openmausbot 0.1.90 → 0.1.92

package/dist-server/container-mcp.js

@@ -22,6 +22,9 @@ function nvmBinDirs() {
     return [];
   }
 }
+function sealedFixture() {
+  return process.env.OMB_TEST_SEALED_PATH === "1";
+}
 function knownDirs() {
   const home = homedir();
   return [
@@ -37,10 +40,13 @@ function knownDirs() {
     // opencode installer
     join(home, ".claude", "local"),
     // claude "local install"
-    "/opt/homebrew/bin",
-    // brew, Apple silicon
-    "/usr/local/bin",
-    // brew Intel / classic installs
+    // Machine-wide rather than under the (possibly temporary) home.
+    ...sealedFixture() ? [] : [
+      "/opt/homebrew/bin",
+      // brew, Apple silicon
+      "/usr/local/bin"
+      // brew Intel / classic installs
+    ],
     join(home, ".volta", "bin"),
     join(home, ".bun", "bin"),
     join(home, ".asdf", "shims"),
@@ -92,7 +98,7 @@ function augmentedPath() {
       ...(process.platform === "win32" ? windowsKnownDirs() : knownDirs()).filter((d) => existsSync(d))
     ]);
   }
-  if (!probed && !process.env.VITEST && process.platform !== "win32") {
+  if (!probed && !process.env.VITEST && !sealedFixture() && process.platform !== "win32") {
     probed = true;
     probeLoginShellPath();
   }
@@ -116,10 +122,123 @@ function probeLoginShellPath() {
     }
   );
 }
+function splitCliString(cli) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  for (const ch of cli.trim()) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+    } else if (/\s/.test(ch)) {
+      if (cur) out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+function isFile(p2) {
+  try {
+    return statSync(p2, { throwIfNoEntry: false })?.isFile() ?? false;
+  } catch {
+    return false;
+  }
+}
+function whichWin(cli, env) {
+  const exts = ((env ?? process.env).PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const probe = (base) => {
+    const order = extname(base) ? [base, ...exts.map((e) => base + e)] : [...exts.map((e) => base + e), base];
+    return order.find(isFile) ?? null;
+  };
+  if (/[\\/]/.test(cli) || /^[a-zA-Z]:/.test(cli)) return probe(cli);
+  const path = env ? env.PATH ?? env.Path ?? "" : augmentedPath();
+  for (const dir of path.split(delimiter)) {
+    if (!dir) continue;
+    const hit = probe(join(dir, cli));
+    if (hit) return hit;
+  }
+  return null;
+}
+function nodeExe(near, env) {
+  const local = join(near, "node.exe");
+  if (isFile(local)) return local;
+  const onPath = whichWin("node.exe", env);
+  if (onPath && extname(onPath).toLowerCase() === ".exe") return onPath;
+  return process.versions.electron ? null : process.execPath;
+}
+function parseCmdShim(shim, env) {
+  let text;
+  try {
+    text = readFileSync(shim, "utf8");
+  } catch {
+    return null;
+  }
+  const dir = dirname(shim);
+  const npmEntry = /^SET "NP[MX]_CLI_JS=%~dp0\\([^"]+)"/im.exec(text);
+  const targets = [...npmEntry ? [npmEntry] : [], ...text.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m2) => join(dir, m2[1])).filter((p2) => isFile(p2) && basename(p2).toLowerCase() !== "node.exe");
+  const script = targets.find((p2) => /\.[cm]?js$/i.test(p2));
+  if (script) {
+    const node = nodeExe(dir, env);
+    if (node) return { command: node, args: [script] };
+  }
+  const exe = targets.find((p2) => extname(p2).toLowerCase() === ".exe");
+  return exe ? { command: exe, args: [] } : null;
+}
+function parseNodeShebang(file2, env) {
+  let head = "";
+  let fd = null;
+  try {
+    fd = openSync(file2, "r");
+    const buf = Buffer.alloc(128);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    head = buf.subarray(0, n).toString("utf8").split("\n", 1)[0];
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+  if (!/^#!.*\bnode(\.exe)?\b/.test(head)) return null;
+  const node = nodeExe(dirname(file2), env);
+  return node ? { command: node, args: [file2] } : null;
+}
+function resolveWord(cli, args, env) {
+  if (process.platform !== "win32") return { command: cli, args };
