openmausbot 0.1.91 → 0.1.92

package/dist-server/server/boat.js

@@ -388,7 +388,7 @@ async function waitReady(cfg, boxId, budgetMs = 90_000) {
 const boatIdCache = new Map();
 function boatInventoryProblem(status, body, included = false) {
     if (status === 401 || status === 403) {
-        return included ? INCLUDED_BOAT_UNAVAILABLE : "boat.dev rejected the Boat API key — update it in Settings → Connections";
+        return included ? INCLUDED_BOAT_UNAVAILABLE : "boat.dev rejected the Boat API key — update it in Settings → API keys";
     }
     if (status === 429)
         return "boat.dev is rate-limiting this account — wait a minute and refresh";
@@ -708,7 +708,7 @@ export async function inspectBoatIdentity(cfg, boxId) {
 function inventoryFailure(inventory) {
     const error = new Error(inventory.configured
         ? (inventory.problem ?? "Cloud computer inventory is unavailable")
-        : "Boat is not configured — add its API key in Settings → Connections");
+        : "Boat is not configured — add its API key in Settings → API keys");
     error.status = inventory.configured ? 503 : 409;
     return error;
 }

package/dist-server/server/browser-engine.js

@@ -442,8 +442,17 @@ export function agentBrowserIntegration(input) {
             ...(sourceEnv.USERPROFILE ? { USERPROFILE: sourceEnv.USERPROFILE } : {}),
         })),
     };
-    if (input.headless !== false)
+    // A Linux host with no display cannot run headed Chrome, and OMB's managed
+    // browser is headless automation (docs/browser-packaging.md). Pin headless
+    // there even for a headed-capable caller. The engine's own flag is
+    // AGENT_BROWSER_HEADED; an explicit "0" pins the default so a daemon that
+    // kept a headed launch config still comes back headless instead of failing
+    // every launch until it is killed by hand (#1383).
+    const displayless = (input.platform ?? process.platform) === "linux" && !sourceEnv.DISPLAY && !sourceEnv.WAYLAND_DISPLAY;
+    if (input.headless !== false || displayless) {
         env.AGENT_BROWSER_HEADLESS = "1";
+        env.AGENT_BROWSER_HEADED = "0";
+    }
     if (input.attachCdpUrl)
         env.AGENT_BROWSER_CDP = input.attachCdpUrl;
     // MCP clients may filter the parent environment. Carry the configured

