 0) cfg.tts.fishKey = process.env.OMB_FISH_AUDIO_API_KEY;
+  cfg.decider = { ...cfg.decider };
+  if (process.env.OMB_JEV_API_KEY !== void 0) cfg.decider.key = process.env.OMB_JEV_API_KEY;
   cfg.imageGen = { ...cfg.imageGen };
   if (process.env.OMB_OPENAI_IMAGE_KEY !== void 0) cfg.imageGen.key = process.env.OMB_OPENAI_IMAGE_KEY;
   if (process.env.OMB_CUSTOM_IMAGE_KEY !== void 0) cfg.imageGen.customApiKey = process.env.OMB_CUSTOM_IMAGE_KEY;
@@ -19029,7 +19106,7 @@ function saveConfig(patch, options = {}) {
   const before = configSaveListeners.size ? structuredClone(disk) : disk;
   const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
   if (storedProfiles.success) disk.browserProfiles = storedProfiles.data;
-  for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+  for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
     const section = checkedPatch[key];
     if (!section) continue;
     const current = jsonObjectSchema.safeParse(disk[key]);
@@ -19215,6 +19292,7 @@ var init_config = __esm({
     init_mcp_registry();
     init_schema();
     init_cloud_overflow();
+    init_cloud_home2();
     optionalText = external_exports.string().optional();
     SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
     LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -19458,6 +19536,19 @@ var init_config = __esm({
         baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the Chatterbox server address must start with http:// or https://").optional(),
         model: optionalText
       }).optional(),
+      /** The decision model (server/decider): a fast classifier that picks
+       * things for bots, starting with who answers a room message. `key` is
+       * write-only like every credential; `baseUrl` points at a Jev-compatible
+       * server instead of TypeSafe's (an operator setting with no UI); `jobs`
+       * switches each decision on or off. Not `decisions`: that section is the
+       * authorization log's retention. */
+      decider: external_exports.object({
+        enabled: external_exports.boolean().optional(),
+        provider: external_exports.enum(["jev", "off"]).optional(),
+        key: optionalText,
+        baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the decision model address must start with http:// or https://").optional(),
+        jobs: external_exports.object({ roomRouting: external_exports.boolean().optional() }).optional()
+      }).optional(),
       /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
       imageGen: external_exports.object({
         provider: external_exports.enum(["openai", "xai", "custom"]).optional(),
@@ -19545,10 +19636,17 @@ var init_config = __esm({
       "OPENCODE_API_KEY",
       "OMB_TTS_KEY",
       "OMB_FISH_AUDIO_API_KEY",
+      "OMB_JEV_API_KEY",
       "OMB_OPENAI_IMAGE_KEY",
       "OMB_CUSTOM_IMAGE_KEY",
       "COMPOSIO_API_KEY",
       "OMB_COMPOSIO_BROKER_TOKEN",
+      // Cloud Pro's included Boat, voice and decision relay tokens
+      // (included-services.ts), used only in-process by the Boat, voice and
+      // decider modules.
+      "OMB_CLOUD_BOAT_TOKEN",
+      "OMB_CLOUD_VOICE_TOKEN",
+      "OMB_CLOUD_DECIDER_TOKEN",
       // Harness-private filesystem hints are not credentials themselves, but
       // exposing them to a shell-capable agent points straight at app-owned
       // state. The built-in browser master is delivered privately in memory.
@@ -19628,6 +19726,14 @@ function ownerPredatesThisBoot(owner) {
 function ownerIsAlive(owner) {
   return !ownerPredatesThisBoot(owner) && processIsAlive2(owner.pid) && ownerIdentityMatches(owner);
 }
+function sameMachine(record3) {
+  if (record3.host === hostname4()) return true;
+  const boot = bootSession();
+  return boot !== null && typeof record3.boot === "string" && record3.boot === boot;
+}
+function otherMachineAdvice(path3) {
+  return ` If OpenMausBot is not running on another computer that shares this folder, quit OpenMausBot, delete ${JSON.stringify(path3)} and start again.`;
+}
 function isLeaseOwner(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   return value.version === 1 && isPid(value.pid) && typeof value.host === "string" && value.host.length > 0 && value.host.length <= 255 && !/[\r\n\0]/.test(value.host) && typeof value.token === "string" && UUID2.test(value.token) && typeof value.createdAt === "number" && Number.isFinite(value.createdAt) && value.createdAt > 0 && (value.boot === void 0 || isBootIdentity(value.boot)) && (value.uptime === void 0 || Number.isInteger(value.uptime) && value.uptime >= 0);
@@ -19773,7 +19879,7 @@ function claimReaperAuthority(leasePath, expected) {
     )) return true;
     const current = readReaper(reaperPath, expected.token);
     if (!current) continue;
-    if (current.host !== candidate.host) {
+    if (!sameMachine(current)) {
       throw leaseError(
         `A stale OpenMausBot data-directory lease is being recovered on another machine. Recovery record: ${JSON.stringify(reaperPath)}.`
       );
@@ -19787,7 +19893,7 @@ function retireDeadOwner(leasePath, expected) {
   if (!claimReaperAuthority(leasePath, expected)) return false;
   const current = readOwner(leasePath);
   if (!current || current.token !== expected.token) return true;
-  if (current.host !== hostname4()) {
+  if (!sameMachine(current)) {
     throw leaseError(
       `The stale OpenMausBot data-directory lease changed ownership to another machine. Lease record: ${JSON.stringify(leasePath)}.`
     );
@@ -19824,9 +19930,9 @@ function assertNoLiveDelegatedChild(dataDir) {
   const childLeasePath = join10(dataDir, DELEGATED_CHILD_DIR, LEASE_NAME);
   const child = readOwner(childLeasePath);
   if (!child) return;
-  if (child.host !== hostname4()) {
+  if (!sameMachine(child)) {
     throw leaseError(
-      `This OpenMausBot data directory still has a delegated server on another machine. Delegated server lease: ${JSON.stringify(childLeasePath)}.`
+      `This OpenMausBot data directory still has a delegated server on another machine. Delegated server lease: ${JSON.stringify(childLeasePath)}.${otherMachineAdvice(childLeasePath)}`
     );
   }
   if (ownerIsAlive(child)) {
@@ -19871,9 +19977,9 @@ function acquireDataDirLeaseInternal(dataDir, options = {}) {
       }
       const current = readOwner(leasePath);
       if (!current) continue;
-      if (current.host !== owner.host) {
+      if (!sameMachine(current)) {
         throw leaseError(
-          `This OpenMausBot data directory is already owned by a process on another machine. Lease record: ${JSON.stringify(leasePath)}.`
+          `This OpenMausBot data directory is already owned by a process on another machine. Lease record: ${JSON.stringify(leasePath)}.${otherMachineAdvice(leasePath)}`
         );
       }
       if (ownerIsAlive(current)) {
@@ -20309,7 +20415,7 @@ async function stopCliTree(child, pid, timeoutMs) {
       while (!settled()) {
         const remaining = deadline - Date.now();
         if (remaining <= 0) return false;
-        await new Promise((resolve12) => setTimeout(resolve12, Math.min(25, remaining)));
+        await new Promise((resolve13) => setTimeout(resolve13, Math.min(25, remaining)));
       }
       return true;
     };
@@ -20320,7 +20426,7 @@ async function stopCliTree(child, pid, timeoutMs) {
     return wait2(1e3);
   }
   if (exited()) return true;
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let timer;
     let finished = false;
     const done = (stopped) => {
@@ -20329,7 +20435,7 @@ async function stopCliTree(child, pid, timeoutMs) {
       clearTimeout(timer);
       child.off("close", closed);
       child.off("exit", closed);
-      resolve12(stopped);
+      resolve13(stopped);
     };
     const closed = () => done(true);
     child.once("close", closed);
@@ -21624,13 +21730,13 @@ function computeBackoff(attempt, random = Math.random) {
 function interruptibleDelay(ms, signal) {
   let timer = null;
   let onCancel = null;
-  const promise2 = new Promise((resolve12) => {
-    timer = setTimeout(() => resolve12("elapsed"), Math.max(1, ms));
+  const promise2 = new Promise((resolve13) => {
+    timer = setTimeout(() => resolve13("elapsed"), Math.max(1, ms));
     timer.unref?.();
-    if (signal?.aborted) return resolve12("cancelled");
+    if (signal?.aborted) return resolve13("cancelled");
     onCancel = () => {
       clearTimeout(timer);
-      resolve12("cancelled");
+      resolve13("cancelled");
     };
     signal?.addEventListener("abort", onCancel, { once: true });
   });
@@ -22026,7 +22132,7 @@ function createAcpDriver(support11) {
           }
           appendNative(threadId, { dir: "out", source: SOURCE, msg: nativeLogMessage(obj) });
         };
-        const request = (method, params, timeoutMs, receive, idleMs, idleMessage) => new Promise((resolve12, reject) => {
+        const request = (method, params, timeoutMs, receive, idleMs, idleMessage) => new Promise((resolve13, reject) => {
           const id = nextId++;
           let timer = null;
           if (timeoutMs) {
@@ -22059,7 +22165,7 @@ function createAcpDriver(support11) {
             // response may arrive before the awaiting continuation resumes.
