openmausbot 0.1.90 → 0.1.92

package/dist-server/server/drivers/openai-compat.js

@@ -15,6 +15,27 @@ const DEFAULT_MODELS = {
         { id: "llama-3.3-70b-versatile", label: "Llama 3.3 70B (Groq)", custom: true },
     ],
 };
+const DEFAULT_KEY_ENV = "OPENAI_COMPAT_API_KEY";
+/** A provider's own key (the built-in OpenAI and OpenRouter instances). An
+ * instance reading one of these never falls back to the workspace
+ * OpenAI-compatible key, URL, model or routing. */
+const OWN_KEY_ENVS = new Set(["OMB_OPENAI_API_KEY", "OMB_OPENROUTER_API_KEY"]);
+/** OpenAI's own API, seeded until its live catalog loads. */
+const OPENAI_MODELS = {
+    default: "gpt-5",
+    options: [
+        { id: "gpt-5", label: "gpt-5" },
+        { id: "gpt-5-mini", label: "gpt-5-mini" },
+    ],
+};
+/** OpenAI's /models lists every model the key can reach: embeddings, speech,
+ * images, moderation and Responses-only models too. Only chat models belong
+ * in a chat picker. */
+export function isOpenAIChatModel(id) {
+    if (!/^(gpt-|chatgpt-|o\d)/i.test(id))
+        return false;
+    return !/(audio|realtime|tts|transcribe|search|image|embedding|moderation|instruct|codex|computer-use|deep-research|-pro\b)/i.test(id);
+}
 function isOpenRouterUrl(url) {
     try {
         const host = new URL(url).hostname.toLowerCase();
@@ -30,7 +51,11 @@ function decodeConfig(raw) {
         throw new Error("tools must be a boolean");
     if (config.managedModels !== undefined && (!Array.isArray(config.managedModels) || !config.managedModels.length || config.managedModels.some(model => typeof model !== "string" || !model.trim())))
         throw new Error("Invalid managed models.");
-    const envUrl = process.env.OPENAI_COMPAT_URL;
+    const ownKey = typeof config.apiKeyEnv === "string" && OWN_KEY_ENVS.has(config.apiKeyEnv);
+    if (config.catalog !== undefined && config.catalog !== "openai")
+        throw new Error("catalog must be \"openai\"");
+    // Workspace defaults belong to the shared OpenAI-compatible connection only.
+    const envUrl = ownKey ? undefined : process.env.OPENAI_COMPAT_URL;
     return {
         ...(config.tools !== undefined ? { tools: config.tools } : {}),
         ...(config.managedModels ? { managedModels: config.managedModels } : {}),
@@ -38,55 +63,65 @@ function decodeConfig(raw) {
             .replace(/\/+$/, ""),
         apiKeyEnv: typeof config.apiKeyEnv === "string" && config.apiKeyEnv
             ? config.apiKeyEnv
-            : "OPENAI_COMPAT_API_KEY",
+            : DEFAULT_KEY_ENV,
+        ...(config.catalog === "openai" ? { catalog: "openai" } : {}),
         key: typeof config.key === "string" && config.key ? config.key : undefined,
         model: typeof config.model === "string" && config.model
             ? config.model
-            : process.env.OPENAI_COMPAT_MODEL || undefined,
+            : ownKey ? undefined : process.env.OPENAI_COMPAT_MODEL || undefined,
         // An explicit empty override disables inherited routing for an isolated
         // connection (CLI setup uses this). Absent still inherits the global pin.
         provider: typeof config.provider === "string"
             ? config.provider || undefined
-            : process.env.OPENAI_COMPAT_PROVIDER || undefined,
+            : ownKey ? undefined : process.env.OPENAI_COMPAT_PROVIDER || undefined,
     };
 }
 export const OpenAICompatDriver = {
     driverKind: DRIVER_KIND,
     metadata: {
-        displayName: "OpenAI-compatible (OpenRouter / Groq)",
+        displayName: "Other (OpenAI-compatible)",
         supportsMultipleInstances: true,
-        access: "custom",
+        access: "api",
     },
     models: DEFAULT_MODELS,
+    // Nothing to install: the key and base URL are saved in the app. The old
+    // descriptor offered a config.json sentence as an "Open install in
+    // Terminal" command.
     install: {
         docsUrl: "https://openrouter.ai/keys",
-        signInCommand: "add {\"openaiCompat\":{\"key\":\"sk-or-v1-…\"}} to ~/.openmausbot/config.json (or set OPENAI_COMPAT_API_KEY)",
-        command: {
-            darwin: "Get a free key at https://openrouter.ai/keys (or https://console.groq.com) then add it to ~/.openmausbot/config.json under openaiCompat.key",
-            linux: "Get a free key at https://openrouter.ai/keys (or https://console.groq.com) then add it to ~/.openmausbot/config.json under openaiCompat.key",
-            win32: "Get a free key at https://openrouter.ai/keys (or https://console.groq.com) then add it to %USERPROFILE%\\.openmausbot\\config.json under openaiCompat.key",
-        },
+        settings: "connections",
+        signInCommand: "Save an OpenAI-compatible API key in Settings → API keys, or set OPENAI_COMPAT_API_KEY on the server.",
     },
     decodeConfig,
     defaultConfig: () => decodeConfig({}),
     async create(input) {
         const { config } = input;
+        // An instance that names its own key variable reads only that one: the