+  const file2 = whichWin(cli, env);
+  if (!file2) return { command: cli, args };
+  const ext = extname(file2).toLowerCase();
+  if (ext === ".cmd" || ext === ".bat") {
+    const direct = parseCmdShim(file2, env);
+    return direct ? { command: direct.command, args: [...direct.args, ...args] } : { command: file2, args };
+  }
+  if (ext === ".exe" || ext === ".com") return { command: file2, args };
+  const viaNode = parseNodeShebang(file2, env);
+  return viaNode ? { command: viaNode.command, args: [...viaNode.args, ...args] } : { command: file2, args };
+}
+function resolveCliSpawn(cli, args, env) {
+  const trimmed = cli.trim();
+  if (trimmed.includes(" ") && existsSync(trimmed)) return resolveWord(trimmed, args, env);
+  const split = splitCliString(cli);
+  if (split.length > 1 || split[0] !== trimmed) {
+    const [head, ...fixed] = split;
+    if (!head) return { command: cli, args };
+    return resolveWord(head, [...fixed, ...args], env);
+  }
+  return resolveWord(cli, args, env);
+}
 
 // server/config.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -15624,26 +15743,109 @@ var stdioEntrySchema = external_exports.object({
 var stdioMutationSchema = stdioEntrySchema.extend({
   env: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
 });
+var CLIENT_ID = /^[\x20-\x7e]+$/;
+var SCOPE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+var CLIENT_SECRET_MAX = 4096;
+var oauthClientSchema = external_exports.object({
+  clientId: external_exports.string().trim().min(1, "Enter the client ID of the app registered with this server's sign-in provider.").max(512).regex(CLIENT_ID, "A client ID is printable text on one line."),
+  clientSecret: external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line.").optional(),
+  scopes: external_exports.array(external_exports.string().max(256).regex(SCOPE, "Scopes are single words, like offline_access or api://my-app/mcp.read.")).max(32).optional()
+}).strict();
 var remoteEntrySchema = external_exports.object({
   /** Streamable HTTP unless the entry says the older SSE transport. */
   type: external_exports.enum(["http", "sse"]).optional(),
   url: external_exports.string().trim().min(1).max(2048),
   headers: external_exports.record(external_exports.string(), external_exports.string().max(16384)).optional(),
+  oauth: oauthClientSchema.optional(),
   enabled: external_exports.boolean().optional()
 }).strict();
 var remoteMutationSchema = remoteEntrySchema.extend({
-  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
+  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional(),
+  oauth: oauthClientSchema.extend({
+    clientSecret: external_exports.union([external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line."), external_exports.literal(true)]).optional()
+  }).optional()
 });
 
 // server/cloud-overflow.ts
 var CLOUD_SEAT_IDLE_STOP_MS = 5 * 6e4;
 var CLOUD_SEAT_SLEEP_RETRY_MAX_MS = 10 * 6e4;
 
+// server/proxy-paths.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var SERVER_ROOT = dirname2(fileURLToPath(import.meta.url));
+function resolveProxy(relative) {
+  const source = join2(SERVER_ROOT, `${relative}.ts`);
+  return existsSync2(source) ? source : join2(SERVER_ROOT, `${relative}.js`);
+}
+var SPAWNED_PROXIES = {
+  browser: resolveProxy("browser-proxy"),
+  localComputer: resolveProxy("local-computer-proxy"),
+  permission: resolveProxy("permission-proxy"),
+  containerMcp: resolveProxy("container-mcp"),
+  vpsContainerMcp: resolveProxy("vps-container-mcp"),
+  agents: resolveProxy("drivers/agents-proxy"),
+  dweb: resolveProxy("drivers/dweb-proxy"),
+  connectors: resolveProxy("connector-proxy"),
+  mcpGate: resolveProxy("mcp-gate"),
+  phone: resolveProxy("drivers/phone-proxy"),
+  hook: resolveProxy("hooks/omb-hook"),
+  // Loaded by the external `pi` process via `-e`, not by this server — but
+  // resolved through the same single source of truth so the packaged layout
+  // check can assert it ships.