package/dist-server/server/browser-live.js

@@ -39,6 +39,19 @@ function displayUrl(value) {
         return "";
     }
 }
+/** Chrome's own launch-failure wording: the engine is installed and its
+ * daemon answers, but no browser can start (no display, an early exit).
+ * Distinct from a missing engine — the fix is a fresh session, not an
+ * install, so the generic "check the engine is installed" guidance would
+ * send the operator the wrong way (#1383). */
+function browserLaunchFailure(error) {
+    const detail = [
+        error?.stderr,
+        error?.stdout,
+        error instanceof Error ? error.message : String(error),
+    ].filter((part) => typeof part === "string").join("\n");
+    return /missing x server|\$DISPLAY|devtoolsactiveport|chrome exited|could not launch|failed to launch|browser launch failed/iu.test(detail);
+}
 /** Project only the viewer protocol. Never relay engine commands, results or console output. */
 export function normalizeBrowserLiveMessage(value) {
     const message = object(value);
@@ -150,6 +163,7 @@ export function parseBrowserLiveAction(value) {
 export class BrowserLive {
     runtime;
     viewers = new Map();
+    sessionResets = new Map();
     constructor({ runtime }) { this.runtime = runtime; }
     current(viewer) {
         try {
@@ -298,12 +312,37 @@ export class BrowserLive {
                 throw new Error("stale viewer");
             const result = object(JSON.parse(stdout));
             const data = object(result?.data);
-            if (result?.success !== true || !data)
-                throw new Error("browser command failed");
+            if (result?.success !== true || !data) {
+                // Keep the engine's own error internal (logged, never sent) so a
+                // launch failure is recognized for what it is below.
+                const detail = [result?.error, result?.message].filter((part) => typeof part === "string").join(" ");
+                throw new Error(detail ? `browser command failed: ${detail}` : "browser command failed");
+            }
             return data;
         }
         catch (error) {
             console.warn("browser-live:", error);
+            if (browserLaunchFailure(error)) {
+                // The daemon is alive but holding a launch configuration Chrome
+                // cannot satisfy on this host (a headed launch with no display). It
+                // fails every command the same way until the daemon is killed —
+                // discard the session so the next connect starts a fresh one. One
+                // tracked reset per session: a reconnect or repeated command joins
+                // the in-flight teardown instead of spawning another (#1383).
+                if (!this.sessionResets.has(viewer.session)) {
+                    const reset = closeBrowserSession(viewer.spec.command, env).then((closed) => {
+                        if (closed)
+                            console.warn(`browser-live: reset ${viewer.session} after a failed browser launch; reconnecting starts a fresh session`);
+                        else
+                            console.warn(`browser-live: reset of ${viewer.session} after a failed browser launch did not finish; the next command retries it`);
+                        return closed;
+                    }, () => false);
+                    this.sessionResets.set(viewer.session, reset);
+                    void reset.finally(() => { if (this.sessionResets.get(viewer.session) === reset)
+                        this.sessionResets.delete(viewer.session); });
+                }
+                throw new BrowserLiveError("The browser could not start on this server. Reconnect to retry with a fresh browser session.", 503);
+            }
             throw new BrowserLiveError("The browser could not complete this action. Check that the browser engine is installed, then reconnect.", 503);
         }
     }
@@ -380,6 +419,11 @@ export class BrowserLive {
         options.res.once("close", () => this.close(viewer));
         options.res.once("error", () => this.close(viewer));
         try {
+            // A failed launch already started this session's daemon teardown; wait
+            // for it so the status probe meets a fresh daemon, not the stuck one.
+            const resetting = this.sessionResets.get(viewer.session);
+            if (resetting)
+                await resetting;
             let status = await this.command(viewer, ["stream", "status"]);
             if (status.enabled !== true) {
                 try {

