openmausbot 0.1.90 → 0.1.91

package/dist-server/server/index.js

@@ -15,7 +15,8 @@ import { selectReplay, DEFAULT_REBUILD_BYTES, MAX_SUMMARY_BYTES } from "./contex
 import { draftSummary, foldPoint } from "./compaction-summary.js";
 import { compactBudget, contextWindowFor, shouldCompact } from "./context-budget.js";
 import { autoCompactWindow } from "./drivers/claude.js";
-import { SharedComputers, sharedComputerOperation, sharedComputerRegistration } from "./shared-computers.js";
+import { provenRequestPerson, SharedComputers, sharedComputerOperation, sharedComputerRegistration } from "./shared-computers.js";
+import { cloudHomeLendingRefusal, createCloudRoutineAuthors } from "./cloud-lending.js";
 import { SharedComputerControl } from "./shared-computer-control.js";
 import { RoomHandoffs } from "./room-handoffs.js";
 import { assertRequestTarget, guardedRequestPath, requestConflict, requestNeedsInput, requestSourceForCard } from "./guarded-requests.js";
@@ -60,7 +61,7 @@ import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, liv
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmRecreatableOnDemand, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -103,7 +104,9 @@ import { ProviderRegistry } from "./harness/registry.js";
 import { ManagedDesktopProviders } from "./managed-desktop.js";
 import { computerKindForResource, ManagedDesktopPolicy } from "./managed-policy.js";
 import { hostedModelPolicy, HOSTED_MODEL_POLICY_HEADER, HOSTED_PROVIDER_SETTINGS_ERROR } from "./hosted-models.js";
-import { CLOUD_IGNORED_KEYS, CLOUD_PAIRING_PATH, cloudHomeConfiguration, createCloudPairing, readSignedBody } from "./cloud-home.js";
+import { boatNotConfiguredMessage, CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_IGNORED_KEYS, CLOUD_PAIRING_PATH, cloudHomeConfiguration, cloudHomeOffersPlace, cloudHomePlaceRefusal, createCloudPairing, readSignedBody, } from "./cloud-home.js";
+import { createCloudMoveRoutes } from "./cloud-move-http.js";
+import { holdIncludedServices } from "./included-services.js";
 import { selectDefaultModelSelection, withNewBotEffort } from "./default-model-selection.js";
 import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, peerApprovalFailure, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerDeliveryReceipt } from "./peer-delivery.js";
@@ -111,6 +114,8 @@ import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
 import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
 import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sectionKey, Store, titleFromLlm, toWireTask, } from "./store.js";
 import * as tts from "./tts/index.js";
+import { createDecider, deciderIncludedHere, deciderReady, deciderSavePatch, describeDecider } from "./decider/index.js";
+import { decideRoomResponder } from "./decider/room-routing.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
 import { buildRecoveryText, buildTurnContext, engineIsFresh, NATIVELY_REPLAYING_DRIVER_KINDS, peerMessageText } from "./turn-context.js";
 import { Handoffs, handedStateUsable, recordHanded, renderUnseen, sessionStart, unseenMessages, withUnseenMessages } from "./delta-context.js";
@@ -129,7 +134,7 @@ import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefault
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
-import { buildSystemPrompt, userProfileSystemPrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
+import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, discoverExistingPoolLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { LocalVmIdleTimer } from "./local-vm-idle.js";
@@ -208,6 +213,7 @@ import { ROUTES, dispatchRoutes } from "./routes/table.js";
 import { createHostedSlackRoutes } from "./routes/hosted-slack.js";
 import { createBotPresetRoutes } from "./routes/bot-presets.js";
 import { createBotMemoryRoutes } from "./routes/bot-memory.js";
+import { createDeciderRoutes } from "./routes/decider.js";
 const PORT = Number(process.env.OMB_PORT || process.env.OGB_PORT || 8799);
 const WEBHOOK_PORT = Number(process.env.OMB_WEBHOOK_PORT || PORT + 1);
 // Behind a proxy or tunnel, the base URL senders should use (docs/self-hosting.md).
@@ -274,6 +280,17 @@ const sharedComputers = new SharedComputers(id => sessions.isLive(id));
 // OMB Cloud Pro home machine (server/cloud-home.ts, docs/cloud-pro.md). A
 // partial or invalid boot contract stops the server here, before it serves.
 const CLOUD_HOME = cloudHomeConfiguration();
+/** Lending a computer to this server (the shared-computer routes, the two
+ * agent tools, the advertised capability): the maintainer flag anywhere, and
+ * always on an OMB Cloud home, where it is the person's own Mac lent to their
+ * own Cloud (docs/cloud-pro.md, "Let my Cloud use this Mac"). */
+const lendingEnabled = () => sharedComputersEnabled(cfg) || CLOUD_HOME !== null;
+/** On a Cloud home every lent computer and every turn belong to one person. */
+const CLOUD_HOME_LENDER = "cloud-home";
+/** Routines whose instructions the Cloud home's owner wrote, and manual runs
+ * the owner started: the only routine turns that may use a lent Mac. */
+const cloudRoutineAuthors = CLOUD_HOME ? createCloudRoutineAuthors(join(DATA_DIR, "lending-routines.json")) : null;
+const ownerStartedRoutineRuns = new Set();
 const cloudPairing = CLOUD_HOME ? createCloudPairing({ secret: CLOUD_HOME.bootstrapSecret, sessions }) : null;
 if (CLOUD_HOME) {
     // The signing secret is held in memory from here on, and a platform
@@ -286,6 +303,9 @@ if (CLOUD_HOME) {
     for (const warning of CLOUD_HOME.warnings)
         console.warn(`cloud home: ${warning}`);
 }
+// Cloud Pro's included Boat, voice and decision relay tokens, when the Admin
+// set them: held in memory from here on, like the signing secret.
+holdIncludedServices();
 // Who each thread is for, when a signed-in person can be named (server-private).
 const threadStarters = new ThreadStarters(join(DATA_DIR, "thread-starters.json"));
 const commandAllowlist = new CommandAllowlistStore(join(DATA_DIR, "command-allowlist.json"));
@@ -341,6 +361,9 @@ bindThreadLogCapProvider(() => threadEventLogMaxBytes(cfg));
 // The decision log keeps month files for at least this many days. Read per
 // prune, so a Settings change applies at the next one without a restart.
 bindDecisionRetention(() => decisionRetentionDays(cfg.decisions?.retentionDays));
+// The decision model (server/decider): reads cfg per call, so a Settings
+// save applies to the next decision. It never throws into a turn.
+const decider = createDecider({ config: () => cfg, dataDir: DATA_DIR });
 const customDomainVerifier = createCustomDomainVerifier({ environmentId: ENVIRONMENT_ID });
 // "Sign in with your email" on /pair: the allow-list is read per call so a
 // Settings change or an env bootstrap applies without a restart.
@@ -438,6 +461,74 @@ function threadPersonKey(threadId) {
         : thread.findLast((message) => message.role === "user");
     return linePersonKey(request) ?? threadStarters.get(threadId);
 }
+/** The person whose lent computers this bot turn may use, or null.
+ * Fail closed: only the person whose own message the harness proved started
+ * this exact turn generation (continuations of that same request keep it).
+ * A routine, a webhook, a room, a bot's delegated or peer turn, the owner on
+ * this machine (who lends nothing to itself) and anything unprovable act for
+ * nobody here. Deliberately not the usage ledger's trigger, which defaults to
+ * the owner. */
+function sharedComputerPrincipal(capability) {
+    // A Cloud home lends the owner's Mac only to turns that provably act for
+    // the owner (server/cloud-lending.ts): their own conversation from one of
+    // their devices, or a routine they wrote. Never a guest, a webhook, a room
+    // or a line someone else slipped in.
+    if (CLOUD_HOME)
+        return cloudHomeLendingRefusal(cloudLendingTurn(capability)) === null ? CLOUD_HOME_LENDER : null;
+    return provenRequestPerson(directRequestOwners.get(capability.threadId), capability.generation, (messageId) => linePersonKey(store.messagesFor(capability.threadId).find((message) => message.id === messageId)));
+}
+/** What the lending rule needs to know about one bot turn on a Cloud home. */
+function cloudLendingTurn(capability) {
+    return {
+        request: directRequestOwners.get(capability.threadId),
+        generation: capability.generation,
+        thread: store.messagesFor(capability.threadId),
+        ownerPerson: cloudOwnerPerson,
+        cardAnswerer: cloudCardAnswerer,
+        routineRun: () => {
+            const run = activeRoutineRunForThread(capability.threadId);
+            if (!run || run.threadId !== capability.threadId || store.taskByThread(capability.botId, capability.threadId)?.routineRunId !== run.id)
+                return null;
+            return {
+                triggerSource: run.triggerSource ?? (run.manual ? "manual" : "schedule"),
+                ownerStarted: ownerStartedRoutineRuns.has(run.id),
+                // What the run snapshotted, on the schedule its routine has now.
