openmausbot 0.1.90 → 0.1.91

package/dist-server/server/cloud-move.js

@@ -0,0 +1,418 @@
+// Move to Cloud (docs/cloud-pro.md): a person's one-time copy of their local
+// workspace onto their OMB Cloud home. The desktop exports the ordinary
+// encrypted workspace backup (workspace-backup.ts) and uploads it here in
+// parts; this machine then previews and restores it like any other backup,
+// so everything that backup policy keeps out (credentials, sign-ins, pairing
+// and sessions, runtime state) stays where it is on both sides.
+//
+// What this file adds: the workspace's size and contents, a resumable upload
+// slot, the space check for the machine's fixed-size volume, a backup of the
+// Cloud's own workspace taken before it is replaced ("Restore previous Cloud"
+// swaps it back), and the tidying that keeps that backup the only copy left
+// behind. Everything lives under `.backups`, which no snapshot includes and
+// no restore replaces.
+import { createHash, randomBytes } from "node:crypto";
+import { createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statfsSync, writeFileSync } from "node:fs";
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { writeFileAtomic } from "./atomic.js";
+import { MAX_WORKSPACE_BACKUP_FILES, MAX_WORKSPACE_BACKUP_UPLOAD_BYTES, omittedFromWorkspaceBackup, removeWorkspaceBackupJob, stageWorkspaceBackup, } from "./workspace-backup.js";
+/** The part size the desktop sends; a part may be at most CLOUD_MOVE_MAX_PART_BYTES. */
+export const CLOUD_MOVE_PART_BYTES = 16 * 1024 ** 2;
+export const CLOUD_MOVE_MAX_PART_BYTES = 64 * 1024 ** 2;
+export const CLOUD_MOVE_MAX_BYTES = MAX_WORKSPACE_BACKUP_UPLOAD_BYTES;
+export const CLOUD_MOVE_MAX_FILES = MAX_WORKSPACE_BACKUP_FILES;
+/** Headroom kept free on the volume after a move's own files. */
+export const CLOUD_MOVE_SPACE_MARGIN = 256 * 1024 ** 2;
+// Encrypted header plus tag: anything smaller cannot be a backup.
+const MIN_BYTES = 60;
+const SHA256 = /^[a-f0-9]{64}$/;
+// An upload nobody has touched for a day is abandoned, not resumable.
+const UPLOAD_STALE_MS = 24 * 3600_000;
+const fail = (message, status, extra = {}) => Object.assign(new Error(message), { status, ...extra });
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+function rosterLength(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return Array.isArray(value) ? value.length : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+/** What the person would call their work: bots, rooms, and the conversations
+ * they took part in (a starter bot's greeting is not a chat). */
+export function workspaceContents(dataDir) {
+    let chats = 0;
+    const database = join(dataDir, "messages.db");
+    if (existsSync(database)) {
+        const db = new DatabaseSync(database, { timeout: 5_000 });
+        try {
+            const columns = db.prepare("SELECT name FROM pragma_table_info('messages')").all().map((row) => String(row.name));
+            if (columns.length) {
+                const who = columns.includes("role") ? "role" : "json_extract(json, '$.role')";
+                chats = Number(db.prepare(`SELECT COUNT(DISTINCT thread_id) AS chats FROM messages WHERE ${who} = 'user'`).get()?.chats ?? 0);
+            }
+        }
+        finally {
+            db.close();
+        }
+    }
+    return { bots: rosterLength(join(dataDir, "bots.json")), rooms: rosterLength(join(dataDir, "groups.json")), chats };
+}
+/** A fresh machine: its one starter bot at most, no rooms, nobody has chatted. */
+export function isEmptyWorkspace(contents) {
+    return contents.bots <= 1 && contents.rooms === 0 && contents.chats === 0;
+}
+/** Bytes and files a backup of this workspace would carry, by the export's
+ * own rules. An estimate: live files can change before the export. */
+export function workspaceMoveSize(dataDir) {
+    let bytes = 0, files = 0;
+    const walk = (directory, prefix) => {
+        for (const name of readdirSync(directory)) {
+            const path = prefix ? `${prefix}/${name}` : name;
+            if (omittedFromWorkspaceBackup(path))
+                continue;
+            const stat = lstatSync(join(directory, name));
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.isDirectory())