package/dist-server/server/browser-runtime.js

@@ -1,6 +1,16 @@
 import { killCliTree, spawnCli } from "./procs.js";
 import { DEFAULT_BROWSER_RESULT_BUDGET, shapeBrowserToolResult, slimBrowserToolList, stripHarnessOwnedArguments } from "./browser-tool-shape.js";
 export const BROWSER_CONTROL_REFUSAL = "Browser tools are paused while a person controls this browser. Wait for them to hand control back; do not try another browser or execution tool.";
+/** Harness-owned recovery tool, advertised beside the engine's own tools. A
+ * phone or chat-only user has no Browser panel Restart button; without this
+ * an interrupted action refuses the bot's browser until the app restarts. */
+export const BROWSER_RESTART_TOOL = "restart_browser";
+const BROWSER_RESTART_TOOL_SPEC = {
+    name: BROWSER_RESTART_TOOL,
+    description: "Close and restart your browser. Use this only when a browser tool says a browser action was interrupted and the browser must be restarted. Open pages are closed; afterwards open the page you need again and check whether the interrupted action already happened before repeating it.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+};
+const BROWSER_INTERRUPTED = `A browser action was interrupted. Restart this browser with the ${BROWSER_RESTART_TOOL} tool before continuing.`;
 const MAX_REQUEST_BYTES = 1_048_576;
 const MAX_RESPONSE_BYTES = 16_777_216;
 /** Startup, not per-request work: a cold engine spawn can exceed a tight
@@ -200,10 +210,15 @@ class BrowserClient {
 export class BrowserRuntime {
     gates = new Map();
     clients = new Map();
+    /** Last advertised tools per session, so a turn that starts while the
+     * browser is uncertain still sees the tools it can use after recovering. */
+    toolLists = new Map();
     options;
-    constructor(options = {}) {
+    closeBrowser;
+    constructor({ closeBrowser, ...options } = {}) {
         const budget = Number(process.env.OMB_BROWSER_RESULT_BUDGET);
         this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: Number.isFinite(budget) && budget > 0 ? budget : DEFAULT_BROWSER_RESULT_BUDGET, ...options };
+        this.closeBrowser = closeBrowser ?? (async () => false);
     }
     gate(session) {
         let gate = this.gates.get(session);
@@ -227,7 +242,7 @@ export class BrowserRuntime {
         if (gate.owner !== null)
             throw new Error(BROWSER_CONTROL_REFUSAL);
         if (gate.uncertain)
-            throw new Error("A browser action was interrupted. Restart this browser before continuing.");
+            throw new Error(BROWSER_INTERRUPTED);
         if (gate.closing)
             throw new Error("The browser is closing. Try again shortly.");
         gate.agents++;
@@ -250,10 +265,21 @@ export class BrowserRuntime {
         // must refuse the closing window itself or its client outlives restart().
         if (method !== "tools/call" && this.gate(session).closing)
             throw new Error("The browser is closing. Try again shortly.");
+        if (method === "tools/call" && params && typeof params === "object" && params.name === BROWSER_RESTART_TOOL) {
+            beforeDispatch?.();
+            await this.agentRestart(session, () => this.closeBrowser(session, spec));
+            beforeDispatch?.(); // A turn revoked while the browser closed receives no result.
+            return { content: [{ type: "text", text: "Browser restarted. Open pages were closed; open the page you need again and check whether the interrupted action already happened before repeating it." }] };
+        }
         // Uncertainty survives client replacement and never self-resolves: refuse
-        // every new browser request until an explicit restart clears it.
-        if (this.gate(session).uncertain)
-            throw new Error("A browser action was interrupted. Restart this browser before continuing.");
+        // every new browser request until an explicit restart clears it. Listing
+        // never reaches the engine; it answers from the last list so the restart
+        // tool is reachable and the engine's tools are there once it succeeds.
+        if (this.gate(session).uncertain) {
+            if (method === "tools/list")
+                return withRestartTool(this.toolLists.get(session) ?? { tools: [] });
+            throw new Error(BROWSER_INTERRUPTED);
+        }
         const invoke = async () => {
             const key = JSON.stringify([spec.command, spec.args, Object.entries(spec.env).sort(([a], [b]) => a.localeCompare(b))]);
             let entry = this.clients.get(session);
@@ -281,8 +307,11 @@ export class BrowserRuntime {
                 const request = method === "tools/call" ? stripHarnessOwnedArguments(params) : params;
                 let result = await entry.client.rpc(method, request);
                 beforeDispatch?.(); // A turn revoked while the tool ran receives no result.
-                if (method === "tools/list")
-                    return slimBrowserToolList(result);
+                if (method === "tools/list") {
+                    const tools = withRestartTool(slimBrowserToolList(result));
+                    this.toolLists.set(session, tools);
+                    return tools;
+                }
                 const toolName = request && typeof request === "object" && typeof request.name === "string" ? request.name : undefined;
                 if (toolName === "agent_browser_open" && result && typeof result === "object" &&
                     result.isError !== true) {
@@ -448,6 +477,35 @@ export class BrowserRuntime {
             this.changed(gate);
         }
     }
+    /** The agent's own recovery, for a turn with no Browser panel to press
+     * Restart in. The same barrier as restart() — the native browser must
+     * close — but it never takes a person's hold, and a failed close leaves no
+     * owner behind that would lock a person out of the panel. */
+    async agentRestart(session, closeBrowser) {
+        const gate = this.gate(session);
+        if (gate.owner !== null)
+            throw new Error(BROWSER_CONTROL_REFUSAL);
+        if (gate.closing || gate.releasing || gate.agents || gate.humans)
+            throw new Error("The browser is busy. Wait for current work to finish before restarting.");
+        gate.ready = false;
+        gate.closing = true;
+        this.changed(gate);
+        try {
+            if (!await closeBrowser())
+                throw new Error("The browser could not be closed. Ask the person to press Restart in the Browser panel of OpenMausBot on their computer, or to restart OpenMausBot.");
+            await this.clients.get(session)?.client.stop();
+            await this.clients.get(session)?.client.stop(); // see restart()
+            gate.uncertain = false;
+        }
+        catch (error) {
+            gate.uncertain = true;
+            throw error;
+        }
+        finally {
+            gate.closing = false;
+            this.changed(gate);
+        }
+    }
     /** Call after the underlying browser is closed when recovering an uncertain
      * action. This closes the MCP transport, not saved logins or profile files. */
     async close(session) {
@@ -460,10 +518,18 @@ export class BrowserRuntime {
         await this.clients.get(session)?.client.stop();
         gate.closing = false;
         this.changed(gate);
-        if (!gate.owner && !gate.agents && !gate.humans)
+        if (!gate.owner && !gate.agents && !gate.humans) {
             this.gates.delete(session);
+            this.toolLists.delete(session);
+        }
     }
     async closeAll() {
         await Promise.all([...new Set([...this.clients.keys(), ...this.gates.keys()])].map((session) => this.close(session)));
     }
 }
+function withRestartTool(result) {
+    if (!result || typeof result !== "object" || !Array.isArray(result.tools))
+        return result;
+    const tools = (result.tools).filter((tool) => tool?.name !== BROWSER_RESTART_TOOL);
+    return { ...result, tools: [...tools, BROWSER_RESTART_TOOL_SPEC] };
+}