+                ownerAuthored: ((routine) => Boolean(routine) && cloudRoutineAuthors?.authored(run.routineId, {
+                    ...routine, prompt: run.prompt, target: run.target, botId: run.botId, groupId: run.groupId, attachments: run.attachments, runOn: run.runOn,
+                }) === true)(routines?.listRoutines().find((candidate) => candidate.id === run.routineId)),
+            };
+        },
+    };
+}
+/** What a bot on a Cloud home is told when its conversation cannot use the
+ * owner's lent Mac because someone else wrote in it. The bot relays it. */
+const LENDING_SOMEONE_ELSE = "Someone else wrote in this conversation, so it can't use your Mac. Start a new conversation to use it.";
+/** Whose lent computers a status reader may see: on a Cloud home, only the
+ * owner's own devices (admin sessions) see the lent Mac, never a guest or a
+ * local process; elsewhere, the person behind the asking session. */
+function sessionLendingPrincipal(auth) {
+    if (CLOUD_HOME)
+        return cloudOwnerSession(auth) ? CLOUD_HOME_LENDER : null;
+    return auth.kind === "session" ? personKey(auth.session) : null;
+}
+/** On a Cloud home: a request from one of the owner's own devices. The
+ * Admin's signed pairing gives the desktop an admin session; a guest the
+ * owner pairs with chat-only access has client scope. Loopback is not the
+ * owner here: nothing the person does reaches a Cloud home that way, only
+ * processes on the machine (a bot's shell) do. */
+function cloudOwnerSession(auth) {
+    return auth.kind === "session" && auth.scopes.includes("admin");
+}
+/** On a Cloud home: whether a message's person key is one of the owner's own
+ * devices right now (a live admin session with that key). */
+function cloudOwnerPerson(person) {
+    return Boolean(person) && sessions.list().some((session) => session.scopes.includes("admin") && personKey(session) === person);
+}
+/** On a Cloud home, a session that is not one of the owner's own devices may
+ * not answer a card of any kind. */
+function cloudCardRefusal(auth) {
+    return auth.scopes.includes("admin") ? null : "Only the owner of this Cloud can answer this card.";
+}
 /** Whose session may answer a card. The provider CLI's own approval modes and
  * the harness's proposals stay exactly as they are; this adds no card, gate
  * or prompt, it only decides whose answer to an existing card counts.
@@ -454,6 +545,11 @@ function cardAnswerRefusal(auth, threadId, requestId, behavior) {
             ? "A local service can only decline this request. Approve or answer it in OpenMausBot while signed in."
             : null;
     }
+    // A Cloud home is one person's: a device paired with chat-only access (a
+    // guest) may read along but never answer, or its words would reach the
+    // owner's turn, and through it a lent Mac (docs/cloud-pro.md).
+    if (CLOUD_HOME)
+        return cloudCardRefusal(auth);
     if (auth.scopes.includes("admin") || !sharedMembership())
         return null;
     const known = [threadStarters.get(threadId), cardRequesterKey(threadId, requestId)].filter((person) => Boolean(person));
@@ -497,7 +593,19 @@ function decisionActorFor(auth) {
 function cardAnswererFor(auth) {
     if (auth.kind === "loopback")
         return auth.trust === "service" ? { kind: "worker" } : { kind: "loopback" };
-    return { kind: "session", name: (auth.session.email ?? auth.session.label ?? "").trim() || "Signed-in user" };
+    return { kind: "session", name: (auth.session.email ?? auth.session.label ?? "").trim() || "Signed-in user",
+        ...(CLOUD_HOME ? { person: personKey(auth.session) } : {}) };
+}
+/** On a Cloud home, who is answering a card right now, by request id: the
+ * answer reaches the turn before `answeredBy` is written, and a lending turn
+ * must know whose words it just received (server/cloud-lending.ts). */
+const cloudCardAnswersInFlight = new Map();
+/** The person who answered a card, as far as lending on a Cloud home is
+ * concerned: the recorded answerer, else whoever is answering it now. */
+function cloudCardAnswerer(card) {
+    if (card.answeredBy)
+        return card.answeredBy.kind === "session" ? card.answeredBy.person : undefined;
+    return card.requestId ? cloudCardAnswersInFlight.get(card.requestId) : undefined;
 }
 /** Answer a card as `auth`: the decision rows written meanwhile name the
  * answerer, and a card this answer settled records who settled it. A card
@@ -507,6 +615,8 @@ async function answeringCardAs(auth, threadId, requestId, work) {
         const card = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId)?.card;
         return Boolean(card && !card.answered && !card.dismissed && !card.expired);
     })();
+    if (CLOUD_HOME && open)
+        cloudCardAnswersInFlight.set(requestId, auth.kind === "session" ? personKey(auth.session) : undefined);
     try {
         await withDecisionActor(decisionActorFor(auth), work);
     }
@@ -516,6 +626,8 @@ async function answeringCardAs(auth, threadId, requestId, work) {
         if (message && card && !card.answeredBy && card.answered !== "unavailable" && (card.answered || card.dismissed)) {
             store.patchMessage(threadId, message.id, { card: { ...card, answeredBy: cardAnswererFor(auth) } });
         }
+        if (CLOUD_HOME && open)
+            cloudCardAnswersInFlight.delete(requestId);
     }
 }
 // ── bot visibility (server/bot-visibility.ts) ──────────────────────────
@@ -771,7 +883,7 @@ function adminAuditPlan(method, path) {
     if (path.startsWith("/api/internal/") || path.startsWith("/api/testing/"))
         return null;
     const plan = {
-        config: requiredScope(method, path, { sharedComputers: sharedComputersEnabled(cfg) }) === "admin",
+        config: requiredScope(method, path, { sharedComputers: lendingEnabled() }) === "admin",
         createsBots: method === "POST" && (path === "/api/bots" || path === "/api/teams/import" || path === "/api/org-library/add"),
         createsWebhook: method === "POST" && path === "/api/webhooks",
         pairing: method === "POST" && path === "/api/auth/pairing",
@@ -1068,6 +1180,18 @@ const companyRuntimeStarted = new Promise(resolve => { companyRuntimeReady = res
 /** The enrolled organisation's desktop policy: in memory only, read-only, and
  * inert (null) unless Electron's enrolled parent sends one. */
 const managedPolicy = new ManagedDesktopPolicy({ onChange: () => broadcast({ kind: "config", ...configStatus() }) });
+/** A computer kind this server will not use, refused before anything is
+ * prepared: a Cloud home never offers this computer or a Local VM
+ * (cloud-home.ts), and an enrolled organisation may disallow any kind. */
+function computerPlaceRefusal(kind) {
+    const cloudHome = CLOUD_HOME ? cloudHomePlaceRefusal(kind === "thisComputer" ? "local" : kind === "localVm" ? "vm" : "cloud") : undefined;
+    if (cloudHome)
+        return { message: cloudHome, code: "cloud_home" };
+    const managed = managedPolicy.computerRefusal(kind);
+    return managed ? { message: managed, code: "managed_policy" } : undefined;
+}
+/** Cloud chosen with no Boat account: a Cloud home suggests the browser, not a Local VM. */
+const BOAT_NOT_CONFIGURED = boatNotConfiguredMessage(Boolean(CLOUD_HOME));
 /** Why the organisation refuses this instance for bots, or undefined. */
 function policyModelRefusal(instance) {
     const engine = BUILT_IN_DRIVERS.find(driver => driver.driverKind === instance.driverKind)?.metadata.displayName;
@@ -1352,7 +1476,10 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
             OMB_SKILL_AUTHORING_ENABLED: skillAuthoring ? "1" : "0",
             // The shared-computer tools are advertised only while the workspace
             // gate is on; the routes behind them refuse regardless.