+                walk(join(directory, name), path);
+            else if (stat.isFile()) {
+                bytes += stat.size;
+                files++;
+            }
+            if (files > CLOUD_MOVE_MAX_FILES)
+                return;
+        }
+    };
+    if (existsSync(dataDir))
+        walk(dataDir, "");
+    return { bytes, files };
+}
+export function freeVolumeBytes(path) {
+    const disk = statfsSync(path, { bigint: true });
+    const free = disk.bavail * disk.bsize;
+    return free > BigInt(Number.MAX_SAFE_INTEGER) ? Number.MAX_SAFE_INTEGER : Number(free);
+}
+/** Peak extra space a move of `upload` bytes needs: the upload, its decrypted
+ * copy and its staged files exist together while it is checked; the restore
+ * then installs from the staged copy. Replacing a workspace first backs it up
+ * (a snapshot and its archive, briefly both). */
+export function moveSpaceNeeded(upload, current, replacing) {
+    return 3 * upload + (replacing ? 2 * current : 0) + CLOUD_MOVE_SPACE_MARGIN;
+}
+function privateFolder(path) {
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw fail("Backup storage must be a real folder, not a link.", 500);
+    return path;
+}
+const backupsRoot = (dataDir) => privateFolder(join(dataDir, ".backups"));
+// Reads never create the folder; beginUpload does.
+const uploadFolder = (dataDir) => join(dataDir, ".backups", "cloud-move");
+const uploadMetaPath = (dataDir) => join(uploadFolder(dataDir), "upload.json");
+const uploadPartPath = (dataDir) => join(uploadFolder(dataDir), "upload.part");
+function readUploadMeta(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(uploadMetaPath(dataDir), "utf8"));
+        if (record(value) && typeof value.sha256 === "string" && SHA256.test(value.sha256) && Number.isSafeInteger(value.bytes) && Number.isSafeInteger(value.updatedAt)) {
+            return value;
+        }
+    }
+    catch { /* none, or unreadable: a fresh upload replaces it */ }
+    return null;
+}
+function receivedBytes(dataDir) {
+    try {
+        const stat = lstatSync(uploadPartPath(dataDir));
+        return stat.isFile() ? stat.size : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+export function uploadStatus(dataDir) {
+    const meta = readUploadMeta(dataDir);
+    return meta ? { sha256: meta.sha256, bytes: meta.bytes, received: Math.min(receivedBytes(dataDir), meta.bytes) } : null;
+}
+export function discardUpload(dataDir) {
+    rmSync(uploadPartPath(dataDir), { force: true });
+    rmSync(uploadMetaPath(dataDir), { force: true });
+}
+/** Check a declared upload: its size, file count and SHA-256. */
+export function validUploadDeclaration(input) {
+    if (typeof input.sha256 !== "string" || !SHA256.test(input.sha256))
+        throw fail("This is not a workspace backup.", 400);
+    if (!Number.isSafeInteger(input.bytes) || input.bytes < MIN_BYTES)
+        throw fail("This is not a workspace backup.", 400);
+    if (input.bytes > CLOUD_MOVE_MAX_BYTES)
+        throw fail("This workspace is larger than the 10 GB a move can carry.", 413);
+    if (input.files !== undefined && (!Number.isSafeInteger(input.files) || input.files < 0 || input.files > CLOUD_MOVE_MAX_FILES)) {
+        throw fail("This workspace has more than the 100,000 files a move can carry.", 413);
+    }
+    return { sha256: input.sha256, bytes: input.bytes };
+}
+/** Start an upload, or continue the same file's upload where it stopped. */
+export function beginUpload(dataDir, declared, now = Date.now()) {
+    const existing = readUploadMeta(dataDir);
+    if (existing && existing.sha256 === declared.sha256 && existing.bytes === declared.bytes && existing.updatedAt + UPLOAD_STALE_MS > now && receivedBytes(dataDir) <= declared.bytes) {
+        writeFileAtomic(uploadMetaPath(dataDir), JSON.stringify({ ...existing, updatedAt: now }), { mode: 0o600 });
+        return { ...declared, received: receivedBytes(dataDir) };
+    }
+    discardUpload(dataDir);
+    backupsRoot(dataDir);
+    privateFolder(uploadFolder(dataDir));
+    writeFileSync(uploadPartPath(dataDir), "", { mode: 0o600, flag: "wx" });
+    writeFileAtomic(uploadMetaPath(dataDir), JSON.stringify({ ...declared, updatedAt: now }), { mode: 0o600 });
+    return { ...declared, received: 0 };
+}