+        // workspace key (OPENAI_COMPAT_API_KEY) belongs to the workspace's
+        // endpoint and must not reach this instance's host.
+        const ownKeyVariable = config.apiKeyEnv !== DEFAULT_KEY_ENV;
         const apiKey = config.key ??
             input.environment[config.apiKeyEnv] ??
-            input.environment.OPENAI_COMPAT_API_KEY ??
+            (ownKeyVariable ? undefined : input.environment[DEFAULT_KEY_ENV]) ??
             process.env[config.apiKeyEnv] ??
-            process.env.OPENAI_COMPAT_API_KEY ??
+            (ownKeyVariable ? undefined : process.env[DEFAULT_KEY_ENV]) ??
             "";
+        // The default key and the built-in providers' keys are saved in
+        // Settings → API keys; any other variable is configured where it was written.
+        const missingKey = !ownKeyVariable || OWN_KEY_ENVS.has(config.apiKeyEnv)
+            ? "No API key — open Settings → API keys."
+            : `no API key — set ${config.apiKeyEnv} or add it to the instance config`;
+        const seeded = config.catalog === "openai" ? OPENAI_MODELS : DEFAULT_MODELS;
         let catalog = config.managedModels
             ? { default: config.managedModels[0], options: config.managedModels.map(id => ({ id, label: id })) }
             : config.model
                 ? {
                     default: config.model,
-                    options: DEFAULT_MODELS.options.some((model) => model.id === config.model)
-                        ? DEFAULT_MODELS.options
-                        : [{ id: config.model, label: config.model, custom: true }, ...DEFAULT_MODELS.options],
+                    options: seeded.options.some((model) => model.id === config.model)
+                        ? seeded.options
+                        : [{ id: config.model, label: config.model, custom: true }, ...seeded.options],
                 }
-                : DEFAULT_MODELS;
+                : seeded;
         const fetchModels = async () => {
             if (config.managedModels)
                 return;
@@ -100,7 +135,14 @@ export const OpenAICompatDriver = {
                 if (!response.ok)
                     return;
                 const json = await response.json();
-                const rows = Array.isArray(json) ? json : Array.isArray(json.data) ? json.data : [];
+                let rows = Array.isArray(json) ? json : Array.isArray(json.data) ? json.data : [];
+                // OpenAI lists its catalog unordered and mixed with non-chat models:
+                // keep chat models, newest first.
+                if (config.catalog === "openai") {
+                    rows = rows
+                        .filter((row) => typeof row.id === "string" && isOpenAIChatModel(row.id))
+                        .sort((a, b) => (typeof b.created === "number" ? b.created : 0) - (typeof a.created === "number" ? a.created : 0));
+                }
                 const seen = new Set();
                 const options = [];
                 for (const row of rows) {
@@ -111,7 +153,8 @@ export const OpenAICompatDriver = {
                     options.push({
                         id,
                         label: typeof row.name === "string" && row.name.trim() ? row.name : id,
-                        custom: true,
+                        // A provider's own catalog is its official list, not a custom model.
+                        ...(config.catalog === "openai" ? {} : { custom: true }),
                     });
                 }
                 if (!options.length)
@@ -146,15 +189,22 @@ export const OpenAICompatDriver = {
                     : {}),
             }),
             httpErrorLabel: "upstream",
-            missingKeyError: `no API key — set ${config.apiKeyEnv} or add it to the instance config`,
-            unavailableReason: `no API key — set ${config.apiKeyEnv} or add it to the instance config`,
+            missingKeyError: missingKey,
+            unavailableReason: missingKey,
             timeoutMs: idleTimeoutMs(),
             reasoning: true,
             billing: "metered",
             includeUsageInCompleted: true,
             nativeLog: {
                 source: "openai-compat.chat.completions",
-                outgoing: (_turn, messages, model) => ({ model, messageCount: messages.length }),
+                // Tool names are the answer to "did the harness send them?" — the
+                // LiteLLM/proxy hop after this point is what drops tools silently,
+                // and until now the tee held no record either side could compare.
+                outgoing: (_turn, messages, model, tools) => ({
+                    model,
+                    messageCount: messages.length,
+                    tools: tools.map(tool => tool.function.name),
+                }),
                 incoming: ({ text, reasoning, usage }) => ({
                     textLength: text.length,
                     reasoningLength: reasoning.length,