             resolve: (result) => {
               receive?.(result);
-              resolve12(result);
+              resolve13(result);
             },
             reject,
             timer,
@@ -22475,8 +22581,8 @@ function createAcpDriver(support11) {
         };
         let rejectStartup = (_error) => {
         };
-        const startupAck = turn.startupRecovery ? new Promise((resolve12, reject) => {
-          acknowledge = () => resolve12({ turnId });
+        const startupAck = turn.startupRecovery ? new Promise((resolve13, reject) => {
+          acknowledge = () => resolve13({ turnId });
           rejectStartup = reject;
         }) : null;
         const asks = /* @__PURE__ */ new Map();
@@ -22838,12 +22944,12 @@ ${promptInput.text}` : promptInput.text;
       const snapshot = async () => {
         const env = childEnv();
         if (support11.snapshot) return support11.snapshot(env, config2, instanceId);
-        const version2 = await new Promise((resolve12) => {
+        const version2 = await new Promise((resolve13) => {
           execCli(
             config2.cli,
             ["--version"],
             { timeout: 8e3, env },
-            (err, stdout2, stderr) => resolve12(err ? null : versionFromProbe(stdout2, stderr))
+            (err, stdout2, stderr) => resolve13(err ? null : versionFromProbe(stdout2, stderr))
           );
         });
         if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
@@ -23255,14 +23361,14 @@ var init_antigravity_acp = __esm({
         this.child.stderr.setEncoding("utf8");
         this.child.stderr.on("data", (chunk) => this.consumeDiagnostics(chunk));
         this.child.once("error", (error51) => this.failAll(error51));
-        this.exited = new Promise((resolve12) => {
+        this.exited = new Promise((resolve13) => {
           this.child.once("close", (code, signal) => {
             this.noteStartupDiagnostic(this.diagnosticBuffer);
             this.diagnosticBuffer = "";
             if (!this.closed) this.failAll(new Error(
               `Antigravity ACP exited ${code ?? signal ?? "unexpectedly"}.${this.nativeStartupHint ? ` ${this.nativeStartupHint}` : ""}`
             ));
-            resolve12();
+            resolve13();
           });
         });
       }
@@ -23368,8 +23474,8 @@ var init_antigravity_acp = __esm({
       async closeAndWait(timeoutMs = 7e3) {
         this.close();
         let timer;
-        const timedOut = new Promise((resolve12) => {
-          timer = setTimeout(() => resolve12(false), timeoutMs);
+        const timedOut = new Promise((resolve13) => {
+          timer = setTimeout(() => resolve13(false), timeoutMs);
           timer.unref?.();
         });
         try {
@@ -23878,7 +23984,7 @@ var init_antigravity_runtime = __esm({
     FREE_SPACE_MARGIN = 256 * 1024 * 1024;
     DOWNLOAD_TIMEOUT_MS2 = 45 * 6e4;
     STAGING_PREFIX = ".install-";
-    wait = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
+    wait = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
     INSTALL_RECORD = ".install-complete.json";
     AntigravitySetupError = class extends Error {
       status = 409;
@@ -24047,9 +24153,51 @@ var init_antigravity = __esm({
   }
 });
 
+// server/decider/jev.ts
+var init_jev = __esm({
+  "server/decider/jev.ts"() {
+    "use strict";
+  }
+});
+
+// server/included-services.ts
+function includedService(url2, token) {
+  const api2 = url2?.trim().replace(/\/+$/, "");
+  const secret = token?.trim();
+  return api2 && secret ? { token: secret, api: api2, included: true } : null;
+}
+function resolve6(own, providerApi, included) {
+  if (own) {
+    if (included && own === included.token) return included;
+    return { token: own, api: providerApi, included: false };
+  }
+  return included;
+}
+function boatCredential(own, env = process.env) {
+  return resolve6(own, boatProviderApi(env), (held ?? includedFrom(env)).boat);
+}
+var BOAT_API_DEFAULT, includedFrom, held, boatProviderApi;
+var init_included_services = __esm({
+  "server/included-services.ts"() {
+    "use strict";
+    init_jev();
+    BOAT_API_DEFAULT = "https://ascii.dev/api/box/v1";
+    includedFrom = (env) => ({
+      boat: includedService(env.OMB_CLOUD_BOAT_URL, env.OMB_CLOUD_BOAT_TOKEN),
+      voice: includedService(env.OMB_CLOUD_VOICE_URL, env.OMB_CLOUD_VOICE_TOKEN),
+      // A Jev base URL as it is: the decider adds /v1/systemone, the relay's one route.
