openmausbot 0.1.90 → 0.1.92

package/dist-server/server/cloud-home-start.js

@@ -1,18 +1,33 @@
 // Entry point of the OMB Cloud Pro home image (deploy/fly/Dockerfile).
 //
-// Starts as root only to hand a fresh Fly volume (mounted root-owned at
-// /data) to the unprivileged `maus` user, then drops privileges for good
-// and runs two children: the OpenMausBot server on 127.0.0.1:8799 (and its
-// webhook receiver on :8800) and the Caddy edge on 0.0.0.0:8080. The edge is
-// the only listener the network can reach, and it always forwards with
-// X-Forwarded-*, so request-auth.ts never grants a remote request loopback
-// trust. If either child exits, both stop and the machine restarts.
+// Starts as root, hands a fresh Fly volume (mounted root-owned at /data) to
+// the unprivileged `maus` user, and stays a small root supervisor of two
+// children that run as `maus`: the OpenMausBot server on 127.0.0.1:8799
+// (and its webhook receiver on :8800) and the Caddy edge on 0.0.0.0:8080.
+// The edge is the only listener the network can reach, and it always
+// forwards with X-Forwarded-*, so request-auth.ts never grants a remote
+// request loopback trust. If either child exits, both stop and the machine
+// restarts; the one exception is the server asking to be started again
+// after a restore.
+//
+// The machine's secrets (the signing secret, the relay tokens) arrive as
+// this process's environment. No child's environment ever carries them:
+// /proc/<pid>/environ keeps a process's starting environment, readable by
+// anything running as the same user (an engine's shell). The server gets
+// them over an inherited pipe it reads first thing and closes
+// (cloud-secrets.ts), and an environment built from an allow-list, so a
+// secret the platform adds later never reaches it either. This process stays
+// root, so its own environment and memory are out of `maus`'s reach, and it
+// runs and trusts only code `maus` cannot change: the image's, never the
+// volume's (codeTrustProblem).
 import { spawn } from "node:child_process";
 import { chownSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { cloudHomeConfiguration, cloudHomeHost, prepareCloudHomeVolume, withoutIgnoredCloudKeys } from "./cloud-home.js";
+import { CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
 const SERVICE_USER = "maus";
+/** The descriptor the server reads its secrets from. */
+const SECRETS_FD = 3;
 /** uid/gid from /etc/passwd; Node has no getpwnam. */
 export function passwdIds(passwd, name) {
     for (const line of passwd.split("\n")) {
@@ -22,22 +37,85 @@ export function passwdIds(passwd, name) {
     }
     return null;
 }
-/** The server child's environment: the operator's contract plus fixed
- * ports and paths (Linux paths inside the image, so POSIX joins on every
- * host that builds them, tests included), never a platform gateway's settings. The edge child gets
- * only what it needs to route. */
+/** What the server child may be given from this process's environment, by
+ * name: the process basics, what the image sets, and the Cloud home's
+ * contract that is not secret. Anything else (a secret the platform adds
+ * later, a test's key, a platform gateway's settings) is left out. */
+const SERVER_ENV_NAMES = new Set([
+    "PATH", "SHELL", "HOSTNAME", "LANG", "LANGUAGE", "TZ", "TERM", "TMPDIR", "NO_COLOR", "NODE_ENV", "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "SSL_CERT_DIR",
+    "AGENT_BROWSER_EXECUTABLE_PATH", "OMB_STATIC_DIR", "OMB_DATA_DIR",
+    "OMB_CLOUD_ROLE", "OMB_CLOUD_MACHINE_ID", "OMB_CLOUD_ADMIN_URL", "OMB_CLOUD_IMAGE", "OMB_PUBLIC_URL", "OMB_WEBHOOK_PUBLIC_URL",
+    "OMB_CLOUD_BOAT_URL", "OMB_CLOUD_VOICE_URL", "OMB_CLOUD_DECIDER_URL", "OMB_TTS_DEFAULT_VOICE",
+]);
+export function serverEnvironmentAllowed(name) {
+    return SERVER_ENV_NAMES.has(name) || name.startsWith("LC_");
+}
+/** The server child's environment: the allowed part of the operator's
+ * contract (serverEnvironmentAllowed) plus fixed ports and paths (Linux
+ * paths inside the image, so POSIX joins on every host that builds them,
