openmausbot 0.1.91 → 0.1.92

package/dist/novnc-NOTICE.txt

@@ -0,0 +1,118 @@
+noVNC 1.7.0
+Copyright (C) 2022 The noVNC authors
+
+OpenMausBot bundles the unmodified noVNC core library under the Mozilla
+Public License 2.0 (MPL-2.0). The corresponding source, including its
+original copyright and license notices, is available at:
+https://github.com/novnc/noVNC/tree/v1.7.0
+
+MPL-2.0 license: https://www.mozilla.org/MPL/2.0/
+Authors: https://github.com/novnc/noVNC/blob/v1.7.0/AUTHORS
+
+The bundled library also includes the following third-party components.
+Their notices are reproduced below.
+
+Pako (vendor/pako/LICENSE)
+=========================
+
+(The MIT License)
+
+Copyright (C) 2014-2016 by Vitaly Puzrin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+DES (core/crypto/des.js)
+========================
+
+/*
+ * Ported from Flashlight VNC ActionScript implementation:
+ *     http://www.wizhelp.com/flashlight-vnc/
+ *
+ * Full attribution follows:
+ *
+ * -------------------------------------------------------------------------
+ *
+ * This DES class has been extracted from package Acme.Crypto for use in VNC.
+ * The unnecessary odd parity code has been removed.
+ *
+ * These changes are:
+ *  Copyright (C) 1999 AT&T Laboratories Cambridge.  All Rights Reserved.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ *
+
+ * DesCipher - the DES encryption method
+ *
+ * The meat of this code is by Dave Zimmerman <dzimm@widget.com>, and is:
+ *
+ * Copyright (c) 1996 Widget Workshop, Inc. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software
+ * and its documentation for NON-COMMERCIAL or COMMERCIAL purposes and
+ * without fee is hereby granted, provided that this copyright notice is kept
+ * intact.
+ *
+ * WIDGET WORKSHOP MAKES NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY
+ * OF THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+ * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE, OR NON-INFRINGEMENT. WIDGET WORKSHOP SHALL NOT BE LIABLE
+ * FOR ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR
+ * DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES.
+ *
+ * THIS SOFTWARE IS NOT DESIGNED OR INTENDED FOR USE OR RESALE AS ON-LINE
+ * CONTROL EQUIPMENT IN HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE
+ * PERFORMANCE, SUCH AS IN THE OPERATION OF NUCLEAR FACILITIES, AIRCRAFT
+ * NAVIGATION OR COMMUNICATION SYSTEMS, AIR TRAFFIC CONTROL, DIRECT LIFE
+ * SUPPORT MACHINES, OR WEAPONS SYSTEMS, IN WHICH THE FAILURE OF THE
+ * SOFTWARE COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SEVERE
+ * PHYSICAL OR ENVIRONMENTAL DAMAGE ("HIGH RISK ACTIVITIES").  WIDGET WORKSHOP
+ * SPECIFICALLY DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY OF FITNESS FOR
+ * HIGH RISK ACTIVITIES.