-            OMB_SHARED_COMPUTERS_ENABLED: sharedComputersEnabled(cfg) ? "1" : "0",
+            OMB_SHARED_COMPUTERS_ENABLED: lendingEnabled() ? "1" : "0",
+            // A Cloud home offers no this computer and no Local VM (cloud-home.ts),
+            // so select_computer lists neither and vm_exec is not shown.
+            OMB_CLOUD_HOME: CLOUD_HOME ? "1" : "0",
             // Same capability rule for voice: the tool is offered only when this
             // bot can actually speak, and the route re-checks on every call.
             OMB_VOICE_NOTES: (() => {
@@ -1603,11 +1730,11 @@ function releaseTurnResources(owner) {
     }
 }
 async function bindTurnComputer(owner, resource, exclusive = false) {
-    // Every computer claim passes here: a kind the organisation disallows is
-    // refused at claim time, whichever path selected it.
-    const kind = computerKindForResource(resource), refusal = kind && managedPolicy.computerRefusal(kind);
+    // Every computer claim passes here: a kind the organisation disallows, or a
+    // Cloud home never offers, is refused at claim time, whichever path selected it.
+    const kind = computerKindForResource(resource), refusal = kind && computerPlaceRefusal(kind);
     if (refusal)
-        throw Object.assign(new Error(refusal), { code: "managed_policy" });
+        throw Object.assign(new Error(refusal.message), { code: refusal.code });
     const active = () => activeInternalGenerationByThread.get(owner.threadId) === owner.generation &&
         turnResourceOwners.get(owner.threadId)?.generation === owner.generation;
     let waitingMessage;
@@ -2464,6 +2591,13 @@ function checkedGroupResponder(value, memberIds) {
         return { kind: "everyone" };
     if (responder.kind === "mentions")
         return { kind: "mentions" };
+    if (responder.kind === "auto") {
+        if (responder.fallbackBotId === undefined || responder.fallbackBotId === null)
+            return { kind: "auto" };
+        return typeof responder.fallbackBotId === "string" && memberIds.includes(responder.fallbackBotId)
+            ? { kind: "auto", fallbackBotId: responder.fallbackBotId }
+            : null;
+    }
     if (responder.kind === "member" &&
         typeof responder.botId === "string" &&
         memberIds.includes(responder.botId)) {
@@ -2619,7 +2753,8 @@ function previewSystemPrompt(bot) {
         { id: "plan", label: "Surface", text: previewPlan.computer === undefined ? "" : surfacePrompt({
                 computer: previewPlan.computer && previewPlan.computer !== "off" && computerPromptKind ? previewPlan.computer : null,
                 browser: previewPlan.computer === undefined ? false : previewPlan.browser,
-            }, { note: previewPlan.note }) },
+            }, { note: previewPlan.note, cloudHome: Boolean(CLOUD_HOME) }) },
+        { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(agentsMounted && lendingEnabled()) : "" },
         { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? composioSystemPrompt(bot.connectorTools) : "" },
         { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(engineMcpServers(bot))) : "" },
         { id: "browser", label: "Browser", text: previewPlan.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
@@ -2701,6 +2836,7 @@ async function botOverview(bot) {
         })),
         engine,
         browserEnabled: builtInBrowserEnabled(cfg),
+        cloudHome: Boolean(CLOUD_HOME),
         connectedApps,
         sectionPeers,
         timeZone,
@@ -3275,7 +3411,9 @@ function createChannel(value) {
             throw Object.assign(new Error("invalid setup.defaultResponder"), { status: 400 });
         setup = { bulletin: requested.bulletin, defaultResponder: responder, completed: true };
     }
-    return store.createGroup(name, memberIds, false, section, setup);
+    // A new room with no routing of its own starts on Auto while the decision
+    // model is on for rooms; otherwise it gets today's default (first member).
+    return store.createGroup(name, memberIds, false, section, setup ?? (deciderReady(cfg, "roomRouting") ? { defaultResponder: { kind: "auto" } } : undefined));
 }
 function updateChannel(groupId, value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -4465,6 +4603,10 @@ function notify(notification) {
 // Group threads: the fold needs to know WHO is talking — the turn engine
 // records the active member here before dispatching its turn.
 const groupSpeakers = new Map();
+/** Auto-room rounds the decision model routed, by thread: the named
+ * speaker's next reply line carries `routedBy` (stamped in the runtime fold
+ * below), so the room can say "Picked by Jev". Only a routed round sets it. */
+const routedRoomReplies = new Map();
 // The latest running token totals for the turn in flight on each thread.
 // Providers report cumulative-within-turn numbers; the final value is folded
 // into the task's tally when the turn settles.
@@ -5199,7 +5341,7 @@ async function attachTeamBoat(computer, botId, owner, canMount, remoteAgent) {
         !turnResources.owns(`computer:box:${machine.id}`, owner))
         throw new Error("This computer turn ended while its machine was starting");
     return {
-        integration: { kind: "box", boxId: machine.id, token: cfg.box.token, control: controlIntegration(botId, owner.threadId, owner.generation) },
+        integration: { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(botId, owner.threadId, owner.generation) },
         capture: () => boat.screenshotBoat(cfg, ownerId, machine.id),
     };
 }
@@ -5305,7 +5447,7 @@ async function attachBotBoat(bot, owner, opts) {
     return {
         capture: () => boat.screenshotBoat(cfg, bot.id, machine.id),
         integration: opts.canMount
-            ? { kind: "box", boxId: machine.id, token: cfg.box.token, control: controlIntegration(bot.id, owner.threadId, owner.generation) }
+            ? { kind: "box", boxId: machine.id, token: boat.boatAccount(cfg)?.token ?? "", control: controlIntegration(bot.id, owner.threadId, owner.generation) }
             : null,
     };
 }
@@ -5418,12 +5560,13 @@ async function computerPreviewSurface(bot, threadId) {
             return "cloud";
     }
     const target = localVmTargetForStatus(bot.id, threadId);
-    if (instance?.adapter.capabilities.computerMcp && localVmSeen.has(target.key)) {
+    // A Cloud home has neither place (cloud-home.ts), so Auto never shows one.
+    if (!CLOUD_HOME && instance?.adapter.capabilities.computerMcp && localVmSeen.has(target.key)) {
         const vm = await containerComputerStatus(undefined, undefined, target).catch(() => null);
         if (vm && autoLocalVmAttachable(vm))
             return "vm";
     }
-    if (shouldMountLocalComputer({ requested: undefined, hostPlatform: process.platform,
+    if (!CLOUD_HOME && shouldMountLocalComputer({ requested: undefined, hostPlatform: process.platform,
         providerSupportsLocal: instance?.adapter.capabilities.localComputerMcp === true }) && readCuaConnection())
         return "local";
     if (bot.cloudBackend === "vps")
@@ -5431,16 +5574,23 @@ async function computerPreviewSurface(bot, threadId) {
     return plan.browser ? "browser" : "off";
 }
 /** Discovery is read-only. Starting or creating a configured computer is
- * deferred until a chat tool selects it and the old turn releases its tools. */
+ * deferred until a chat tool selects it and the old turn releases its tools.
+ * A Cloud home lists only the places it has (cloud-home.ts), so a bot never
+ * tells the person to set up this computer or a Local VM there. */
 async function selectableComputers(bot) {
     const caps = registry.get(bot.modelSelection.instanceId)?.adapter.capabilities;
     const off = bot.computer === "off";
     const localEngine = caps?.remoteAgent !== true;
-    return Promise.all(["cloud", "vm", "local", "browser"].map(async (surface) => {
+    const surfaces = ["cloud", "vm", "local", "browser"].filter(surface => !CLOUD_HOME || cloudHomeOffersPlace(surface));
+    return Promise.all(surfaces.map(async (surface) => {
         let ready = false;
         let canStart = false;
         let canCreate = false;
-        let reason = "This computer is not configured or running. Open the Computer panel to set it up.";
+        // On a Cloud home "this computer" reads as the person's own; name the
+        // place the reason is about.
+        let reason = CLOUD_HOME && surface === "cloud"
+            ? "The cloud computer is not set up or running. Open the Computer panel to set it up."
