openmausbot 0.1.90 → 0.1.92

package/dist-server/server/workspace-backup.js

@@ -26,6 +26,12 @@ const EXCLUDED = new Set([
     ".openmausbot-server-child", "environment-id", "sessions.json", "tunnel-account.json",
     "team-computers.json",
     "openmausbot-server.lease", "box-create-requests.lock", "messages.db-wal", "messages.db-shm",
+    // This machine's decision-model log (server/decider/log.ts): local
+    // measurement of what the classifier picked, not workspace data.
+    "decider-log",
+    // A Cloud home's record of who its owner was (server/cloud-owner.ts): this
+    // machine's own, kept in place by a restore, which settles what it brought.
+    "cloud-owner.json",
 ]);
 const EXCLUSION_NOTES = [
     "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",
@@ -49,6 +55,12 @@ function preserved(name) {
     const folded = name.toLowerCase();
     return excluded(folded) && folded !== "messages.db-wal" && folded !== "messages.db-shm";
 }
+/** Left where it is by a restore. The session registry's open marker is this
+ * machine's own (never exported or installed): a crash before the restore
+ * still costs account sign-ins, as it would have without one. */
+function keptInPlace(name) {
+    return preserved(name) || name.toLowerCase() === "sessions.json.open";
+}
 function folder(path) {
     mkdirSync(path, { recursive: true, mode: 0o700 });
     const stat = lstatSync(path);
@@ -544,22 +556,24 @@ async function decryptArchive(inputPath, plaintext, password) {
 }
 async function inspectTar(path) {
     const fd = openSync(path, "r");
-    const signature = Buffer.alloc(2);
+    const signature = Buffer.alloc(4);
     try {
-        readSync(fd, signature, 0, 2, 0);
+        readSync(fd, signature, 0, 4, 0);
     }
     finally {
         closeSync(fd);
     }
-    // This format is uncompressed tar. Reject auto-detected gzip before tar's
-    // parser can inflate an authenticated but malicious decompression bomb.
-    if (signature[0] === 0x1f && signature[1] === 0x8b)
+    // This format is uncompressed tar. Reject auto-detected gzip and zstd
+    // before tar's parser can inflate an authenticated but malicious
+    // decompression bomb; tar is also told never to decompress (below).
+    if ((signature[0] === 0x1f && signature[1] === 0x8b) || signature.equals(Buffer.from([0x28, 0xb5, 0x2f, 0xfd]))) {
         throw new Error("Compressed payloads are not supported in this workspace backup version.");
+    }
     const entries = new Map();
     const names = new Set();
     let bytes = 0;
     let problem = "";
-    await tar.t({ file: path, strict: true, onReadEntry(entry) {
+    await tar.t({ file: path, strict: true, brotli: false, zstd: false, onReadEntry(entry) {
             const name = entry.type === "Directory" ? entry.path.replace(/\/$/, "") : entry.path;
             const expectedRoot = name === "manifest.json" || name === "data" || name.startsWith("data/");
             // ReadEntry normalizes backslashes on Windows; inspect the raw header too
@@ -651,7 +665,7 @@ export async function stageWorkspaceBackup(dataDir, archivePath, options) {
         const expected = await inspectTar(plaintext);
         const staged = join(job.directory, "staged");
         folder(staged);
-        await tar.x({ file: plaintext, cwd: staged, strict: true, preservePaths: false, umask: 0o077, noChmod: true });
+        await tar.x({ file: plaintext, cwd: staged, strict: true, preservePaths: false, umask: 0o077, noChmod: true, brotli: false, zstd: false });
         const manifest = validateStaged(staged, expected);
         const versions = [manifest.summary.appVersion, options.currentAppVersion ?? ""].map((version) => /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version)?.slice(1).map(Number));
         if (versions[0] && versions[1]) {
@@ -1037,7 +1051,7 @@ export function applyPendingWorkspaceRestore(dataDir) {
     folder(join(safetyCopyPath, "data"));
     const journal = {
         id: pending.id, phase: "applying",
-        existing: readdirSync(dataDir).filter((name) => !preserved(name)).sort(),
+        existing: readdirSync(dataDir).filter((name) => !keptInPlace(name)).sort(),
         incoming: readdirSync(prepared).sort(),
     };
     // Top-level source and destination names are checked before recording any
@@ -1087,3 +1101,9 @@ export function removeWorkspaceBackupJob(dataDir, id) {
         throw new Error("Unsafe workspace backup cleanup target.");
     rmSync(path, { recursive: true, force: true });
 }
+/** Whether a snapshot leaves out this workspace-relative path, by the same
+ * rules as the export walk (cloud-move.ts sizes a move with it). Symbolic
+ * links are the caller's to skip. */
+export function omittedFromWorkspaceBackup(path) {
+    return excluded(path.split("/")[0]) || excludedWorkspaceAuthPath(path) || ephemeralWorkspaceTokenPath(path) || redownloadedOrgLibraryPath(path);
+}