+      decider: includedService(env.OMB_CLOUD_DECIDER_URL, env.OMB_CLOUD_DECIDER_TOKEN)
+    });
+    held = null;
+    boatProviderApi = (env = process.env) => env.OMB_BOX_API || BOAT_API_DEFAULT;
+  }
+});
+
 // server/drivers/boatagent.ts
-async function loadCatalog() {
-  const root = BOAT_API.replace(/\/api\/box\/v1\/?$/, "");
+async function loadCatalog(api2) {
+  const root = api2.replace(/\/api\/box\/v1\/?$/, "");
+  if (catalog && catalogRoot === root) return;
+  catalogRoot = root;
   catalog = await fetch(`${root}/api/provider-models`, { signal: AbortSignal.timeout(15e3) }).then((res) => res.ok ? res.json() : null).catch(() => null);
 }
 function decodeConfig(raw) {
@@ -24059,15 +24207,15 @@ function decodeConfig(raw) {
     ...typeof o.askTimeoutMs === "number" ? { askTimeoutMs: o.askTimeoutMs } : {}
   };
 }
-var DRIVER_KIND, BOAT_API, MODELS, ASK_FENCE_ANY, catalog, providerFor, BoatAgentDriver;
+var DRIVER_KIND, MODELS, ASK_FENCE_ANY, catalog, catalogRoot, providerFor, BoatAgentDriver;
 var init_boatagent = __esm({
   "server/drivers/boatagent.ts"() {
     "use strict";
     init_contracts();
+    init_included_services();
     init_native();
     init_ask_question();
     DRIVER_KIND = "boxAgent";
-    BOAT_API = process.env.OMB_BOX_API || "https://ascii.dev/api/box/v1";
     MODELS = {
       default: "claude-fable-5",
       options: [
@@ -24078,6 +24226,7 @@ var init_boatagent = __esm({
     };
     ASK_FENCE_ANY = /(^|\n)[ \t]{0,3}(`{3,}|~{3,})[ \t]*omb-ask\b/;
     catalog = null;
+    catalogRoot = "";
     providerFor = (model) => {
       const slash = model.indexOf("/");
       if (slash > 0 && catalog?.[model.slice(0, slash)]) return { provider: model.slice(0, slash), model: model.slice(slash + 1) };
@@ -24094,7 +24243,8 @@ var init_boatagent = __esm({
       defaultConfig: () => decodeConfig({}),
       async create(input) {
         const { instanceId, config: config2 } = input;
-        const token = input.environment.BOX_TOKEN ?? process.env.BOX_TOKEN ?? "";
+        const ownToken = input.environment.BOX_TOKEN ?? process.env.BOX_TOKEN;
+        const account = () => boatCredential(ownToken);
         const listeners = /* @__PURE__ */ new Set();
         const active = /* @__PURE__ */ new Map();
         const heldAsks = /* @__PURE__ */ new Map();
@@ -24110,9 +24260,10 @@ var init_boatagent = __esm({
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         });
         const api2 = async (path3, opts = {}) => {
-          const res = await fetch(`${BOAT_API}${path3}`, {
+          const credential = account();
+          const res = await fetch(`${credential?.api ?? boatProviderApi()}${path3}`, {
             ...opts,
-            headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...opts.headers },
+            headers: { authorization: `Bearer ${credential?.token ?? ""}`, "content-type": "application/json", ...opts.headers },
             signal: opts.signal ?? AbortSignal.timeout(3e4)
           });
           const body = await res.json().catch(() => null);
@@ -24125,7 +24276,7 @@ var init_boatagent = __esm({
           const { threadId } = turn;
           const computer = turn.integrations?.computer;
           const boxId = computer && (!computer.kind || computer.kind === "box") ? computer.boxId : void 0;
-          if (!token) throw new Error('box not configured \u2014 add {"box":{"token":"\u2026"}} to ~/.openmausbot/config.json');
+          if (!account()) throw new Error('box not configured \u2014 add {"box":{"token":"\u2026"}} to ~/.openmausbot/config.json');
           if (!boxId) {
             throw new Error("this bot has no computer yet \u2014 open the Computer panel and provision one");
           }
@@ -24142,7 +24293,7 @@ var init_boatagent = __esm({
             turn.text
           ].filter((s2) => s2 !== void 0).join("\n");
           const postPrompt = async (promptText) => {
-            if (!catalog) await loadCatalog();
+            await loadCatalog(account()?.api ?? boatProviderApi());
             const started = await api2(`/boxes/${boxId}/prompt`, {
               method: "POST",
               body: JSON.stringify({ ...providerFor(model), prompt: promptText })
@@ -24195,13 +24346,13 @@ var init_boatagent = __esm({
               }
               const requestId = newId();
               let settleHeld;
-              const held = new Promise((resolve12) => {
+              const held2 = new Promise((resolve13) => {
                 const timer = setTimeout(() => settleHeld(null, "timeout"), config2.askTimeoutMs ?? 15 * 6e4);
                 timer.unref?.();
                 settleHeld = (reply2, source2) => {
                   heldAsks.delete(threadId);
                   clearTimeout(timer);
-                  resolve12([reply2, source2]);
+                  resolve13([reply2, source2]);
                 };
               });
               heldAsks.set(threadId, { requestId, settle: settleHeld });
@@ -24217,7 +24368,7 @@ var init_boatagent = __esm({
                 ...choices?.length ? { choices } : {},
                 origin: "output"
               });
-              const [reply, source] = await held;
+              const [reply, source] = await held2;
               emit({ ...base2(threadId, turnId), requestId, type: "request.resolved", behavior: reply !== null ? "answer" : "deny", source });
               if (reply === null || cancelled) {
                 return { ok: ok && !cancelled, stopReason: cancelled ? "interrupted" : stopReason };
@@ -24316,7 +24467,7 @@ var init_boatagent = __esm({
           return { turnId };
         };
         const snapshot = async () => {
-          if (!token) {
+          if (!account()) {
             return { state: "unavailable", reason: 'no Boat token \u2014 add {"box":{"token":"\u2026"}} to ~/.openmausbot/config.json' };
           }
           try {
@@ -24339,15 +24490,15 @@ var init_boatagent = __esm({
             sendTurn,
             interruptTurn: async (threadId) => active.get(threadId)?.cancel(),
             respondToRequest: async (threadId, requestId, decision) => {
-              const held = heldAsks.get(threadId);
-              if (!held || held.requestId !== requestId) return "unavailable";
+              const held2 = heldAsks.get(threadId);
+              if (!held2 || held2.requestId !== requestId) return "unavailable";
               const reply = decision.message?.trim();
               if (decision.behavior === "answer" && reply) {
-                held.settle(decision.message, "user");
+                held2.settle(decision.message, "user");
                 return "answered";
               }
               if (decision.behavior === "deny") {
-                held.settle(null, "user");
+                held2.settle(null, "user");
                 return "rejected";
               }
               return "unavailable";
@@ -24375,7 +24526,7 @@ var init_boatagent = __esm({
 import { randomUUID as randomUUID8 } from "node:crypto";
 import { realpathSync as realpathSync2 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute4, join as join19, resolve as resolve6 } from "node:path";
+import { basename as basename6, dirname as dirname8, isAbsolute as isAbsolute4, join as join19, resolve as resolve7 } from "node:path";
 import { stripVTControlCharacters as stripVTControlCharacters4 } from "node:util";
 function canonicalPath(path3) {
   try {
@@ -24439,7 +24590,7 @@ var init_claude_login_auth = __esm({
         if (!isAbsolute4(home) || env.CLAUDE_CONFIG_DIR && !isAbsolute4(env.CLAUDE_CONFIG_DIR)) {
           throw new Error("Use an absolute HOME and CLAUDE_CONFIG_DIR path for this server's Claude provider before signing in.");
         }
-        const homeKey = canonicalPath(resolve6(env.CLAUDE_CONFIG_DIR || join19(home, ".claude")));