+/** Store one part at `offset`. A part already stored is accepted again
+ * without writing; any other offset than the next one answers where the
+ * upload stands (409, `received`). A failed part is cut back off. */
+export async function writeUploadPart(dataDir, sha256, offset, length, body, now = Date.now()) {
+    const meta = readUploadMeta(dataDir);
+    if (!meta || meta.sha256 !== sha256)
+        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+    if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length <= 0 || length > CLOUD_MOVE_MAX_PART_BYTES) {
+        throw fail("Invalid upload part.", 400);
+    }
+    if (offset + length > meta.bytes)
+        throw fail("The upload is larger than the file it declared.", 413);
+    const received = receivedBytes(dataDir);
+    const drain = async () => { for await (const _chunk of body) { /* already stored */ } };
+    if (offset + length <= received) {
+        await drain();
+        return received;
+    }
+    if (offset !== received) {
+        await drain();
+        throw fail("The upload continues from another point.", 409, { received });
+    }
+    const handle = await open(uploadPartPath(dataDir), "r+");
+    let written = 0;
+    try {
+        for await (const chunk of body) {
+            if (written + chunk.length > length)
+                throw fail("The upload part is larger than it declared.", 413);
+            let done = 0;
+            while (done < chunk.length)
+                done += (await handle.write(chunk, done, chunk.length - done, offset + written + done)).bytesWritten;
+            written += chunk.length;
+        }
+        if (written !== length)
+            throw fail("The upload part was incomplete.", 400);
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.truncate(received).catch(() => { });
+        throw error;
+    }
+    finally {
+        await handle.close();
+    }
+    writeFileAtomic(uploadMetaPath(dataDir), JSON.stringify({ ...meta, updatedAt: now }), { mode: 0o600 });
+    return received + length;
+}
+/** The complete upload's path, once its size and SHA-256 match what was declared. */
+export async function completedUpload(dataDir, sha256) {
+    const status = uploadStatus(dataDir);
+    if (!status || status.sha256 !== sha256)
+        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+    if (status.received !== status.bytes)
+        throw fail("The upload is not complete yet.", 409, { received: status.received });
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(uploadPartPath(dataDir), { highWaterMark: 1024 * 1024 }))
+        hash.update(chunk);
+    if (hash.digest("hex") !== sha256) {
+        discardUpload(dataDir);
+        throw fail("The uploaded file was damaged on the way. Start the move again.", 400);
+    }
+    return uploadPartPath(dataDir);
+}
+const previousFolder = (dataDir) => join(dataDir, ".backups", "cloud-previous");
+const nextPreviousFolder = (dataDir) => join(dataDir, ".backups", "cloud-previous.next");
+const moveRestoresPath = (dataDir) => join(dataDir, ".backups", "cloud-move-restores.json");
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function readPrevious(folder) {
+    try {
+        const value = JSON.parse(readFileSync(join(folder, "previous.json"), "utf8"));
+        if (!record(value) || typeof value.password !== "string" || typeof value.createdAt !== "string" || !record(value.contents))
+            return null;
+        if (!lstatSync(join(folder, "workspace.ombbackup")).isFile())
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+/** The previous Cloud that can be put back, never its password. A fresh
+ * Cloud's (its starter bot, nothing else) is kept but not offered. */
+export function previousCloud(dataDir) {
+    const previous = readPrevious(previousFolder(dataDir));
+    if (!previous || isEmptyWorkspace(previous.contents))
+        return null;
+    return { createdAt: previous.createdAt, ...previous.contents, bytes: lstatSync(join(previousFolder(dataDir), "workspace.ombbackup")).size };
+}
+/** Back up this workspace as the next previous Cloud, for the restore
+ * `restoreId`. `create` is createWorkspaceBackup, run by the caller inside
+ * the maintenance gate. It becomes the previous Cloud only once startup has