+  piMcpExtension: resolveProxy("drivers/pi-mcp-extension")
+};
+
+// server/enterprise.ts
+var layerSchema = external_exports.object({
+  customer: external_exports.string().min(1),
+  features: external_exports.array(external_exports.string().min(1)),
+  expiresAt: external_exports.string().nullable()
+});
+var DAY_MS = 24 * 60 * 6e4;
+
+// server/sessions.ts
+var PAIRING_CODE_TTL_MS = 5 * 6e4;
+function daysMs(value, fallbackDays) {
+  const days = Number(value);
+  const ok = Number.isInteger(days) && days >= 1 && days <= 3650;
+  return (ok ? days : fallbackDays) * 24 * 60 * 6e4;
+}
+var SESSION_TTL_MS = daysMs(process.env.OMB_SESSION_TTL_DAYS, 30);
+var SESSION_MAX_AGE_MS = daysMs(process.env.OMB_SESSION_MAX_DAYS, 180);
+var SESSION_RENEW_WHEN_LEFT_MS = SESSION_TTL_MS / 2;
+var STREAM_TICKET_TTL_MS = 5 * 6e4;
+var scopeSchema = external_exports.enum(["admin", "client"]);
+var sessionSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  tokenHash: external_exports.string().length(64),
+  label: external_exports.string().max(80),
+  scopes: external_exports.array(scopeSchema).min(1),
+  createdAt: external_exports.number(),
+  lastSeenAt: external_exports.number(),
+  expiresAt: external_exports.number(),
+  /** Set when the session came from an account sign-in rather than a code. */
+  userId: external_exports.string().max(256).optional(),
+  email: external_exports.string().max(320).optional(),
+  /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
+});
+var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
+
+// server/cloud-home.ts
+var CLOUD_PAIRING_NONCE_MS = 10 * 6e4;
+
 // server/config.ts
 var optionalText = external_exports.string().optional();
 var SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 var LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
 var BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
+var FISH_TTS_MODELS = ["s2.1-pro", "s2.1-pro-free"];
 var MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 var MAX_ROOM_TURN_TIMEOUT_MINUTES = 1440;
 var DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
@@ -15654,6 +15856,8 @@ var MIN_THREAD_EVENT_LOG_BYTES = 256 * 1024;
 var MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
 var MIN_LOCAL_VM_MAX_INSTANCES = 1;
 var MAX_LOCAL_VM_MAX_INSTANCES = 8;
+var MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 5;
+var MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 1440;
 function isValidSshAlias(value) {
   return typeof value === "string" && SSH_ALIAS.test(value);
 }
@@ -15691,7 +15895,8 @@ var roomConfigSchema = external_exports.object({
 );
 var localVmConfigSchema = external_exports.object({
   mode: external_exports.enum(["shared", "per-bot", "pool"]).optional(),
-  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional()
+  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional(),
+  idleTimeoutMinutes: external_exports.number().int().min(MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES).max(MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES).optional()
 });
 var browserProfileSchema = external_exports.object({
   // "guest" is the throwaway session's reserved id, never a saved profile
@@ -15850,7 +16055,11 @@ var onboardingConfigSchema = external_exports.object({
   /** Which welcome flow was completed; a newer flow may re-show itself. */
   version: external_exports.number().int().min(0).max(1e3).optional(),
   reelSeen: external_exports.boolean().optional(),
-  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional()
+  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional(),
+  /** OMB Cloud home only: when a bot's turn first finished on this machine
+   * (cloud-home.ts firstCloudTurnPatch). Written by the server, read by the
+   * Cloud's setup checklist. */
+  firstTurnAt: external_exports.string().trim().max(40).optional()
 }).strict();
 var instanceConfigSchema = external_exports.object({
   driver: external_exports.string().min(1),
@@ -15862,6 +16071,7 @@ var instanceConfigSchema = external_exports.object({
   ]).optional(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   enabled: external_exports.boolean().optional(),
+  access: external_exports.enum(["subscription", "custom", "api"]).optional(),
   config: external_exports.json().optional()
 });
 var instanceConfigMapSchema = external_exports.record(external_exports.string(), instanceConfigSchema);
@@ -15923,7 +16133,12 @@ var appConfigSchema = external_exports.object({
   /** Anthropic API key for Claude Code billed per token, handed only to
    * Claude instances; `url` only for a proxy or a test double. Never a
    * personal-login OAuth token. */