+        const homeKey = canonicalPath(resolve7(env.CLAUDE_CONFIG_DIR || join19(home, ".claude")));
         if (authenticatingHomes.has(homeKey)) {
           throw new Error("A Claude sign-in is already running for this server account. Finish or cancel it before starting another.");
         }
@@ -24535,7 +24686,7 @@ var init_claude_login_auth = __esm({
         if (!isAbsolute4(home) || env.CLAUDE_CONFIG_DIR && !isAbsolute4(env.CLAUDE_CONFIG_DIR)) {
           throw new Error("Use an absolute HOME and CLAUDE_CONFIG_DIR path for this server's Claude provider before signing out.");
         }
-        const homeKey = canonicalPath(resolve6(env.CLAUDE_CONFIG_DIR || join19(home, ".claude")));
+        const homeKey = canonicalPath(resolve7(env.CLAUDE_CONFIG_DIR || join19(home, ".claude")));
         if (authenticatingHomes.has(homeKey)) {
           throw new Error("A Claude sign-in is running for this server account. Finish or cancel it before signing out.");
         }
@@ -24795,12 +24946,12 @@ import { createServer as createNetServer } from "node:net";
 import { homedir as homedir9, tmpdir as tmpdir3 } from "node:os";
 import { join as join21, dirname as dirname9, isAbsolute as isAbsolute5, normalize } from "node:path";
 function claudeAuthStatus(cli, env, run2 = execCli) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     run2(cli, ["auth", "status", "--json"], { timeout: 8e3, maxBuffer: 65536, env }, (_error, stdout2) => {
       try {
         const status = JSON.parse(stdout2);
         if (!status || typeof status !== "object" || !("loggedIn" in status) || status.loggedIn !== true) {
-          return resolve12({ authenticated: false });
+          return resolve13({ authenticated: false });
         }
         const identity = status;
         const boundedText2 = (value, max) => typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\p{Cc}\p{Cf}]/u.test(value) ? value.trim() : void 0;
@@ -24812,9 +24963,9 @@ function claudeAuthStatus(cli, env, run2 = execCli) {
           ...organization ? { organization } : {},
           ...identity.authMethod === "api_key" ? { method: "api-key" } : {}
         };
-        resolve12({ authenticated: true, ...Object.keys(account).length ? { account } : {} });
+        resolve13({ authenticated: true, ...Object.keys(account).length ? { account } : {} });
       } catch {
-        resolve12({ authenticated: false });
+        resolve13({ authenticated: false });
       }
     });
   });
@@ -25094,9 +25245,9 @@ async function createPermissionBroker(opts) {
       unlinkSync3(candidate);
     } catch {
     }
-    let outcome = await new Promise((resolve12) => {
-      attempt.once("listening", () => resolve12("listening"));
-      attempt.once("error", (error51) => resolve12(error51));
+    let outcome = await new Promise((resolve13) => {
+      attempt.once("listening", () => resolve13("listening"));
+      attempt.once("error", (error51) => resolve13(error51));
       attempt.listen(candidate);
     });
     if (outcome === "listening" && process.platform !== "win32") {
@@ -25370,6 +25521,7 @@ var init_claude = __esm({
         { id: "claude-fable-5", label: "Claude Fable 5" },
         { id: "claude-opus-5-5", label: "Claude Opus 5.5", contextWindow: 1e6 },
         { id: "claude-opus-5", label: "Claude Opus 5" },
+        { id: "claude-sonnet-5-5", label: "Claude Sonnet 5.5", contextWindow: 1e6 },
         { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
         { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" }
       ]
@@ -25422,12 +25574,12 @@ var init_claude = __esm({
         await refreshModels();
         let cliVersion = null;
         let cliVersionChecked = false;
-        const readCliVersion = (env) => new Promise((resolve12) => {
+        const readCliVersion = (env) => new Promise((resolve13) => {
           execCli(
             config2.cli,
             ["--version"],
             { timeout: 8e3, env },
-            (err, stdout2) => resolve12(err ? null : stdout2.trim() || null)
+            (err, stdout2) => resolve13(err ? null : stdout2.trim() || null)
           );
         });
         const listeners = /* @__PURE__ */ new Set();
@@ -25466,19 +25618,19 @@ var init_claude = __esm({
         };
         const writeUser = (s2, threadId, promptMsg) => {
           if (!s2.child.stdin.writable || s2.child.stdin.destroyed) return Promise.resolve(false);
-          return new Promise((resolve12) => {
+          return new Promise((resolve13) => {
             try {
               s2.child.stdin.write(JSON.stringify(promptMsg) + "\n", (error51) => {
-                if (error51) return resolve12(false);
+                if (error51) return resolve13(false);
                 appendNative(threadId, {
                   dir: "out",
                   source: "claude.sdk.message",
                   msg: diagnosticClaudeUserMessage(promptMsg)
                 });
-                resolve12(true);
+                resolve13(true);
               });
             } catch {
-              resolve12(false);
+              resolve13(false);
             }
           });
         };
@@ -26189,7 +26341,7 @@ var init_claude = __esm({
           const warning = claudeInheritWarning(env);
           return { state: "available", version: version2, ...auth, ...update ? { update } : {}, ...warning ? { warning } : {}, billing: "subscription" };
         };
-        const generateReview = (prompt, signal, onUsage) => new Promise((resolve12, reject) => {
+        const generateReview = (prompt, signal, onUsage) => new Promise((resolve13, reject) => {
           const model = config2.managedModels?.[0] ?? "claude-haiku-4-5";
           const child = spawnCli(
             config2.cli,
@@ -26208,7 +26360,7 @@ var init_claude = __esm({
             clearTimeout(timer);
             signal?.removeEventListener("abort", onAbort);
             if (error51) reject(error51);
-            else resolve12(stdout2.trim());
+            else resolve13(stdout2.trim());
           };
           const onAbort = () => {
             killCliTree(child);
@@ -26406,9 +26558,9 @@ var init_codex_mcp_names = __esm({
 
 // server/drivers/codex-identity.ts
 import { homedir as homedir11 } from "node:os";
-import { isAbsolute as isAbsolute6, join as join23, resolve as resolve7 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join23, resolve as resolve8 } from "node:path";
 function codexHome(env) {
-  if (env.CODEX_HOME) return isAbsolute6(env.CODEX_HOME) ? resolve7(env.CODEX_HOME) : null;
+  if (env.CODEX_HOME) return isAbsolute6(env.CODEX_HOME) ? resolve8(env.CODEX_HOME) : null;
   const home = userHome(env);
   return isAbsolute6(home) ? join23(home, ".codex") : null;
 }
@@ -26534,7 +26686,7 @@ function decodeCodexSelection(id) {
   return { model: id, modelProvider: MODEL_ID2.test(id) ? OFFICIAL_CODEX_PROVIDER : null };
 }
 function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8e3) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const child = spawnCli(cli, ["app-server"], {
       cwd: homedir12(),
       env,
@@ -26551,7 +26703,7 @@ function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8e3) {
       settled = true;
       clearTimeout(timer);
       killCliTree(child);
-      resolve12(catalog2);
+      resolve13(catalog2);
     };
     const request = (method, params, kind) => {
       const id = nextId++;
@@ -26958,7 +27110,7 @@ var init_codex_instructions = __esm({
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { realpathSync as realpathSync3 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { basename as basename8, dirname as dirname10, isAbsolute as isAbsolute7, join as join26, resolve as resolve8 } from "node:path";