+            : "This computer is not configured or running. Open the Computer panel to set it up.";
         try {
             if (off)
                 reason = "Computer access is Off in this bot's settings.";
@@ -5826,7 +5976,12 @@ bus.subscribe((event) => {
         const owner = bot ? directRequestOwners.get(event.threadId) : undefined;
         const proven = owner?.messageId && !owner.stopped && owner.generation === directTurnGenerationByThread.get(event.threadId) &&
             owner.turnId && (!event.turnId || event.turnId === owner.turnId);
-        const message = store.appendMessage(event.threadId, group && m.role === "bot" ? { ...m, from: speaker }
+        // One line per routed reply: the routed speaker's first text of its turn.
+        const routed = group && m.role === "bot" && m.kind === "text" ? routedRoomReplies.get(event.threadId) : undefined;
+        const routedBy = routed && speaker && routed.botId === speaker.botId ? routed.routedBy : undefined;
+        if (routedBy)
+            routedRoomReplies.delete(event.threadId);
+        const message = store.appendMessage(event.threadId, group && m.role === "bot" ? { ...m, from: speaker, ...(routedBy ? { routedBy } : {}) }
             : proven ? { ...m, requestMessageId: owner.messageId } : m);
         return message;
     };
@@ -7572,7 +7727,7 @@ async function startTurn(botId, text, opts) {
     // an edit hands us its already-branched user message; a plain send appends
     let userMessage = opts?.userMessage;
     if (opts?.editedMessageId) {
-        const edited = store.branchMessage(threadId, opts.editedMessageId, text, opts.sendId);
+        const edited = store.branchMessage(threadId, opts.editedMessageId, text, opts.sendId, opts.sender);
         if (!edited)
             throw Object.assign(new Error("only a user text message can be edited"), { status: 400 });
         store.patchTask(bot.id, threadId, { rewound: true });
@@ -7630,7 +7785,7 @@ async function startTurn(botId, text, opts) {
     }
     requestGenerations.add(dispatchClaimId);
     directRequestOwners.set(threadId, { generation: dispatchClaimId, messageId: requestMessageId,
-        generations: requestGenerations, turnId: null });
+        generations: requestGenerations, turnId: null, ...(opts?.automationSource ? { automation: opts.automationSource } : {}) });
     // An unknown control-plane wake may invalidate a prior final, but it must
     // never acquire authority by guessing the latest user as its origin.
     const pendingSource = requestMessageId ?? store.activePath(threadId).findLast(message => message.role === "user")?.id;
@@ -7926,13 +8081,13 @@ async function startTurn(botId, text, opts) {
                 throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
             }
             const wants = plan.computer;
-            // A place the organisation disallows is refused before anything is
-            // prepared; Auto below simply skips disallowed places.
+            // A place the organisation disallows, or a Cloud home never offers, is
+            // refused before anything is prepared; Auto below simply skips them.
             const wantedKind = teamComputer ? "box" : wants === "local" ? "thisComputer" : wants === "vm" ? "localVm"
                 : wants === "cloud" ? (cloudBackend === "vps" ? "vps" : "box") : undefined;
-            const placeRefusal = wantedKind && managedPolicy.computerRefusal(wantedKind);
+            const placeRefusal = wantedKind && computerPlaceRefusal(wantedKind);
             if (placeRefusal)
-                throw Object.assign(new Error(placeRefusal), { status: 409, code: "managed_policy" });
+                throw Object.assign(new Error(placeRefusal.message), { status: 409, code: placeRefusal.code });
             let previewCapture = null;
             let browserCapture = null;
             let computerKind = null;
@@ -8243,7 +8398,7 @@ async function startTurn(botId, text, opts) {
                 }
             }
             if (wants === "cloud" && cloudBackend === "box" && !boat.boatConfigured(cfg)) {
-                throw new Error("Cloud Boat is not configured — add a Boat API key or choose Local VM");
+                throw new Error(BOAT_NOT_CONFIGURED);
             }
             if (wants === "cloud" && cloudBackend === "box" && !integrations.computer) {
                 throw new Error("the cloud computer could not be created or reached");
@@ -8253,7 +8408,7 @@ async function startTurn(botId, text, opts) {
             // Auto reaches a Local VM this bot already has before it ever touches the
             // host's own desktop: on a headless server that VM is the only desktop
             // there is, and a person who prepared one meant it to be used.
-            if (wants === undefined && !integrations.computer && !integrations.localComputer && managedPolicy.computerAllowed("localVm") && await attachLocalVm(false))
+            if (wants === undefined && !integrations.computer && !integrations.localComputer && !computerPlaceRefusal("localVm") && await attachLocalVm(false))
                 computerKind = "vm";
             // An unattended run on a bot with a VPS configured never lands on the
             // host's own desktop instead: a scheduled job clicking on someone's
@@ -8263,7 +8418,7 @@ async function startTurn(botId, text, opts) {
                 !integrations.localComputer &&
                 wants === undefined &&
                 !unattendedVps &&
-                managedPolicy.computerAllowed("thisComputer") &&
+                !computerPlaceRefusal("thisComputer") &&
                 shouldMountLocalComputer({
                     requested: undefined,
                     hostPlatform: process.platform,
@@ -8462,7 +8617,8 @@ async function startTurn(botId, text, opts) {
                 { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
                 { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
-                { id: "plan", label: "Surface", text: surfacePrompt({ computer: mountedComputer, browser: Boolean(integrations.browser) }, { pinned: plan.pinned, note: plan.note, canSelect: computerSelectionTurns.has(threadId) }) },
+                { id: "plan", label: "Surface", text: surfacePrompt({ computer: mountedComputer, browser: Boolean(integrations.browser) }, { pinned: plan.pinned, note: plan.note, canSelect: computerSelectionTurns.has(threadId), cloudHome: Boolean(CLOUD_HOME) }) },
+                { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
                 { id: "composio", label: "Connected apps", text: integrations.composio ? composioSystemPrompt(liveBot?.connectorTools ?? bot.connectorTools) : "" },
@@ -9903,6 +10059,33 @@ function serializeRoomContext(threadId, userName, textOverrides, readerBotId) {
     })
         .join("\n");
 }
+/** The decision model's view of a room message: the room, its people, the
+ * last room lines before this one, and the message. Text is scrubbed of
+ * secrets and attachment markup before it leaves this machine. */
+function roomRoutingInput(roomName, text, members, history, sender) {
+    const userName = cfg.profile?.name?.trim() || "User";
+    const clean = (value) => redactSecretsInText(extractTurnImages(value).text);
+    const humans = new Set([userName]);
+    const recent = history.flatMap((m) => {
+        if (m.kind !== "text" || !m.text)
+            return [];
+        if (m.role === "user") {
+            const person = m.sender?.name ?? userName;
+            humans.add(person);
+            return [{ from: person, text: clean(m.text) }];
+        }
+        return [{ from: `${m.from?.name ?? "A bot"} (bot)`, text: clean(m.text) }];
+    });
+    const from = sender?.name ?? userName;
+    humans.add(from);
+    return {
+        room: roomName,
+        humans: [...humans],
+        members: members.map((member) => ({ id: member.id, name: member.name, title: member.title, description: member.description })),
+        recent,
+        message: { from, text: clean(text) },
+    };
+}
 // What each room has already taken from its bots. Keyed by room because the
 // loop post_to_room can start is a property of the room, not of any one
 // caller — three bots posting twice each is the same runaway as one bot
@@ -10244,13 +10427,14 @@ setupRetry = 0) {
                 readyBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true,
         });
-        // A place the organisation disallows is refused before anything is
-        // provisioned or started, exactly as a bot thread refuses it.