+ * tests included), never a platform gateway's settings and never a secret
+ * (`secrets`, handed over the pipe instead). `dropped` names what was left
+ * out, for the log. The edge child gets only what it needs to route. */
 export function cloudHomeChildEnvironments(config, env, home) {
+    const offered = withoutCloudSecrets(withoutIgnoredCloudKeys(env));
+    const allowed = Object.fromEntries(Object.entries(offered).filter(([name, value]) => value !== undefined && serverEnvironmentAllowed(name)));
+    const dropped = Object.keys(offered).filter((name) => !serverEnvironmentAllowed(name) && name !== "HOME").sort();
     const server = {
-        ...withoutIgnoredCloudKeys(env), HOME: home, OMB_DATA_DIR: env.OMB_DATA_DIR || posix.join(home, ".openmausbot"),
+        ...allowed, HOME: home, OMB_DATA_DIR: env.OMB_DATA_DIR || posix.join(home, ".openmausbot"),
         OMB_PORT: "8799", OMB_WEBHOOK_PORT: "8800", OMB_PUBLIC_URL: config.publicOrigin,
         OMB_WEBHOOK_PUBLIC_URL: env.OMB_WEBHOOK_PUBLIC_URL || config.publicOrigin,
+        [CLOUD_SECRETS_FD_ENV]: String(SECRETS_FD),
     };
     const edge = {
         PATH: env.PATH ?? "/usr/local/bin:/usr/bin:/bin", HOME: "/tmp/omb-edge",
         XDG_DATA_HOME: "/tmp/omb-edge/data", XDG_CONFIG_HOME: "/tmp/omb-edge/config",
         OMB_CLOUD_PUBLIC_HOST: cloudHomeHost(config),
     };
-    return { server, edge };
+    return { server, edge, secrets: cloudHomeSecrets(env), dropped };
+}
+/** Why the root supervisor must not run or trust `files`, or null: each
+ * must be root's and not writable by anyone else (nor any folder above it),
+ * and none may live on the volume `home`, which `maus` owns. The image makes its code
+ * root's (deploy/fly/Dockerfile); a file `maus` could rewrite would run as
+ * root at the next start, or be handed the secrets. */
+export function codeTrustProblem(files, home, stat = statSync) {
+    const volume = posix.join(home, "/");
+    for (const file of files) {
+        if (file === home || file.startsWith(volume))
+            return `${file} is on the volume`;
+        for (let path = file;; path = dirname(path)) {
+            let owner;
+            try {
+                owner = stat(path);
+            }
+            catch {
+                return `${path} cannot be checked`;
+            }
+            if (owner.uid !== 0)
+                return `${path} is not root's`;
+            // A folder with the sticky bit (/tmp) lets nobody replace root's files.
+            if (owner.mode & 0o022 && !(path !== file && owner.mode & 0o1000))
+                return `${path} is writable by others than root`;
+            if (dirname(path) === path)
+                break;
+        }
+    }
+    return null;
+}
+/** Start the server with its secrets on an inherited pipe (never its
+ * environment), as `ids` when given. The pipe is written and closed at once;
+ * nothing else is ever sent on it. */
+export function spawnWithSecrets(command, args, env, secrets, ids) {
+    const child = spawn(command, args, { env, stdio: ["inherit", "inherit", "inherit", "pipe"], ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) });
+    const pipe = child.stdio[SECRETS_FD];
+    pipe?.on("error", () => { });
+    pipe?.end(JSON.stringify(secrets));
+    return child;
+}
+/** What the launcher does when the server child exits: start it again only
+ * when it asked to (a committed restore), and only a few times in a row. */
+export function serverExitAction(code, stopping, restarts) {
+    return !stopping && code === CLOUD_HOME_RESTART_EXIT_CODE && restarts < 5 ? "restart" : "stop";
 }
 export function startCloudHome(env = process.env) {
     process.umask(0o077);
@@ -48,8 +126,11 @@ export function startCloudHome(env = process.env) {
     for (const warning of config.warnings)
         console.warn(`cloud home: ${warning}`);
     const home = env.HOME || "/data";
+    // Who the children run as: `maus` when this starts as root (the image),
+    // else whoever started it (a test, a dev machine).