-  anthropic: external_exports.object({ key: optionalText, url: optionalText }).optional(),
+  anthropic: external_exports.object({ key: optionalText, url: optionalText, everyClaudeBot: external_exports.boolean().optional() }).optional(),
+  /** OpenAI's own API key, for the `openai` instance only. Codex keeps its
+   * own ChatGPT or API login and never reads this. */
+  openai: external_exports.object({ key: optionalText }).optional(),
+  /** OpenRouter key, for the `openrouter` instance only. */
+  openrouter: external_exports.object({ key: optionalText }).optional(),
   /** Monthly spend limit for the whole workspace, against the cost engines
    * report to the usage ledger. Enforced only with the `budgets` entitlement. */
   budgets: external_exports.object({
@@ -15957,8 +16172,8 @@ var appConfigSchema = external_exports.object({
   opencodeGo: external_exports.object({ apiKey: optionalText }).optional(),
   /** Voice settings and the selected voice id. `provider` picks the
    * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
-   * `fishKey`), "system" (the Mac's built-in voices, no key), or
-   * "xai" (Grok TTS, reusing `xai.key`), or
+   * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
+   * built-in voices, no key), "xai" (Grok TTS, reusing `xai.key`), or
    * "chatterbox" (a local OpenAI-compatible Chatterbox server; `baseUrl`
    * and `model` are settings, not secrets). Cloud keys stay separate so
    * switching providers never overwrites or misuses the other key. */
@@ -15968,7 +16183,21 @@ var appConfigSchema = external_exports.object({
     voice: optionalText,
     provider: external_exports.enum(["elevenlabs", "fish", "system", "chatterbox", "xai"]).optional(),
     baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the Chatterbox server address must start with http:// or https://").optional(),
-    model: optionalText
+    model: optionalText,
+    fishModel: external_exports.enum(FISH_TTS_MODELS).optional()
+  }).optional(),
+  /** The decision model (server/decider): a fast classifier that picks
+   * things for bots, starting with who answers a room message. `key` is
+   * write-only like every credential; `baseUrl` points at a Jev-compatible
+   * server instead of TypeSafe's (an operator setting with no UI); `jobs`
+   * switches each decision on or off. Not `decisions`: that section is the
+   * authorization log's retention. */
+  decider: external_exports.object({
+    enabled: external_exports.boolean().optional(),
+    provider: external_exports.enum(["jev", "off"]).optional(),
+    key: optionalText,
+    baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the decision model address must start with http:// or https://").optional(),
+    jobs: external_exports.object({ roomRouting: external_exports.boolean().optional() }).optional()
   }).optional(),
   /** Avatar provider credentials stay separate; choosing a router never reuses a cloud key. */
   imageGen: external_exports.object({
@@ -16039,36 +16268,37 @@ var storedAppConfigSchema = appConfigSchema.extend({
 var appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true }).extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() });
 var jsonObjectSchema = external_exports.record(external_exports.string(), external_exports.json());
 var DEFAULT_CAPTURE_QUIET_MS = 2 * 6e4;
-var DATA_DIR = process.env.OMB_DATA_DIR ?? join2(homedir2(), ".openmausbot");
-var LEGACY_DATA_DIR = join2(homedir2(), ".opengrokbot");
-var EVENTS_DIR = join2(DATA_DIR, "events");
-var NATIVE_DIR = join2(DATA_DIR, "native");
-
-// server/proxy-paths.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
-import { fileURLToPath } from "node:url";
-var SERVER_ROOT = dirname2(fileURLToPath(import.meta.url));
-function resolveProxy(relative) {
-  const source = join3(SERVER_ROOT, `${relative}.ts`);
-  return existsSync2(source) ? source : join3(SERVER_ROOT, `${relative}.js`);
-}
-var SPAWNED_PROXIES = {
-  browser: resolveProxy("browser-proxy"),
-  localComputer: resolveProxy("local-computer-proxy"),
-  permission: resolveProxy("permission-proxy"),
-  containerMcp: resolveProxy("container-mcp"),
-  vpsContainerMcp: resolveProxy("vps-container-mcp"),
-  agents: resolveProxy("drivers/agents-proxy"),
-  dweb: resolveProxy("drivers/dweb-proxy"),
-  connectors: resolveProxy("connector-proxy"),
-  mcpGate: resolveProxy("mcp-gate"),
-  phone: resolveProxy("drivers/phone-proxy"),
-  hook: resolveProxy("hooks/omb-hook"),
-  // Loaded by the external `pi` process via `-e`, not by this server — but
-  // resolved through the same single source of truth so the packaged layout
-  // check can assert it ships.