+import { basename as basename8, dirname as dirname10, isAbsolute as isAbsolute7, join as join26, resolve as resolve9 } from "node:path";
 import { stripVTControlCharacters as stripVTControlCharacters5 } from "node:util";
 function canonicalPath2(path3) {
   try {
@@ -27016,7 +27168,7 @@ var init_codex_device_auth = __esm({
         if (!isAbsolute7(home) || env.CODEX_HOME && !isAbsolute7(env.CODEX_HOME)) {
           throw new Error("Use an absolute HOME and CODEX_HOME path for this server's Codex provider before signing in.");
         }
-        const homeKey = canonicalPath2(resolve8(env.CODEX_HOME || join26(home, ".codex")));
+        const homeKey = canonicalPath2(resolve9(env.CODEX_HOME || join26(home, ".codex")));
         if (authenticatingHomes2.has(homeKey)) {
           throw new Error("A ChatGPT sign-in is already running for this server account. Finish or cancel it before starting another.");
         }
@@ -27095,7 +27247,7 @@ var init_codex_device_auth = __esm({
         if (!isAbsolute7(home) || env.CODEX_HOME && !isAbsolute7(env.CODEX_HOME)) {
           throw new Error("Use an absolute HOME and CODEX_HOME path for this server's Codex provider before signing out.");
         }
-        const homeKey = canonicalPath2(resolve8(env.CODEX_HOME || join26(home, ".codex")));
+        const homeKey = canonicalPath2(resolve9(env.CODEX_HOME || join26(home, ".codex")));
         if (authenticatingHomes2.has(homeKey)) {
           throw new Error("A ChatGPT sign-in is running for this server account. Finish or cancel it before signing out.");
         }
@@ -27833,7 +27985,7 @@ var init_codex = __esm({
                 msg: codexNativeLogMessage(obj)
               });
             };
-            const request = (method, params, timeoutMs = 6e4) => new Promise((resolve12, reject) => {
+            const request = (method, params, timeoutMs = 6e4) => new Promise((resolve13, reject) => {
               const id = nextId++;
               if (method === "config/read") sensitiveResponseIds.add(id);
               const timer = setTimeout(() => {
@@ -27861,7 +28013,7 @@ var init_codex = __esm({
                       handleNotification(notification);
                     }
                   }
-                  resolve12(v2);
+                  resolve13(v2);
                 },
                 reject: (e) => {
                   clearTimeout(timer);
@@ -28461,22 +28613,22 @@ var init_codex = __esm({
         };
         const snapshot = async () => {
           const env = childEnv();
-          const version2 = await new Promise((resolve12) => {
+          const version2 = await new Promise((resolve13) => {
             execCli(
               config2.cli,
               ["--version"],
               { timeout: 8e3, env },
-              (err, stdout2) => resolve12(err ? null : stdout2.trim())
+              (err, stdout2) => resolve13(err ? null : stdout2.trim())
             );
           });
           if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
           if (config2.managed) return { state: "available", version: version2, authenticated: Boolean(input.environment.OPENMAUSBOT_COMPANY_API_KEY && input.environment.CODEX_HOME), billing: "metered" };
-          const authenticated = await new Promise((resolve12) => {
+          const authenticated = await new Promise((resolve13) => {
             execCli(
               config2.cli,
               ["login", "status"],
               { timeout: 8e3, env },
-              (err, stdout2, stderr) => resolve12(!err && /^logged in\b/im.test(`${stdout2}
+              (err, stdout2, stderr) => resolve13(!err && /^logged in\b/im.test(`${stdout2}
 ${stderr ?? ""}`))
             );
           });
@@ -31507,7 +31659,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve12.call(this, root, ref);
+      let _sch = resolve13.call(this, root, ref);
       if (_sch === void 0) {
         const schema4 = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -31534,7 +31686,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve12(root, ref) {
+    function resolve13(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -32165,7 +32317,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve12(baseURI, relativeURI, options) {
+    function resolve13(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
       const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
@@ -32449,7 +32601,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize: normalize2,
-      resolve: resolve12,
+      resolve: resolve13,
       resolveComponent,
       equal,
       serialize,
@@ -36946,10 +37098,11 @@ function snapshotBoatConfig(cfg) {
   return { box: cfg.box ? { token: cfg.box.token } : void 0 };
 }
 function boatFetch(cfg, path3, opts = {}) {
-  return fetch(`${BOAT_API2}${path3}`, {
+  const account = boatAccount(cfg);
+  return fetch(`${account?.api ?? boatProviderApi()}${path3}`, {
     ...opts,
     headers: {
-      authorization: `Bearer ${cfg.box?.token}`,
+      authorization: `Bearer ${account?.token}`,
       "content-type": "application/json",
       ...opts.headers
     }
@@ -36988,9 +37141,9 @@ async function runCommand(cfg, boxId, command, { timeoutMs = 12e4, signal } = {}
     stderr: body?.stderr ?? ""
   };
 }
-function boatInventoryProblem(status, body) {
+function boatInventoryProblem(status, body, included = false) {
   if (status === 401 || status === 403) {
-    return "boat.dev rejected the Boat API key \u2014 update it in Settings \u2192 Connections";
+    return included ? INCLUDED_BOAT_UNAVAILABLE : "boat.dev rejected the Boat API key \u2014 update it in Settings \u2192 Connections";
   }
   if (status === 429) return "boat.dev is rate-limiting this account \u2014 wait a minute and refresh";
   const message2 = typeof body?.message === "string" ? body.message.trim() : "";
@@ -37009,7 +37162,11 @@ async function listBoatPages(cfg) {
       return { ok: false, problem: "Could not reach boat.dev to list cloud computers \u2014 check your connection and refresh" };
     }
     if (!listed.ok || !Array.isArray(listed.body?.boxes)) {
-      return { ok: false, problem: boatInventoryProblem(listed.status, listed.body), credentialRejected: listed.status === 401 || listed.status === 403 };
+      return {
+        ok: false,
+        problem: boatInventoryProblem(listed.status, listed.body, usesIncludedBoat(cfg)),
+        credentialRejected: listed.status === 401 || listed.status === 403
+      };
     }
     boats.push(...listed.body.boxes);
     const next = listed.body?.pageInfo?.nextCursor;
@@ -37075,6 +37232,12 @@ async function findBoat(cfg, botId) {
   }
   return found;
 }
+function boatAccount(cfg) {
+  return boatCredential(cfg.box?.token);
+}
+function usesIncludedBoat(cfg) {
+  return boatAccount(cfg)?.included === true;
+}
 function panelShotCommand({ width = PANEL_FRAME_WIDTH, quality = PANEL_FRAME_QUALITY, framePath = PANEL_PATH, nativeSize = false } = {}) {
   return [
     "export DISPLAY=${DISPLAY:-:0}",
@@ -37136,16 +37299,16 @@ async function screenshotBoat(cfg, botId, knownBoatId, options) {
   if (!data) throw new Error("could not read the frame back from the box");
   return { png: data, format: "jpeg" };
 }
-var shellQuote2, BOAT_API2, READY, DEFAULT_BOAT_TTL_SECONDS, TRIAL_BOAT_TTL_SECONDS, BOAT_INVENTORY_PAGE_SIZE, MAX_BOAT_INVENTORY_PAGES, BOAT_ID3, scopedBoatPrefixCache, boatIdCache, QUIESCE_BROWSER, PANEL_PATH, PANEL_FRAME_WIDTH, PANEL_FRAME_QUALITY, PANEL_FRAME_FFMPEG_Q, SHOT_CMD, MAX_FRAME_BYTES, FRAME_TOO_LARGE;
+var shellQuote2, READY, DEFAULT_BOAT_TTL_SECONDS, TRIAL_BOAT_TTL_SECONDS, BOAT_INVENTORY_PAGE_SIZE, MAX_BOAT_INVENTORY_PAGES, BOAT_ID3, scopedBoatPrefixCache, boatIdCache, QUIESCE_BROWSER, INCLUDED_BOAT_UNAVAILABLE, PANEL_PATH, PANEL_FRAME_WIDTH, PANEL_FRAME_QUALITY, PANEL_FRAME_FFMPEG_Q, SHOT_CMD, MAX_FRAME_BYTES, FRAME_TOO_LARGE;