package/dist-server/server/engine-install.js

@@ -9,9 +9,10 @@ import { join } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "./config.js";
 import { augmentedPath, findCliCandidates, registerPathDir, resetPathCache } from "./env-path.js";
-import { killCliTree, spawnCli } from "./procs.js";
+import { execCli, killCliTree, spawnCli } from "./procs.js";
 const MAX_OUTPUT = 64 * 1024;
 const DEFAULT_TIMEOUT_MS = 10 * 60_000;
+const PROBE_TIMEOUT_MS = 30_000;
 /** npm's global prefix for engines the app installs itself. */
 export function enginesPrefix(baseDir = DATA_DIR) {
     return join(baseDir, "tools", "npm");
@@ -68,21 +69,54 @@ async function installOnce(pkg, options) {
     stripWorkspaceCredentialEnv(env);
     // npm 11 skips a dependency's install script unless the package is named
     // here; the engines that need one (Claude Code) are exactly these.
-    const args = ["install", "-g", "--prefix", prefix, "--loglevel=error", `--allow-scripts=${pkg}`, `${pkg}@latest`];
-    const result = await runNpm(args, env, prefix, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    if (result.code !== 0) {
-        throw new Error(`npm could not install ${pkg} on this server.${tail(result.output)}`);
-    }
+    // Engines like Codex ship their native binary as a platform optional
+    // dependency, so a user-level `omit=optional` must not leave it out.
+    const args = ["install", "-g", "--prefix", prefix, "--loglevel=error", "--include=optional", `--allow-scripts=${pkg}`, `${pkg}@latest`];
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    await runInstall(pkg, args, env, prefix, timeoutMs);
     // Whatever the boot registration did, the directory we just filled must
     // be on the engines' PATH from here on.
-    registerPathDir(enginesBinDir(options.baseDir));
+    const binDir = enginesBinDir(options.baseDir);
+    registerPathDir(binDir);
     resetPathCache();
-    if (options.cli) {
-        const binDir = enginesBinDir(options.baseDir);
-        if (!findCliCandidates(options.cli).some((path) => path.startsWith(binDir))) {
-            throw new Error(`${pkg} installed, but it did not provide a \`${options.cli}\` command. Check the package name in this engine's install descriptor.`);
-        }
+    if (!options.cli)
+        return;
+    const installed = findCliCandidates(options.cli).find((path) => path.startsWith(binDir));
+    if (!installed) {
+        throw new Error(`${pkg} installed, but it did not provide a \`${options.cli}\` command. Check the package name in this engine's install descriptor.`);
     }
+    // npm exits 0 even when it drops an optional dependency it failed to
+    // download, which leaves a launcher without its platform binary (#2064).
+    // A copy here shadows every other one on PATH, so prove it starts; a
+    // second run fetches what the first one dropped.
+    let failure = await probeCli(installed, env);
+    if (failure === null)
+        return;
+    await runInstall(pkg, args, env, prefix, timeoutMs);
+    failure = await probeCli(installed, env);
+    if (failure === null)
+        return;
+    throw new Error(`npm installed ${pkg}, but \`${options.cli}\` does not start: ${failure}\nnpm can leave out a platform package when its download fails, even after a retry. Check this server's network connection, then install again from Settings.`);
+}
+async function runInstall(pkg, args, env, prefix, timeoutMs) {
+    const result = await runNpm(args, env, prefix, timeoutMs);
+    if (result.code !== 0) {
+        throw new Error(`npm could not install ${pkg} on this server.${tail(result.output)}`);
+    }
+}
+/** Null when `<cli> --version` succeeds, else why it did not. A Node
+ * launcher that throws prints its source line first, so its `Error:` line
+ * is the one worth showing. */
+function probeCli(cli, env) {
+    return new Promise((resolveProbe) => {
+        execCli(cli, ["--version"], { env: { ...env, PATH: augmentedPath() }, timeout: PROBE_TIMEOUT_MS, killSignal: "SIGKILL", maxBuffer: MAX_OUTPUT }, (error, stdout, stderr) => {
+            if (!error)
+                return resolveProbe(null);
+            const lines = stripVTControlCharacters(`${stderr ?? ""}\n${stdout}`).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+            const said = lines.find((line) => /^\w*Error: /.test(line)) ?? lines[0] ?? error.message;
+            resolveProbe(said.slice(0, 400));
+        });
+    });
 }
 function tail(output) {
     const clean = stripVTControlCharacters(output).trim();