package/dist-server/server/workspace.js

@@ -8,7 +8,7 @@
 // memory/ holds topic files the bot reads on demand with its ordinary
 // file tools. Plain markdown on purpose — the user can open, edit, or
 // delete anything the bot believes.
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { isMemoryDate, untilMark, withoutExpired } from "./memory-entries.js";
@@ -58,6 +58,53 @@ export function ensureWorkspace(botId) {
 export function workspaceDir(botId) {
     return join(WORKSPACES_DIR, botId);
 }
+/** On an OMB Cloud home a bot's memory is read only from regular files,
+ * never through a link: server/lending-memory.ts judges a link by where it
+ * points, not by what is there, so a turn must never read through one.
+ * Elsewhere memory reads exactly as it always did. */
+let regularMemoryFilesOnly = false;
+export function readMemoryOnlyFromRegularFiles() {
+    regularMemoryFilesOnly = true;
+}
+/** A memory file's text. Throws like readFileSync when it cannot be read,
+ * and, on a Cloud home, when it is not a regular file. */
+export function readMemoryText(path) {
+    if (!regularMemoryFilesOnly)
+        return readFileSync(path, "utf8");
+    // O_NOFOLLOW refuses a link at open where there is one; Windows has none
+    // (and opens what a link points at), so the entry is looked at first too.
+    if (!lstatSync(path).isFile())
+        throw Object.assign(new Error(`not a regular file: ${path}`), { code: "EINVAL" });
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        if (!fstatSync(fd).isFile())
+            throw Object.assign(new Error(`not a regular file: ${path}`), { code: "EINVAL" });
+        return readFileSync(fd, "utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** A memory folder's entries; on a Cloud home, none when the folder itself
+ * is a link. */
+function memoryFolderEntries(dir) {
+    if (regularMemoryFilesOnly && !lstatSync(dir).isDirectory())
+        return [];
+    return readdirSync(dir);
+}
+function regularFile(path) {
+    try {
+        return lstatSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** The stat a listing trusts: on a Cloud home, the entry's own (a link is
+ * not a file); elsewhere what it points at, as before. */
+function memoryEntryStat(path) {
+    return regularMemoryFilesOnly ? lstatSync(path) : statSync(path);
+}
 /** File locations, not file contents or wider tool permissions. Threads keep
  * independent working directories; the same bot can find its earlier output
  * without assuming that a file absent from the current directory was lost. */
@@ -89,7 +136,7 @@ export function memoryOverBudget(text) {
 export function loadMemory(botId, opts = {}) {
     let raw;
     try {
-        raw = readFileSync(join(workspaceDir(botId), "MEMORY.md"), "utf8");
+        raw = readMemoryText(join(workspaceDir(botId), "MEMORY.md"));
     }
     catch {
         return null;
@@ -128,7 +175,7 @@ export const MEMORY_FILE_MAX_BYTES = 256 * 1024;
 export function readMemoryFile(botId) {
     let raw;
     try {
-        raw = readFileSync(join(workspaceDir(botId), "MEMORY.md"), "utf8");
+        raw = readMemoryText(join(workspaceDir(botId), "MEMORY.md"));
     }
     catch {
         return { text: "", truncated: false };
@@ -159,7 +206,7 @@ function indexWrittenMemoryFile(botId, relativePath) {
     try {
         const path = join(workspaceDir(botId), relativePath);
         const stat = statSync(path);
-        indexMemoryFile(botId, relativePath, searchableMemoryText(relativePath, readFileSync(path, "utf8")), { mtimeMs: stat.mtimeMs, bytes: stat.size });
+        indexMemoryFile(botId, relativePath, searchableMemoryText(relativePath, readMemoryText(path)), { mtimeMs: stat.mtimeMs, bytes: stat.size });
     }
     catch {
         // the next search's sync pass picks it up
@@ -176,7 +223,7 @@ function memoryFilesOnDisk(botId) {
     ];
     return names.flatMap((relativePath) => {
         try {
-            const stat = statSync(join(dir, relativePath));
+            const stat = memoryEntryStat(join(dir, relativePath));
             return stat.isFile() ? [{ path: relativePath, mtimeMs: stat.mtimeMs, bytes: stat.size }] : [];
         }
         catch {
@@ -206,7 +253,7 @@ export function syncMemoryIndex(botId) {
         if (!dateChanged && known && known.bytes === file.bytes && known.mtimeMs === Math.trunc(file.mtimeMs))
             continue;
         try {
-            const text = readFileSync(join(workspaceDir(botId), file.path), "utf8");
+            const text = readMemoryText(join(workspaceDir(botId), file.path));
             indexMemoryFile(botId, file.path, searchableMemoryText(file.path, text), file);
         }
         catch {
@@ -318,7 +365,7 @@ export function updateMemory(botId, update, opts = {}) {
     const dir = ensureWorkspace(botId);
     // Do not use readMemoryFile's editor-friendly missing/read-error fallback:
     // a failed read must never turn into a successful overwrite of old notes.
-    const raw = readFileSync(join(dir, "MEMORY.md"), "utf8");
+    const raw = readMemoryText(join(dir, "MEMORY.md"));
     const current = raw === MEMORY_SEED ? "" : raw;
     const today = memoryDate(opts.now);
     // Every appended entry ends its own line; a file the person left without
@@ -419,7 +466,7 @@ export function appendMemoryLog(botId, text, opts = {}) {
     const path = join(dir, file);
     let current = "";
     try {
-        current = readFileSync(path, "utf8");
+        current = readMemoryText(path);
     }
     catch {
         // first line of the day
@@ -442,7 +489,8 @@ export function writeMemoryLog(botId, name, text) {
 /** The bot's daily log files, oldest first, by day name. */
 export function listMemoryLogs(botId) {
     try {
-        return readdirSync(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR)).filter((name) => LOG_FILE_NAME.test(name)).sort();
+        const dir = join(workspaceDir(botId), "memory", MEMORY_LOG_DIR);
+        return memoryFolderEntries(dir).filter((name) => LOG_FILE_NAME.test(name) && (!regularMemoryFilesOnly || regularFile(join(dir, name)))).sort();
     }
     catch {
         return [];
@@ -453,7 +501,7 @@ export function readMemoryLog(botId, name) {
     if (!LOG_FILE_NAME.test(name))
         return null;
     try {
-        return readFileSync(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR, name), "utf8");
+        return readMemoryText(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR, name));
     }
     catch {
         return null;
@@ -472,7 +520,7 @@ export function isMemoryTopicName(name) {
 export function listMemoryTopics(botId) {
     let entries;
     try {
-        entries = readdirSync(join(workspaceDir(botId), "memory"));
+        entries = memoryFolderEntries(join(workspaceDir(botId), "memory"));
     }
     catch {
         return [];
@@ -481,7 +529,7 @@ export function listMemoryTopics(botId) {
         .filter(isMemoryTopicName)
         .flatMap((name) => {
         try {
-            const stat = statSync(join(workspaceDir(botId), "memory", name));
+            const stat = memoryEntryStat(join(workspaceDir(botId), "memory", name));
             return stat.isFile() ? [{ name, bytes: stat.size }] : [];
         }
         catch {
@@ -507,7 +555,7 @@ export function readMemoryTopic(botId, name) {
     if (!isMemoryTopicName(name))
         return null;
     try {
-        return readFileSync(join(workspaceDir(botId), "memory", name), "utf8");
+        return readMemoryText(join(workspaceDir(botId), "memory", name));
     }
     catch {
         return null;
@@ -541,12 +589,14 @@ export function memoryTopicIndex(botId) {
     const dir = join(workspaceDir(botId), "memory");
     return renderTopicIndex(listMemoryTopics(botId).map((topic) => ({ name: topic.name, header: parseTopicHeader(readTopicHead(join(dir, topic.name))) })));
 }
-/** The memory block appended to a bot's system prompt. Always present for
- * bots with a workspace, so the bot knows the mechanism exists even before
+/** The memory block appended to a bot's system prompt when enabled. Present for
+ * enabled bots with a workspace, so the bot knows the mechanism exists even before
  * it has written anything. Content from other bots or imported files must
  * never be recorded as fact — memory is a prompt-injection persistence
  * vector the moment a bot copies untrusted text into it. */
 export function memorySystemPrompt(botId, opts = {}) {
+    if (opts.enabled === false)
+        return "";
     const memory = loadMemory(botId);
     const memoryFile = join(workspaceDir(botId), "MEMORY.md");
     const topicDir = join(workspaceDir(botId), "memory");

package/dist-server/shared/cloud-home.js

@@ -0,0 +1,4 @@
+/** Whether a Cloud home offers this place at all. */
+export function cloudHomeOffersPlace(place) {
+    return place !== "local" && place !== "vm";
+}

package/dist-server/shared/package-format.js

@@ -161,7 +161,24 @@ const requirementsSchema = z.object({
     capabilities: z.array(requiredText(80)).max(20),
     platforms: z.array(requiredText(80)).max(10).optional(),
 });
-const roomSchema = z.object({
+const ROOM_RESPONDER_KINDS = new Set(["agent", "everyone", "mentions", "auto"]);
+/** A responder kind from a newer release degrades to the room's first member
+ * as lead, which is what a room without a responder does, instead of
+ * refusing the whole package. Malformed values still fail below. */
+function knownRoomResponder(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const room = value;
+    const responder = room.defaultResponder;
+    if (!responder || typeof responder !== "object" || Array.isArray(responder))
+        return value;
+    const kind = responder.kind;
+    if (typeof kind !== "string" || ROOM_RESPONDER_KINDS.has(kind))
+        return value;
+    const first = Array.isArray(room.members) && typeof room.members[0] === "string" ? room.members[0] : undefined;
+    return { ...room, defaultResponder: first ? { kind: "agent", agent: first } : { kind: "mentions" } };
+}
+const roomSchema = z.preprocess(knownRoomResponder, z.object({
     key,
     name: requiredText(100),
     members: z.array(key).min(1).max(200),
@@ -170,8 +187,11 @@ const roomSchema = z.object({
         z.object({ kind: z.literal("agent"), agent: key }),
         z.object({ kind: z.literal("everyone") }),
         z.object({ kind: z.literal("mentions") }),
+        // Read, not written: exports spell an Auto room as its lead (see
+        // server/package-export.ts) so every older app can still open them.
+        z.object({ kind: z.literal("auto"), agent: key.optional() }),
     ]),
-});
+}));
 const exampleSchema = z.object({
     title: requiredText(120),
     input: requiredText(4_000),
@@ -580,7 +600,8 @@ function checkV1References(pkg) {
             if (!agents.has(member))
                 throw invalid(`Room ${room.key} references unknown agent: ${member}`);
         }
-        if (room.defaultResponder.kind === "agent" && !members.has(room.defaultResponder.agent)) {
+        if ((room.defaultResponder.kind === "agent" || room.defaultResponder.kind === "auto") && room.defaultResponder.agent !== undefined &&
+            !members.has(room.defaultResponder.agent)) {
             throw invalid(`Room ${room.key} has an unknown default responder`);
         }
     }
@@ -637,7 +658,8 @@ function checkV2References(pkg) {
             if (!agents.has(member))
                 throw invalid(`Room ${room.key} references unknown agent: ${member}`);
         }
-        if (room.defaultResponder.kind === "agent" && !members.has(room.defaultResponder.agent)) {
+        if ((room.defaultResponder.kind === "agent" || room.defaultResponder.kind === "auto") && room.defaultResponder.agent !== undefined &&
+            !members.has(room.defaultResponder.agent)) {
             throw invalid(`Room ${room.key} has a default responder who is not a member: ${room.defaultResponder.agent}`);
         }
         roomMembers.set(room.key, members);
@@ -821,8 +843,12 @@ export function downgradeToV1(document) {
         return [{ ...kept, enabledAfterInstall: false }];
     });
     const { team, publisher: _publisher, notes: _notes, presets: _presets, connections: _connections, skills: _skills, agents: _agents, routines: _routines, ...rest } = pkg;
+    // Older apps know no Auto room: spell one as its lead, as exports do.
+    const rooms = rest.rooms?.map((room) => room.defaultResponder.kind !== "auto" ? room
+        : { ...room, defaultResponder: { kind: "agent", agent: room.defaultResponder.agent ?? room.members[0] } });
     const v1 = {
         ...rest,
+        ...(rooms ? { rooms } : {}),
         agents,
         ...(team.leader ? { chiefOfStaff: team.leader } : {}),
         ...(routines.length ? { routines } : {}),

package/dist-server/shared/team-backup.js

@@ -63,6 +63,20 @@ const memory = z.object({
  * against. Shareable exports never carry grants at all, and an import
  * always lands bots grant-less whatever the file says. */
 const connectorTools = z.record(z.string().regex(CONNECTOR_SLUG_PATTERN), z.object({ tools: z.union([z.literal("*"), z.array(z.string().regex(CONNECTOR_TOOL_NAME_PATTERN)).min(1).max(500)]) }));
+/** A responder kind from a newer release restores as the room's first
+ * member as lead (what a room without one does) instead of refusing the
+ * whole backup. Malformed values still fail the schema. */
+function knownRoomResponder(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const group = value;
+    const kind = group.defaultResponder && typeof group.defaultResponder === "object"
+        ? group.defaultResponder.kind : undefined;
+    if (typeof kind !== "string" || ["member", "everyone", "mentions", "auto"].includes(kind))
+        return value;
+    const first = Array.isArray(group.memberIds) && typeof group.memberIds[0] === "string" ? group.memberIds[0] : undefined;
+    return { ...group, defaultResponder: first ? { kind: "member", botId: first } : { kind: "mentions" } };
+}
 const backupSchema = z.object({
     format: z.literal("openmaus.backup"),
     version: z.literal(1),
@@ -86,7 +100,7 @@ const backupSchema = z.object({
         connectorTools: connectorTools.optional(),
         memory: memory.optional(),
     })).min(1).max(200),
-    groups: z.array(z.object({
+    groups: z.array(z.preprocess(knownRoomResponder, z.object({
         ...owner,
         memberIds: z.array(key).max(200),
         dm: z.boolean(),
@@ -95,8 +109,9 @@ const backupSchema = z.object({
             z.object({ kind: z.literal("member"), botId: key }),
             z.object({ kind: z.literal("everyone") }),
             z.object({ kind: z.literal("mentions") }),
+            z.object({ kind: z.literal("auto"), fallbackBotId: key.optional() }),
         ]),
-    })).max(2_000),
+    }))).max(2_000),
     routines: z.array(z.object({
         name, prompt: z.string().trim().min(1).max(200_000),
         target: z.enum(["bot", "room-goal"]), botId: key, groupId: key.optional(),
@@ -136,7 +151,9 @@ export function parseTeamBackup(input) {
         if (group.memberIds.some((id) => !bots.has(id)))
             throw new Error("Invalid backup: unknown room member");
         unique(group.memberIds, "room member");
-        if (group.defaultResponder.kind === "member" && !group.memberIds.includes(group.defaultResponder.botId)) {
+        const lead = group.defaultResponder.kind === "member" ? group.defaultResponder.botId
+            : group.defaultResponder.kind === "auto" ? group.defaultResponder.fallbackBotId : undefined;
+        if (lead !== undefined && !group.memberIds.includes(lead)) {
             throw new Error("Invalid backup: room responder is not a member");
         }
         if (group.dm && (group.memberIds.length !== 2 || group.tasks.length !== 1))

package/dist-server/shared/workspace-backup-client.js

@@ -7,6 +7,7 @@ export const WORKSPACE_BACKUP_CLIENT_KEYS = [
     "omb-draft-channel-modes",
     "omb-skin",
     "omb-show-threads",
+    "omb-show-run-card",
     "openmausbot.sidebarDensity",
     "openmausbot.sidebarCollapsedSections.v1",
     "openmausbot.sidebarSectionOrder.v1",

package/dist-server/src/lib/citations.js

@@ -0,0 +1,177 @@
+// Selection matching is adapted from T3 Code's assistantTextSelection.ts
+// (Copyright 2026 T3 Tools Inc., MIT License; see third_party/t3-code/LICENSE).
+export const CITATION_MAX_QUOTE_LENGTH = 12_000;
+export const CITATION_MAX_COMMENT_LENGTH = 4_000;
+const CITATION_CONTEXT_LENGTH = 64;
+const CITATION_MARKER = "<!--omb-citation-v1:";
+const CITATION_MARKER_RE = /<!--omb-citation-v1:([A-Za-z0-9_-]{1,100000})-->/g;
+function boundedString(value, max, allowEmpty = false) {
+    return typeof value === "string" && value.length <= max && (allowEmpty || value.length > 0);
+}
+export function isCitationAttachment(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const citation = value;
+    const source = citation.source;
+    return citation.kind === "citation" &&
+        citation.version === 1 &&
+        boundedString(citation.id, 200) &&
+        boundedString(citation.quote, CITATION_MAX_QUOTE_LENGTH) &&
+        (citation.comment === undefined || boundedString(citation.comment, CITATION_MAX_COMMENT_LENGTH, true)) &&
+        typeof citation.size === "number" && Number.isFinite(citation.size) && citation.size >= 0 &&
+        Boolean(source) &&
+        (source.ownerType === "bot" || source.ownerType === "group") &&
+        boundedString(source.ownerId, 200) &&
+        boundedString(source.threadId, 200) &&
+        boundedString(source.messageId, 200) &&
+        Number.isSafeInteger(source.start) && Number(source.start) >= 0 &&
+        Number.isSafeInteger(source.end) && Number(source.end) >= Number(source.start) &&
+        boundedString(source.prefix, CITATION_CONTEXT_LENGTH, true) &&
+        boundedString(source.suffix, CITATION_CONTEXT_LENGTH, true);
+}
+function newId() {
+    return globalThis.crypto?.randomUUID?.() ?? `c${Math.random().toString(36).slice(2)}`;
+}
+function byteLength(text) {
+    return new TextEncoder().encode(text).length;
+}
+export function citationAttachment(source, selector, comment = "") {
+    const trimmedComment = comment.trim();
+    if (!selector.text.trim() || selector.text.length > CITATION_MAX_QUOTE_LENGTH) {
+        throw new Error("Citation quote is empty or too long");
+    }
+    if (trimmedComment.length > CITATION_MAX_COMMENT_LENGTH)
+        throw new Error("Citation comment is too long");
+    return {
+        kind: "citation",
+        version: 1,
+        id: newId(),
+        quote: selector.text,
+        ...(trimmedComment ? { comment: trimmedComment } : {}),
+        source: { ...source, start: selector.start, end: selector.end, prefix: selector.prefix, suffix: selector.suffix },
+        size: byteLength(selector.text) + byteLength(trimmedComment),
+    };
+}
+export function withCitationComment(citation, comment) {
+    const trimmed = comment.trim();
+    if (trimmed.length > CITATION_MAX_COMMENT_LENGTH)
+        throw new Error("Citation comment is too long");
+    const { comment: _old, ...rest } = citation;
+    return { ...rest, ...(trimmed ? { comment: trimmed } : {}), size: byteLength(citation.quote) + byteLength(trimmed) };
+}
+function base64UrlEncode(value) {
+    const bytes = new TextEncoder().encode(JSON.stringify(value));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    return JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (character) => character.charCodeAt(0))));
+}
+/** Readable in clients without citation UI and unambiguous to model providers. */
+export function citationFallback(citation) {
+    const quote = citation.quote.split("\n").map((line) => `> ${line}`).join("\n");
+    return `> Quoted message:\n${quote}${citation.comment ? `\n\nComment:\n${citation.comment}` : ""}`;
+}
+export function serializeCitation(citation) {
+    return `${CITATION_MARKER}${base64UrlEncode(citation)}-->\n${citationFallback(citation)}`;
+}
+export function splitTranscriptCitations(text) {
+    const citations = [];
+    let display = "";
+    let cursor = 0;
+    for (const match of text.matchAll(CITATION_MARKER_RE)) {
+        if (match.index < cursor)
+            continue;
+        let citation;
+        try {
+            const decoded = base64UrlDecode(match[1]);
+            if (!isCitationAttachment(decoded))
+                continue;
+            citation = decoded;
+        }
+        catch {
+            continue;
+        }
+        const block = `${match[0]}\n${citationFallback(citation)}`;
+        if (!text.startsWith(block, match.index))
+            continue;
+        display += text.slice(cursor, match.index);
+        cursor = match.index + block.length;
+        citations.push(citation);
+    }
+    return { display: `${display}${text.slice(cursor)}`.trim(), citations };
+}
+export function citationPreviewText(text) {
+    const cited = splitTranscriptCitations(text);
+    if (!cited.citations.length)
+        return text;
+    return [
+        cited.display,
+        ...cited.citations.map((citation) => citation.comment
+            ? `${citation.quote} — ${citation.comment}`
+            : citation.quote),
+    ].filter(Boolean).join(" ");
+}
+function normalizeWhitespace(text) {
+    return text.replace(/\s+/g, " ");
+}
+function splitsSurrogatePair(text, offset) {
+    const before = text.charCodeAt(offset - 1);
+    const after = text.charCodeAt(offset);
+    return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff;
+}
+export function createCitationTextSelector(text, rawStart, rawEnd) {
+    const quote = text.slice(rawStart, rawEnd);
+    if (!quote.trim())
+        return null;
+    const normalized = normalizeWhitespace(text);
+    let start = normalizeWhitespace(text.slice(0, rawStart)).length;
+    if (rawStart > 0 && /\s/.test(text[rawStart - 1]) && /\s/.test(text[rawStart]))
+        start -= 1;
+    const end = normalizeWhitespace(text.slice(0, rawEnd)).length;
+    let prefixStart = Math.max(0, start - CITATION_CONTEXT_LENGTH);
+    let suffixEnd = Math.min(normalized.length, end + CITATION_CONTEXT_LENGTH);
+    if (splitsSurrogatePair(normalized, prefixStart))
+        prefixStart += 1;
+    if (splitsSurrogatePair(normalized, suffixEnd))
+        suffixEnd -= 1;
+    return {
+        text: quote,
+        start,
+        end,
+        prefix: normalized.slice(prefixStart, start),
+        suffix: normalized.slice(end, suffixEnd),
+    };
+}
+export function findCitationText(text, selector) {
+    const normalized = normalizeWhitespace(text);
+    const quote = normalizeWhitespace(selector.text);
+    if (!quote.trim())
+        return null;
+    const prefix = normalizeWhitespace(selector.prefix);
+    const suffix = normalizeWhitespace(selector.suffix);
+    const matchesContext = (start, end) => normalized.slice(Math.max(0, start - prefix.length), start) === prefix &&
+        normalized.slice(end, end + suffix.length) === suffix;
+    let match = Number.isSafeInteger(selector.start) && Number.isSafeInteger(selector.end) &&
+        selector.start >= 0 && selector.end - selector.start === quote.length &&
+        normalized.slice(selector.start, selector.end) === quote && matchesContext(selector.start, selector.end)
+        ? { start: selector.start, end: selector.end }
+        : null;
+    let onlyQuote = null;
+    let quoteCount = 0;
+    for (let start = normalized.indexOf(quote); start !== -1; start = normalized.indexOf(quote, start + 1)) {
+        const end = start + quote.length;
+        quoteCount += 1;
+        onlyQuote = { start, end };
+        if (!matchesContext(start, end))
+            continue;
+        if (match && match.start !== start)
+            return null;
+        match = { start, end };
+    }
+    return match ?? (quoteCount === 1 ? onlyQuote : null);
+}

package/dist-server/src/lib/composer-attachments.js

@@ -1,7 +1,10 @@
+import { isCitationAttachment, serializeCitation } from "./citations.js";
 export function isAttachment(value) {
     if (!value || typeof value !== "object")
         return false;
     const attachment = value;
+    if (attachment.kind === "citation")
+        return isCitationAttachment(value);
     if (typeof attachment.id !== "string" || !validSize(attachment.size))
         return false;
     if (attachment.kind === "paste") {
@@ -362,7 +365,10 @@ export function formatSize(bytes) {
 export function composeMessage(text, attachments) {
     const parts = [text.trim()];
     attachments.forEach((a, i) => {
-        if (a.kind === "paste") {
+        if (a.kind === "citation") {
+            parts.push(serializeCitation(a));
+        }
+        else if (a.kind === "paste") {
             parts.push(`<pasted-text index="${i + 1}">\n${a.text}\n</pasted-text>`);
         }
         else if (a.kind === "image") {