package/dist-server/server/browser-tool-shape.js

@@ -12,11 +12,13 @@
 import { trimResultText } from "./mcp-trim.js";
 /** Launch, session and network settings OpenMausBot owns through the
  * environment (see browser-engine.ts). A model has no business setting them
- * per call — `session` would reach another bot's browser, `extraArgs` and
- * `caCert` change the launch — and each one cost more schema than the tool's
- * own description. */
+ * per call — `session` would reach another bot's browser, `extraArgs`,
+ * `caCert` and `headed` change the launch — and each one cost more schema
+ * than the tool's own description. `headed` in particular overrides
+ * AGENT_BROWSER_HEADED and the managed config, so a single call can pin a
+ * daemon to a launch mode this host cannot satisfy (#1383). */
 export const HARNESS_OWNED_BROWSER_PARAMS = new Set([
-    "allowedDomains", "caCert", "clearCaCert", "extraArgs", "idleTimeout", "namespace",
+    "allowedDomains", "caCert", "clearCaCert", "extraArgs", "headed", "idleTimeout", "namespace",
     "restore", "restoreCheckFn", "restoreCheckText", "restoreCheckUrl", "restoreSave", "session", "timeoutMs",
 ]);
 /** Characters of one browser result that may enter the model's context.

package/dist-server/server/chief-of-staff.js

@@ -29,7 +29,7 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
     });
     const delegation = canDelegate
         ? boundedCoordination
-            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, everything you send a teammate continues your one standing conversation with them, using their own model and permissions, so they still have the context of your earlier assignments. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
+            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, each distinct assignment starts a fresh thread for that teammate, using their own model and permissions. Include the context they need in each brief. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
             : [
                 "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
                 "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",

package/dist-server/server/cloud-home-start.js

@@ -1,19 +1,33 @@
 // Entry point of the OMB Cloud Pro home image (deploy/fly/Dockerfile).
 //
-// Starts as root only to hand a fresh Fly volume (mounted root-owned at
-// /data) to the unprivileged `maus` user, then drops privileges for good
-// and runs two children: the OpenMausBot server on 127.0.0.1:8799 (and its
-// webhook receiver on :8800) and the Caddy edge on 0.0.0.0:8080. The edge is
-// the only listener the network can reach, and it always forwards with
-// X-Forwarded-*, so request-auth.ts never grants a remote request loopback
-// trust. If either child exits, both stop and the machine restarts; the one
-// exception is the server asking to be started again after a restore.
+// Starts as root, hands a fresh Fly volume (mounted root-owned at /data) to
+// the unprivileged `maus` user, and stays a small root supervisor of two
+// children that run as `maus`: the OpenMausBot server on 127.0.0.1:8799
+// (and its webhook receiver on :8800) and the Caddy edge on 0.0.0.0:8080.
+// The edge is the only listener the network can reach, and it always
+// forwards with X-Forwarded-*, so request-auth.ts never grants a remote
+// request loopback trust. If either child exits, both stop and the machine
+// restarts; the one exception is the server asking to be started again
+// after a restore.
+//
+// The machine's secrets (the signing secret, the relay tokens) arrive as
+// this process's environment. No child's environment ever carries them:
+// /proc/<pid>/environ keeps a process's starting environment, readable by
+// anything running as the same user (an engine's shell). The server gets
+// them over an inherited pipe it reads first thing and closes
+// (cloud-secrets.ts), and an environment built from an allow-list, so a
+// secret the platform adds later never reaches it either. This process stays
+// root, so its own environment and memory are out of `maus`'s reach, and it
+// runs and trusts only code `maus` cannot change: the image's, never the
+// volume's (codeTrustProblem).
 import { spawn } from "node:child_process";
 import { chownSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { CLOUD_HOME_RESTART_EXIT_CODE, cloudHomeConfiguration, cloudHomeHost, prepareCloudHomeVolume, withoutIgnoredCloudKeys } from "./cloud-home.js";
+import { CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
 const SERVICE_USER = "maus";
+/** The descriptor the server reads its secrets from. */
+const SECRETS_FD = 3;
 /** uid/gid from /etc/passwd; Node has no getpwnam. */
 export function passwdIds(passwd, name) {
     for (const line of passwd.split("\n")) {
@@ -23,22 +37,80 @@ export function passwdIds(passwd, name) {
     }
     return null;
 }
-/** The server child's environment: the operator's contract plus fixed
- * ports and paths (Linux paths inside the image, so POSIX joins on every
- * host that builds them, tests included), never a platform gateway's settings. The edge child gets
- * only what it needs to route. */
+/** What the server child may be given from this process's environment, by
+ * name: the process basics, what the image sets, and the Cloud home's
+ * contract that is not secret. Anything else (a secret the platform adds
+ * later, a test's key, a platform gateway's settings) is left out. */
+const SERVER_ENV_NAMES = new Set([
+    "PATH", "SHELL", "HOSTNAME", "LANG", "LANGUAGE", "TZ", "TERM", "TMPDIR", "NO_COLOR", "NODE_ENV", "NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "SSL_CERT_DIR",
+    "AGENT_BROWSER_EXECUTABLE_PATH", "OMB_STATIC_DIR", "OMB_DATA_DIR",
+    "OMB_CLOUD_ROLE", "OMB_CLOUD_MACHINE_ID", "OMB_CLOUD_ADMIN_URL", "OMB_CLOUD_IMAGE", "OMB_PUBLIC_URL", "OMB_WEBHOOK_PUBLIC_URL",
+    "OMB_CLOUD_BOAT_URL", "OMB_CLOUD_VOICE_URL", "OMB_CLOUD_DECIDER_URL", "OMB_TTS_DEFAULT_VOICE",
+]);
+export function serverEnvironmentAllowed(name) {