package/dist-server/server/env-path.js

@@ -27,6 +27,15 @@ function nvmBinDirs() {
         return [];
     }
 }
+/** A sealed test fixture finds CLIs only where it was granted them: its own
+ * PATH, OMB_EXTRA_PATH, app-managed dirs, and install dirs under its own
+ * temporary home. The machine-wide install dirs and the login shell's PATH
+ * would hand it this computer's real CLIs — a Homebrew `codex` made the
+ * fixture's ChatGPT plan engine "available" on a developer Mac (#2035).
+ * Only the verification launcher (scripts/control-omb.ts) sets it. */
+function sealedFixture() {
+    return process.env.OMB_TEST_SEALED_PATH === "1";
+}
 function knownDirs() {
     const home = homedir();
     return [
@@ -36,8 +45,11 @@ function knownDirs() {
         join(home, ".grok", "bin"), // x.ai installer
         join(home, ".opencode", "bin"), // opencode installer
         join(home, ".claude", "local"), // claude "local install"
-        "/opt/homebrew/bin", // brew, Apple silicon
-        "/usr/local/bin", // brew Intel / classic installs
+        // Machine-wide rather than under the (possibly temporary) home.
+        ...(sealedFixture() ? [] : [
+            "/opt/homebrew/bin", // brew, Apple silicon
+            "/usr/local/bin", // brew Intel / classic installs
+        ]),
         join(home, ".volta", "bin"),
         join(home, ".bun", "bin"),
         join(home, ".asdf", "shims"),
@@ -115,7 +127,7 @@ export function augmentedPath() {
     // belt-and-braces: fold in the login shell's PATH once, in the
     // background — catches anything the known-dirs list doesn't (custom
     // rc exports). Never blocks a spawn; the next one benefits.
-    if (!probed && !process.env.VITEST && process.platform !== "win32") {
+    if (!probed && !process.env.VITEST && !sealedFixture() && process.platform !== "win32") {
         probed = true;
         probeLoginShellPath();
     }

package/dist-server/server/group-goal-run.js

@@ -66,12 +66,14 @@ export function parseGroupGoalDecision(text) {
     }
     return { visibleText, decision: null };
 }
-/** Explicit room lead wins. Otherwise prefer an in-room Chief, then the
- * first active member. A goal run never recruits somebody outside the room. */
+/** Explicit room lead (or an Auto room's fallback) wins. Otherwise prefer
+ * an in-room Chief, then the first active member. A goal run never recruits
+ * somebody outside the room. */
 export function selectGroupGoalCoordinator(members, responder) {
     const active = members.filter((member) => !member.hidden);
-    if (responder.kind === "member") {
-        const explicit = active.find((member) => member.id === responder.botId);
+    const lead = responder.kind === "member" ? responder.botId : responder.kind === "auto" ? responder.fallbackBotId : undefined;
+    if (lead) {
+        const explicit = active.find((member) => member.id === lead);
         if (explicit)
             return explicit;
     }

package/dist-server/server/harness/registry.js

@@ -235,11 +235,11 @@ export class ProviderRegistry {
                 install: withServerInstall(driver?.install, npmPresent),
                 authentication: inst.startAuthentication
                     ? {
-                        method: inst.getAuthentication && inst.completeAuthentication
+                        method: inst.authenticationMethod ?? (inst.getAuthentication && inst.completeAuthentication
                             ? "paste-code" // a link to open, then a code pasted back (Claude)
                             : inst.getAuthentication
                                 ? "device-code" // a code to enter at the provider's page (Codex)
-                                : "browser", // a link and a callback URL (managed engines)
+                                : "browser"), // a link and a callback URL (managed engines)
                         // the browser may remove the stored sign-in to switch accounts
                         signOut: inst.signOut !== undefined,
                     }

package/dist-server/server/harness-capabilities.js

@@ -20,6 +20,8 @@ const ENVELOPE = {
     skillAuthoring: true,
     sharedComputers: true,
     voiceNotes: true,
+    // Not a tool it adds: a Cloud home only hides its Local VM shell.
+    cloudHome: false,
     botId: "",
 };
 /** Extra card lines for an engine switch, empty when nothing changes. */

package/dist-server/server/included-services.js

@@ -0,0 +1,70 @@
+// Boat cloud computers, ElevenLabs voice and the Jev decision model included
+// with Cloud Pro (docs/cloud-pro.md, "Included Boat computers, voice and
+// decisions").
+// The Admin relays each on its own accounts, so its provider keys never reach
+// this machine; each Cloud home gets its own relay tokens:
+//
+//   OMB_CLOUD_BOAT_URL    + OMB_CLOUD_BOAT_TOKEN     the Boat relay, ending in /api/box/v1
+//   OMB_CLOUD_VOICE_URL   + OMB_CLOUD_VOICE_TOKEN    the ElevenLabs relay, ending in /v1
+//   OMB_CLOUD_DECIDER_URL + OMB_CLOUD_DECIDER_TOKEN  the Jev relay, a Jev base URL
+//
+// An included token is only a fallback. The person's own key (Settings, or
+// BOX_TOKEN / OMB_TTS_KEY / OMB_JEV_API_KEY) always wins, and removing it
+// falls back again, so the credential is resolved on every request, never
+// cached. The relay knows only our account, so each credential goes to one
+// place: an own key to the provider (OMB_BOX_API / OMB_ELEVENLABS_API /
+// decider.baseUrl when set, for dev and tests), an included token to its
+// relay. An included token is never written to config.json, never reported
+// to a client, and never the saved key Settings verifies, rotates or clears.
+import { JEV_DEFAULT_BASE_URL } from "./decider/jev.js";
+export const BOAT_API_DEFAULT = "https://ascii.dev/api/box/v1";
+export const ELEVENLABS_API_DEFAULT = "https://api.elevenlabs.io/v1";
+/** Also on WORKSPACE_CREDENTIAL_ENV (config.ts). */
+export const INCLUDED_TOKEN_ENV = ["OMB_CLOUD_BOAT_TOKEN", "OMB_CLOUD_VOICE_TOKEN", "OMB_CLOUD_DECIDER_TOKEN"];
+function includedService(url, token) {
+    const api = url?.trim().replace(/\/+$/, "");
+    const secret = token?.trim();
+    return api && secret ? { token: secret, api, included: true } : null;
+}
+const includedFrom = (env) => ({
+    boat: includedService(env.OMB_CLOUD_BOAT_URL, env.OMB_CLOUD_BOAT_TOKEN),
+    voice: includedService(env.OMB_CLOUD_VOICE_URL, env.OMB_CLOUD_VOICE_TOKEN),
+    // A Jev base URL as it is: the decider adds /v1/systemone, the relay's one route.
+    decider: includedService(env.OMB_CLOUD_DECIDER_URL, env.OMB_CLOUD_DECIDER_TOKEN),
+});
+let held = null;
+/** At server startup: keep the included tokens in memory and drop them from
+ * the environment, as with the Cloud bootstrap secret, so nothing the server
+ * starts can inherit them. Before this (tests, scripts) they are read from
+ * the environment on each call. */
+export function holdIncludedServices(env = process.env) {
+    held = includedFrom(env);
+    for (const name of INCLUDED_TOKEN_ENV)
+        delete env[name];
+}
+function resolve(own, providerApi, included) {
+    if (own) {
+        // A leased computer descriptor hands the token in use back as a plain
+        // token; the included one still goes only to its relay.
+        if (included && own === included.token)
+            return included;
+        return { token: own, api: providerApi, included: false };
+    }
+    return included;
+}
+export const boatProviderApi = (env = process.env) => env.OMB_BOX_API || BOAT_API_DEFAULT;
+export const elevenLabsProviderApi = (env = process.env) => env.OMB_ELEVENLABS_API || ELEVENLABS_API_DEFAULT;
+/** The Boat credential in use: the person's own token, else the included one. */
+export function boatCredential(own, env = process.env) {
+    return resolve(own, boatProviderApi(env), (held ?? includedFrom(env)).boat);
+}
+/** The ElevenLabs credential in use: the person's own key, else the included one. */
+export function voiceCredential(own, env = process.env) {
+    return resolve(own, elevenLabsProviderApi(env), (held ?? includedFrom(env)).voice);
+}
+/** The decision model's credential in use: the person's own Jev key (saved,
+ * or OMB_JEV_API_KEY) with their `decider.baseUrl` or Jev's own, else the
+ * included token with the relay. `api` is a Jev base URL. */
+export function deciderCredential(own, ownBaseUrl, env = process.env) {
+    return resolve(own?.trim(), ownBaseUrl?.trim() || JEV_DEFAULT_BASE_URL, (held ?? includedFrom(env)).decider);
+}