+    let ids = null;
     if (process.getuid?.() === 0) {
-        const ids = passwdIds(readFileSync("/etc/passwd", "utf8"), SERVICE_USER);
+        ids = passwdIds(readFileSync("/etc/passwd", "utf8"), SERVICE_USER);
         if (!ids)
             throw new Error(`The ${SERVICE_USER} user is missing from this image.`);
         // A new volume is a root-owned mount point. Only the mount point itself
@@ -58,14 +139,32 @@ export function startCloudHome(env = process.env) {
         if (stat.uid !== ids.uid || stat.gid !== ids.gid)
             chownSync(home, ids.uid, ids.gid);
         process.setgroups?.([]);
-        process.setgid(ids.gid);
-        process.setuid(ids.uid);
+        // The volume is prepared as `maus`, so what it creates is theirs.
+        process.setegid(ids.gid);
+        process.seteuid(ids.uid);
+        try {
+            prepareCloudHomeVolume(home, config.machineId);
+        }
+        finally {
+            process.seteuid(0);
+            process.setegid(0);
+        }
+    }
+    else {
+        prepareCloudHomeVolume(home, config.machineId);
     }
-    if (process.getuid?.() === 0)
-        throw new Error("The Cloud home must run as an unprivileged user.");
-    prepareCloudHomeVolume(home, config.machineId);
     const here = dirname(fileURLToPath(import.meta.url));
-    const { server, edge } = cloudHomeChildEnvironments(config, env, home);
+    const edgeBin = env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy";
+    const edgeConfig = env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile";
+    if (ids) {
+        const problem = codeTrustProblem([process.execPath, fileURLToPath(import.meta.url), join(here, "index.js"), edgeBin, edgeConfig], home);
+        if (problem)
+            throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it from deploy/fly/Dockerfile.`);
+    }
+    const { server, edge, secrets, dropped } = cloudHomeChildEnvironments(config, env, home);
+    // Names only, never values: what the server does not get from here.
+    if (dropped.length)
+        console.log(`cloud home: not passed to the server: ${dropped.join(", ")}`);
     const children = [];
     let stopping = false;
     const stop = (failed) => {
@@ -81,14 +180,25 @@ export function startCloudHome(env = process.env) {
                 child.kill("SIGKILL"); }, 20_000);
         force.unref();
     };
-    const run = (command, args, childEnv) => {
-        const child = spawn(command, args, { env: childEnv, stdio: "inherit" });
+    const watch = (child, again) => {
         children.push(child);
         child.once("error", () => stop(true));
-        child.once("exit", () => stop(true));
+        child.once("exit", (code) => {
+            children.splice(children.indexOf(child), 1);
+            if (!again?.(code))
+                stop(true);
+        });
     };
-    run(process.execPath, [join(here, "index.js")], server);
-    run(env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy", ["run", "--config", env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile", "--adapter", "caddyfile"], edge);
+    let restarts = 0;
+    const runServer = () => watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
+        if (serverExitAction(code, stopping, restarts) !== "restart")
+            return false;
+        restarts++;
+        runServer();
+        return true;
+    });
+    runServer();
+    watch(spawn(edgeBin, ["run", "--config", edgeConfig, "--adapter", "caddyfile"], { env: edge, stdio: "inherit", ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) }));
     process.once("SIGTERM", () => stop(false));
     process.once("SIGINT", () => stop(false));
 }

package/dist-server/server/cloud-home.js

@@ -1,5 +1,5 @@
-// OMB Cloud Pro home machine: the boot contract, the Admin's signed pairing
-// request, and the volume the machine lives on. docs/cloud-pro.md is the
+// OMB Cloud Pro home machine: the boot contract, the places it offers, the
+// Admin's signed pairing request, and the volume the machine lives on. docs/cloud-pro.md is the
 // contract of record (and openmaus-cloud docs/consumer-cloud.md its Admin
 // half); keep them in step.
 //
@@ -12,7 +12,10 @@
 // the machine's bootstrap secret (HMAC-SHA256 over the method, path, a
 // timestamp, a nonce and the body's hash); each valid request opens one
 // ordinary pairing window (sessions.ts: single use, at most ten minutes),
-// which the Admin hands to the person's signed-in desktop app.
+// which the Admin hands to the person's signed-in desktop app. A request for
+// a browser sign-in (the Cloud page's "Use in your browser") names the
+// account that owns this Cloud and opens a window only this machine's web
+// page redeems, for at most two minutes, after showing whose Cloud it is.
 //
 // Cloud Pro includes no AI. The person signs in on the machine with their own
 // Claude or ChatGPT account, or an API key, exactly as on any server; nothing
@@ -33,12 +36,20 @@ export const CLOUD_IGNORED_KEYS = ["OMB_HOSTED_MODEL_URL", "OMB_HOSTED_MODEL_TOK
 export const CLOUD_PAIRING_PATH = "/api/cloud/pairing";
 export const CLOUD_PAIRING_DEFAULT_TTL_S = 300;
 export const CLOUD_PAIRING_MAX_TTL_S = 600;
+/** A browser sign-in's owner: printable ASCII with no space, `<` or `>`, and exactly one `@`. */
+const OWNER_EMAIL = /^[!-;=?A-~]{1,64}@[!-;=?A-~]{1,189}$/;
+/** A browser sign-in is redeemed the moment its tab loads. */
+export const CLOUD_BROWSER_SIGN_IN_MAX_TTL_S = 120;
 /** How far a signed request's timestamp may be from this machine's clock. */
 export const CLOUD_PAIRING_SKEW_S = 300;
 /** How long a used nonce is refused. Longer than the whole accepted window. */
 export const CLOUD_PAIRING_NONCE_MS = 10 * 60_000;
 const MAX_NONCES = 10_000;
 export const CLOUD_HOME_MARKER = ".omb-cloud-home.json";
+/** The server exits with this after a restore commits (Move to Cloud): the
+ * launcher then starts it again, and startup installs the restore. Any other
+ * exit stops the machine for Fly to restart. */
+export const CLOUD_HOME_RESTART_EXIT_CODE = 75;
 export function cloudHomeConfigured(env = process.env) {
     return CLOUD_HOME_KEYS.some((key) => env[key] !== undefined);
 }
@@ -85,6 +96,9 @@ export function cloudHomeConfiguration(env = process.env) {
         warnings.push(`ignoring ${ignored.join(", ")}: Cloud Pro includes no AI; people sign in with their own Claude or ChatGPT account, or an API key`);
     return { machineId, adminOrigin, publicOrigin, bootstrapSecret, warnings };
 }
+// The secrets and their pipe live in cloud-secrets.ts, which the server
+// reads before anything else (cloud-secrets-boot.ts).
+export { CLOUD_HOME_SECRET_KEYS, CLOUD_SECRETS_FD_ENV, cloudHomeSecrets, takeCloudSecrets, withoutCloudSecrets } from "./cloud-secrets.js";
 /** The environment without a platform gateway's settings (CLOUD_IGNORED_KEYS). */
 export function withoutIgnoredCloudKeys(env) {
     const kept = { ...env };
@@ -92,6 +106,37 @@ export function withoutIgnoredCloudKeys(env) {
         delete kept[key];
     return kept;
 }
+// The places a Cloud home offers live in shared/cloud-home.ts, so the app
+// lists exactly what the server accepts.
+export { cloudHomeOffersPlace } from "../shared/cloud-home.js";
+/** Why a Cloud home refuses a place it never offers (no "this computer" of
+ * the person's, no Local VM), in the words the person reads; undefined for a
+ * place it offers. A turn's error shows 160 characters, so each fits. */
+export function cloudHomePlaceRefusal(place) {
+    if (place === "local")
+        return "This computer isn't a place on your OMB Cloud: its bots run in the cloud. Set Works on to Auto, Cloud or Browser, or lend your Mac under Settings → OMB Cloud.";
+    if (place === "vm")
+        return "Bots on your OMB Cloud can't use a Local VM: the cloud machine has no container runtime. Set Works on to Auto, Cloud or Browser.";
+    return undefined;
+}
+/** What a turn is told when Cloud is chosen but no Boat account is set up (no
+ * key of the person's and no included Boat). A Cloud home has no Local VM to
+ * suggest instead. */
+export function boatNotConfiguredMessage(cloudHome) {
+    return `Cloud Boat is not configured — add a Boat API key or choose ${cloudHome ? "Browser" : "Local VM"}`;
+}
+/** The Cloud's setup checklist (docs/cloud-pro.md) has a "try something"
+ * step that is done once a bot's turn finishes on the machine itself. The
+ * server records when, once, in this Cloud's own onboarding record: that
+ * section never travels with Move to Cloud (workspace-backup-policy.ts), so a
+ * moved-in history of turns does not count. Null when there is nothing to
+ * record: not a Cloud home, already recorded, a failed or stopped turn, or a
+ * thread that is no bot's conversation or room. */
+export function firstCloudTurnPatch(turn) {
+    if (!turn.cloudHome || turn.recorded || !turn.ok || !turn.known)
+        return null;
+    return { onboarding: { firstTurnAt: (turn.now ?? new Date()).toISOString() } };
+}
 /** The Admin's side of the signature (openmaus-cloud cloudPairingSignature). */
 export function cloudPairingSignature(secret, timestamp, nonce, body) {
     const bodyHash = createHash("sha256").update(body).digest("base64url");
@@ -141,18 +186,32 @@ export function createCloudPairing(options) {
             }
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
                 return { status: 400, body: { error: "invalid_body" } };
-            const { label, ttlSeconds } = parsed;
+            const { label, ttlSeconds, purpose, owner } = parsed;
             // oxlint-disable-next-line no-control-regex
             if (label !== undefined && (typeof label !== "string" || label.length > 80 || /[\x00-\x1f\x7f]/.test(label)))
                 return { status: 400, body: { error: "invalid_label" } };
             if (ttlSeconds !== undefined && (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1))
                 return { status: 400, body: { error: "invalid_ttl" } };
-            const ttl = Math.min(ttlSeconds ?? CLOUD_PAIRING_DEFAULT_TTL_S, CLOUD_PAIRING_MAX_TTL_S);
+            if (purpose !== undefined && purpose !== "browser")
+                return { status: 400, body: { error: "invalid_purpose" } };
+            const browser = purpose === "browser";
+            // A browser sign-in names its Cloud's owner (the account's email), which the sign-in page shows before the
+            // person continues: one address in printable ASCII, as the Admin's email schemas allow, with no `<` or `>`.
+            if ((browser || owner !== undefined) && (typeof owner !== "string" || owner.length > 254 || !OWNER_EMAIL.test(owner))) {
+                return { status: 400, body: { error: "invalid_owner" } };
+            }
+            const ttl = Math.min(ttlSeconds ?? CLOUD_PAIRING_DEFAULT_TTL_S, browser ? CLOUD_BROWSER_SIGN_IN_MAX_TTL_S : CLOUD_PAIRING_MAX_TTL_S);
             const opened = sessions.openPairing({
                 scopes: ["admin", "client"],
                 label: typeof label === "string" && label.trim() ? label.trim() : "OMB Cloud",
                 ttlMs: ttl * 1000,
+                browser,
+                ...(browser ? { owner: owner } : {}),
             });
+            // A browser sign-in has no code to type: only its credential redeems it, and saying `purpose` back tells the
+            // Admin this machine made one (a machine from before this ignores `purpose` and opens an ordinary window).
