openmausbot 0.1.90 → 0.1.91

package/dist-server/workspace-backup.worker.js

@@ -16,7 +16,7 @@ import {
   cpSync,
   createReadStream,
   createWriteStream,
-  existsSync,
+  existsSync as existsSync2,
   fstatSync,
   fsyncSync as fsyncSync2,
   lstatSync,
@@ -31,7 +31,7 @@ import {
   writeFileSync as writeFileSync2,
   writeSync
 } from "node:fs";
-import { isAbsolute, join as join2, parse as parse3, posix, relative, resolve, win32 } from "node:path";
+import { isAbsolute, join as join3, parse as parse3, posix, relative, resolve, win32 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { backup, DatabaseSync } from "node:sqlite";
 import { pipeline } from "node:stream/promises";
@@ -3178,7 +3178,7 @@ var WORKSPACE_BACKUP_CLIENT_KEYS = [
 
 // server/config.ts
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -18706,6 +18706,72 @@ function schemaIssue(error51, fallback) {
 var CLOUD_SEAT_IDLE_STOP_MS = 5 * 6e4;
 var CLOUD_SEAT_SLEEP_RETRY_MAX_MS = 10 * 6e4;
 
+// server/proxy-paths.ts
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+var SERVER_ROOT = dirname(fileURLToPath(import.meta.url));
+function resolveProxy(relative2) {
+  const source = join(SERVER_ROOT, `${relative2}.ts`);
+  return existsSync(source) ? source : join(SERVER_ROOT, `${relative2}.js`);
+}
+var SPAWNED_PROXIES = {
+  browser: resolveProxy("browser-proxy"),
+  localComputer: resolveProxy("local-computer-proxy"),
+  permission: resolveProxy("permission-proxy"),
+  containerMcp: resolveProxy("container-mcp"),
+  vpsContainerMcp: resolveProxy("vps-container-mcp"),
+  agents: resolveProxy("drivers/agents-proxy"),
+  dweb: resolveProxy("drivers/dweb-proxy"),
+  connectors: resolveProxy("connector-proxy"),
+  mcpGate: resolveProxy("mcp-gate"),
+  phone: resolveProxy("drivers/phone-proxy"),
+  hook: resolveProxy("hooks/omb-hook"),
+  // Loaded by the external `pi` process via `-e`, not by this server — but
+  // resolved through the same single source of truth so the packaged layout
+  // check can assert it ships.
+  piMcpExtension: resolveProxy("drivers/pi-mcp-extension")
+};
+
+// server/enterprise.ts
+var layerSchema = external_exports.object({
+  customer: external_exports.string().min(1),
+  features: external_exports.array(external_exports.string().min(1)),
+  expiresAt: external_exports.string().nullable()
+});
+var DAY_MS = 24 * 60 * 6e4;
+
+// server/sessions.ts
+var PAIRING_CODE_TTL_MS = 5 * 6e4;
+function daysMs(value, fallbackDays) {
+  const days = Number(value);
+  const ok = Number.isInteger(days) && days >= 1 && days <= 3650;
+  return (ok ? days : fallbackDays) * 24 * 60 * 6e4;
+}
+var SESSION_TTL_MS = daysMs(process.env.OMB_SESSION_TTL_DAYS, 30);
+var SESSION_MAX_AGE_MS = daysMs(process.env.OMB_SESSION_MAX_DAYS, 180);
+var SESSION_RENEW_WHEN_LEFT_MS = SESSION_TTL_MS / 2;
+var STREAM_TICKET_TTL_MS = 5 * 6e4;
+var scopeSchema = external_exports.enum(["admin", "client"]);
+var sessionSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  tokenHash: external_exports.string().length(64),
+  label: external_exports.string().max(80),
+  scopes: external_exports.array(scopeSchema).min(1),
+  createdAt: external_exports.number(),
+  lastSeenAt: external_exports.number(),
+  expiresAt: external_exports.number(),
+  /** Set when the session came from an account sign-in rather than a code. */
+  userId: external_exports.string().max(256).optional(),
+  email: external_exports.string().max(320).optional(),
+  /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
+  membershipAuthority: external_exports.literal("portal").optional()
+});
+var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
+
+// server/cloud-home.ts
+var CLOUD_PAIRING_NONCE_MS = 10 * 6e4;
+
 // server/config.ts
 var optionalText = external_exports.string().optional();
 var SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
@@ -19037,6 +19103,19 @@ var appConfigSchema = external_exports.object({
     baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the Chatterbox server address must start with http:// or https://").optional(),
     model: optionalText
   }).optional(),
+  /** The decision model (server/decider): a fast classifier that picks
+   * things for bots, starting with who answers a room message. `key` is
+   * write-only like every credential; `baseUrl` points at a Jev-compatible
+   * server instead of TypeSafe's (an operator setting with no UI); `jobs`
+   * switches each decision on or off. Not `decisions`: that section is the
+   * authorization log's retention. */
+  decider: external_exports.object({
+    enabled: external_exports.boolean().optional(),
+    provider: external_exports.enum(["jev", "off"]).optional(),
+    key: optionalText,
+    baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the decision model address must start with http:// or https://").optional(),
+    jobs: external_exports.object({ roomRouting: external_exports.boolean().optional() }).optional()
+  }).optional(),
   /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
   imageGen: external_exports.object({
     provider: external_exports.enum(["openai", "xai", "custom"]).optional(),
@@ -19111,10 +19190,10 @@ function parseStoredConfig(value) {
   return parsed.data;
 }
 var DEFAULT_CAPTURE_QUIET_MS = 2 * 6e4;
-var DATA_DIR = process.env.OMB_DATA_DIR ?? join(homedir(), ".openmausbot");
-var LEGACY_DATA_DIR = join(homedir(), ".opengrokbot");
-var EVENTS_DIR = join(DATA_DIR, "events");
-var NATIVE_DIR = join(DATA_DIR, "native");
+var DATA_DIR = process.env.OMB_DATA_DIR ?? join2(homedir(), ".openmausbot");
+var LEGACY_DATA_DIR = join2(homedir(), ".opengrokbot");
+var EVENTS_DIR = join2(DATA_DIR, "events");
+var NATIVE_DIR = join2(DATA_DIR, "native");
 