 var init_boat = __esm({
   "server/boat.ts"() {
     "use strict";
     init_config();
     init_environment();
+    init_included_services();
     init_boat_create_idempotency();
     init_boat_delete_journal();
     shellQuote2 = (value) => `'${value.replace(/'/g, "'\\''")}'`;
-    BOAT_API2 = process.env.OMB_BOX_API || "https://ascii.dev/api/box/v1";
     READY = /* @__PURE__ */ new Set(["idle", "ready", "running"]);
     DEFAULT_BOAT_TTL_SECONDS = 8 * 60 * 60;
     TRIAL_BOAT_TTL_SECONDS = 2 * 60 * 60;
@@ -37158,6 +37321,7 @@ var init_boat = __esm({
       'for name in chrome google-chrome chromium chromium-browser; do pid=$(pgrep -o -x "$name" 2>/dev/null || true); [ -z "$pid" ] || kill -TERM "$pid" 2>/dev/null || true; done',
       "for i in 1 2 3 4 5 6 7 8; do if ! pgrep -x chrome >/dev/null 2>&1 && ! pgrep -x google-chrome >/dev/null 2>&1 && ! pgrep -x chromium >/dev/null 2>&1 && ! pgrep -x chromium-browser >/dev/null 2>&1; then break; fi; sleep 0.25; done"
     ].join("; ");
+    INCLUDED_BOAT_UNAVAILABLE = "Cloud Pro's included cloud computers aren't available right now. Try again later.";
     PANEL_PATH = "/tmp/ogb-panel.jpg";
     PANEL_FRAME_WIDTH = 1920;
     PANEL_FRAME_QUALITY = 85;
@@ -37614,13 +37778,13 @@ var init_chat_mcp_tools = __esm({
         if (this.closed) throw new Error("MCP session closed");
         const id = this.nextId++;
         try {
-          return await new Promise((resolve12, reject) => {
+          return await new Promise((resolve13, reject) => {
             const finish = (error51, value) => {
               clearTimeout(timer);
               signal.removeEventListener("abort", cancel);
               this.pending.delete(id);
               if (error51) reject(error51);
-              else resolve12(value);
+              else resolve13(value);
             };
             const cancel = () => {
               try {
@@ -37701,7 +37865,7 @@ function createChatToolApproval(options) {
     ask(tool2, summary) {
       if (closed || options.signal.aborted) return Promise.resolve(false);
       const ask = { id: newId(), tool: tool2, summary };
-      return new Promise((resolve12) => {
+      return new Promise((resolve13) => {
         let timer;
         const card = {
           kind: "permission",
@@ -37712,7 +37876,7 @@ function createChatToolApproval(options) {
             options.signal.removeEventListener("abort", abort);
             const allowed = decision?.allowed === true;
             options.resolved(ask, allowed, source);
-            resolve12(allowed);
+            resolve13(allowed);
           }
         };
         const abort = () => card.finish("system");
@@ -37726,7 +37890,7 @@ function createChatToolApproval(options) {
     question(tool2, summary, questions) {
       if (closed || options.signal.aborted) return Promise.resolve(null);
       const ask = { id: newId(), tool: tool2, summary };
-      return new Promise((resolve12) => {
+      return new Promise((resolve13) => {
         let timer;
         const card = {
           kind: "question",
@@ -37737,7 +37901,7 @@ function createChatToolApproval(options) {
             options.signal.removeEventListener("abort", abort);
             const reply = typeof decision?.message === "string" && decision.message.length > 0 ? decision.message : null;
             options.resolvedQuestion(ask, reply !== null, source);
-            resolve12(reply);
+            resolve13(reply);
           }
         };
         const abort = () => card.finish("system");
@@ -38142,8 +38306,8 @@ function createOpenAIChatRuntime(options) {
       })
     });
     let resolveDone;
-    const done = new Promise((resolve12) => {
-      resolveDone = resolve12;
+    const done = new Promise((resolve13) => {
+      resolveDone = resolve13;
     });
     const turnEntry = { abort, turnId, done, approval, asides: [] };
     active.set(turn.threadId, turnEntry);
@@ -39644,10 +39808,10 @@ function decodeCursorAuthText(text4) {
   return null;
 }
 function execText(run2, cli, args, env) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     run2(cli, args, { timeout: EXEC_TIMEOUT_MS, env }, (err, stdout2) => {
-      if (err) return resolve12(null);
-      resolve12(String(stdout2 ?? ""));
+      if (err) return resolve13(null);
+      resolve13(String(stdout2 ?? ""));
     });
   });
 }
@@ -39844,7 +40008,7 @@ function parseOpenCodeModelsOutput(stdout2) {
   return { default: (preferred ?? options[0]).id, options };
 }
 function runOpenCodeModels(cli, environment, verbose) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     execCli(
       cli,
       ["models", ...verbose ? ["--verbose"] : []],
@@ -39854,7 +40018,7 @@ function runOpenCodeModels(cli, environment, verbose) {
           reject(new Error(stderr?.trim() || error51.message, { cause: error51 }));
           return;
         }
-        resolve12(stdout2);
+        resolve13(stdout2);
       }
     );
   });
@@ -47331,13 +47495,13 @@ function hermesAcpModelsTimeoutMs(env) {
   return Number.isInteger(parsed) && parsed > 0 && parsed <= 2147483647 ? parsed : HERMES_ACP_MODELS_DEFAULT_TIMEOUT_MS;
 }
 async function fetchHermesAcpModels(cli, env) {
-  return await new Promise((resolve12) => {
+  return await new Promise((resolve13) => {
     let child;
     try {
       const resolved = resolveCli(cli, ["acp"], env);
       child = spawn6(resolved.command, resolved.args, { stdio: ["pipe", "pipe", "ignore"], env, windowsHide: true });
     } catch {
-      return resolve12([]);
+      return resolve13([]);
     }
     let settled = false;
     let timer;
@@ -47358,7 +47522,7 @@ async function fetchHermesAcpModels(cli, env) {
         }
       } catch {
       }
-      resolve12(out);
+      resolve13(out);
     };
     timer = setTimeout(() => done([]), hermesAcpModelsTimeoutMs(env));
     child.once("error", () => done([]));
@@ -47833,7 +47997,7 @@ function readPiDefaultModel(env) {
 }
 async function fetchPiModels(cli, env) {
   const child = spawnCli(cli, PI_ARGS, { stdio: ["pipe", "pipe", "pipe"], env });
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let buf = "";
     let done = false;
     const fallbackDefault = readPiDefaultModel(env);
@@ -47844,7 +48008,7 @@ async function fetchPiModels(cli, env) {
         killCliTree(child);
       } catch {
       }
-      resolve12(catalog2);
+      resolve13(catalog2);
     };
     const timer = setTimeout(() => finish({ default: "", options: [] }), 15e3);
     timer.unref?.();
@@ -47874,12 +48038,12 @@ async function fetchPiModels(cli, env) {
   });
 }
 async function updatePiModelCatalog(cli, env) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     execCli(
       cli,
       PI_MODEL_UPDATE_ARGS,
       { env, timeout: 6e4, maxBuffer: 1024 * 1024 },
-      (error51) => resolve12(!error51)
+      (error51) => resolve13(!error51)
     );
   });
 }
@@ -48043,13 +48207,13 @@ var init_pi = __esm({
             }
             responseWaiters.clear();
           };
-          const awaitResponse = (command, timeoutMs = 2e4, key = command) => new Promise((resolve12, reject) => {
+          const awaitResponse = (command, timeoutMs = 2e4, key = command) => new Promise((resolve13, reject) => {
             const timer = setTimeout(() => {
               responseWaiters.delete(key);
               reject(new Error(`pi ${command} timed out`));
             }, timeoutMs);
             timer.unref?.();
-            responseWaiters.set(key, { resolve: resolve12, reject, timer });
+            responseWaiters.set(key, { resolve: resolve13, reject, timer });
           });
           child.stdin.on("error", () => rejectWaiters(new Error("pi stdin closed")));
           const send = (obj) => {