+    return SERVER_ENV_NAMES.has(name) || name.startsWith("LC_");
+}
+/** The server child's environment: the allowed part of the operator's
+ * contract (serverEnvironmentAllowed) plus fixed ports and paths (Linux
+ * paths inside the image, so POSIX joins on every host that builds them,
+ * tests included), never a platform gateway's settings and never a secret
+ * (`secrets`, handed over the pipe instead). `dropped` names what was left
+ * out, for the log. The edge child gets only what it needs to route. */
 export function cloudHomeChildEnvironments(config, env, home) {
+    const offered = withoutCloudSecrets(withoutIgnoredCloudKeys(env));
+    const allowed = Object.fromEntries(Object.entries(offered).filter(([name, value]) => value !== undefined && serverEnvironmentAllowed(name)));
+    const dropped = Object.keys(offered).filter((name) => !serverEnvironmentAllowed(name) && name !== "HOME").sort();
     const server = {
-        ...withoutIgnoredCloudKeys(env), HOME: home, OMB_DATA_DIR: env.OMB_DATA_DIR || posix.join(home, ".openmausbot"),
+        ...allowed, HOME: home, OMB_DATA_DIR: env.OMB_DATA_DIR || posix.join(home, ".openmausbot"),
         OMB_PORT: "8799", OMB_WEBHOOK_PORT: "8800", OMB_PUBLIC_URL: config.publicOrigin,
         OMB_WEBHOOK_PUBLIC_URL: env.OMB_WEBHOOK_PUBLIC_URL || config.publicOrigin,
+        [CLOUD_SECRETS_FD_ENV]: String(SECRETS_FD),
     };
     const edge = {
         PATH: env.PATH ?? "/usr/local/bin:/usr/bin:/bin", HOME: "/tmp/omb-edge",
         XDG_DATA_HOME: "/tmp/omb-edge/data", XDG_CONFIG_HOME: "/tmp/omb-edge/config",
         OMB_CLOUD_PUBLIC_HOST: cloudHomeHost(config),
     };
-    return { server, edge };
+    return { server, edge, secrets: cloudHomeSecrets(env), dropped };
+}
+/** Why the root supervisor must not run or trust `files`, or null: each
+ * must be root's and not writable by anyone else (nor any folder above it),
+ * and none may live on the volume `home`, which `maus` owns. The image makes its code
+ * root's (deploy/fly/Dockerfile); a file `maus` could rewrite would run as
+ * root at the next start, or be handed the secrets. */
+export function codeTrustProblem(files, home, stat = statSync) {
+    const volume = posix.join(home, "/");
+    for (const file of files) {
+        if (file === home || file.startsWith(volume))
+            return `${file} is on the volume`;
+        for (let path = file;; path = dirname(path)) {
+            let owner;
+            try {
+                owner = stat(path);
+            }
+            catch {
+                return `${path} cannot be checked`;
+            }
+            if (owner.uid !== 0)
+                return `${path} is not root's`;
+            // A folder with the sticky bit (/tmp) lets nobody replace root's files.
+            if (owner.mode & 0o022 && !(path !== file && owner.mode & 0o1000))
+                return `${path} is writable by others than root`;
+            if (dirname(path) === path)
+                break;
+        }
+    }
+    return null;
+}
+/** Start the server with its secrets on an inherited pipe (never its
+ * environment), as `ids` when given. The pipe is written and closed at once;
+ * nothing else is ever sent on it. */
+export function spawnWithSecrets(command, args, env, secrets, ids) {
+    const child = spawn(command, args, { env, stdio: ["inherit", "inherit", "inherit", "pipe"], ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) });
+    const pipe = child.stdio[SECRETS_FD];
+    pipe?.on("error", () => { });
+    pipe?.end(JSON.stringify(secrets));
+    return child;
 }
 /** What the launcher does when the server child exits: start it again only
  * when it asked to (a committed restore), and only a few times in a row. */
@@ -54,8 +126,11 @@ export function startCloudHome(env = process.env) {
     for (const warning of config.warnings)
         console.warn(`cloud home: ${warning}`);
     const home = env.HOME || "/data";
+    // Who the children run as: `maus` when this starts as root (the image),
+    // else whoever started it (a test, a dev machine).
+    let ids = null;
     if (process.getuid?.() === 0) {
-        const ids = passwdIds(readFileSync("/etc/passwd", "utf8"), SERVICE_USER);
+        ids = passwdIds(readFileSync("/etc/passwd", "utf8"), SERVICE_USER);
         if (!ids)
             throw new Error(`The ${SERVICE_USER} user is missing from this image.`);
         // A new volume is a root-owned mount point. Only the mount point itself
@@ -64,14 +139,32 @@ export function startCloudHome(env = process.env) {
         if (stat.uid !== ids.uid || stat.gid !== ids.gid)
             chownSync(home, ids.uid, ids.gid);
         process.setgroups?.([]);
-        process.setgid(ids.gid);
-        process.setuid(ids.uid);
+        // The volume is prepared as `maus`, so what it creates is theirs.
+        process.setegid(ids.gid);
+        process.seteuid(ids.uid);
+        try {
+            prepareCloudHomeVolume(home, config.machineId);
+        }
+        finally {
+            process.seteuid(0);
+            process.setegid(0);
+        }
+    }
+    else {
+        prepareCloudHomeVolume(home, config.machineId);
     }
-    if (process.getuid?.() === 0)
-        throw new Error("The Cloud home must run as an unprivileged user.");
-    prepareCloudHomeVolume(home, config.machineId);
     const here = dirname(fileURLToPath(import.meta.url));
-    const { server, edge } = cloudHomeChildEnvironments(config, env, home);
+    const edgeBin = env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy";
+    const edgeConfig = env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile";
+    if (ids) {
+        const problem = codeTrustProblem([process.execPath, fileURLToPath(import.meta.url), join(here, "index.js"), edgeBin, edgeConfig], home);
+        if (problem)
+            throw new Error(`This image's code is not safe to run as root: ${problem}. Rebuild it from deploy/fly/Dockerfile.`);
+    }
+    const { server, edge, secrets, dropped } = cloudHomeChildEnvironments(config, env, home);
+    // Names only, never values: what the server does not get from here.
+    if (dropped.length)
+        console.log(`cloud home: not passed to the server: ${dropped.join(", ")}`);
     const children = [];
     let stopping = false;
     const stop = (failed) => {
@@ -87,8 +180,7 @@ export function startCloudHome(env = process.env) {
                 child.kill("SIGKILL"); }, 20_000);
         force.unref();
     };
-    const run = (command, args, childEnv, again) => {
-        const child = spawn(command, args, { env: childEnv, stdio: "inherit" });
+    const watch = (child, again) => {
         children.push(child);
         child.once("error", () => stop(true));
         child.once("exit", (code) => {
@@ -98,7 +190,7 @@ export function startCloudHome(env = process.env) {
         });
     };
     let restarts = 0;
-    const runServer = () => run(process.execPath, [join(here, "index.js")], server, (code) => {
+    const runServer = () => watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
         if (serverExitAction(code, stopping, restarts) !== "restart")
             return false;
         restarts++;
@@ -106,7 +198,7 @@ export function startCloudHome(env = process.env) {
         return true;
     });
     runServer();
-    run(env.OMB_CLOUD_EDGE_BIN || "/usr/local/bin/caddy", ["run", "--config", env.OMB_CLOUD_EDGE_CONFIG || "/app/cloud/Caddyfile", "--adapter", "caddyfile"], edge);
+    watch(spawn(edgeBin, ["run", "--config", edgeConfig, "--adapter", "caddyfile"], { env: edge, stdio: "inherit", ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) }));
     process.once("SIGTERM", () => stop(false));
     process.once("SIGINT", () => stop(false));
 }

