openmausbot 0.1.90 → 0.1.91

package/dist-server/server/drivers/boatagent.js

@@ -1,10 +1,9 @@
 import { newEventId, newId } from "../contracts.js";
+import { boatCredential, boatProviderApi } from "../included-services.js";
 import { appendNative } from "./native.js";
 import { OMB_ASK_TOOL, answerWithoutPreamble, askQuestionSummary, capAnswerEcho, ombAskProtocolPrompt, parseOmbAskQuestions, questionChoices, stripOmbAskBlock, } from "../../shared/ask-question.js";
 // "boxAgent" is Boat's historical driver kind (catalog and wire); keep it.
 const DRIVER_KIND = "boxAgent";
-// overridable so tests and a dev backend can be pointed at instead of the live provider
-const BOAT_API = process.env.OMB_BOX_API || "https://ascii.dev/api/box/v1";
 const MODELS = {
     default: "claude-fable-5",
     options: [
@@ -20,10 +19,15 @@ const ASK_FENCE_ANY = /(^|\n)[ \t]{0,3}(`{3,}|~{3,})[ \t]*omb-ask\b/;
  * prime-agent, kimi). Which one a model id belongs to comes from the public
  * catalog, `GET /api/provider-models` at the API root: an object keyed by
  * harness, each with its `models`. A bot that arrives here from another engine
- * carries that engine's model id, so this is what lets it keep its model. */
+ * carries that engine's model id, so this is what lets it keep its model. The
+ * root is the API in use (Boat, or Cloud Pro's relay), so it is cached per root. */
 let catalog = null;
-async function loadCatalog() {
-    const root = BOAT_API.replace(/\/api\/box\/v1\/?$/, "");
+let catalogRoot = "";
+async function loadCatalog(api) {
+    const root = api.replace(/\/api\/box\/v1\/?$/, "");
+    if (catalog && catalogRoot === root)
+        return;
+    catalogRoot = root;
     catalog = await fetch(`${root}/api/provider-models`, { signal: AbortSignal.timeout(15_000) })
         .then((res) => (res.ok ? res.json() : null))
         .catch(() => null);
@@ -53,7 +57,11 @@ export const BoatAgentDriver = {
     defaultConfig: () => decodeConfig({}),
     async create(input) {
         const { instanceId, config } = input;
-        const token = input.environment.BOX_TOKEN ?? process.env.BOX_TOKEN ?? "";
+        // The person's own token (instanceConfigs injects it), else Cloud Pro's
+        // included one, with the one base URL each may be sent to. Resolved per
+        // request, like every other Boat call.
+        const ownToken = input.environment.BOX_TOKEN ?? process.env.BOX_TOKEN;
+        const account = () => boatCredential(ownToken);
         const listeners = new Set();
         const active = new Map();
         /** One open ask per thread: the turn-held transport's pending card. The
@@ -75,9 +83,10 @@ export const BoatAgentDriver = {
             createdAt: new Date().toISOString(),
         });
         const api = async (path, opts = {}) => {
-            const res = await fetch(`${BOAT_API}${path}`, {
+            const credential = account();
+            const res = await fetch(`${credential?.api ?? boatProviderApi()}${path}`, {
                 ...opts,
-                headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...opts.headers },
+                headers: { authorization: `Bearer ${credential?.token ?? ""}`, "content-type": "application/json", ...opts.headers },
                 signal: opts.signal ?? AbortSignal.timeout(30_000),
             });
             const body = await res.json().catch(() => null);
@@ -90,7 +99,7 @@ export const BoatAgentDriver = {
             const { threadId } = turn;
             const computer = turn.integrations?.computer;
             const boxId = computer && (!computer.kind || computer.kind === "box") ? computer.boxId : undefined;
-            if (!token)
+            if (!account())
                 throw new Error('box not configured — add {"box":{"token":"…"}} to ~/.openmausbot/config.json');
             if (!boxId) {
                 throw new Error("this bot has no computer yet — open the Computer panel and provision one");
@@ -113,8 +122,7 @@ export const BoatAgentDriver = {
                 .filter((s) => s !== undefined)
                 .join("\n");
             const postPrompt = async (promptText) => {
-                if (!catalog)
-                    await loadCatalog();
+                await loadCatalog(account()?.api ?? boatProviderApi());
                 const started = await api(`/boxes/${boxId}/prompt`, {
                     method: "POST",
                     body: JSON.stringify({ ...providerFor(model), prompt: promptText }),
@@ -355,7 +363,7 @@ export const BoatAgentDriver = {
             return { turnId };
         };
         const snapshot = async () => {
-            if (!token) {
+            if (!account()) {
                 return { state: "unavailable", reason: 'no Boat token — add {"box":{"token":"…"}} to ~/.openmausbot/config.json' };
             }
             try {

package/dist-server/server/drivers/claude.js

@@ -328,6 +328,7 @@ export const STATIC_CLAUDE_MODELS = {
         { id: "claude-fable-5", label: "Claude Fable 5" },
         { id: "claude-opus-5-5", label: "Claude Opus 5.5", contextWindow: 1_000_000 },
         { id: "claude-opus-5", label: "Claude Opus 5" },
+        { id: "claude-sonnet-5-5", label: "Claude Sonnet 5.5", contextWindow: 1_000_000 },
         { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
         { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" },
     ],