+        // A place the organisation disallows, or a Cloud home never offers, is
+        // refused before anything is provisioned or started, exactly as a bot
+        // thread refuses it.
         const roomKind = roomTeamComputer ? "box" : roomPlan.computer === "local" ? "thisComputer" : readyBot.computer === "vm" ? "localVm"
             : roomPlan.computer === "cloud" ? (turnProvider(readyBot) === "vps" ? "vps" : "box") : undefined;
-        const roomPlaceRefusal = roomKind && managedPolicy.computerRefusal(roomKind);
+        const roomPlaceRefusal = roomKind && computerPlaceRefusal(roomKind);
         if (roomPlaceRefusal)
-            throw Object.assign(new Error(roomPlaceRefusal), { code: "managed_policy" });
+            throw Object.assign(new Error(roomPlaceRefusal.message), { code: roomPlaceRefusal.code });
         // The Computer engine runs on the Boat; this computer has no tools it can
         // reach, exactly as a bot thread refuses it.
         if (roomPlan.computer === "local" && instance.adapter.capabilities.remoteAgent === true) {
@@ -10318,7 +10502,7 @@ setupRetry = 0) {
             }
             else {
                 if (!boat.boatConfigured(cfg))
-                    throw new Error("Cloud Boat is not configured — add a Boat API key or choose Local VM");
+                    throw new Error(BOAT_NOT_CONFIGURED);
                 const remoteAgent = instance.adapter.capabilities.remoteAgent === true;
                 const attached = await attachBotBoat(readyBot, resourceOwner, { explicitCloud: true,
                     canMount: instance.adapter.capabilities.usesCloudComputer === true, remoteAgent });
@@ -10472,7 +10656,8 @@ setupRetry = 0) {
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
             { id: "computer", label: "Computer", text: computerPrompt(roomComputerPromptKind) },
             { id: "team-computer", label: "Team computer", text: teamComputerPrompt(roomTeamComputer) },
-            { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : surfaceOfComputerKind(roomComputerKind), browser: Boolean(integrations.browser) }, { note: roomPlan.note }) },
+            { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : surfaceOfComputerKind(roomComputerKind), browser: Boolean(integrations.browser) }, { note: roomPlan.note, cloudHome: Boolean(CLOUD_HOME) }) },
+            { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
             { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
@@ -11131,6 +11316,13 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
     if (options.goalCoordinatorBotId && (channelMode !== "goal" || !requestedGoalCoordinator)) {
         throw Object.assign(new Error("the selected goal coordinator is not an active room member"), { status: 409 });
     }
+    // An Auto room may ask the decision model who answers. It reads the room
+    // as it stood before this message, which is appended just below.
+    const autoCandidate = !group.dm && channelMode === "chat" && group.defaultResponder.kind === "auto" &&
+        deciderReady(cfg, "roomRouting");
+    const historyBeforeSend = autoCandidate
+        ? store.messagesFor(threadId).filter((m) => m.kind === "text" && m.text).slice(-GROUP_CONTEXT_MESSAGES)
+        : [];
     // A coalesced drain appends every queued line under its own queueId (the
     // chips and sendId receipts stay per-item); the LAST line is the turn's
     // user message, exactly like the 1:1 drain's userMessage.
@@ -11223,25 +11415,42 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
         }
         return message;
     }
+    // Auto with nobody addressed: the responders above are only the fallback
+    // until the decision model answers, in the async round below. The append
+    // and this function's return stay synchronous either way.
+    const autoRoute = autoCandidate && !goalCoordinator && availableMembers.length > 1 &&
+        roomResponders(text, availableMembers, { kind: "mentions" }).length === 0;
     // The snippet is only the fallback name here too. The member about to
     // answer supplies the same cheap one-shot the bot path uses, and the
     // swap lands only while the row still carries the snippet — a rename by
     // the person always wins. Channel tasks carry no peer provenance (no
     // assignment opens them), and a member whose engine offers no text
     // one-shot simply keeps the snippet.
-    const titleBot = goalCoordinator ?? responders[0];
-    const titleInstance = registry.get(titleBot.modelSelection.instanceId);
     const titleText = extractTurnImages(text).text;
-    // An engine the organisation disallows never receives the text, even for a title.
-    if (titled && snippet && titleText.trim() && llmThreadTitlesEnabled(cfg) && titleInstance?.generateText && !policyModelRefusal(titleInstance)) {
-        void generateThreadTitle(titleInstance, titleText)
-            .then((title) => {
-            if (title)
-                store.retitleGroupTask(group.id, threadId, snippet, title);
+    const startTitle = (titleBot) => {
+        const titleInstance = registry.get(titleBot.modelSelection.instanceId);
+        // An engine the organisation disallows never receives the text, even for a title.
+        if (titled && snippet && titleText.trim() && llmThreadTitlesEnabled(cfg) && titleInstance?.generateText && !policyModelRefusal(titleInstance)) {
+            void generateThreadTitle(titleInstance, titleText)
+                .then((title) => {
+                if (title)
+                    store.retitleGroupTask(group.id, threadId, snippet, title);
+            })
+                .catch(() => undefined);
+        }
+    };
+    // An Auto round titles with whoever the decision picks, once it has.
+    if (!autoRoute)
+        startTitle(goalCoordinator ?? responders[0]);
+    const operation = beginGroupTurnOperation(groupId, threadId, goalCoordinator || autoRoute ? [] : responders.map((responder) => responder.id));
+    // Asked now, in parallel with any earlier room work still queued: the
+    // answer is waited for only when this round's turn comes up. It never
+    // rejects; a Stop aborts it through the operation's signal.
+    const routing = autoRoute
+        ? decideRoomResponder(decider, roomRoutingInput(group.name, text, availableMembers, historyBeforeSend, options.sender), {
+            signal: operation.cancellation.signal,
         })
-            .catch(() => undefined);
-    }
-    const operation = beginGroupTurnOperation(groupId, threadId, goalCoordinator ? [] : responders.map((responder) => responder.id));
+        : null;
     if (queuedGroup && queuedGroup.length > 0) {
         // member turns use these stable ids to carry every burst line's words
         // and attachments through the turn that swallowed the burst
@@ -11298,9 +11507,27 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
             await runGroupGoalOperation({ groupId, threadId, coordinator: goalCoordinator, members, operation });
         }
         else {
+            let round = responders;
+            let routedBy;
+            if (routing) {
+                const route = await routing;
+                if (operation.cancelled)
+                    return;
+                const picked = route.kind === "member" ? availableMembers.filter((member) => member.id === route.botId)
+                    : route.kind === "everyone" ? availableMembers
+                        : [];
+                if (picked.length && route.kind !== "fallback") {
+                    round = picked;
+                    routedBy = { provider: "jev", probability: Math.round(route.probability * 100) / 100 };
+                }
+                // What a routed round holds from the start, like any other round.
+                for (const responder of round)
+                    operation.botIds.add(responder.id);
+                startTitle(round[0]);
+            }
             const spoken = new Set();
             const skillAuthoringClaim = { claimed: false };
-            for (const responder of responders) {
+            for (const responder of round) {
                 if (operation.cancelled)
                     break;
                 if (spoken.has(responder.id))
@@ -11316,7 +11543,19 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
                     spoken.add(responder.id);
                     continue;
                 }
-                if (!(await runGroupMemberTurn(groupId, threadId, responder.id, 0, spoken, undefined, undefined, () => operation.cancelled, () => groupProviderHandshakeStarted(operation), () => groupProviderHandshakeSettled(operation), skillAuthoringClaim, undefined, operation)))
+                // This speaker's first reply line says the decision model chose it.
+                const stamp = routedBy ? { botId: responder.id, routedBy } : undefined;
+                if (stamp)
+                    routedRoomReplies.set(threadId, stamp);
+                let proceed;
+                try {
+                    proceed = await runGroupMemberTurn(groupId, threadId, responder.id, 0, spoken, undefined, undefined, () => operation.cancelled, () => groupProviderHandshakeStarted(operation), () => groupProviderHandshakeSettled(operation), skillAuthoringClaim, undefined, operation);
+                }
+                finally {
+                    if (stamp && routedRoomReplies.get(threadId) === stamp)
+                        routedRoomReplies.delete(threadId);
+                }
+                if (!proceed)
                     break;
             }
         }
@@ -12188,24 +12427,15 @@ async function testCliBinary(cli, driver) {
     });
 }
 /** A pre-save probe only needs PATH. Never hand credentials inherited by the
- * desktop/server process to an arbitrary wrapper selected through Settings. */
+ * desktop/server process to an arbitrary wrapper selected through Settings.