+ *
+ *
+ * The rest is:
+ *
+ * Copyright (C) 1996 by Jef Poskanzer <jef@acme.com>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * Visit the ACME Labs Java page for up-to-date versions of this and other
+ * fine Java utilities: http://www.acme.com/java/
+ */

package/dist-server/cloud-home-start.js

@@ -14635,10 +14635,26 @@ var sessionSchema = external_exports.object({
   userId: external_exports.string().max(256).optional(),
   email: external_exports.string().max(320).optional(),
   /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
-  membershipAuthority: external_exports.literal("portal").optional()
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
 });
 var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
 
+// server/cloud-secrets.ts
+var CLOUD_HOME_SECRET_KEYS = ["OMB_CLOUD_BOOTSTRAP_SECRET", "OMB_CLOUD_BOAT_TOKEN", "OMB_CLOUD_VOICE_TOKEN", "OMB_CLOUD_DECIDER_TOKEN"];
+var CLOUD_SECRETS_FD_ENV = "OMB_CLOUD_SECRETS_FD";
+function cloudHomeSecrets(env) {
+  return Object.fromEntries(CLOUD_HOME_SECRET_KEYS.flatMap((key) => env[key] ? [[key, env[key]]] : []));
+}
+function withoutCloudSecrets(env) {
+  const kept = { ...env };
+  for (const key of CLOUD_HOME_SECRET_KEYS) delete kept[key];
+  return kept;
+}
+
 // server/cloud-home.ts
 var CLOUD_HOME_KEYS = ["OMB_CLOUD_ROLE", "OMB_CLOUD_MACHINE_ID", "OMB_CLOUD_ADMIN_URL", "OMB_CLOUD_BOOTSTRAP_SECRET"];
 var CLOUD_IGNORED_KEYS = ["OMB_HOSTED_MODEL_URL", "OMB_HOSTED_MODEL_TOKEN", "OMB_HOSTED_MODELS"];
@@ -14713,6 +14729,7 @@ function cloudHomeHost(config2) {
 
 // server/cloud-home-start.ts
 var SERVICE_USER = "maus";
+var SECRETS_FD = 3;
 function passwdIds(passwd, name) {
   for (const line of passwd.split("\n")) {
     const [user, , uid, gid] = line.split(":");
@@ -14720,15 +14737,50 @@ function passwdIds(passwd, name) {
   }
   return null;
 }
+var SERVER_ENV_NAMES = /* @__PURE__ */ new Set([
+  "PATH",
+  "SHELL",
+  "HOSTNAME",
+  "LANG",
+  "LANGUAGE",
+  "TZ",
+  "TERM",
+  "TMPDIR",
+  "NO_COLOR",
+  "NODE_ENV",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "AGENT_BROWSER_EXECUTABLE_PATH",
+  "OMB_STATIC_DIR",
+  "OMB_DATA_DIR",
+  "OMB_CLOUD_ROLE",
+  "OMB_CLOUD_MACHINE_ID",
+  "OMB_CLOUD_ADMIN_URL",
+  "OMB_CLOUD_IMAGE",
+  "OMB_PUBLIC_URL",
+  "OMB_WEBHOOK_PUBLIC_URL",
+  "OMB_CLOUD_BOAT_URL",
+  "OMB_CLOUD_VOICE_URL",
+  "OMB_CLOUD_DECIDER_URL",
+  "OMB_TTS_DEFAULT_VOICE"
+]);
+function serverEnvironmentAllowed(name) {
+  return SERVER_ENV_NAMES.has(name) || name.startsWith("LC_");
+}
 function cloudHomeChildEnvironments(config2, env, home) {
+  const offered = withoutCloudSecrets(withoutIgnoredCloudKeys(env));
+  const allowed = Object.fromEntries(Object.entries(offered).filter(([name, value]) => value !== void 0 && serverEnvironmentAllowed(name)));
+  const dropped = Object.keys(offered).filter((name) => !serverEnvironmentAllowed(name) && name !== "HOME").sort();
   const server = {
-    ...withoutIgnoredCloudKeys(env),
+    ...allowed,
     HOME: home,
     OMB_DATA_DIR: env.OMB_DATA_DIR || posix.join(home, ".openmausbot"),
     OMB_PORT: "8799",
     OMB_WEBHOOK_PORT: "8800",
     OMB_PUBLIC_URL: config2.publicOrigin,
-    OMB_WEBHOOK_PUBLIC_URL: env.OMB_WEBHOOK_PUBLIC_URL || config2.publicOrigin
+    OMB_WEBHOOK_PUBLIC_URL: env.OMB_WEBHOOK_PUBLIC_URL || config2.publicOrigin,
+    [CLOUD_SECRETS_FD_ENV]: String(SECRETS_FD)
   };
   const edge = {
     PATH: env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
@@ -14737,7 +14789,33 @@ function cloudHomeChildEnvironments(config2, env, home) {
     XDG_CONFIG_HOME: "/tmp/omb-edge/config",
     OMB_CLOUD_PUBLIC_HOST: cloudHomeHost(config2)
   };
-  return { server, edge };
+  return { server, edge, secrets: cloudHomeSecrets(env), dropped };
+}
+function codeTrustProblem(files, home, stat = statSync) {
+  const volume = posix.join(home, "/");
+  for (const file2 of files) {
+    if (file2 === home || file2.startsWith(volume)) return `${file2} is on the volume`;
+    for (let path = file2; ; path = dirname2(path)) {
+      let owner;
+      try {
+        owner = stat(path);
+      } catch {
+        return `${path} cannot be checked`;
+      }
+      if (owner.uid !== 0) return `${path} is not root's`;
+      if (owner.mode & 18 && !(path !== file2 && owner.mode & 512)) return `${path} is writable by others than root`;
+      if (dirname2(path) === path) break;
+    }
+  }
+  return null;
+}
+function spawnWithSecrets(command, args, env, secrets, ids) {
+  const child = spawn(command, args, { env, stdio: ["inherit", "inherit", "inherit", "pipe"], ...ids ? { uid: ids.uid, gid: ids.gid } : {} });
+  const pipe2 = child.stdio[SECRETS_FD];
+  pipe2?.on("error", () => {
+  });
+  pipe2?.end(JSON.stringify(secrets));
+  return child;
 }
 function serverExitAction(code, stopping, restarts) {
   return !stopping && code === CLOUD_HOME_RESTART_EXIT_CODE && restarts < 5 ? "restart" : "stop";
@@ -14748,19 +14826,33 @@ function startCloudHome(env = process.env) {
   if (!config2) throw new Error("This image runs an OMB Cloud home machine; set its boot contract (docs/cloud-pro.md).");
   for (const warning of config2.warnings) console.warn(`cloud home: ${warning}`);
   const home = env.HOME || "/data";
+  let ids = null;
   if (process.getuid?.() === 0) {
-    const ids = passwdIds(readFileSync2("/etc/passwd", "utf8"), SERVICE_USER);
+    ids = passwdIds(readFileSync2("/etc/passwd", "utf8"), SERVICE_USER);
     if (!ids) throw new Error(`The ${SERVICE_USER} user is missing from this image.`);
     const stat = statSync(home);
     if (stat.uid !== ids.uid || stat.gid !== ids.gid) chownSync(home, ids.uid, ids.gid);
     process.setgroups?.([]);
-    process.setgid(ids.gid);
-    process.setuid(ids.uid);
+    process.setegid(ids.gid);
+    process.seteuid(ids.uid);
+    try {
+      prepareCloudHomeVolume(home, config2.machineId);
+    } finally {
+      process.seteuid(0);
+      process.setegid(0);
+    }
+  } else {
+    prepareCloudHomeVolume(home, config2.machineId);
   }
-  if (process.getuid?.() === 0) throw new Error("The Cloud home must run as an unprivileged user.");
-  prepareCloudHomeVolume(home, config2.machineId);
   const here = dirname2(fileURLToPath2(import.meta.url));
-  const { server, edge } = cloudHomeChildEnvironments(config2, env, home);
+  const edgeBin = env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy";
+  const edgeConfig = env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile";
+  if (ids) {
+    const problem = codeTrustProblem([process.execPath, fileURLToPath2(import.meta.url), join3(here, "index.js"), edgeBin, edgeConfig], home);
+    if (problem) throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it from deploy/fly/Dockerfile.`);
+  }
+  const { server, edge, secrets, dropped } = cloudHomeChildEnvironments(config2, env, home);
+  if (dropped.length) console.log(`cloud home: not passed to the server: ${dropped.join(", ")}`);
   const children = [];
   let stopping = false;
   const stop = (failed) => {
@@ -14773,8 +14865,7 @@ function startCloudHome(env = process.env) {
     }, 2e4);
     force.unref();
   };
-  const run = (command, args, childEnv, again) => {
-    const child = spawn(command, args, { env: childEnv, stdio: "inherit" });
+  const watch = (child, again) => {
     children.push(child);
     child.once("error", () => stop(true));
     child.once("exit", (code) => {
@@ -14783,14 +14874,18 @@ function startCloudHome(env = process.env) {
     });
   };
   let restarts = 0;
-  const runServer = () => run(process.execPath, [join3(here, "index.js")], server, (code) => {
+  const runServer = () => watch(spawnWithSecrets(process.execPath, [join3(here, "index.js")], server, secrets, ids), (code) => {
     if (serverExitAction(code, stopping, restarts) !== "restart") return false;
     restarts++;
     runServer();
     return true;
   });
   runServer();
-  run(env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy", ["run", "--config", env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile", "--adapter", "caddyfile"], edge);
+  watch(spawn(
+    edgeBin,
+    ["run", "--config", edgeConfig, "--adapter", "caddyfile"],
+    { env: edge, stdio: "inherit", ...ids ? { uid: ids.uid, gid: ids.gid } : {} }
+  ));
   process.once("SIGTERM", () => stop(false));
   process.once("SIGINT", () => stop(false));
 }
@@ -14804,7 +14899,10 @@ if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1]
 }
 export {
   cloudHomeChildEnvironments,
+  codeTrustProblem,
   passwdIds,
+  serverEnvironmentAllowed,
   serverExitAction,
+  spawnWithSecrets,
   startCloudHome
 };

package/dist-server/container-mcp.js

@@ -22,6 +22,9 @@ function nvmBinDirs() {
     return [];
   }
 }
+function sealedFixture() {
+  return process.env.OMB_TEST_SEALED_PATH === "1";
+}
 function knownDirs() {
   const home = homedir();
   return [
@@ -37,10 +40,13 @@ function knownDirs() {
     // opencode installer
     join(home, ".claude", "local"),
     // claude "local install"
-    "/opt/homebrew/bin",
-    // brew, Apple silicon
-    "/usr/local/bin",
-    // brew Intel / classic installs
+    // Machine-wide rather than under the (possibly temporary) home.
+    ...sealedFixture() ? [] : [
+      "/opt/homebrew/bin",
+      // brew, Apple silicon
+      "/usr/local/bin"
+      // brew Intel / classic installs
+    ],
     join(home, ".volta", "bin"),
     join(home, ".bun", "bin"),
     join(home, ".asdf", "shims"),
@@ -92,7 +98,7 @@ function augmentedPath() {
       ...(process.platform === "win32" ? windowsKnownDirs() : knownDirs()).filter((d) => existsSync(d))
     ]);
   }
-  if (!probed && !process.env.VITEST && process.platform !== "win32") {
+  if (!probed && !process.env.VITEST && !sealedFixture() && process.platform !== "win32") {
     probed = true;
     probeLoginShellPath();
   }
@@ -116,6 +122,119 @@ function probeLoginShellPath() {
     }
   );
 }
+function splitCliString(cli) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  for (const ch of cli.trim()) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+    } else if (/\s/.test(ch)) {
+      if (cur) out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+function isFile(p2) {
+  try {
+    return statSync(p2, { throwIfNoEntry: false })?.isFile() ?? false;
+  } catch {
+    return false;
+  }
+}
+function whichWin(cli, env) {
+  const exts = ((env ?? process.env).PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const probe = (base) => {
+    const order = extname(base) ? [base, ...exts.map((e) => base + e)] : [...exts.map((e) => base + e), base];
+    return order.find(isFile) ?? null;
+  };
+  if (/[\\/]/.test(cli) || /^[a-zA-Z]:/.test(cli)) return probe(cli);
+  const path = env ? env.PATH ?? env.Path ?? "" : augmentedPath();
+  for (const dir of path.split(delimiter)) {
+    if (!dir) continue;
+    const hit = probe(join(dir, cli));
+    if (hit) return hit;
+  }
+  return null;
+}
+function nodeExe(near, env) {
+  const local = join(near, "node.exe");
+  if (isFile(local)) return local;
+  const onPath = whichWin("node.exe", env);
+  if (onPath && extname(onPath).toLowerCase() === ".exe") return onPath;
+  return process.versions.electron ? null : process.execPath;
+}
+function parseCmdShim(shim, env) {
+  let text;
+  try {
+    text = readFileSync(shim, "utf8");
+  } catch {
+    return null;
+  }
+  const dir = dirname(shim);
+  const npmEntry = /^SET "NP[MX]_CLI_JS=%~dp0\\([^"]+)"/im.exec(text);