 // server/workspace-backup-policy.ts
 var PORTABLE_CONFIG_KEYS = [
@@ -19141,7 +19220,7 @@ function redownloadedOrgLibraryPath(path) {
   return /^org-library\/(?:catalog\.json(?:\.[0-9a-f-]{36}\.tmp)?$|blobs(?:\/|$))/.test(path);
 }
 function ephemeralWorkspaceTokenPath(path) {
-  return /^hook-tokens(?:\/|$)/.test(path);
+  return /^(?:hook-tokens(?:\/|$)|sessions\.json\.open$)/.test(path);
 }
 
 // server/workspace-backup.ts
@@ -19169,7 +19248,10 @@ var EXCLUDED = /* @__PURE__ */ new Set([
   "openmausbot-server.lease",
   "box-create-requests.lock",
   "messages.db-wal",
-  "messages.db-shm"
+  "messages.db-shm",
+  // This machine's decision-model log (server/decider/log.ts): local
+  // measurement of what the classifier picked, not workspace data.
+  "decider-log"
 ]);
 var EXCLUSION_NOTES = [
   "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",
@@ -19197,13 +19279,13 @@ function backupRoot(dataDir2) {
   if (root === parse3(root).root) throw new Error("A filesystem root cannot be a workspace backup target.");
   const stat = lstatSync(root);
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("The workspace data directory must not be a symbolic link.");
-  const path = join2(root, ".backups");
+  const path = join3(root, ".backups");
   folder(path);
   return path;
 }
 function jobPath(dataDir2, id) {
   if (!ID.test(id)) throw new Error("Invalid workspace backup identifier.");
-  const path = join2(backupRoot(dataDir2), id);
+  const path = join3(backupRoot(dataDir2), id);
   if (entryExists(path)) {
     const stat = lstatSync(path);
     if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("Unsafe workspace backup job directory.");
@@ -19246,14 +19328,14 @@ function writeJson(path, value) {
   writeFileAtomic(path, text, { mode: 384 });
 }
 function assertLocalAuthOutsideSnapshot(dataDir2) {
-  const configPath = join2(dataDir2, "config.json");
-  const config2 = existsSync(configPath) ? privateJson(configPath) : {};
+  const configPath = join3(dataDir2, "config.json");
+  const config2 = existsSync2(configPath) ? privateJson(configPath) : {};
   const instances = record2(config2) && record2(config2.instances) ? config2.instances : {};
   const fields = ["HOME", "USERPROFILE", "CLAUDE_CONFIG_DIR", "CODEX_HOME", "GROK_HOME", "KIMI_CODE_HOME", "HERMES_HOME", "FACTORY_HOME_OVERRIDE", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "LOCALAPPDATA"];
   const check2 = (value, field, home) => {
     if (typeof value !== "string" || !value.trim()) return;
     const text = value.trim();
-    const expanded = text.startsWith("~/") || text.startsWith("~\\") ? join2(home, text.slice(2)) : text;
+    const expanded = text.startsWith("~/") || text.startsWith("~\\") ? join3(home, text.slice(2)) : text;
     const resolved = resolve(expanded);
     const exists = entryExists(resolved);
     const path = relative(exists ? realpathSync(dataDir2) : resolve(dataDir2), exists ? realpathSync(resolved) : resolved).replaceAll("\\", "/");
@@ -19331,7 +19413,7 @@ function hashFile(path) {
   }
 }
 function countJsonArray(path) {
-  if (!existsSync(path)) return 0;
+  if (!existsSync2(path)) return 0;
   const value = privateJson(path);
   if (!Array.isArray(value)) throw new Error("A workspace roster is not a valid JSON array.");
   const ids = /* @__PURE__ */ new Set();
@@ -19344,7 +19426,7 @@ function countJsonArray(path) {
   return value.length;
 }
 function databaseCounts(path) {
-  if (!existsSync(path)) return { threads: 0, messages: 0 };
+  if (!existsSync2(path)) return { threads: 0, messages: 0 };
   const db = new DatabaseSync(path, { readOnly: true });
   try {
     const check2 = db.prepare("PRAGMA quick_check").all();
@@ -19363,27 +19445,27 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
   const salt = randomBytes(16);
   const key = await passwordKey(options2.password, salt);
   const job = newJob(dataDir2, jobId2);
-  const snapshot = join2(job.directory, "snapshot");
-  folder(join2(snapshot, "data"));
+  const snapshot = join3(job.directory, "snapshot");
+  folder(join3(snapshot, "data"));
   const entries = [];
   const warnings = ["Stop external editors and managed desktops before exporting; files written outside this server cannot be frozen by the backup gate.", "Conversation text and user files are not redacted and may contain secrets you pasted. Keep the encrypted backup private.", RESTORE_WARNING];
   let bytes = 0;