@@ -48395,7 +48559,7 @@ ${turn.text}` : turn.text;
           return { turnId };
         };
         const snapshot = async () => {
-          const version2 = await new Promise((resolve12) => {
+          const version2 = await new Promise((resolve13) => {
             const child = spawnCli(config2.cli, ["--version"], {
               stdio: ["ignore", "pipe", "pipe"],
               env: piEnvironment({ ...process.env, ...input.environment })
@@ -48408,16 +48572,16 @@ ${turn.text}` : turn.text;
                 killCliTree(child);
               } catch {
               }
-              resolve12(null);
+              resolve13(null);
             }, 8e3);
             timer.unref?.();
             child.on("error", () => {
               clearTimeout(timer);
-              resolve12(null);
+              resolve13(null);
             });
             child.on("close", () => {
               clearTimeout(timer);
-              resolve12(out.trim() || null);
+              resolve13(out.trim() || null);
             });
           });
           if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
@@ -48910,7 +49074,7 @@ __export(cli_setup_exports, {
 });
 import { spawn as spawn7 } from "node:child_process";
 import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join39, resolve as resolve9 } from "node:path";
+import { join as join39, resolve as resolve10 } from "node:path";
 import { randomUUID as randomUUID13 } from "node:crypto";
 async function inspect(id, entry) {
   const registry2 = new ProviderRegistry(BUILT_IN_DRIVERS);
@@ -48943,7 +49107,7 @@ async function runSetupCli(cli, args, environment = {}) {
   resetPathCache();
 }
 function assertDataDir(dataDir) {
-  if (resolve9(dataDir) !== resolve9(DATA_DIR)) throw new Error("Setup data directory mismatch. Restart the CLI with --data-dir.");
+  if (resolve10(dataDir) !== resolve10(DATA_DIR)) throw new Error("Setup data directory mismatch. Restart the CLI with --data-dir.");
 }
 function checkStoredConfig(dataDir) {
   try {
@@ -49358,7 +49522,7 @@ import { spawn as spawn8 } from "node:child_process";
 import { createHash as createHash13, randomBytes as randomBytes3, randomUUID as randomUUID14 } from "node:crypto";
 import { chmodSync as chmodSync7, constants as constants2, copyFileSync, existsSync as existsSync18, mkdirSync as mkdirSync21, readFileSync as readFileSync26, readdirSync as readdirSync3, renameSync as renameSync6, rmSync as rmSync8, statSync as statSync5, unlinkSync as unlinkSync7, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir20, tmpdir as tmpdir5 } from "node:os";
-import { delimiter as delimiter6, dirname as dirname12, join as join42, resolve as resolve10 } from "node:path";
+import { delimiter as delimiter6, dirname as dirname12, join as join42, resolve as resolve11 } from "node:path";
 function browserRestoreKey(session) {
   if (!/^[A-Za-z0-9_.-]{1,96}$/.test(session)) throw new Error("Invalid browser session.");
   return `omb-${createHash13("sha256").update(session).digest("hex")}`;
@@ -49454,7 +49618,7 @@ async function closeBrowserSession(binaryPath, env, timeoutMs = 15e3) {
     } catch {
       return false;
     }
-    await new Promise((resolve12) => setTimeout(resolve12, Math.min(25, Math.max(1, deadline - Date.now()))));
+    await new Promise((resolve13) => setTimeout(resolve13, Math.min(25, Math.max(1, deadline - Date.now()))));
   }
   return false;
 }
@@ -49524,7 +49688,7 @@ function onPath(env, platform, exists) {
   for (const part of (pathValue ?? "").split(delimiter6)) {
     const dir = part.trim().replace(/^"|"$/gu, "");
     if (!dir) continue;
-    const candidate = resolve10(dir, executableName(platform));
+    const candidate = resolve11(dir, executableName(platform));
     if (exists(candidate)) return candidate;
   }
   return null;
@@ -49533,7 +49697,7 @@ function packagedBrowser(options) {
   const resources = (options.env ?? process.env).OMB_RESOURCES_PATH;
   if (!resources) return null;
   try {
-    return browserBundlePaths(join42(resolve10(resources), "browser-engine"), `${options.platform ?? process.platform}-${options.arch ?? process.arch}`);
+    return browserBundlePaths(join42(resolve11(resources), "browser-engine"), `${options.platform ?? process.platform}-${options.arch ?? process.arch}`);
   } catch {
     return null;
   }
@@ -49546,7 +49710,7 @@ function resolveAgentBrowserBinary(options = {}) {
   const platform = options.platform ?? process.platform;
   const exists = options.exists ?? existsSync18;
   const override = env.OMB_AGENT_BROWSER_PATH?.trim();
-  if (override) return resolve10(override) && exists(resolve10(override)) ? resolve10(override) : null;
+  if (override) return resolve11(override) && exists(resolve11(override)) ? resolve11(override) : null;
   const bundle = packagedBrowser(options);
   if (bundle && exists(bundle.directory)) return completePackage(bundle, exists) ? bundle.engine : null;
   const pinned = pinnedBinaryPath(options.dataDir, platform, options.arch);
@@ -49616,7 +49780,7 @@ async function installAgentBrowserBinary(options = {}) {
 }
 function ensureChrome(binaryPath, options = {}) {
   const bundle = packagedBrowser(options);
-  if (!options.withDeps && bundle && resolve10(binaryPath) === bundle.engine && completePackage(bundle, existsSync18)) {
+  if (!options.withDeps && bundle && resolve11(binaryPath) === bundle.engine && completePackage(bundle, existsSync18)) {
     options.log?.("agent-browser: the bundled browser is ready; no download needed");
     return Promise.resolve();
   }
@@ -49716,7 +49880,7 @@ function agentBrowserIntegration(input) {
     if (sourceEnv[name]) env[name] = sourceEnv[name];
   }
   const bundle = packagedBrowser({ env: sourceEnv, platform: input.platform, arch: input.arch });
-  if (!env.AGENT_BROWSER_EXECUTABLE_PATH && bundle && resolve10(input.binaryPath) === bundle.engine && completePackage(bundle, existsSync18)) {
+  if (!env.AGENT_BROWSER_EXECUTABLE_PATH && bundle && resolve11(input.binaryPath) === bundle.engine && completePackage(bundle, existsSync18)) {
     env.AGENT_BROWSER_EXECUTABLE_PATH = bundle.chrome;
   }
   return { command: input.binaryPath, args: ["mcp", "--tools", "core", "--no-webmcp"], env };
@@ -49833,7 +49997,7 @@ import { spawn as spawn9 } from "node:child_process";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { closeSync as closeSync6, existsSync as existsSync19, mkdirSync as mkdirSync22, openSync as openSync6, readFileSync as readFileSync27 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
-import { dirname as dirname13, join as join43, resolve as resolve11 } from "node:path";
+import { dirname as dirname13, join as join43, resolve as resolve12 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
@@ -50431,13 +50595,13 @@ function writePrivateToken(runtimeRoot2, token, { fileSystem, processId, identif
 }
 async function waitForExit(child, milliseconds) {
   if (child.exitCode !== null || child.signalCode !== null) return;
-  await new Promise((resolve12) => {
+  await new Promise((resolve13) => {
     let settled = false;
     const finish = () => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve12();
+      resolve13();
     };
     child.once("exit", finish);
     const timer = setTimeout(finish, milliseconds);
@@ -50601,8 +50765,8 @@ function createManagedCompanionTunnel({
       child = spawned;
       const cancellationController = new AbortController();
       let resolveCancellation;
-      const cancellation = new Promise((resolve12) => {
-        resolveCancellation = resolve12;
+      const cancellation = new Promise((resolve13) => {
+        resolveCancellation = resolve13;
       });
       let cancelled = false;
       attemptHandle = {
@@ -50618,8 +50782,8 @@ function createManagedCompanionTunnel({