-  piMcpExtension: resolveProxy("drivers/pi-mcp-extension")
+var DATA_DIR = process.env.OMB_DATA_DIR ?? join3(homedir2(), ".openmausbot");
+var LEGACY_DATA_DIR = join3(homedir2(), ".opengrokbot");
+var EVENTS_DIR = join3(DATA_DIR, "events");
+var NATIVE_DIR = join3(DATA_DIR, "native");
+var OPENAI_API_INSTANCE = "openai";
+var OPENROUTER_API_INSTANCE = "openrouter";
+var XAI_API_INSTANCE = "xaiApi";
+var CLAUDE_API_INSTANCE = "claudeApi";
+var API_KEY_FLEET = {
+  [OPENAI_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenAI",
+    access: "api",
+    icon: { kind: "preset", preset: "openai" },
+    config: { url: "https://api.openai.com/v1", apiKeyEnv: "OMB_OPENAI_API_KEY", catalog: "openai" }
+  },
+  [CLAUDE_API_INSTANCE]: {
+    driver: "claudeAgent",
+    displayName: "Claude (API key)",
+    access: "api",
+    icon: { kind: "preset", preset: "anthropic" },
+    config: { requireApiKey: true }
+  },
+  [XAI_API_INSTANCE]: { driver: "grok", displayName: "xAI", access: "api", icon: { kind: "preset", preset: "xai" } },
+  [OPENROUTER_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenRouter",
+    access: "api",
+    icon: { kind: "preset", preset: "openrouter" },
+    config: { url: "https://openrouter.ai/api/v1", apiKeyEnv: "OMB_OPENROUTER_API_KEY" }
+  }
 };
 
 // server/container-computer.ts
@@ -16402,9 +16632,11 @@ function createMcpBridgeInterceptor(options) {
   };
 }
 function runMcpBridge(options) {
-  const child = spawn(options.command, options.args, {
+  const env = options.env ?? { ...process.env, PATH: augmentedPath() };
+  const { command, args } = resolveCliSpawn(options.command, options.args, env);
+  const child = spawn(command, args, {
     shell: false,
-    env: options.env ?? { ...process.env, PATH: augmentedPath() },
+    env,
     stdio: ["pipe", "pipe", "pipe"]
   });
   child.stdin.on("error", () => {

package/dist-server/drivers/agents-proxy.js

@@ -129,6 +129,8 @@ function catalogProfileFromEnv(env) {
     skillAuthoring: env.OMB_SKILL_AUTHORING_ENABLED === "1",
     sharedComputers: env.OMB_SHARED_COMPUTERS_ENABLED === "1",
     voiceNotes: env.OMB_VOICE_NOTES === "1",
+    cloudHome: env.OMB_CLOUD_HOME === "1",
+    memoryEnabled: env.OMB_MEMORY_ENABLED !== "0",
     botId: env.OMB_BOT_ID ?? ""
   };
 }
@@ -309,14 +311,14 @@ var toolDefinitions = (externalRuntime) => [
   },
   {
     name: "coordinate_bots",
-    description: "Ask existing OpenMausBot teammates for advice or assign concrete work. From normal chat every assignment you send a teammate continues your one standing conversation with that teammate, so they keep the context of what you asked before; from a room it defaults to this room. Use group_id from list_room_targets for a specific room. Give 1-4 bot_ids \u2014 teammate ids as list_bots or your roster prints them; a unique teammate name also resolves: they receive only your brief and use their own model, tools and permissions. Busy bots queue. They can consult their specialists; all results return here and resume you automatically. Include exact file paths, constraints and what must be verified. After sending all assignments, END your turn; do not poll or wait. On return, resolve tradeoffs, verify the requested outcome and request concrete corrections if necessary before giving one final answer. Do not send acknowledgements as new work.",
+    description: "Ask existing OpenMausBot teammates for advice or assign concrete work. From normal chat each distinct assignment starts a fresh thread for that teammate; from a room it defaults to this room. Give a self-contained brief. Use group_id from list_room_targets for a specific room. Give 1-4 bot_ids \u2014 teammate ids as list_bots or your roster prints them; a unique teammate name also resolves: they receive only your brief and use their own model, tools and permissions. Busy bots queue. They can consult their specialists; all results return here and resume you automatically. Include exact file paths, constraints and what must be verified. After sending all assignments, END your turn; do not poll or wait. On return, resolve tradeoffs, verify the requested outcome and request concrete corrections if necessary before giving one final answer. Do not send acknowledgements as new work.",