+ * installed that restore. */
+export async function prepareNextPreviousCloud(dataDir, restoreId, create) {
+    const password = randomBytes(32).toString("base64url");
+    const contents = workspaceContents(dataDir);
+    const created = await create(password);
+    const next = nextPreviousFolder(dataDir);
+    try {
+        backupsRoot(dataDir);
+        rmSync(next, { recursive: true, force: true });
+        privateFolder(next);
+        renameSync(created.path, join(next, "workspace.ombbackup"));
+        const meta = { password, createdAt: new Date().toISOString(), contents, forRestore: restoreId };
+        writeFileAtomic(join(next, "previous.json"), JSON.stringify(meta), { mode: 0o600 });
+        return { createdAt: meta.createdAt, ...contents };
+    }
+    catch (error) {
+        rmSync(next, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        try {
+            removeWorkspaceBackupJob(dataDir, created.id);
+        }
+        catch { /* The export job expires with the others. */ }
+    }
+}
+/** Drop a next previous Cloud whose restore did not commit. */
+export function discardNextPreviousCloud(dataDir) {
+    rmSync(nextPreviousFolder(dataDir), { recursive: true, force: true });
+}
+/** Stage the previous Cloud for an ordinary restore; its archive stays. */
+export async function stagePreviousCloud(dataDir, appVersion) {
+    const previous = readPrevious(previousFolder(dataDir));
+    if (!previous || isEmptyWorkspace(previous.contents))
+        throw fail("There is no previous Cloud to restore.", 404);
+    const archive = join(previousFolder(dataDir), "workspace.ombbackup");
+    const staged = await stageWorkspaceBackup(dataDir, archive, { password: previous.password, currentAppVersion: appVersion });
+    return { ...staged, bytes: lstatSync(archive).size };
+}
+/** The archive size of the previous Cloud (0 without one), for space checks. */
+export function previousCloudArchiveBytes(dataDir) {
+    try {
+        return lstatSync(join(previousFolder(dataDir), "workspace.ombbackup")).size;
+    }
+    catch {
+        return 0;
+    }
+}
+function readMoveRestores(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(moveRestoresPath(dataDir), "utf8"));
+        return Array.isArray(value) ? value.filter((id) => typeof id === "string" && UUID.test(id)) : [];
+    }
+    catch {
+        return [];
+    }
+}
+function writeMoveRestores(dataDir, ids) {
+    backupsRoot(dataDir);
+    if (ids.length)
+        writeFileAtomic(moveRestoresPath(dataDir), JSON.stringify([...new Set(ids)]), { mode: 0o600 });
+    else
+        rmSync(moveRestoresPath(dataDir), { force: true });
+}
+/** Remember a restore made by a move or a swap back, before it commits, so
+ * its safety copy and staged files are tidied once it is installed. */
+export function noteMoveRestore(dataDir, restoreId) {
+    writeMoveRestores(dataDir, [...readMoveRestores(dataDir), restoreId]);
+}
+export function forgetMoveRestore(dataDir, restoreId) {
+    writeMoveRestores(dataDir, readMoveRestores(dataDir).filter((id) => id !== restoreId));
+}
+/** Delete a staged job, and its safety copy, by id: guarded paths only. */
+export function removeMoveFiles(dataDir, id) {
+    if (!UUID.test(id))
+        return;
+    for (const name of [id, `safety-${id}`]) {
+        const path = join(dataDir, ".backups", name);
+        try {
+            const stat = lstatSync(path);
+            if (stat.isDirectory() && !stat.isSymbolicLink())
+                rmSync(path, { recursive: true, force: true });
+        }
+        catch { /* already gone */ }
+    }
+}
+function pendingRestoreId(dataDir) {
+    try {
+        const value = JSON.parse(readFileSync(join(dataDir, ".backups", "pending-restore.json"), "utf8"));
+        return record(value) && typeof value.id === "string" ? value.id : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** At a Cloud home's startup, after any pending restore was applied:
+ * - a next previous Cloud becomes the previous Cloud once its restore is
+ *   installed, and is dropped otherwise;
+ * - moves' and swaps' restores, once settled, keep no safety copy or staged
+ *   files (the previous Cloud is the one undo point);
+ * - an upload nobody has touched for a day is deleted.