package/dist-server/server/cloud-home.js

@@ -12,7 +12,10 @@
 // the machine's bootstrap secret (HMAC-SHA256 over the method, path, a
 // timestamp, a nonce and the body's hash); each valid request opens one
 // ordinary pairing window (sessions.ts: single use, at most ten minutes),
-// which the Admin hands to the person's signed-in desktop app.
+// which the Admin hands to the person's signed-in desktop app. A request for
+// a browser sign-in (the Cloud page's "Use in your browser") names the
+// account that owns this Cloud and opens a window only this machine's web
+// page redeems, for at most two minutes, after showing whose Cloud it is.
 //
 // Cloud Pro includes no AI. The person signs in on the machine with their own
 // Claude or ChatGPT account, or an API key, exactly as on any server; nothing
@@ -33,6 +36,10 @@ export const CLOUD_IGNORED_KEYS = ["OMB_HOSTED_MODEL_URL", "OMB_HOSTED_MODEL_TOK
 export const CLOUD_PAIRING_PATH = "/api/cloud/pairing";
 export const CLOUD_PAIRING_DEFAULT_TTL_S = 300;
 export const CLOUD_PAIRING_MAX_TTL_S = 600;
+/** A browser sign-in's owner: printable ASCII with no space, `<` or `>`, and exactly one `@`. */
+const OWNER_EMAIL = /^[!-;=?A-~]{1,64}@[!-;=?A-~]{1,189}$/;
+/** A browser sign-in is redeemed the moment its tab loads. */
+export const CLOUD_BROWSER_SIGN_IN_MAX_TTL_S = 120;
 /** How far a signed request's timestamp may be from this machine's clock. */
 export const CLOUD_PAIRING_SKEW_S = 300;
 /** How long a used nonce is refused. Longer than the whole accepted window. */
@@ -89,6 +96,9 @@ export function cloudHomeConfiguration(env = process.env) {
         warnings.push(`ignoring ${ignored.join(", ")}: Cloud Pro includes no AI; people sign in with their own Claude or ChatGPT account, or an API key`);
     return { machineId, adminOrigin, publicOrigin, bootstrapSecret, warnings };
 }
+// The secrets and their pipe live in cloud-secrets.ts, which the server
+// reads before anything else (cloud-secrets-boot.ts).
+export { CLOUD_HOME_SECRET_KEYS, CLOUD_SECRETS_FD_ENV, cloudHomeSecrets, takeCloudSecrets, withoutCloudSecrets } from "./cloud-secrets.js";
 /** The environment without a platform gateway's settings (CLOUD_IGNORED_KEYS). */
 export function withoutIgnoredCloudKeys(env) {
     const kept = { ...env };
@@ -115,6 +125,18 @@ export function cloudHomePlaceRefusal(place) {
 export function boatNotConfiguredMessage(cloudHome) {
     return `Cloud Boat is not configured — add a Boat API key or choose ${cloudHome ? "Browser" : "Local VM"}`;
 }
+/** The Cloud's setup checklist (docs/cloud-pro.md) has a "try something"
+ * step that is done once a bot's turn finishes on the machine itself. The
+ * server records when, once, in this Cloud's own onboarding record: that
+ * section never travels with Move to Cloud (workspace-backup-policy.ts), so a
+ * moved-in history of turns does not count. Null when there is nothing to
+ * record: not a Cloud home, already recorded, a failed or stopped turn, or a
+ * thread that is no bot's conversation or room. */
+export function firstCloudTurnPatch(turn) {
+    if (!turn.cloudHome || turn.recorded || !turn.ok || !turn.known)
+        return null;
+    return { onboarding: { firstTurnAt: (turn.now ?? new Date()).toISOString() } };
+}
 /** The Admin's side of the signature (openmaus-cloud cloudPairingSignature). */
 export function cloudPairingSignature(secret, timestamp, nonce, body) {
     const bodyHash = createHash("sha256").update(body).digest("base64url");
@@ -164,18 +186,32 @@ export function createCloudPairing(options) {
             }
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
                 return { status: 400, body: { error: "invalid_body" } };
-            const { label, ttlSeconds } = parsed;
+            const { label, ttlSeconds, purpose, owner } = parsed;
             // oxlint-disable-next-line no-control-regex
             if (label !== undefined && (typeof label !== "string" || label.length > 80 || /[\x00-\x1f\x7f]/.test(label)))
                 return { status: 400, body: { error: "invalid_label" } };
             if (ttlSeconds !== undefined && (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1))
                 return { status: 400, body: { error: "invalid_ttl" } };
-            const ttl = Math.min(ttlSeconds ?? CLOUD_PAIRING_DEFAULT_TTL_S, CLOUD_PAIRING_MAX_TTL_S);
+            if (purpose !== undefined && purpose !== "browser")
+                return { status: 400, body: { error: "invalid_purpose" } };
+            const browser = purpose === "browser";
+            // A browser sign-in names its Cloud's owner (the account's email), which the sign-in page shows before the
+            // person continues: one address in printable ASCII, as the Admin's email schemas allow, with no `<` or `>`.
+            if ((browser || owner !== undefined) && (typeof owner !== "string" || owner.length > 254 || !OWNER_EMAIL.test(owner))) {
+                return { status: 400, body: { error: "invalid_owner" } };
+            }
+            const ttl = Math.min(ttlSeconds ?? CLOUD_PAIRING_DEFAULT_TTL_S, browser ? CLOUD_BROWSER_SIGN_IN_MAX_TTL_S : CLOUD_PAIRING_MAX_TTL_S);
             const opened = sessions.openPairing({
                 scopes: ["admin", "client"],
                 label: typeof label === "string" && label.trim() ? label.trim() : "OMB Cloud",
                 ttlMs: ttl * 1000,
+                browser,
+                ...(browser ? { owner: owner } : {}),
             });
+            // A browser sign-in has no code to type: only its credential redeems it, and saying `purpose` back tells the
+            // Admin this machine made one (a machine from before this ignores `purpose` and opens an ordinary window).
+            if (browser)
+                return { status: 200, body: { credential: opened.credential, expiresAt: opened.expiresAt, purpose: "browser" } };
             return { status: 200, body: { code: formatPairingCode(opened.code), credential: opened.credential, expiresAt: opened.expiresAt } };
         },
     };