package/dist-server/server/group-goal-run.js

@@ -66,12 +66,14 @@ export function parseGroupGoalDecision(text) {
     }
     return { visibleText, decision: null };
 }
-/** Explicit room lead wins. Otherwise prefer an in-room Chief, then the
- * first active member. A goal run never recruits somebody outside the room. */
+/** Explicit room lead (or an Auto room's fallback) wins. Otherwise prefer
+ * an in-room Chief, then the first active member. A goal run never recruits
+ * somebody outside the room. */
 export function selectGroupGoalCoordinator(members, responder) {
     const active = members.filter((member) => !member.hidden);
-    if (responder.kind === "member") {
-        const explicit = active.find((member) => member.id === responder.botId);
+    const lead = responder.kind === "member" ? responder.botId : responder.kind === "auto" ? responder.fallbackBotId : undefined;
+    if (lead) {
+        const explicit = active.find((member) => member.id === lead);
         if (explicit)
             return explicit;
     }

package/dist-server/server/harness-capabilities.js

@@ -20,6 +20,8 @@ const ENVELOPE = {
     skillAuthoring: true,
     sharedComputers: true,
     voiceNotes: true,
+    // Not a tool it adds: a Cloud home only hides its Local VM shell.
+    cloudHome: false,
     botId: "",
 };
 /** Extra card lines for an engine switch, empty when nothing changes. */

package/dist-server/server/included-services.js

@@ -0,0 +1,70 @@
+// Boat cloud computers, ElevenLabs voice and the Jev decision model included
+// with Cloud Pro (docs/cloud-pro.md, "Included Boat computers, voice and
+// decisions").
+// The Admin relays each on its own accounts, so its provider keys never reach
+// this machine; each Cloud home gets its own relay tokens:
+//
+//   OMB_CLOUD_BOAT_URL    + OMB_CLOUD_BOAT_TOKEN     the Boat relay, ending in /api/box/v1
+//   OMB_CLOUD_VOICE_URL   + OMB_CLOUD_VOICE_TOKEN    the ElevenLabs relay, ending in /v1
+//   OMB_CLOUD_DECIDER_URL + OMB_CLOUD_DECIDER_TOKEN  the Jev relay, a Jev base URL
+//
+// An included token is only a fallback. The person's own key (Settings, or
+// BOX_TOKEN / OMB_TTS_KEY / OMB_JEV_API_KEY) always wins, and removing it
+// falls back again, so the credential is resolved on every request, never
+// cached. The relay knows only our account, so each credential goes to one
+// place: an own key to the provider (OMB_BOX_API / OMB_ELEVENLABS_API /
+// decider.baseUrl when set, for dev and tests), an included token to its
+// relay. An included token is never written to config.json, never reported
+// to a client, and never the saved key Settings verifies, rotates or clears.
+import { JEV_DEFAULT_BASE_URL } from "./decider/jev.js";
+export const BOAT_API_DEFAULT = "https://ascii.dev/api/box/v1";
+export const ELEVENLABS_API_DEFAULT = "https://api.elevenlabs.io/v1";
+/** Also on WORKSPACE_CREDENTIAL_ENV (config.ts). */
+export const INCLUDED_TOKEN_ENV = ["OMB_CLOUD_BOAT_TOKEN", "OMB_CLOUD_VOICE_TOKEN", "OMB_CLOUD_DECIDER_TOKEN"];
+function includedService(url, token) {
+    const api = url?.trim().replace(/\/+$/, "");
+    const secret = token?.trim();
+    return api && secret ? { token: secret, api, included: true } : null;
+}
+const includedFrom = (env) => ({
+    boat: includedService(env.OMB_CLOUD_BOAT_URL, env.OMB_CLOUD_BOAT_TOKEN),
+    voice: includedService(env.OMB_CLOUD_VOICE_URL, env.OMB_CLOUD_VOICE_TOKEN),
+    // A Jev base URL as it is: the decider adds /v1/systemone, the relay's one route.
+    decider: includedService(env.OMB_CLOUD_DECIDER_URL, env.OMB_CLOUD_DECIDER_TOKEN),
+});
+let held = null;
+/** At server startup: keep the included tokens in memory and drop them from
+ * the environment, as with the Cloud bootstrap secret, so nothing the server
+ * starts can inherit them. Before this (tests, scripts) they are read from
+ * the environment on each call. */
+export function holdIncludedServices(env = process.env) {
+    held = includedFrom(env);
+    for (const name of INCLUDED_TOKEN_ENV)
+        delete env[name];
+}
+function resolve(own, providerApi, included) {
+    if (own) {
+        // A leased computer descriptor hands the token in use back as a plain
+        // token; the included one still goes only to its relay.
+        if (included && own === included.token)
+            return included;
+        return { token: own, api: providerApi, included: false };
+    }
+    return included;
+}
+export const boatProviderApi = (env = process.env) => env.OMB_BOX_API || BOAT_API_DEFAULT;
+export const elevenLabsProviderApi = (env = process.env) => env.OMB_ELEVENLABS_API || ELEVENLABS_API_DEFAULT;
+/** The Boat credential in use: the person's own token, else the included one. */
+export function boatCredential(own, env = process.env) {
+    return resolve(own, boatProviderApi(env), (held ?? includedFrom(env)).boat);
+}
+/** The ElevenLabs credential in use: the person's own key, else the included one. */
+export function voiceCredential(own, env = process.env) {
+    return resolve(own, elevenLabsProviderApi(env), (held ?? includedFrom(env)).voice);
+}
+/** The decision model's credential in use: the person's own Jev key (saved,
+ * or OMB_JEV_API_KEY) with their `decider.baseUrl` or Jev's own, else the
+ * included token with the relay. `api` is a Jev base URL. */
+export function deciderCredential(own, ownBaseUrl, env = process.env) {
+    return resolve(own?.trim(), ownBaseUrl?.trim() || JEV_DEFAULT_BASE_URL, (held ?? includedFrom(env)).decider);
+}