+ * Never touches a restore still waiting to be applied. */
+export function tidyCloudMoveStorage(dataDir, restored, now = Date.now()) {
+    if (!existsSync(join(dataDir, ".backups")))
+        return;
+    const pending = pendingRestoreId(dataDir);
+    const next = readPrevious(nextPreviousFolder(dataDir));
+    if (next && next.forRestore !== pending) {
+        if (restored.restored && restored.id === next.forRestore) {
+            rmSync(previousFolder(dataDir), { recursive: true, force: true });
+            renameSync(nextPreviousFolder(dataDir), previousFolder(dataDir));
+        }
+        else
+            discardNextPreviousCloud(dataDir);
+    }
+    else if (!next && existsSync(nextPreviousFolder(dataDir)) && !pending)
+        discardNextPreviousCloud(dataDir);
+    const settled = readMoveRestores(dataDir).filter((id) => id !== pending);
+    for (const id of settled)
+        removeMoveFiles(dataDir, id);
+    writeMoveRestores(dataDir, readMoveRestores(dataDir).filter((id) => id === pending));
+    if (restored.id && settled.includes(restored.id)) {
+        // The receipt must not point at a safety copy that is gone.
+        delete restored.safetyCopyPath;
+        try {
+            const receipt = join(dataDir, ".backups", "last-restore.json");
+            const value = JSON.parse(readFileSync(receipt, "utf8"));
+            if (record(value) && value.id === restored.id && "safetyCopyPath" in value) {
+                delete value.safetyCopyPath;
+                writeFileAtomic(receipt, JSON.stringify(value), { mode: 0o600 });
+            }
+        }
+        catch { /* no receipt */ }
+    }
+    const upload = readUploadMeta(dataDir);
+    if ((upload && upload.updatedAt + UPLOAD_STALE_MS <= now) || (!upload && existsSync(uploadPartPath(dataDir))))
+        discardUpload(dataDir);
+}
+/** Bytes under `.backups`: what backups, safety copies and moves hold on the volume. */
+export function backupsBytes(dataDir) {
+    let bytes = 0;
+    const walk = (directory) => {
+        for (const name of readdirSync(directory)) {
+            const stat = lstatSync(join(directory, name));
+            if (stat.isDirectory() && !stat.isSymbolicLink())
+                walk(join(directory, name));
+            else if (stat.isFile())
+                bytes += stat.size;
+        }
+    };
+    try {
+        walk(join(dataDir, ".backups"));
+    }
+    catch { /* none yet */ }
+    return bytes;
+}

package/dist-server/server/config.js

@@ -14,6 +14,7 @@ import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-ico
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
 import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
+import { cloudHomeConfigured } from "./cloud-home.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -429,6 +430,24 @@ const appConfigSchema = z.object({
             .optional(),
         model: optionalText,
     }).optional(),
+    /** The decision model (server/decider): a fast classifier that picks
+     * things for bots, starting with who answers a room message. `key` is
+     * write-only like every credential; `baseUrl` points at a Jev-compatible
+     * server instead of TypeSafe's (an operator setting with no UI); `jobs`
+     * switches each decision on or off. Not `decisions`: that section is the
+     * authorization log's retention. */
+    decider: z.object({
+        enabled: z.boolean().optional(),
+        provider: z.enum(["jev", "off"]).optional(),
+        key: optionalText,
+        baseUrl: z
+            .string()
+            .trim()
+            .max(2048)
+            .refine((value) => !value || /^https?:\/\//i.test(value), "the decision model address must start with http:// or https://")
+            .optional(),
+        jobs: z.object({ roomRouting: z.boolean().optional() }).optional(),