+  const targets = [...npmEntry ? [npmEntry] : [], ...text.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m2) => join(dir, m2[1])).filter((p2) => isFile(p2) && basename(p2).toLowerCase() !== "node.exe");
+  const script = targets.find((p2) => /\.[cm]?js$/i.test(p2));
+  if (script) {
+    const node = nodeExe(dir, env);
+    if (node) return { command: node, args: [script] };
+  }
+  const exe = targets.find((p2) => extname(p2).toLowerCase() === ".exe");
+  return exe ? { command: exe, args: [] } : null;
+}
+function parseNodeShebang(file2, env) {
+  let head = "";
+  let fd = null;
+  try {
+    fd = openSync(file2, "r");
+    const buf = Buffer.alloc(128);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    head = buf.subarray(0, n).toString("utf8").split("\n", 1)[0];
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+  if (!/^#!.*\bnode(\.exe)?\b/.test(head)) return null;
+  const node = nodeExe(dirname(file2), env);
+  return node ? { command: node, args: [file2] } : null;
+}
+function resolveWord(cli, args, env) {
+  if (process.platform !== "win32") return { command: cli, args };
+  const file2 = whichWin(cli, env);
+  if (!file2) return { command: cli, args };
+  const ext = extname(file2).toLowerCase();
+  if (ext === ".cmd" || ext === ".bat") {
+    const direct = parseCmdShim(file2, env);
+    return direct ? { command: direct.command, args: [...direct.args, ...args] } : { command: file2, args };
+  }
+  if (ext === ".exe" || ext === ".com") return { command: file2, args };
+  const viaNode = parseNodeShebang(file2, env);
+  return viaNode ? { command: viaNode.command, args: [...viaNode.args, ...args] } : { command: file2, args };
+}
+function resolveCliSpawn(cli, args, env) {
+  const trimmed = cli.trim();
+  if (trimmed.includes(" ") && existsSync(trimmed)) return resolveWord(trimmed, args, env);
+  const split = splitCliString(cli);
+  if (split.length > 1 || split[0] !== trimmed) {
+    const [head, ...fixed] = split;
+    if (!head) return { command: cli, args };
+    return resolveWord(head, [...fixed, ...args], env);
+  }
+  return resolveWord(cli, args, env);
+}
 
 // server/config.ts
 import { homedir as homedir2 } from "node:os";
@@ -15624,15 +15743,27 @@ var stdioEntrySchema = external_exports.object({
 var stdioMutationSchema = stdioEntrySchema.extend({
   env: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
 });
+var CLIENT_ID = /^[\x20-\x7e]+$/;
+var SCOPE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+var CLIENT_SECRET_MAX = 4096;
+var oauthClientSchema = external_exports.object({
+  clientId: external_exports.string().trim().min(1, "Enter the client ID of the app registered with this server's sign-in provider.").max(512).regex(CLIENT_ID, "A client ID is printable text on one line."),
+  clientSecret: external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line.").optional(),
+  scopes: external_exports.array(external_exports.string().max(256).regex(SCOPE, "Scopes are single words, like offline_access or api://my-app/mcp.read.")).max(32).optional()
+}).strict();
 var remoteEntrySchema = external_exports.object({
   /** Streamable HTTP unless the entry says the older SSE transport. */
   type: external_exports.enum(["http", "sse"]).optional(),
   url: external_exports.string().trim().min(1).max(2048),
   headers: external_exports.record(external_exports.string(), external_exports.string().max(16384)).optional(),
+  oauth: oauthClientSchema.optional(),
   enabled: external_exports.boolean().optional()
 }).strict();
 var remoteMutationSchema = remoteEntrySchema.extend({
-  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
+  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional(),
+  oauth: oauthClientSchema.extend({