     inputSchema: { type: "object", additionalProperties: false, properties: {
-      group_id: { type: "string", description: "Optional destination room. Omit for this room, or your standing conversation with each teammate when chatting directly." },
+      group_id: { type: "string", description: "Optional destination room. Omit for this room, or a fresh thread for each teammate when chatting directly." },
       bot_ids: { type: "array", items: { type: "string", description: "A teammate's id exactly as list_bots or your roster prints it ([id: \u2026]). A teammate's unique display name also resolves; a name shared by two reachable teammates is refused." }, minItems: 1, maxItems: 4, uniqueItems: true },
       message: { type: "string", minLength: 1, maxLength: 4e3, description: "Self-contained question or task for these teammates. Send separate requests when responsibilities differ." },
       request_key: { type: "string", description: "A short unique assignment key. Reuse for an identical retry." },
       rework: { type: "boolean", description: "True only for concrete additional work from someone who already completed a request." },
-      label: { type: "string", description: "Optional short name (one line, at most 60 characters) for this job. Used only when the teammate is still working on your previous assignment and this one therefore runs in its own thread beside your standing conversation." }
+      label: { type: "string", description: "Optional short name (one line, at most 60 characters) for this job. Names the new direct assignment thread." }
     }, required: ["bot_ids", "message", "request_key"] }
   },
   {
@@ -853,9 +855,19 @@ var ROOM_ONLY_TOOLS = /* @__PURE__ */ new Set(["list_room_targets", "coordinate_
 var ROOM_REPLACED_TOOLS = /* @__PURE__ */ new Set(["ask_bot", "delegate_bot", "check_delegation", "wait_delegation", "start_thread", "send_to_thread", "wait_thread"]);
 var EXTERNAL_TOOL_NAMES = /* @__PURE__ */ new Set(["list_bots", "ask_bot", "delegate_bot", "check_delegation", "wait_delegation"]);
 var WATCHER_TOOL_NAMES = /* @__PURE__ */ new Set(["create_options_card"]);
+var LOCAL_VM_TOOL_NAMES = /* @__PURE__ */ new Set(["vm_exec"]);
+var CLOUD_HOME_SURFACE = {
+  type: "string",
+  enum: ["auto", "cloud", "browser"],
+  description: "auto = suitable configured computer, cloud = remote Boat/VPS, browser = built-in browser. Omit to list. This server runs in the cloud: the user's own computer and a Local VM are not places here."
+};
 function availableTools(profile) {
+  const tools = catalogTools(profile);
+  return profile.cloudHome ? tools.filter((tool) => !LOCAL_VM_TOOL_NAMES.has(tool.name)).map((tool) => tool.name === "select_computer" ? { ...tool, inputSchema: { ...tool.inputSchema, properties: { surface: CLOUD_HOME_SURFACE } } } : tool) : tools;
+}
+function catalogTools(profile) {
   const TOOLS = toolDefinitions(profile.externalRuntime);
-  const BOT_SCOPED_TOOLS = profile.botId === WATCHER_OPTIONS_CARD_BOT_ID ? TOOLS : TOOLS.filter((tool) => !WATCHER_TOOL_NAMES.has(tool.name));
+  const BOT_SCOPED_TOOLS = TOOLS.filter((tool) => (profile.botId === WATCHER_OPTIONS_CARD_BOT_ID || !WATCHER_TOOL_NAMES.has(tool.name)) && (profile.memoryEnabled !== false || tool.name !== "memory_update" && tool.name !== "memory_log"));
   const AUTHORING_TOOLS = profile.skillAuthoring ? BOT_SCOPED_TOOLS : BOT_SCOPED_TOOLS.filter((tool) => !SKILL_TOOL_NAMES.has(tool.name));
   const SHAREABLE_TOOLS = profile.sharedComputers ? AUTHORING_TOOLS : AUTHORING_TOOLS.filter((tool) => !SHARED_COMPUTER_TOOL_NAMES.has(tool.name));
   const VOICE_READY_TOOLS = profile.voiceNotes ? SHAREABLE_TOOLS : SHAREABLE_TOOLS.filter((tool) => !VOICE_TOOL_NAMES.has(tool.name));

package/dist-server/enterprise/server/index.js

@@ -14728,7 +14728,11 @@ var sessionSchema = external_exports.object({
   userId: external_exports.string().max(256).optional(),
   email: external_exports.string().max(320).optional(),
   /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
-  membershipAuthority: external_exports.literal("portal").optional()
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
 });
 var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });