openmausbot 0.1.90 → 0.1.92

package/dist-server/server/decider/index.js

@@ -0,0 +1,238 @@
+import { deciderCredential } from "../included-services.js";
+import { jevBackend } from "./jev.js";
+import { appendDeciderLog, stateHash } from "./log.js";
+import { KEY_CHECK_QUESTION, KEY_CHECK_STATE, relayAccepts, relaySeam } from "./relay.js";
+export { DECIDER_JOBS } from "./types.js";
+/** Used when a caller passes no timeout. Room routing passes its own. */
+export const DEFAULT_DECIDER_TIMEOUT_MS = 1_500;
+/** The Settings key check is one tiny call a person is waiting on. */
+export const KEY_CHECK_TIMEOUT_MS = 10_000;
+const MIN_TIMEOUT_MS = 50;
+const MAX_TIMEOUT_MS = 30_000;
+/** A request the switches never let through. */
+const offBackend = {
+    id: "off",
+    decide: async () => ({ ok: false, reason: "disabled" }),
+};
+const BACKENDS = { jev: jevBackend };
+export function deciderProvider(cfg) {
+    const provider = cfg.decider?.provider ?? "jev";
+    return provider in BACKENDS ? provider : "off";
+}
+/** The key a call uses and the one base URL it goes to: the person's own
+ * (a draft being tested, else the config value or the desktop's encrypted
+ * store handed over as env) with `decider.baseUrl` or Jev's own, else Cloud
+ * Pro's included token with the Admin's relay, but only where the relay
+ * accepts that seam: any other job has only an own key. Resolved on every
+ * call. */
+function deciderAccount(cfg, seam, draft) {
+    const account = deciderCredential(draft?.trim() || cfg.decider?.key, cfg.decider?.baseUrl);
+    return account?.included && seam && !relaySeam(seam) ? null : account;
+}
+/** A key is on file, or Cloud Pro includes decisions here. */
+export function deciderConfigured(cfg) {
+    return Boolean(deciderAccount(cfg));
+}
+/** Cloud Pro includes decisions on this machine, whatever key is saved:
+ * what clearing an own key falls back to. */
+export function deciderIncludedHere() {
+    return deciderCredential(undefined, undefined)?.included === true;
+}
+/** The master switch as it takes effect: off while there is no key. With an
+ * own key it is on once switched on (saving the key does that); with Cloud
+ * Pro's included decisions it is on until someone switches it off. */
+export function deciderEnabled(cfg) {
+    const account = deciderAccount(cfg);
+    if (!account || deciderProvider(cfg) === "off")
+        return false;
+    return account.included ? cfg.decider?.enabled !== false : cfg.decider?.enabled === true;
+}
+/** One job's own switch. Absent means on: turning the decider on turns on
+ * what it decides unless a job was switched off by hand. */
+export function deciderJobOn(cfg, job) {
+    return cfg.decider?.jobs?.[job] !== false;
+}
+/** Whether a job would be asked right now. Callers check this before they
+ * spend any effort building a request. */
+export function deciderReady(cfg, job) {
+    return deciderEnabled(cfg) && deciderJobOn(cfg, job) && Boolean(deciderAccount(cfg, job));
+}
+/** What Settings needs. Never the key, and not the base URL either: that is
+ * an operator setting with no UI. `included`: the decisions are Cloud Pro's,
+ * not a saved key. */
+export function describeDecider(cfg) {
+    const account = deciderAccount(cfg);
+    return {
+        provider: "jev",
+        configured: Boolean(account),
+        ...(account?.included ? { included: true } : {}),
+        enabled: deciderEnabled(cfg),
+        jobs: { roomRouting: deciderJobOn(cfg, "roomRouting") },
+    };
+}
+/** The config write a Settings save becomes.
+ *
+ * Owner rule: the switch is off while no key is saved, and saving a key is
+ * the "turn it on" — it switches the decider and its room job on, with no
+ * extra step. Clearing the key switches it off, unless Cloud Pro includes
+ * decisions here (`included`): then it falls back to them as it stands.
+ * Explicit values in the same patch win. Jobs merge per job, because
+ * saveConfig replaces a section's nested objects whole. Returns an error for
+ * a switch-on with no key and nothing included. */
+export function deciderSavePatch(patch, current, included = false) {
+    const next = { ...patch };
+    const savingKey = typeof patch.key === "string" && Boolean(patch.key.trim());
+    const clearingKey = typeof patch.key === "string" && !patch.key.trim();
+    if (typeof patch.key === "string")
+        next.key = patch.key.trim();
+    if (savingKey) {
+        next.enabled = patch.enabled ?? true;
+        next.jobs = { ...current?.jobs, roomRouting: true, ...patch.jobs };
+    }
+    else if (clearingKey) {
+        if (!included)
+            next.enabled = false;
+    }
+    else if (patch.jobs) {
+        next.jobs = { ...current?.jobs, ...patch.jobs };
+    }
+    if (next.enabled === true && !savingKey && !current?.key?.trim() && !included) {
+        return { ok: false, error: "Save a Jev API key before turning on fast decisions." };
+    }
+    return { ok: true, patch: next };
+}
+export function createDecider(deps) {
+    const fetchImpl = deps.fetch ?? fetch;
+    const now = deps.now ?? (() => performance.now());
+    function gate(cfg, seam) {
+        if (deciderProvider(cfg) === "off")
+            return "disabled";
+        if (seam === "keyCheck")
+            return null;
+        if (!deciderConfigured(cfg))
+            return cfg.decider?.enabled === true ? "no_key" : "disabled";
+        if (!deciderEnabled(cfg))
+            return "disabled";
+        if (!deciderJobOn(cfg, seam))
+            return "job_off";
+        // Only the included token, and the relay does not take this job.
+        if (!deciderAccount(cfg, seam))
+            return "no_key";
+        return null;
+    }
+    async function call(seam, backend, request, options) {
+        const provider = backend.id === "off" ? undefined : backend.id;
+        if (options.signal?.aborted)
+            return { ok: false, ...(provider ? { provider } : {}), reason: "cancelled" };
+        const timeoutMs = Math.min(MAX_TIMEOUT_MS, Math.max(MIN_TIMEOUT_MS, options.timeoutMs ?? DEFAULT_DECIDER_TIMEOUT_MS));
+        const controller = new AbortController();
+        const onAbort = () => controller.abort();
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        let timer;
+        // The race, not only the abort, bounds the call: a body that stalls
+        // after its headers must not hold a room turn past the budget.
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                controller.abort();
+                resolve({ ok: false, reason: "timeout" });
+            }, timeoutMs);
+        });
+        const started = now();
+        let outcome;
+        try {
+            const decided = Promise.resolve()
+                .then(() => backend.decide({ ...request, signal: controller.signal, fetch: fetchImpl }))
+                .catch(() => ({ ok: false, reason: "malformed" }));
+            outcome = await Promise.race([decided, timedOut]);
+        }
+        finally {
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", onAbort);
+        }
+        const latencyMs = Math.max(0, Math.round(now() - started));
+        if (!outcome.ok && outcome.reason !== "timeout" && options.signal?.aborted)
+            outcome = { ok: false, reason: "cancelled" };
+        if (provider && deps.dataDir) {
+            const first = outcome.ok ? Object.values(outcome.answers).find((answer) => answer.type === "choice") : undefined;
+            appendDeciderLog(deps.dataDir, {
+                at: new Date().toISOString(),
+                seam,
+                provider,
+                ok: outcome.ok,
+                ...(!outcome.ok ? { reason: outcome.reason, ...(outcome.status ? { status: outcome.status } : {}) } : {}),
+                ...(first ? { choice: first.choice } : {}),
+                pTop: first?.pTop ?? null,
+                margin: first?.margin ?? null,
+                latencyMs,
+                ...(outcome.ok && outcome.inputTokens !== undefined ? { inputTokens: outcome.inputTokens } : {}),
+                stateHash: stateHash(request.state),
+            });
+        }
+        if (!outcome.ok)
+            return { ok: false, ...(provider ? { provider } : {}), reason: outcome.reason, ...(outcome.status ? { status: outcome.status } : {}), latencyMs };
+        return {
+            ok: true,
+            provider: provider,
+            answers: outcome.answers,
+            latencyMs,
+            ...(outcome.inputTokens !== undefined ? { inputTokens: outcome.inputTokens } : {}),
+            ...(outcome.model ? { model: outcome.model } : {}),
+        };
+    }
+    async function ask(seam, state, questions, options = {}) {
+        try {
+            const cfg = deps.config();
+            const refused = gate(cfg, seam);
+            if (refused)
+                return { ok: false, reason: refused };
+            const provider = deciderProvider(cfg);
+            const backend = provider === "off" ? offBackend : BACKENDS[provider];
+            const account = deciderAccount(cfg, seam);
+            // Through the included token, only the exact requests the relay takes.
+            if (account.included && !relayAccepts(seam, state, questions))
+                return { ok: false, reason: "misconfigured" };
+            return await call(seam, backend, { key: account.token, baseUrl: account.api, state, questions }, options);
+        }
+        catch {
+            return { ok: false, reason: "malformed" };
+        }
+    }
+    const single = (result) => result.ok ? { ...result, answers: result.answers.answer } : result;
+    return {
+        ask,
+        async choose(seam, state, question, options) {
+            const asked = { answer: { type: "choice", instructions: question.instructions, options: question.options } };
+            return single(await ask(seam, state, asked, options));
+        },
+        async score(seam, state, question, options) {
+            return single(await ask(seam, state, { answer: { type: "score", instructions: question.instructions, levels: question.levels } }, options));
+        },
+        async yesNo(seam, state, instructions, options) {
+            return single(await ask(seam, state, { answer: { type: "yesno", instructions } }, options));
+        },
+        async testKey(input = {}, options = {}) {
+            try {
+                const cfg = deps.config();
+                // A draft or saved own key goes to Jev (or decider.baseUrl); with
+                // neither, Cloud Pro's included token goes to its relay.
+                const account = deciderAccount(cfg, "keyCheck", input.key);
+                if (!account)
+                    return { ok: false, reason: "no_key" };
+                const provider = deciderProvider(cfg);
+                const backend = provider === "off" ? offBackend : BACKENDS[provider];
+                const questions = { answer: { type: "yesno", instructions: KEY_CHECK_QUESTION } };
+                if (account.included && !relayAccepts("keyCheck", KEY_CHECK_STATE, questions))
+                    return { ok: false, reason: "misconfigured" };
+                return single(await call("keyCheck", backend, {
+                    key: account.token,
+                    baseUrl: account.api,
+                    state: KEY_CHECK_STATE,
+                    questions,
+                }, { timeoutMs: KEY_CHECK_TIMEOUT_MS, ...options }));
+            }
+            catch {
+                return { ok: false, reason: "malformed" };
+            }
+        },
+    };
+}

package/dist-server/server/decider/jev.js

@@ -0,0 +1,183 @@
+export const JEV_DEFAULT_BASE_URL = "https://api.typesafe.ai";
+export const JEV_MODEL = "jev-latest";
+export const JEV_MAX_OPTIONS = 255;
+export const JEV_MIN_LEVELS = 2;
+export const JEV_MAX_LEVELS = 10;
+function isLoopback(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, "");
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
+}
+/** The endpoint for a base URL, or null when the key must not be sent there:
+ * https anywhere, plain http only to this machine (a local Jev-compatible
+ * server or a test double). */
+export function jevEndpoint(baseUrl) {
+    const root = (baseUrl?.trim() || JEV_DEFAULT_BASE_URL).replace(/\/+$/, "");
+    let url;
+    try {
+        url = new URL(`${root}/v1/systemone`);
+    }
+    catch {
+        return null;
+    }
+    if (url.username || url.password)
+        return null;
+    if (url.protocol === "https:")
+        return url;
+    return url.protocol === "http:" && isLoopback(url.hostname) ? url : null;
+}
+/** Questions within the API's limits: 2–255 options, 2–10 levels. */
+export function questionsFit(questions) {
+    const entries = Object.entries(questions);
+    if (!entries.length)
+        return false;
+    return entries.every(([, question]) => {
+        if (question.type === "choice") {
+            const count = Object.keys(question.options).length;
+            return count >= 2 && count <= JEV_MAX_OPTIONS;
+        }
+        if (question.type === "score")
+            return question.levels.length >= JEV_MIN_LEVELS && question.levels.length <= JEV_MAX_LEVELS;
+        return true;
+    });
+}
+export function jevRequestBody(state, questions) {
+    const wire = {};
+    for (const [id, question] of Object.entries(questions)) {
+        if (question.type === "choice") {
+            wire[id] = { type: "choice", instructions: question.instructions, criteria: { ...question.options } };
+        }
+        else if (question.type === "score") {
+            wire[id] = { type: "score", instructions: question.instructions, criteria: [...question.levels] };
+        }
+        else {
+            const criteria = question.criteria?.yes || question.criteria?.no
+                ? { ...(question.criteria.yes ? { true: question.criteria.yes } : {}), ...(question.criteria.no ? { false: question.criteria.no } : {}) }
+                : undefined;
+            wire[id] = { type: "noul", instructions: question.instructions, ...(criteria ? { criteria } : {}) };
+        }
+    }
+    return { state, model: JEV_MODEL, questions: wire };
+}
+const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+const isProbability = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+/** Jev rounds to two places, so a map can sum to 0.98 or 1.02. */
+const SUM_TOLERANCE = 0.1;
+const EPSILON = 1e-9;
+function parseChoice(raw, question) {
+    const offered = new Set(Object.keys(question.options));
+    const choice = raw.choice;
+    if (typeof choice !== "string" || !offered.has(choice))
+        return null;
+    if (!isRecord(raw.probabilities))
+        return null;
+    const probabilities = {};
+    let sum = 0;
+    for (const [key, value] of Object.entries(raw.probabilities)) {
+        if (!offered.has(key) || !isProbability(value))
+            return null;
+        probabilities[key] = value;
+        sum += value;
+    }
+    if (!(Math.abs(sum - 1) <= SUM_TOLERANCE))
+        return null;
+    const pTop = probabilities[choice];
+    if (pTop === undefined)
+        return null;
+    const others = Object.entries(probabilities).filter(([key]) => key !== choice).map(([, value]) => value);
+    const runnerUp = others.length ? Math.max(...others) : 0;
+    // Ties break to the first key on the vendor side; a choice that is not
+    // the most likely option means the answer is not what it claims to be.
+    if (runnerUp > pTop + EPSILON)
+        return null;
+    return { type: "choice", choice, pTop, margin: pTop - runnerUp, probabilities };
+}
+function parseScore(raw, question) {
+    const levels = question.levels.length;
+    const score = raw.score;
+    if (typeof score !== "number" || !Number.isFinite(score) || score < -EPSILON || score > levels - 1 + EPSILON)
+        return null;
+    if (!isRecord(raw.probabilities))
+        return null;
+    const probabilities = Array.from({ length: levels }, () => 0);
+    for (const [key, value] of Object.entries(raw.probabilities)) {
+        const index = Number(key);
+        if (!Number.isInteger(index) || index < 0 || index >= levels || String(index) !== key || !isProbability(value))
+            return null;
+        probabilities[index] = value;
+    }
+    const sum = probabilities.reduce((total, value) => total + value, 0);
+    if (!(Math.abs(sum - 1) <= SUM_TOLERANCE))
+        return null;
+    const level = probabilities.indexOf(Math.max(...probabilities));
+    return { type: "score", score, level, probabilities };
+}
+function parseYesNo(raw) {
+    return isProbability(raw.noul) ? { type: "yesno", p: raw.noul } : null;
+}
+const WIRE_TYPE = { choice: "choice", score: "score", yesno: "noul" };
+/** Strictly decode one response body against the questions that were asked. */
+export function parseJevResponse(body, questions) {
+    if (!isRecord(body) || !isRecord(body.answers))
+        return { ok: false };
+    const answers = {};
+    for (const [id, question] of Object.entries(questions)) {
+        const raw = body.answers[id];
+        if (!isRecord(raw))
+            return { ok: false };
+        if (raw.type !== undefined && raw.type !== WIRE_TYPE[question.type])
+            return { ok: false };
+        const parsed = question.type === "choice" ? parseChoice(raw, question)
+            : question.type === "score" ? parseScore(raw, question)
+                : parseYesNo(raw);
+        if (!parsed)
+            return { ok: false };
+        answers[id] = parsed;
+    }
+    const usage = isRecord(body.usage) ? body.usage.input_tokens : undefined;
+    const inputTokens = typeof usage === "number" && Number.isFinite(usage) && usage >= 0 ? usage : undefined;
+    const model = typeof body.model === "string" && body.model.length <= 80 ? body.model : undefined;
+    return { ok: true, answers, ...(inputTokens !== undefined ? { inputTokens } : {}), ...(model ? { model } : {}) };
+}
+function refusal(status) {
+    if (status === 401 || status === 403)
+        return { ok: false, reason: "rejected", status };
+    if (status === 429)
+        return { ok: false, reason: "rate_limited", status };
+    if (status === 529 || status === 503)
+        return { ok: false, reason: "overloaded", status };
+    return { ok: false, reason: "http_error", status };
+}
+async function decide(request) {
+    const endpoint = jevEndpoint(request.baseUrl);
+    if (!endpoint || !questionsFit(request.questions))
+        return { ok: false, reason: "misconfigured" };
+    let response;
+    try {
+        response = await request.fetch(endpoint, {
+            method: "POST",
+            headers: { authorization: `Bearer ${request.key}`, "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify(jevRequestBody(request.state, request.questions)),
+            signal: request.signal,
+            // Never replay the key to wherever a redirect points.
+            redirect: "error",
+        });
+    }
+    catch {
+        // The caller tells a timeout or a Stop from a dead network by its own signals.
+        return { ok: false, reason: "unreachable" };
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        return refusal(response.status);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { ok: false, reason: "malformed" };
+    }
+    const parsed = parseJevResponse(body, request.questions);
+    return parsed.ok ? parsed : { ok: false, reason: "malformed" };
+}
+export const jevBackend = { id: "jev", decide };

package/dist-server/server/decider/log.js

@@ -0,0 +1,62 @@
+// The decision model's own log: one row per call that reached a backend,
+// one file per UTC month under <data>/decider-log/YYYY-MM.ndjson.
+//
+// Not the authorization decision log (server/decision-log.ts, <data>/
+// decisions/), which records approvals. This one records what a fast
+// classifier picked and how sure it was, so its accuracy and cost can be
+// measured later. A row never holds the message text, the options' text or
+// the key: only the seam, the chosen option key (a bot id for room routing),
+// the probabilities and a short hash of the state.
+//
+// Same discipline as the other logs: 0600, fire-and-forget, serialized per
+// directory, and months older than the shared retention window pruned.
+import { createHash } from "node:crypto";
+import { appendFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { boundRetentionDays, pruneMonthFiles } from "../decision-log.js";
+export const DECIDER_LOG_DIR = "decider-log";
+const PRUNE_EVERY_MS = 60 * 60_000;
+const writeQueues = new Map();
+const lastPrune = new Map();
+export function stateHash(state) {
+    let text;
+    try {
+        text = JSON.stringify(state) ?? "";
+    }
+    catch {
+        text = "";
+    }
+    return createHash("sha256").update(text).digest("hex").slice(0, 16);
+}
+function monthKey(at) {
+    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
+}
+export function deciderLogFileFor(dataDir, at) {
+    return join(dataDir, DECIDER_LOG_DIR, `${monthKey(at)}.ndjson`);
+}
+async function write(dataDir, row) {
+    const at = new Date(row.at);
+    await mkdir(join(dataDir, DECIDER_LOG_DIR), { recursive: true, mode: 0o700 });
+    await appendFile(deciderLogFileFor(dataDir, at), JSON.stringify(row) + "\n", { mode: 0o600 });
+    if (at.getTime() - (lastPrune.get(dataDir) ?? 0) >= PRUNE_EVERY_MS) {
+        lastPrune.set(dataDir, at.getTime());
+        await pruneMonthFiles(join(dataDir, DECIDER_LOG_DIR), boundRetentionDays(), at);
+    }
+}
+/** Append one row. Never throws and never waits: a full disk must not turn
+ * into a slower or failed room turn. */
+export function appendDeciderLog(dataDir, row) {
+    const previous = writeQueues.get(dataDir) ?? Promise.resolve();
+    const queued = previous.then(() => write(dataDir, row)).catch(() => {
+        /* logging must never take down a decision */
+    });
+    writeQueues.set(dataDir, queued);
+    void queued.finally(() => {
+        if (writeQueues.get(dataDir) === queued)
+            writeQueues.delete(dataDir);
+    });
+}
+/** Test seam: wait until every queued row for this directory is on disk. */
+export async function flushDeciderLog(dataDir) {
+    await writeQueues.get(dataDir);
+}

package/dist-server/server/decider/relay.js

@@ -0,0 +1,52 @@
+// What Cloud Pro's decision relay accepts through the included token
+// (docs/cloud-pro.md, "Included Boat computers, voice and decisions"; the
+// Admin checks the same): room routing's one request and the Settings key
+// check, within its size caps. Anything else (another job, another question,
+// a larger state) is never sent through the included token: it goes only
+// with the person's own key, until the relay accepts it too.
+import { jevRequestBody } from "./jev.js";
+import { ROOM_ROUTING_INSTRUCTIONS, ROOM_ROUTING_STATE_KEYS } from "./room-routing.js";
+/** The Settings key check's fixed request. */
+export const KEY_CHECK_STATE = { purpose: "OpenMausBot is checking that a decision-model key works." };
+export const KEY_CHECK_QUESTION = "Is this a connection check?";
+/** The relay's caps: the whole request body, and the state as JSON. Both
+ * measured in UTF-8 bytes, which is never less than characters. */
+export const RELAY_MAX_BODY_BYTES = 64 * 1024;
+export const RELAY_MAX_STATE_BYTES = 24_000;
+/** Where a request may use the included token. A job added later is not here
+ * until the relay accepts it. */
+const RELAY_SEAMS = new Set(["roomRouting", "keyCheck"]);
+const ROOM_STATE_KEYS = new Set(ROOM_ROUTING_STATE_KEYS);
+const ROOM_STATE_REQUIRED = ROOM_ROUTING_STATE_KEYS.filter((key) => key !== "recent_messages");
+export function relaySeam(seam) {
+    return RELAY_SEAMS.has(seam);
+}
+const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function shapeFits(seam, state, questions) {
+    const ids = Object.keys(questions);
+    const question = questions.answer;
+    if (ids.length !== 1 || !question)
+        return false;
+    if (seam === "keyCheck") {
+        return question.type === "yesno" && question.instructions === KEY_CHECK_QUESTION && !question.criteria &&
+            JSON.stringify(state) === JSON.stringify(KEY_CHECK_STATE);
+    }
+    if (seam === "roomRouting") {
+        return question.type === "choice" && question.instructions === ROOM_ROUTING_INSTRUCTIONS && isRecord(state) &&
+            Object.keys(state).every((key) => ROOM_STATE_KEYS.has(key)) && ROOM_STATE_REQUIRED.every((key) => key in state);
+    }
+    // Any other seam: the relay takes nothing from it.
+    return false;
+}
+/** Whether this exact request may go through the included token. */
+export function relayAccepts(seam, state, questions) {
+    try {
+        if (!shapeFits(seam, state, questions))
+            return false;
+        return Buffer.byteLength(JSON.stringify(state)) <= RELAY_MAX_STATE_BYTES &&
+            Buffer.byteLength(JSON.stringify(jevRequestBody(state, questions))) <= RELAY_MAX_BODY_BYTES;
+    }
+    catch {
+        return false;
+    }
+}