       let terminated = false;
       let expectedStop = false;
       let resolveExit;
-      const exit = new Promise((resolve12) => {
-        resolveExit = resolve12;
+      const exit = new Promise((resolve13) => {
+        resolveExit = resolve13;
       });
       const onTerminated = () => {
         if (terminated) return;
@@ -50653,8 +50817,8 @@ function createManagedCompanionTunnel({
         }
         if (Date.now() >= deadline) break;
         await Promise.race([
-          new Promise((resolve12) => {
-            const timer = setTimeout(resolve12, verifyIntervalMs);
+          new Promise((resolve13) => {
+            const timer = setTimeout(resolve13, verifyIntervalMs);
             timer.unref?.();
           }),
           exit,
@@ -51434,18 +51598,8 @@ function sharedSignIn(lists) {
   return lists.members.length > 0 || lists.admins.length > 1 || [...lists.admins, ...lists.members].some((entry) => entry.trim().startsWith("@"));
 }
 
-// server/enterprise.ts
-init_zod();
-init_proxy_paths();
-var layerSchema = external_exports.object({
-  customer: external_exports.string().min(1),
-  features: external_exports.array(external_exports.string().min(1)),
-  expiresAt: external_exports.string().nullable()
-});
-var DAY_MS3 = 24 * 60 * 6e4;
-function hostedWorkspaceConfigured(env = process.env) {
-  return env.OMB_ADMIN_URL !== void 0 || env.OMB_ADMIN_WORKSPACE !== void 0 || env.OMB_ADMIN_MEMBERSHIP !== void 0;
-}
+// server/cli.ts
+init_enterprise();
 
 // server/request-auth.ts
 function resolveLoopbackTrust(input) {
@@ -52372,7 +52526,7 @@ function tenantIo(owner, file2, action, content, mode) {
 function defaultFleetDeps() {
   return {
     isRoot: () => typeof process.getuid === "function" && process.getuid() === 0,
-    run: (argv) => new Promise((resolve12) => {
+    run: (argv) => new Promise((resolve13) => {
       const [command, ...args] = argv;
       let output = "";
       try {
@@ -52382,10 +52536,10 @@ function defaultFleetDeps() {
         };
         child.stdout.on("data", receive);
         child.stderr.on("data", receive);
-        child.once("error", (error51) => resolve12({ code: null, output: `${output}${error51.message}` }));
-        child.once("close", (code) => resolve12({ code, output }));
+        child.once("error", (error51) => resolve13({ code: null, output: `${output}${error51.message}` }));
+        child.once("close", (code) => resolve13({ code, output }));
       } catch (error51) {
-        resolve12({ code: null, output: error51 instanceof Error ? error51.message : String(error51) });
+        resolve13({ code: null, output: error51 instanceof Error ? error51.message : String(error51) });
       }
     }),
     pathExists: (path3) => {
@@ -52434,7 +52588,7 @@ ${line}
           if (response.ok) return true;
         } catch {
         }
-        await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+        await new Promise((resolve13) => setTimeout(resolve13, 1e3));
       }
       return false;
     }
@@ -52653,17 +52807,17 @@ import { createServer } from "node:http";
 import { dirname as dirname3 } from "node:path";
 var MAX_BODY = 256 * 1024;
 function readBody(req) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     let text4 = "";
     req.on("data", (chunk) => {
       text4 += chunk.toString("utf8");
       if (text4.length > MAX_BODY) reject(Object.assign(new Error("request too large"), { status: 413 }));
     });
     req.on("end", () => {
-      if (!text4.trim()) return resolve12({});
+      if (!text4.trim()) return resolve13({});
       try {
         const value = JSON.parse(text4);
-        resolve12(value && typeof value === "object" && !Array.isArray(value) ? value : {});
+        resolve13(value && typeof value === "object" && !Array.isArray(value) ? value : {});
       } catch {
         reject(Object.assign(new Error("body must be JSON"), { status: 400 }));
       }
@@ -52833,9 +52987,9 @@ async function startFleetAgent(options, io) {
   const server = createFleetAgent(options);
   mkdirSync4(dirname3(options.socketPath), { recursive: true, mode: 493 });
   if (existsSync4(options.socketPath)) rmSync3(options.socketPath, { force: true });
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     server.once("error", reject);
-    server.listen(options.socketPath, () => resolve12());
+    server.listen(options.socketPath, () => resolve13());
   });
   chmodSync2(options.socketPath, 432);
   if (options.group) {
@@ -52902,14 +53056,14 @@ function explainTailscaleFailure(reason) {
   }
 }
 function run(cli, args, timeoutMs) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     execFile(
       cli,
       args,
       { timeout: timeoutMs, killSignal: "SIGKILL", maxBuffer: 16 * 1024 * 1024, env: tailscaleEnvironment() },
       (error51, stdout2, stderr) => {
         const code = error51 && "code" in error51 && typeof error51.code === "number" ? error51.code : error51 ? null : 0;
-        resolve12({ ok: !error51, stdout: String(stdout2 ?? ""), stderr: String(stderr ?? ""), code });
+        resolve13({ ok: !error51, stdout: String(stdout2 ?? ""), stderr: String(stderr ?? ""), code });
       }
     );
   });
@@ -53345,7 +53499,7 @@ function parseArgs(argv, env = process.env) {
     };
     try {
       if (arg === "--port") options.port = Number(value());
-      else if (arg === "--data-dir") options.dataDir = resolve11(value());
+      else if (arg === "--data-dir") options.dataDir = resolve12(value());
       else if (arg === "--label") options.label = value();
       else if (arg === "--public-url") options.publicUrl = value().replace(/\/+$/, "");
       else if (arg === "--tailscale") options.tailscale = true;
@@ -53382,8 +53536,8 @@ function parseArgs(argv, env = process.env) {
         options.email = value();
       } else if (options.command === "fleet" && arg === "--admin") options.admins = [...options.admins ?? [], value()];
       else if (options.command === "fleet" && arg === "--member") options.members = [...options.members ?? [], value()];
-      else if (options.command === "fleet" && arg === "--brand") options.brandFile = resolve11(value());
-      else if (options.command === "fleet" && arg === "--anthropic-key-file") options.anthropicKeyFile = resolve11(value());
+      else if (options.command === "fleet" && arg === "--brand") options.brandFile = resolve12(value());
+      else if (options.command === "fleet" && arg === "--anthropic-key-file") options.anthropicKeyFile = resolve12(value());
       else if (options.command === "fleet" && arg === "--cap") options.cap = Number(value());
       else if (options.command === "fleet" && arg === "--license-key") options.licenseKey = value();
       else if (options.command === "fleet" && arg === "--memory") options.memory = value();
@@ -53498,7 +53652,7 @@ function defaultIo() {
 }
 function serverVersion(here = HERE2) {
   try {
-    const parsed = JSON.parse(readFileSync27(resolve11(here, "..", "package.json"), "utf8"));
+    const parsed = JSON.parse(readFileSync27(resolve12(here, "..", "package.json"), "utf8"));
     const version2 = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "version") : void 0;
     return typeof version2 === "string" && version2 ? version2 : "0.0.0";
   } catch {
@@ -53935,7 +54089,7 @@ async function runBrowser(options, io = defaultIo()) {
 }
 function serverEntry(here = HERE2) {
   const bundled = join43(here, "index.js");
-  const root = resolve11(here, "..");
+  const root = resolve12(here, "..");
   if (existsSync19(bundled)) {
     const staticDir2 = [join43(root, "dist"), join43(here, "..", "ui")].find((d) => existsSync19(join43(d, "index.html"))) ?? null;
     const skillsDir = existsSync19(join43(root, "skills")) ? join43(root, "skills") : null;