+    clientSecret: external_exports.union([external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line."), external_exports.literal(true)]).optional()
+  }).optional()
 });
 
 // server/cloud-overflow.ts
@@ -15698,7 +15829,11 @@ var sessionSchema = external_exports.object({
   userId: external_exports.string().max(256).optional(),
   email: external_exports.string().max(320).optional(),
   /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
-  membershipAuthority: external_exports.literal("portal").optional()
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
 });
 var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
 
@@ -15710,6 +15845,7 @@ var optionalText = external_exports.string().optional();
 var SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 var LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
 var BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
+var FISH_TTS_MODELS = ["s2.1-pro", "s2.1-pro-free"];
 var MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 var MAX_ROOM_TURN_TIMEOUT_MINUTES = 1440;
 var DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
@@ -15720,6 +15856,8 @@ var MIN_THREAD_EVENT_LOG_BYTES = 256 * 1024;
 var MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
 var MIN_LOCAL_VM_MAX_INSTANCES = 1;
 var MAX_LOCAL_VM_MAX_INSTANCES = 8;
+var MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 5;
+var MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 1440;
 function isValidSshAlias(value) {
   return typeof value === "string" && SSH_ALIAS.test(value);
 }
@@ -15757,7 +15895,8 @@ var roomConfigSchema = external_exports.object({
 );
 var localVmConfigSchema = external_exports.object({
   mode: external_exports.enum(["shared", "per-bot", "pool"]).optional(),
-  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional()
+  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional(),
+  idleTimeoutMinutes: external_exports.number().int().min(MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES).max(MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES).optional()
 });
 var browserProfileSchema = external_exports.object({
   // "guest" is the throwaway session's reserved id, never a saved profile
@@ -15916,7 +16055,11 @@ var onboardingConfigSchema = external_exports.object({
   /** Which welcome flow was completed; a newer flow may re-show itself. */
   version: external_exports.number().int().min(0).max(1e3).optional(),
   reelSeen: external_exports.boolean().optional(),
-  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional()
+  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional(),
+  /** OMB Cloud home only: when a bot's turn first finished on this machine
+   * (cloud-home.ts firstCloudTurnPatch). Written by the server, read by the
+   * Cloud's setup checklist. */
+  firstTurnAt: external_exports.string().trim().max(40).optional()
 }).strict();
 var instanceConfigSchema = external_exports.object({
   driver: external_exports.string().min(1),
@@ -15928,6 +16071,7 @@ var instanceConfigSchema = external_exports.object({
   ]).optional(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   enabled: external_exports.boolean().optional(),
+  access: external_exports.enum(["subscription", "custom", "api"]).optional(),
   config: external_exports.json().optional()
 });
 var instanceConfigMapSchema = external_exports.record(external_exports.string(), instanceConfigSchema);
@@ -15989,7 +16133,12 @@ var appConfigSchema = external_exports.object({
   /** Anthropic API key for Claude Code billed per token, handed only to
    * Claude instances; `url` only for a proxy or a test double. Never a
    * personal-login OAuth token. */
-  anthropic: external_exports.object({ key: optionalText, url: optionalText }).optional(),
+  anthropic: external_exports.object({ key: optionalText, url: optionalText, everyClaudeBot: external_exports.boolean().optional() }).optional(),
+  /** OpenAI's own API key, for the `openai` instance only. Codex keeps its
+   * own ChatGPT or API login and never reads this. */
+  openai: external_exports.object({ key: optionalText }).optional(),
+  /** OpenRouter key, for the `openrouter` instance only. */
+  openrouter: external_exports.object({ key: optionalText }).optional(),
   /** Monthly spend limit for the whole workspace, against the cost engines
    * report to the usage ledger. Enforced only with the `budgets` entitlement. */
   budgets: external_exports.object({
@@ -16023,8 +16172,8 @@ var appConfigSchema = external_exports.object({
   opencodeGo: external_exports.object({ apiKey: optionalText }).optional(),
   /** Voice settings and the selected voice id. `provider` picks the
    * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
-   * `fishKey`), "system" (the Mac's built-in voices, no key), or
-   * "xai" (Grok TTS, reusing `xai.key`), or
+   * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
+   * built-in voices, no key), "xai" (Grok TTS, reusing `xai.key`), or
    * "chatterbox" (a local OpenAI-compatible Chatterbox server; `baseUrl`
    * and `model` are settings, not secrets). Cloud keys stay separate so
    * switching providers never overwrites or misuses the other key. */
@@ -16034,7 +16183,8 @@ var appConfigSchema = external_exports.object({
     voice: optionalText,
     provider: external_exports.enum(["elevenlabs", "fish", "system", "chatterbox", "xai"]).optional(),
     baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the Chatterbox server address must start with http:// or https://").optional(),
-    model: optionalText
+    model: optionalText,
+    fishModel: external_exports.enum(FISH_TTS_MODELS).optional()
   }).optional(),
   /** The decision model (server/decider): a fast classifier that picks
    * things for bots, starting with who answers a room message. `key` is
@@ -16122,6 +16272,34 @@ var DATA_DIR = process.env.OMB_DATA_DIR ?? join3(homedir2(), ".openmausbot");
 var LEGACY_DATA_DIR = join3(homedir2(), ".opengrokbot");
 var EVENTS_DIR = join3(DATA_DIR, "events");
 var NATIVE_DIR = join3(DATA_DIR, "native");
+var OPENAI_API_INSTANCE = "openai";
+var OPENROUTER_API_INSTANCE = "openrouter";
+var XAI_API_INSTANCE = "xaiApi";
+var CLAUDE_API_INSTANCE = "claudeApi";
+var API_KEY_FLEET = {
+  [OPENAI_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenAI",
+    access: "api",
+    icon: { kind: "preset", preset: "openai" },
+    config: { url: "https://api.openai.com/v1", apiKeyEnv: "OMB_OPENAI_API_KEY", catalog: "openai" }
+  },
+  [CLAUDE_API_INSTANCE]: {
+    driver: "claudeAgent",
+    displayName: "Claude (API key)",
+    access: "api",
+    icon: { kind: "preset", preset: "anthropic" },
+    config: { requireApiKey: true }
+  },
+  [XAI_API_INSTANCE]: { driver: "grok", displayName: "xAI", access: "api", icon: { kind: "preset", preset: "xai" } },
+  [OPENROUTER_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenRouter",
+    access: "api",
+    icon: { kind: "preset", preset: "openrouter" },
+    config: { url: "https://openrouter.ai/api/v1", apiKeyEnv: "OMB_OPENROUTER_API_KEY" }
+  }
+};
 
 // server/container-computer.ts
 var run = promisify(execFile2);
@@ -16454,9 +16632,11 @@ function createMcpBridgeInterceptor(options) {
   };
 }
 function runMcpBridge(options) {
-  const child = spawn(options.command, options.args, {
+  const env = options.env ?? { ...process.env, PATH: augmentedPath() };
+  const { command, args } = resolveCliSpawn(options.command, options.args, env);
+  const child = spawn(command, args, {
     shell: false,
-    env: options.env ?? { ...process.env, PATH: augmentedPath() },
+    env,
     stdio: ["pipe", "pipe", "pipe"]
   });
   child.stdin.on("error", () => {