package/dist-server/server/decider/room-routing.js

@@ -0,0 +1,88 @@
+/** Turn starts take seconds anyway, and people far from the US West Coast
+ * see 400–700 ms round trips; 1.5 s keeps a slow answer usable. */
+export const ROOM_ROUTING_TIMEOUT_MS = 1_500;
+/** Bench calibration: answers at >= 0.6 were right 92–99% of the time. */
+export const ROOM_ROUTING_MIN_PROBABILITY = 0.6;
+export const EVERYONE_OPTION = "__everyone__";
+const EVERYONE_MEANING = "Several members: the message explicitly needs answers or work from more than one member of the room, for example it asks everyone or asks each member for their part.";
+/** Fixed: Cloud Pro's decision relay accepts room routing only with these
+ * exact instructions (relay.ts). */
+export const ROOM_ROUTING_INSTRUCTIONS = "Which bot in this room should answer `new_message`? Choose __everyone__ only when the message needs several members to answer.";
+/** Every key the state may carry; `recent_messages` is left out when there
+ * are none. Cloud Pro's relay accepts no other. */
+export const ROOM_ROUTING_STATE_KEYS = ["room", "humans_in_room", "bots_in_room", "recent_messages", "new_message"];
+const NAME_MAX = 80;
+const TITLE_MAX = 120;
+const DESCRIPTION_MAX = 400;
+const LINE_MAX = 500;
+/** The room context window bounds how many lines; this bounds their size,
+ * because large irrelevant state makes the classifier worse, not better. */
+const RECENT_BUDGET_CHARS = 6_000;
+function clip(value, max) {
+    const flat = value.replace(/\s+/g, " ").trim();
+    return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+/** What one bot is, as an option: "Maya, Product Designer. Owns UI…". */
+export function memberOption(member) {
+    const name = clip(member.name, NAME_MAX) || "Unnamed bot";
+    const title = member.title ? clip(member.title, TITLE_MAX) : "";
+    const description = member.description ? clip(member.description, DESCRIPTION_MAX) : "";
+    return `${name}${title ? `, ${title}` : ""} bot.${description ? ` ${description}` : ""}`;
+}
+/** The newest lines that fit the budget, oldest first, each clipped. */
+function recentWithinBudget(recent) {
+    const kept = [];
+    let used = 0;
+    for (let index = recent.length - 1; index >= 0; index--) {
+        const line = recent[index];
+        const text = clip(line.text, LINE_MAX);
+        if (!text)
+            continue;
+        const size = text.length + line.from.length;
+        if (used + size > RECENT_BUDGET_CHARS)
+            break;
+        used += size;
+        kept.unshift({ from: clip(line.from, NAME_MAX), text });
+    }
+    return kept;
+}
+export function roomRoutingRequest(input) {
+    const options = {};
+    for (const member of input.members)
+        options[member.id] = memberOption(member);
+    options[EVERYONE_OPTION] = EVERYONE_MEANING;
+    const recent = recentWithinBudget(input.recent);
+    const state = {
+        room: clip(input.room, NAME_MAX),
+        humans_in_room: input.humans.map((human) => clip(human, NAME_MAX)),
+        bots_in_room: input.members.map((member) => clip(member.name, NAME_MAX)),
+        ...(recent.length ? { recent_messages: recent } : {}),
+        new_message: { from: clip(input.message.from, NAME_MAX), text: input.message.text.trim().slice(0, 8_000) },
+    };
+    return { state, question: { instructions: ROOM_ROUTING_INSTRUCTIONS, options } };
+}
+/** Ask once and turn the answer into a route. Never throws. */
+export async function decideRoomResponder(decider, input, options = {}) {
+    try {
+        if (input.members.length < 2)
+            return { kind: "fallback", reason: "no_choice" };
+        const { state, question } = roomRoutingRequest(input);
+        const result = await decider.choose("roomRouting", state, question, {
+            timeoutMs: options.timeoutMs ?? ROOM_ROUTING_TIMEOUT_MS,
+            signal: options.signal,
+        });
+        if (!result.ok)
+            return { kind: "fallback", reason: result.reason };
+        const { choice, pTop } = result.answers;
+        if (pTop < ROOM_ROUTING_MIN_PROBABILITY)
+            return { kind: "fallback", reason: "low_confidence" };
+        if (choice === EVERYONE_OPTION)
+            return { kind: "everyone", probability: pTop };
+        if (!input.members.some((member) => member.id === choice))
+            return { kind: "fallback", reason: "malformed" };
+        return { kind: "member", botId: choice, probability: pTop };
+    }
+    catch {
+        return { kind: "fallback", reason: "malformed" };
+    }
+}

package/dist-server/server/decider/types.js

@@ -0,0 +1,5 @@
+// The decision model's vocabulary, shared by every backend and caller. A
+// question is one of three typed shapes; an answer comes back typed to match.
+// Nothing here names a vendor: `jev` is one backend, and another (a local
+// Jev-compatible server, an LLM) plugs in behind the same types.
+export const DECIDER_JOBS = ["roomRouting"];

package/dist-server/server/desktop-viewer-targets.js

@@ -0,0 +1,26 @@
+import { desktopViewerUrl } from "./routes/desktop-viewer.js";
+export const viewerTargetId = (target) => `local/${target.key.replace(":", "-")}`;
+/** Native owner windows keep the existing direct viewer and cookie isolation. */
+export function localVmViewerStatus(status, auth) {
+    return auth.kind === "loopback" ? status : {
+        ...status,
+        viewer_url: status.viewer_url ? desktopViewerUrl(viewerTargetId({ key: status.target_key })) : "",
+    };
+}
+export function localDesktopTarget(target, deps) {
+    return {
+        key: target.key,
+        async resolve() {
+            const status = await deps.status(target);
+            if (!status.managed || !status.imageMatches || status.network !== "loopback" || status.container !== "running"
+                || !status.viewer_url) {
+                throw Object.assign(new Error("Local VM unavailable"), { status: 409 });
+            }
+            return {
+                port: status.viewer_port ?? 0,
+                password: new URLSearchParams(new URL(status.viewer_url).hash.slice(1)).get("password"),
+                touch: () => deps.touch(target),
+            };
+        },
+    };
+}