   let skippedLinks = 0;
   try {
     const root = realpathSync(dataDir2);
-    const sourceDb = join2(root, "messages.db");
-    if (existsSync(sourceDb)) {
+    const sourceDb = join3(root, "messages.db");
+    if (existsSync2(sourceDb)) {
       if (lstatSync(sourceDb).isSymbolicLink()) throw new Error("The message database must not be a symbolic link.");
       const db = new DatabaseSync(sourceDb, { readOnly: true });
       const completionPulse = setInterval(() => {
       }, 25);
       try {
-        await backup(db, join2(snapshot, "messages-snapshot.db"));
+        await backup(db, join3(snapshot, "messages-snapshot.db"));
       } finally {
         clearInterval(completionPulse);
         db.close();
       }
-      const snapshotDb = new DatabaseSync(join2(snapshot, "messages-snapshot.db"));
+      const snapshotDb = new DatabaseSync(join3(snapshot, "messages-snapshot.db"));
       try {
         snapshotDb.exec("PRAGMA journal_mode = DELETE");
       } finally {
@@ -19397,7 +19479,7 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
         if (excludedWorkspaceAuthPath(path2) || ephemeralWorkspaceTokenPath(path2) || redownloadedOrgLibraryPath(path2)) continue;
         if (forbiddenArchivePath(path2)) throw new Error("A workspace filename conflicts with a protected authentication or runtime path.");
         if (!validRelative(path2)) throw new Error("A workspace filename cannot be safely restored on supported platforms.");
-        const source = join2(directory, name);
+        const source = join3(directory, name);
         const stat = lstatSync(source);
         if (stat.isSymbolicLink()) {
           let target;
@@ -19417,7 +19499,7 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
           continue;
         }
         if (entries.length >= MAX_WORKSPACE_BACKUP_FILES) throw new Error("The workspace exceeds the 100,000-entry backup limit.");
-        const destination = join2(snapshot, "data", path2);
+        const destination = join3(snapshot, "data", path2);
         if (stat.isDirectory()) {
           folder(destination);
           entries.push({ path: path2, type: "directory", size: 0, mode: 448 });
@@ -19435,7 +19517,7 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
               writeJson(destination, value);
             }
             copied = { size: lstatSync(destination).size, mode: 384, sha256: hashFile(destination) };
-          } else copied = copyRegular(path2 === "messages.db" ? join2(snapshot, "messages-snapshot.db") : source, destination);
+          } else copied = copyRegular(path2 === "messages.db" ? join3(snapshot, "messages-snapshot.db") : source, destination);
           bytes += copied.size;
           if (bytes > MAX_WORKSPACE_BACKUP_BYTES) throw new Error("The workspace exceeds the 10 GB backup limit.");
           entries.push({ path: path2, type: "file", ...copied });
@@ -19453,9 +19535,9 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
       files: entries.filter((entry) => entry.type === "file").length,
       directories: entries.filter((entry) => entry.type === "directory").length,
       bytes,
-      bots: countJsonArray(join2(snapshot, "data", "bots.json")),
-      groups: countJsonArray(join2(snapshot, "data", "groups.json")),
-      ...databaseCounts(join2(snapshot, "data", "messages.db")),
+      bots: countJsonArray(join3(snapshot, "data", "bots.json")),
+      groups: countJsonArray(join3(snapshot, "data", "groups.json")),
+      ...databaseCounts(join3(snapshot, "data", "messages.db")),
       exclusions: EXCLUSION_NOTES,
       warnings
     };
@@ -19465,9 +19547,9 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
       clientState: options2.clientState ?? {},
       entries
     };
-    writeJson(join2(snapshot, "manifest.json"), manifest);
-    validateManifest(privateJson(join2(snapshot, "manifest.json")));
-    const path = join2(job.directory, "workspace.ombbackup");
+    writeJson(join3(snapshot, "manifest.json"), manifest);
+    validateManifest(privateJson(join3(snapshot, "manifest.json")));
+    const path = join3(job.directory, "workspace.ombbackup");
     const iv = randomBytes(12);
     const header = Buffer.concat([MAGIC, salt, iv]);
     const cipher = createCipheriv("aes-256-gcm", key, iv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-BCuyHjFV.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-Dc4OePBL.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};