+    }).optional(),
     /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
     imageGen: z.object({
         provider: z.enum(["openai", "xai", "custom"]).optional(),
@@ -645,9 +664,13 @@ export function routinesInConversationEnabled(cfg) {
     return cfg.features?.routinesInConversation === true;
 }
 /** Workspace-level gate for the experimental built-in browser. A bot's own
- * switch sits under it, so either can withhold the browser. */
-export function builtInBrowserEnabled(cfg) {
-    return cfg.features?.browser === true;
+ * switch sits under it, so either can withhold the browser. Off until the
+ * desktop's first-run welcome turns it on. A Cloud home (cloud-home.ts)
+ * skips that welcome, ships the browser in its image and has no other screen
+ * of its own, so there it is on unless the person switched it off. */
+export function builtInBrowserEnabled(cfg, env = process.env) {
+    const chosen = cfg.features?.browser;
+    return chosen === undefined ? cloudHomeConfigured(env) : chosen === true;
 }
 /** Opt-in computer sharing: the routes, the agent tools, the advertised
  * capability and the desktop connector. Off unless an explicit `true` turns
@@ -723,6 +746,8 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     "profile",
     "language",
     "tts",
+    // no engine reads it: the harness asks it before a turn starts
+    "decider",
     "imageGen",
     "vps",
     "rooms",
@@ -871,6 +896,9 @@ export function loadConfig() {
         cfg.tts.voice = presetVoice;
     if (process.env.OMB_FISH_AUDIO_API_KEY !== undefined)
         cfg.tts.fishKey = process.env.OMB_FISH_AUDIO_API_KEY;
+    cfg.decider = { ...cfg.decider };
+    if (process.env.OMB_JEV_API_KEY !== undefined)
+        cfg.decider.key = process.env.OMB_JEV_API_KEY;
     cfg.imageGen = { ...cfg.imageGen };
     if (process.env.OMB_OPENAI_IMAGE_KEY !== undefined)
         cfg.imageGen.key = process.env.OMB_OPENAI_IMAGE_KEY;
@@ -906,6 +934,7 @@ export function syncCredentialEnv(patch) {
         [patch.opencodeGo?.apiKey, "OPENCODE_API_KEY"],
         [patch.tts?.key, "OMB_TTS_KEY"],
         [patch.tts?.fishKey, "OMB_FISH_AUDIO_API_KEY"],
+        [patch.decider?.key, "OMB_JEV_API_KEY"],
         [patch.imageGen?.key, "OMB_OPENAI_IMAGE_KEY"],
         [patch.imageGen?.customApiKey, "OMB_CUSTOM_IMAGE_KEY"],
     ];
@@ -952,10 +981,17 @@ export const WORKSPACE_CREDENTIAL_ENV = [
     "OPENCODE_API_KEY",
     "OMB_TTS_KEY",
     "OMB_FISH_AUDIO_API_KEY",
+    "OMB_JEV_API_KEY",
     "OMB_OPENAI_IMAGE_KEY",
     "OMB_CUSTOM_IMAGE_KEY",
     "COMPOSIO_API_KEY",
     "OMB_COMPOSIO_BROKER_TOKEN",
+    // Cloud Pro's included Boat, voice and decision relay tokens
+    // (included-services.ts), used only in-process by the Boat, voice and
+    // decider modules.
+    "OMB_CLOUD_BOAT_TOKEN",
+    "OMB_CLOUD_VOICE_TOKEN",
+    "OMB_CLOUD_DECIDER_TOKEN",
     // Harness-private filesystem hints are not credentials themselves, but
     // exposing them to a shell-capable agent points straight at app-owned
     // state. The built-in browser master is delivered privately in memory.
@@ -1037,7 +1073,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -1247,6 +1283,8 @@ function injectedEnvironment(cfg, driver) {
     if (driver === "openai-compat" && cfg.openaiCompat?.url)
         environment.set("OPENAI_COMPAT_URL", cfg.openaiCompat.url);
     // driverKind "boxAgent" and env BOX_TOKEN keep their historical names.
+    // Only the person's own token: without one the driver itself falls back
+    // to Cloud Pro's included token, which never enters an environment map.
     if (driver === "boxAgent" && cfg.box?.token)
         environment.set("BOX_TOKEN", cfg.box.token);
     if (driver === "opencodeGo" && cfg.opencodeGo?.apiKey)