+            if (browser)
+                return { status: 200, body: { credential: opened.credential, expiresAt: opened.expiresAt, purpose: "browser" } };
             return { status: 200, body: { code: formatPairingCode(opened.code), credential: opened.credential, expiresAt: opened.expiresAt } };
         },
     };

package/dist-server/server/cloud-lending.js

@@ -0,0 +1,167 @@
+// Who may use a Mac lent to an OMB Cloud home (docs/cloud-pro.md, "Let my
+// Cloud use this Mac"). A Cloud home is one person's server, but not every
+// turn on it is theirs: a guest the owner paired, a webhook's payload, or a
+// line someone else slipped into a running turn must never reach the Mac.
+//
+// A turn may use the lent Mac only when the harness can prove it acts for the
+// owner:
+// - a conversation the owner started from one of their own devices (a live
+//   session with admin scope), or
+// - a scheduled run of a routine whose instructions the owner wrote (created
+//   or edited from one of those devices), or a run the owner started by hand;
+// and the conversation was opened by them and holds nobody else's words,
+// ever: a resumed session carries everything said in it, so one line (or
+// card answer) from a guest, a teammate bot or a local process, before or
+// during the turn, takes that conversation out of lending. The owner starts a new one to lend again.
+// Webhook runs, guests, rooms, a bot's delegated or peer turn, and anything
+// unprovable never can.
+// Everything here is pure; server/index.ts supplies the records.
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+const personOf = (line) => line?.role === "user" && !line.peerAsk ? line.sender?.id : undefined;
+export function cloudHomeTurnMayLend(turn) {
+    return cloudHomeLendingRefusal(turn) === null;
+}
+export function cloudHomeLendingRefusal(turn) {
+    const { request } = turn;
+    if (!request?.messageId || request.stopped || !request.generations.has(turn.generation))
+        return "unproven";
+    const index = turn.thread.findIndex(line => line.id === request.messageId);
+    if (index < 0)
+        return "unproven";
+    let owner;
+    if (request.automation === undefined) {
+        owner = turn.ownerPerson(personOf(turn.thread[index]));
+    }
+    else {
+        const run = turn.routineRun();
+        owner = request.automation !== "webhook" && Boolean(run) && run.triggerSource !== "webhook" &&
+            run.ownerAuthored && (run.triggerSource !== "manual" || run.ownerStarted);
+    }
+    if (!owner)
+        return "not-owner";
+    // A conversation someone else opened (and named) is theirs, whoever writes in it.
+    if (turn.starters?.some((person) => person !== undefined && !turn.ownerPerson(person)))
+        return "someone-else";
+    if (turn.reportsFromOthers)
+        return "someone-else";
+    // Nothing anyone else wrote (a guest, a teammate bot, a local process) may
+    // be anywhere in this conversation, before or after the request, as a line
+    // (sent, queued, steered or handed in) or as the answer to a card. A
+    // routine's own prompt line names nobody; its provenance was proven above.
+    const clean = ownerOnlyConversation(turn.thread, turn.ownerPerson, turn.cardAnswerer, request.automation !== undefined ? request.messageId : undefined);
+    return clean ? null : "someone-else";
+}
+/** A conversation only the owner has written in: every user line is theirs
+ * and every card someone answered was answered by them (`exempt`: one line,
+ * a routine's own prompt, that names nobody). The same test decides which of
+ * a bot's other conversations may feed a turn on a Cloud home (recall, the
+ * recent-work brief, memory capture, the daily log). */
+export function ownerOnlyConversation(thread, ownerPerson, cardAnswerer, exempt) {
+    return thread.every(line => (line.role !== "user" || line.id === exempt || ownerPerson(personOf(line))) &&
+        (!answeredByPerson(line.card) || ownerPerson(cardAnswerer(line.card))));
+}
+/** A card someone answered: a person's verdict or words. The harness's own
+ * settlements (automatic approvals, a turn that ended) are marked dismissed
+ * or unavailable and carry nobody's words. */
+function answeredByPerson(card) {
+    if (!card)
+        return false;
+    return (Boolean(card.answered) && card.answered !== "unavailable" && card.dismissed !== true) || Boolean(card.answeredText);
+}
+/** What a routine run does and when, reduced to what its author decides:
+ * the instructions, where and on what it runs, and its schedule. The
+ * scheduler never rewrites these (it does rewrite a routine's results thread
+ * on each run, so that is guarded by who edits the routine instead: see the
+ * routines PATCH route). An edit by anyone else changes the fingerprint. */
+export function routineFingerprint(routine) {
+    const attachments = (routine.attachments ?? []).map(attachment => [attachment.id, attachment.path]);
+    return createHash("sha256").update(JSON.stringify([
+        routine.prompt ?? "", routine.target ?? null, routine.botId ?? "", routine.groupId ?? null, attachments,
+        routine.schedule ?? null, routine.runOn ?? null,
+    ])).digest("hex");
+}
+const authorsFile = z.object({
+    version: z.literal(1),
+    routines: z.record(z.string().max(128), z.string().regex(/^[a-f0-9]{64}$/)),
+    /** Whoever last wrote each routine (a person key), owner or not. */
+    writers: z.record(z.string().max(128), z.string().regex(/^p_[\w-]{22}$/)).optional(),
+}).strict();
+/** Which routines the owner wrote, as the fingerprint of what they wrote.
+ * Persisted beside the routines (owner-only). A missing or damaged file
+ * means none: it never grants anything by being absent. */
+export function createCloudRoutineAuthors(file) {
+    let routines = {};
+    let writers = {};
+    try {
+        if (existsSync(file)) {
+            const stat = lstatSync(file);
+            if (stat.isFile() && !stat.isSymbolicLink() && stat.size <= 1_000_000) {
+                const parsed = authorsFile.parse(JSON.parse(readFileSync(file, "utf8")));
+                routines = parsed.routines;
+                writers = parsed.writers ?? {};
+            }
+        }
+    }
+    catch {
+        routines = {};
+        writers = {};
+    }
+    const save = () => writeFileAtomic(file, JSON.stringify({ version: 1, routines, writers }), { mode: 0o600 });
+    return {
+        /** The owner wrote this routine as it stands now. */
+        record(id, routine) { routines = { ...routines, [id]: routineFingerprint(routine) }; save(); },
+        /** The owner's authorship ends; whoever wrote it last is still named. */
+        forget(id) { if (Object.hasOwn(routines, id)) {
+            const next = { ...routines };
+            delete next[id];
+            routines = next;
+            save();
+        } },
+        /** Someone (a person key) created or edited this routine. */
+        wrote(id, person) { if (writers[id] !== person) {
+            writers = { ...writers, [id]: person };
+            save();
+        } },
+        /** Who last wrote this routine, when that is known. */
+        writer(id) { return Object.hasOwn(writers, id) ? writers[id] : undefined; },
+        /** The routine is gone: nothing about it is kept. */
+        remove(id) {
+            if (!Object.hasOwn(routines, id) && !Object.hasOwn(writers, id))
+                return;
+            const nextRoutines = { ...routines };
+            delete nextRoutines[id];
+            routines = nextRoutines;
+            const nextWriters = { ...writers };
+            delete nextWriters[id];
+            writers = nextWriters;
+            save();
+        },
+        /** Whether this routine, as it stands (or as a run snapshotted it), is
+         * exactly what the owner wrote. */
+        authored(id, routine) { return Object.hasOwn(routines, id) && routines[id] === routineFingerprint(routine); },
+        /** Whether the owner's fingerprint is on record for this routine at all,
+         * matching what it runs now or not. */
+        recorded(id) { return Object.hasOwn(routines, id); },
+        /** Everyone named as a writer (server/cloud-owner.ts). */
+        people() { return new Set(Object.values(writers)); },
+        /** Name `to` as the writer wherever `move` accepts the writer: a one-time
+         * migration (server/cloud-owner.ts). The routines that changed. */
+        reassign(move, to) {
+            const moved = [];
+            const next = { ...writers };
+            for (const [id, person] of Object.entries(writers))
+                if (person !== to && move(person)) {
+                    next[id] = to;
+                    moved.push(id);
+                }
+            if (moved.length) {
+                writers = next;
+                save();
+            }
+            return moved;
+        },
+    };
+}