+ * The shared lists (config.ts) cover every workspace, control-plane and
+ * provider credential, including ones added later; the probe and `claude
+ * update` keep everything else (HOME, proxy settings, CA bundles). */
 function cliProbeEnvironment() {
     const env = { ...process.env, PATH: augmentedPath() };
-    for (const key of [
-        "XAI_API_KEY",
-        "BOX_TOKEN",
-        "OPENCODE_API_KEY",
-        "COMPOSIO_API_KEY",
-        "OMB_COMPOSIO_BROKER_TOKEN",
-        "OMB_TTS_KEY",
-        "OMB_FISH_AUDIO_API_KEY",
-        "OMB_OPENAI_IMAGE_KEY",
-        "OMB_CUSTOM_IMAGE_KEY",
-        "ANTHROPIC_API_KEY",
-        "OPENAI_API_KEY",
-    ]) {
+    stripWorkspaceCredentialEnv(env);
+    for (const key of PROVIDER_CREDENTIAL_ENV)
         delete env[key];
-    }
     return env;
 }
 /** execFile's error carries the child's stderr in .stderr. */
@@ -12365,17 +12595,24 @@ function configStatus() {
             configured: composio.configured(cfg),
             mode: composio.connectionMode(cfg),
         },
-        box: { configured: Boolean(cfg.box?.token) },
+        // configured = cloud computers work here; included = through Cloud Pro,
+        // not a saved key
+        box: boat.describeBoatAccount(cfg),
         vps: { configured: Boolean(vpsSshAlias(cfg)), sshAlias: vpsSshAlias(cfg) ?? "" },
         opencodeGo: { configured: Boolean(cfg.opencodeGo?.apiKey) },
         // the chosen voice is a setting, not a secret; the key is reported the
         // same configured-or-not way as every other credential
         tts: tts.describeVoice(cfg),
+        // the decision model: switches and configured-or-not, never the key
+        decider: describeDecider(cfg),
         imageGen: avatarImageStatus(cfg),
         // not a secret — the sidebar shows it
         profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "" },
         // the enrolled organisation's read-only desktop policy; null when not enrolled
         managedPolicy: managedPolicy.summary(),
+        // an OMB Cloud home (cloud-home.ts): the app offers no this computer and
+        // no Local VM here
+        ...(CLOUD_HOME ? { cloudHome: true } : {}),
         // not a secret — the settings picker shows it; "" = follow the system
         language: cfg.language ?? "",
         rooms: { turnTimeoutMinutes: roomTurnTimeoutMinutes(cfg) },
@@ -12718,12 +12955,7 @@ function serveStatic(res, path) {
 // requests from any loopback connection and any web page that DNS-rebinds
 // onto it. Reject non-loopback Hosts outright (defeats rebinding) and
 // origins outside loopback (blocks remote-web CSRF).
-const workspaceBackupRoutes = createWorkspaceBackupRoutes({
-    dataDir: DATA_DIR,
-    appVersion: serverVersion(),
-    readBody,
-    restored: workspaceRestore,
-    status: () => ({ busy: workspaceMaintenance.active, pendingRestore: workspaceMaintenance.pendingRestore }),
+const workspaceBackupAccess = {
     authorized: (req, original) => {
         const current = resolveRequestAuth(req, {
             sessions, cookieName: SESSION_COOKIE, streamPath: "/api/events",
@@ -12759,6 +12991,27 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
             closeMessageDb();
         },
     }, keepLocked),
+    status: () => ({ busy: workspaceMaintenance.active, pendingRestore: workspaceMaintenance.pendingRestore }),
+};
+const workspaceBackupRoutes = createWorkspaceBackupRoutes({
+    dataDir: DATA_DIR,
+    appVersion: serverVersion(),
+    readBody,
+    restored: workspaceRestore,
+    ...workspaceBackupAccess,
+});
+// Move to Cloud (server/cloud-move-http.ts): every server sizes its own
+// workspace for the desktop; only a Cloud home receives one. After its
+// restore commits, the Cloud home restarts so startup installs it.
+let cloudHomeRestartRequested = false;
+const cloudMoveRoutes = createCloudMoveRoutes({
+    dataDir: DATA_DIR,
+    appVersion: serverVersion(),
+    cloudHome: Boolean(CLOUD_HOME),
+    readBody,
+    restored: workspaceRestore,
+    ...workspaceBackupAccess,
+    restart: () => { cloudHomeRestartRequested = true; gracefulShutdown(); },
 });
 // Route modules (server/routes/README.md). `workspaceAccess` is assigned at
 // boot, after this line, so the dependency reads it per request.
@@ -12780,6 +13033,7 @@ ROUTES.push(createBotMemoryRoutes({
         broadcast({ kind: "config", ...configStatus() });
     },
 }));
+ROUTES.push(createDeciderRoutes({ decider }));
 const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
@@ -12836,7 +13090,7 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && !path.startsWith("/api/") && !path.startsWith("/.well-known/") && serveStatic(res, path))
             return;
         if (method === "GET" && path === "/.well-known/openmausbot/environment") {
-            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && emailSignIn.enabled(), sharedComputers: sharedComputersEnabled(cfg) }));
+            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && emailSignIn.enabled(), sharedComputers: lendingEnabled() }));
         }
         const domainCheck = /^\/\.well-known\/openmausbot\/domain-check\/([a-f0-9]{64})$/.exec(path);
         if (method === "GET" && domainCheck) {
@@ -12879,7 +13133,7 @@ const handleRequest = async (req, res) => {
             }
             sessions.clearFailures(source);
             const issued = sessions.issue({ label: label.trim() || labelFromUserAgent(req.headers["user-agent"]), scopes: verified.scopes, userId: verified.userId, email: verified.email });
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: true, sharedComputers: sharedComputersEnabled(cfg) });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: true, sharedComputers: lendingEnabled() });
             const secure = requestOrigin(req)?.startsWith("https://") === true;
             res.setHeader("set-cookie", serializeSessionCookie(SESSION_COOKIE, issued.token, { secure, maxAgeSeconds: cookieMaxAgeSeconds(issued.session) }));
             return json(res, 200, { session: issued.session, environment });
@@ -12921,7 +13175,7 @@ const handleRequest = async (req, res) => {
                 console.warn(`pairing refused from ${requestSource(req)}: ${result.error}`);
                 return json(res, result.status, { error: result.error });
             }
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: emailSignIn.enabled(), sharedComputers: sharedComputersEnabled(cfg) });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: emailSignIn.enabled(), sharedComputers: lendingEnabled() });
             if (wantsCookie) {
                 const secure = requestOrigin(req)?.startsWith("https://") === true;
                 res.setHeader("set-cookie", serializeSessionCookie(SESSION_COOKIE, result.token, { secure, maxAgeSeconds: cookieMaxAgeSeconds(result.session) }));
@@ -12973,7 +13227,7 @@ const handleRequest = async (req, res) => {
             url,
             loopbackMutationToken: desktopMutationToken,
             companionMutationToken,
-            features: { sharedComputers: sharedComputersEnabled(cfg) },
+            features: { sharedComputers: lendingEnabled() },
             loopbackTrust: LOOPBACK.trust,
             cliOwnerToken,
         });
@@ -13031,6 +13285,8 @@ const handleRequest = async (req, res) => {
         }
         if (await workspaceBackupRoutes(req, res, path, auth))
             return;
+        if (await cloudMoveRoutes(req, res, path, auth))
+            return;
         // Count ordinary requests until their asynchronous handler returns, not
         // merely until the browser disconnects. A cancelled upload can still write.
         if (path.startsWith("/api/") && path !== "/api/events" && path !== "/api/health" && !path.startsWith("/api/shared-computers/") && !isWorkspaceBackupSessionControl(method, path)) {
@@ -13150,11 +13406,15 @@ const handleRequest = async (req, res) => {
             const cancelled = sessions.cancelPairing(m[1]);
             return json(res, cancelled ? 200 : 404, cancelled ? { ok: true } : { error: "no such pairing code" });
         }
-        if (method === "POST" && path === "/api/desktop/shared-computer-control" && sharedComputersEnabled(cfg)) {
+        // The desktop's own server always answers its desktop here: lending to the
+        // person's Cloud (docs/cloud-pro.md) needs the lease without the
+        // maintainer flag. It grants nothing by itself; it only keeps local bot
+        // turns and a remote screen action from using the screen at once.
+        if (method === "POST" && path === "/api/desktop/shared-computer-control" && (sharedComputersEnabled(cfg) || DESKTOP_MANAGED)) {
             if (auth.kind !== "loopback")
                 return json(res, 403, { error: "Local desktop only" });
             const body = await readBody(req, 1024);
-            if (!sharedComputersEnabled(cfg))
+            if (!sharedComputersEnabled(cfg) && !DESKTOP_MANAGED)
                 return json(res, 404, { error: `no route: ${method} ${path}` });
             if (!z.string().uuid().safeParse(body?.id).success || !["acquire", "release", "renew"].includes(body?.action))
                 return json(res, 400, { error: "Invalid computer lease" });
@@ -13177,13 +13437,19 @@ const handleRequest = async (req, res) => {
         // With features.sharedComputers off the whole family falls through to the
         // generic "no route" 404, so a probe cannot tell a disabled feature from
         // a build that never had one.
-        if (method === "POST" && path.startsWith("/api/shared-computers/") && sharedComputersEnabled(cfg)) {
+        // What the asking person has lent to this server, online or not, with its
+        // scopes (docs/cloud-pro.md, "What the Cloud can see"). Owner-scoped like
+        // the bot routes; no id a session could not already use, and no secret.
+        if (method === "GET" && path === "/api/shared-computers" && lendingEnabled()) {
+            return json(res, 200, { computers: sharedComputers.status(sessionLendingPrincipal(auth)) });
+        }
+        if (method === "POST" && path.startsWith("/api/shared-computers/") && lendingEnabled()) {
             if (auth.kind !== "session")
                 return json(res, 403, { error: "Pair this desktop first" });
             if (!/^application\/json\b/i.test(String(req.headers["content-type"] ?? "")))
                 return json(res, 415, { error: "JSON required" });
             const body = await readBody(req, 4_000_000);
-            if (!sharedComputersEnabled(cfg))
+            if (!lendingEnabled())
                 return json(res, 404, { error: `no route: ${method} ${path}` });
             if (!sessions.isLive(auth.session.id))
                 return json(res, 401, { error: "Session ended" });
@@ -13195,7 +13461,11 @@ const handleRequest = async (req, res) => {
                 const registration = parsed.data;
                 if (registration.environmentId !== ENVIRONMENT_ID)
                     return json(res, 409, { error: "Workspace identity changed. Pair again before sharing this computer." });
-                sharedComputers.register(registration, auth.session.id, secret);
+                // A Cloud home is one person's: only their own devices, which the
+                // Admin's pairing signs in with admin scope, may lend to it.
+                if (CLOUD_HOME && !auth.scopes.includes("admin"))
+                    return json(res, 403, { error: "Only your own computers can lend to your Cloud. Connect this computer to your Cloud from its OMB Cloud settings." });
+                sharedComputers.register(registration, { session: auth.session.id, person: CLOUD_HOME ? CLOUD_HOME_LENDER : personKey(auth.session) }, secret);
                 return json(res, 200, { ok: true });
             }
             const route = /^\/api\/shared-computers\/([\w-]+)\/(poll|lease|result|disconnect)$/.exec(path);
@@ -13364,6 +13634,7 @@ const handleRequest = async (req, res) => {
                 if (method === "POST" && requested !== "auto" && !parseSurface(requested)) {
                     return json(res, 400, { error: "surface must be auto, cloud, vm, local, or browser" });
                 }
+                const unoffered = CLOUD_HOME && method === "POST" && requested !== "auto" ? cloudHomePlaceRefusal(parseSurface(requested)) : undefined;
                 const options = await selectableComputers(bot);
                 const current = source ? source.mounted ?? "off" : await computerPreviewSurface(bot, bot.threadId);
                 requireActiveInternalCapability();
@@ -13371,6 +13642,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 200, { current, canSelect, options });
                 if (computerSelectionTurns.get(internalCapability.threadId) !== source)
                     return json(res, 409, { error: "The user request ended before its computer was selected." });
+                if (unoffered)
+                    return json(res, 409, { error: unoffered, options });
                 const option = requested === "auto"
                     ? options.find(option => option.ready && option.surface === current) ?? options.find(option => option.ready && option.surface === "vm") ?? options.find(option => option.ready) ?? options.find(option => option.canStart) ?? options.find(option => option.canCreate && option.surface === "vm") ?? options.find(option => option.canCreate)
                     : options.find(option => option.surface === requested);
@@ -13484,15 +13757,30 @@ const handleRequest = async (req, res) => {
             }
             // Off by default: both fall through to the same "unknown internal
             // endpoint" 404 a never-implemented route returns.
-            if (method === "GET" && path === "/api/internal/shared-computers" && sharedComputersEnabled(cfg))
-                return json(res, 200, { computers: sharedComputers.list() });
-            if (method === "POST" && path === "/api/internal/shared-computers" && sharedComputersEnabled(cfg)) {
+            // Owner-scoped: a turn sees and uses only the computers of the person it
+            // provably acts for (sharedComputerPrincipal), never anyone else's.
+            if (method === "GET" && path === "/api/internal/shared-computers" && lendingEnabled()) {
+                const principal = sharedComputerPrincipal(internalCapability);
+                // Say why an owner's own conversation sees no Mac, so the bot can tell them.
+                const notice = CLOUD_HOME && !principal && sharedComputers.status(CLOUD_HOME_LENDER).length > 0 &&
+                    cloudHomeLendingRefusal(cloudLendingTurn(internalCapability)) === "someone-else" ? { unavailable: LENDING_SOMEONE_ELSE } : {};
+                return json(res, 200, { computers: sharedComputers.list(principal), ...notice });
+            }
+            if (method === "POST" && path === "/api/internal/shared-computers" && lendingEnabled()) {
                 const parsed = sharedComputerOperation.safeParse(await readInternalBody());
-                if (!sharedComputersEnabled(cfg))
+                if (!lendingEnabled())
                     return json(res, 404, { error: "unknown internal endpoint" });
                 if (!parsed.success)
                     return json(res, 400, { error: "Invalid shared computer operation" });
-                return json(res, 200, { result: await sharedComputers.request(parsed.data, () => sharedComputersEnabled(cfg) && internalCapabilityIsActive(internalCapability)) });
+                // The bot's own "no computer" setting holds on a lent screen too.
+                if (["computer_tools", "computer_call"].includes(parsed.data.action) && store.bot(internalCapability.botId)?.computer === "off") {
+                    return json(res, 403, { error: "This bot has no computer. Change its Computer setting to use a shared computer's apps and screen." });
+                }
+                const principal = sharedComputerPrincipal(internalCapability);
+                if (CLOUD_HOME && !principal && cloudHomeLendingRefusal(cloudLendingTurn(internalCapability)) === "someone-else") {
+                    return json(res, 403, { error: LENDING_SOMEONE_ELSE });
+                }
+                return json(res, 200, { result: await sharedComputers.request(parsed.data, principal, () => lendingEnabled() && internalCapabilityIsActive(internalCapability)) });
             }
             if (method === "GET" && path === "/api/internal/agents") {
                 const sender = internalSender;
@@ -15266,7 +15554,11 @@ const handleRequest = async (req, res) => {
                     }
                     const group = createChannel({
                         name: redactSecretsInText(parsed.data.name), memberIds, section: chief.section,
-                        setup: { bulletin: redactSecretsInText(parsed.data.bulletin ?? ""), defaultResponder: { kind: "member", botId: chief.id } },
+                        setup: {
+                            bulletin: redactSecretsInText(parsed.data.bulletin ?? ""),
+                            // The Chief leads; on Auto it is the fallback when the decision model is unsure.
+                            defaultResponder: deciderReady(cfg, "roomRouting") ? { kind: "auto", fallbackBotId: chief.id } : { kind: "member", botId: chief.id },
+                        },
                     });
                     internalCapability.createdRooms = (internalCapability.createdRooms ?? 0) + 1;
                     return json(res, 201, { id: group.id, name: group.name, section: group.section || "General", memberIds: group.memberIds, memberCount: group.memberIds.length });
@@ -15645,7 +15937,12 @@ const handleRequest = async (req, res) => {
             const hidden = hiddenRoutineTarget(body, visible);
             if (hidden)
                 return json(res, 404, { error: hidden });
-            return json(res, 201, { routine: routines.create(body) });
+            const routine = routines.create(body);
+            // On a Cloud home, a routine the owner writes from their own device may
+            // use their lent Mac when it runs (server/cloud-lending.ts).
+            if (cloudRoutineAuthors && cloudOwnerSession(auth))
+                cloudRoutineAuthors.record(routine.id, routine);
+            return json(res, 201, { routine });
         }
         // The desktop shell polls this to decide whether to hold the computer
         // awake: a run in flight, or a routine due within the hour.
@@ -15655,6 +15952,8 @@ const handleRequest = async (req, res) => {
         let routineMatch = path.match(/^\/api\/routines\/([\w-]+)\/run$/);
         if (routineMatch && method === "POST") {
             const run = routines.runNow(routineMatch[1]);
+            if (run && CLOUD_HOME && cloudOwnerSession(auth))
+                ownerStartedRoutineRuns.add(run.id);
             return run ? json(res, 201, { run }) : json(res, 404, { error: "no such routine" });
         }
         routineMatch = path.match(/^\/api\/routines\/([\w-]+)$/);
@@ -15663,11 +15962,26 @@ const handleRequest = async (req, res) => {
             const hidden = hiddenRoutineTarget(body, visible);
             if (hidden)
                 return json(res, 404, { error: hidden });
+            const before = cloudRoutineAuthors ? routines.listRoutines().find((candidate) => candidate.id === routineMatch[1]) : undefined;
+            const wasOwners = Boolean(before && cloudRoutineAuthors?.authored(before.id, before));
             const routine = routines.update(routineMatch[1], body);
+            // The owner's own edit keeps (or, when it rewrites the instructions,
+            // makes) the routine theirs. Anyone else's edit, of any field (its
+            // schedule, where its results go, whether it is on), makes it no longer
+            // the owner's: it stops lending until the owner rewrites it.
+            if (routine && cloudRoutineAuthors) {
+                if (!cloudOwnerSession(auth))
+                    cloudRoutineAuthors.forget(routine.id);
+                else if (wasOwners || (body && typeof body === "object" && "prompt" in body))
+                    cloudRoutineAuthors.record(routine.id, routine);
+            }
             return routine ? json(res, 200, { routine }) : json(res, 404, { error: "no such routine" });
         }
         if (routineMatch && method === "DELETE") {
-            return routines.remove(routineMatch[1])
+            const removed = routines.remove(routineMatch[1]);
+            if (removed)
+                cloudRoutineAuthors?.forget(routineMatch[1]);
+            return removed
                 ? json(res, 200, { ok: true })
                 : json(res, 404, { error: "no such routine" });
         }
@@ -16340,7 +16654,7 @@ const handleRequest = async (req, res) => {
             const current = resolveRequestAuth(req, {
                 sessions, cookieName: SESSION_COOKIE, streamPath: "/api/events", url,
                 loopbackMutationToken: desktopMutationToken, companionMutationToken,
-                features: { sharedComputers: sharedComputersEnabled(cfg) }, loopbackTrust: LOOPBACK.trust, cliOwnerToken,
+                features: { sharedComputers: lendingEnabled() }, loopbackTrust: LOOPBACK.trust, cliOwnerToken,
             });
             if (!current.auth)
                 return json(res, current.status, { error: current.error });
@@ -16838,15 +17152,7 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "bulletin must be a string" });
                 if (body.bulletin.length > 12_000)
                     return json(res, 400, { error: "bulletin must be at most 12000 characters" });
-                const value = body.defaultResponder;
-                let responder = null;
-                if (value?.kind === "everyone")
-                    responder = { kind: "everyone" };
-                else if (value?.kind === "mentions")
-                    responder = { kind: "mentions" };
-                else if (value?.kind === "member" && typeof value.botId === "string" && group.memberIds.includes(value.botId)) {
-                    responder = { kind: "member", botId: value.botId };
-                }
+                const responder = checkedGroupResponder(body.defaultResponder, group.memberIds);
                 if (!responder)
                     return json(res, 400, { error: "invalid default responder" });
                 patch.cwd = checked.cwd ?? undefined;
@@ -18775,6 +19081,12 @@ const handleRequest = async (req, res) => {
             if (existing.card.requestId) {
                 return json(res, 409, { error: "request cards must be answered through the approval endpoint" });
             }
+            // On a Cloud home only the owner answers cards (cardAnswerRefusal).
+            // This route only keeps how an options card looks; the answer itself
+            // reaches the bot as a chat line, which lending already checks.
+            const cloudRefusal = CLOUD_HOME && body.answered !== undefined && auth.kind === "session" ? cloudCardRefusal(auth) : null;
+            if (cloudRefusal)
+                return json(res, 403, { error: cloudRefusal });
             if (Object.keys(body).some((key) => key !== "answered" && key !== "dismissed" && key !== "threadId")) {
                 return json(res, 400, { error: "only answered and dismissed may be changed" });
             }
@@ -18789,6 +19101,7 @@ const handleRequest = async (req, res) => {
                     ...existing.card,
                     ...(body.answered !== undefined ? { answered: body.answered } : {}),
                     ...(body.dismissed !== undefined ? { dismissed: body.dismissed } : {}),
+                    ...(CLOUD_HOME && body.answered !== undefined ? { answeredBy: cardAnswererFor(auth) } : {}),
                 },
             });
             return json(res, 200, { message: patched });
@@ -19167,7 +19480,10 @@ const handleRequest = async (req, res) => {
             // startTurn admits the rerun before branching. A shared-resource or
             // concurrency-limit refusal must leave the original transcript intact.
             const replyTo = source.replyToId ? resolveReplyTarget(bot.threadId, source.replyToId) : undefined;
-            const message = await startTurn(bot.id, text, { threadId: bot.threadId, editedMessageId: messageId, replyTo, sendId, trigger: usageTriggerFor(auth) });
+            // On a Cloud home an edit is its author's line, so the owner's own edit
+            // keeps their conversation theirs for lending (server/cloud-lending.ts).
+            const message = await startTurn(bot.id, text, { threadId: bot.threadId, editedMessageId: messageId, replyTo, sendId, trigger: usageTriggerFor(auth),
+                ...(CLOUD_HOME ? { sender: messageSender(auth) } : {}) });
             return json(res, 202, { ok: true, message });
         }
         // switch which fork of the conversation is visible (no new turn)
@@ -20783,6 +21099,14 @@ const handleRequest = async (req, res) => {
             }
             if (!Object.keys(patch).length)
                 return json(res, 400, { error: "nothing to save" });
+            if (patch.decider) {
+                // Saving a key is the "turn it on"; clearing it turns it off, or
+                // falls back to Cloud Pro's included decisions where there are some.
+                const planned = deciderSavePatch(patch.decider, cfg.decider, deciderIncludedHere());
+                if (!planned.ok)
+                    return json(res, 400, { error: planned.error });
+                patch.decider = planned.patch;
+            }
             const changingVoiceProvider = patch.tts?.provider !== undefined
                 && patch.tts.provider !== tts.voiceProvider(cfg);
             if (changingVoiceProvider && patch.tts?.voice === undefined) {
@@ -21072,6 +21396,15 @@ const handleRequest = async (req, res) => {
                     if (!check.ok)
                         return json(res, 400, { error: check.message });
                 }
+                // A pasted decision-model key is tried once (one tiny yes/no call).
+                // Only a refusal blocks the save: an offline or overloaded service must
+                // not stop a person saving a key that may well be fine.
+                if (patch.decider?.key) {
+                    const check = await decider.testKey({ key: patch.decider.key });
+                    if (!check.ok && check.reason === "rejected") {
+                        return json(res, 400, { error: "Jev rejected this key. Check it at typesafe.ai and paste it again.", code: "decider_rejected" });
+                    }
+                }
                 if (patch.browserProfiles !== undefined) {
                     // Provider/credential validation above may await the network. A turn
                     // can start during that window and claim a profile which looked idle
@@ -21139,6 +21472,8 @@ const handleRequest = async (req, res) => {
                             persisted.tts.key = "";
                         if (persisted.tts?.fishKey !== undefined)
                             persisted.tts.fishKey = "";
+                        if (persisted.decider?.key !== undefined)
+                            persisted.decider.key = "";
                         if (persisted.imageGen?.key !== undefined)
                             persisted.imageGen.key = "";
                         if (persisted.imageGen?.customApiKey !== undefined)
@@ -21174,7 +21509,7 @@ const handleRequest = async (req, res) => {
                 let browserReferenceCleanupError = null;
                 if (patch.signIn !== undefined)
                     sessions.revalidateEmailSessions();
-                if (!sharedComputersEnabled(cfg)) {
+                if (!lendingEnabled()) {
                     sharedComputers.close();
                     sharedComputerControl.close();
                 }
@@ -21998,7 +22333,8 @@ const gracefulShutdown = createGracefulShutdown({
         }
         closeMessageDb();
         releaseDataDirLeaseAtExit();
-        process.exit(code);
+        // A Cloud home's launcher starts the server again on this code only.
+        process.exit(cloudHomeRestartRequested && code === 0 ? CLOUD_HOME_RESTART_EXIT_CODE : code);
     },
 });
 for (const signal of ["SIGINT", "SIGTERM"]) {