openmausbot 0.1.91 → 0.1.92

package/dist-server/server/model-catalog/presets.js

@@ -0,0 +1,176 @@
+// Hand-kept facts about model providers that models.dev does not carry:
+// - which providers we recommend, in what order, and under what name;
+// - a pinned OpenAI-compatible base URL for each (models.dev lists some
+//   providers without one, and a pinned URL means a catalog refresh can never
+//   change where a newly pasted key for a recommended provider is sent);
+// - the Anthropic-compatible endpoint Claude Code can use, where one exists;
+// - whether the provider documents Codex support, and its exceptions;
+// - how to prove a key when the provider's model list is public.
+// Every row was checked by hand on its `checkedAt` date.
+//
+// Codex rules (see codexVerdict): Codex is offered only when the provider's
+// /responses route passed the check AND either the provider documents Codex
+// or the person turned on the experimental switch. Documented exceptions
+// (Fireworks: no MiniMax models, no Fire Pass keys) always apply.
+const CHECKED = "2026-09-30";
+/** The AI SDK package for any OpenAI-compatible base URL. */
+export const OPENAI_COMPATIBLE_NPM = "@ai-sdk/openai-compatible";
+export const PROVIDER_PRESETS = [
+    {
+        id: "openrouter",
+        catalogId: "openrouter",
+        label: "OpenRouter",
+        recommended: 1,
+        api: "https://openrouter.ai/api/v1",
+        anthropic: {
+            baseUrl: "https://openrouter.ai/api",
+            auth: "bearer",
+            doc: "https://openrouter.ai/docs/guides/guides/claude-code-integration",
+        },
+        codex: { kind: "documented", doc: "https://openrouter.ai/docs/cookbook/coding-agents/codex-cli" },
+        // /models is public; /key answers only with a valid key.
+        keyCheck: "/key",
+        publicModels: true,
+        checkedAt: CHECKED,
+    },
+    {
+        id: "fireworks-ai",
+        catalogId: "fireworks-ai",
+        label: "Fireworks AI",
+        recommended: 2,
+        api: "https://api.fireworks.ai/inference/v1",
+        anthropic: {
+            baseUrl: "https://api.fireworks.ai/inference",
+            auth: "bearer",
+            doc: "https://docs.fireworks.ai/tools-sdks/anthropic-compatibility",
+        },
+        codex: {
+            kind: "documented",
+            doc: "https://docs.fireworks.ai/ecosystem/fireconnect/codex",
+            // Fireworks: MiniMax models and Fire Pass keys do not work with Codex.
+            denyModels: /minimax/i,
+            denyKeyPrefixes: ["fpk_"],
+        },
+        checkedAt: CHECKED,
+    },
+    {
+        id: "deepseek",
+        catalogId: "deepseek",
+        label: "DeepSeek",
+        recommended: 3,
+        api: "https://api.deepseek.com",
+        anthropic: { baseUrl: "https://api.deepseek.com/anthropic", doc: "https://api-docs.deepseek.com/guides/anthropic_api" },
+        codex: { kind: "unsupported", reason: "no-responses-api" },
+        checkedAt: CHECKED,
+    },
+    {
+        id: "cline-pass",
+        catalogId: "cline-pass",
+        label: "Cline (ClinePass)",
+        recommended: 4,
+        api: "https://api.cline.bot/api/v1",
+        codex: { kind: "unsupported", reason: "not-supported" },
+        publicModels: true,
+        checkedAt: CHECKED,
+    },
+    {
+        // Cline's pay-as-you-go credits: the same API as ClinePass with a larger,
+        // OpenRouter-style model list. Not in models.dev.
+        id: "cline-credits",
+        label: "Cline (credits)",
+        recommended: 5,
+        api: "https://api.cline.bot/api/v1",
+        env: "CLINE_API_KEY",
+        doc: "https://docs.cline.bot/api/overview",
+        codex: { kind: "unsupported", reason: "not-supported" },
+        publicModels: true,
+        checkedAt: CHECKED,
+    },
+    { id: "groq", catalogId: "groq", label: "Groq", recommended: 6, api: "https://api.groq.com/openai/v1", checkedAt: CHECKED },
+    { id: "togetherai", catalogId: "togetherai", label: "Together AI", recommended: 7, api: "https://api.together.xyz/v1", checkedAt: CHECKED },
+    { id: "mistral", catalogId: "mistral", label: "Mistral", recommended: 8, api: "https://api.mistral.ai/v1", checkedAt: CHECKED },
+    { id: "xai", catalogId: "xai", label: "xAI", recommended: 9, api: "https://api.x.ai/v1", checkedAt: CHECKED },
+    {
+        id: "moonshotai",
+        catalogId: "moonshotai",
+        label: "Moonshot (Kimi)",
+        recommended: 10,
+        api: "https://api.moonshot.ai/v1",
+        anthropic: { baseUrl: "https://api.moonshot.ai/anthropic" },
+        checkedAt: CHECKED,
+    },
+    {
+        id: "zai",
+        catalogId: "zai",
+        label: "Z.ai",
+        recommended: 11,
+        api: "https://api.z.ai/api/paas/v4",
+        anthropic: { baseUrl: "https://api.z.ai/api/anthropic" },
+        checkedAt: CHECKED,
+    },
+    {
+        // models.dev lists MiniMax's Anthropic endpoint as its `api` (with
+        // @ai-sdk/anthropic); the chat engine and OpenCode need the OpenAI one,
+        // and OpenCode needs the matching SDK with it.
+        id: "minimax",
+        catalogId: "minimax",
+        label: "MiniMax",
+        recommended: 12,
+        api: "https://api.minimax.io/v1",
+        npm: OPENAI_COMPATIBLE_NPM,
+        anthropic: { baseUrl: "https://api.minimax.io/anthropic" },
+        chat: "after-check",
+        checkedAt: CHECKED,
+    },
+    { id: "cerebras", catalogId: "cerebras", label: "Cerebras", recommended: 13, api: "https://api.cerebras.ai/v1", checkedAt: CHECKED },
+    {
+        id: "openai",
+        catalogId: "openai",
+        label: "OpenAI",
+        api: "https://api.openai.com/v1",
+        codex: { kind: "documented", doc: "https://github.com/openai/codex" },
+        checkedAt: CHECKED,
+    },
+    {
+        id: "opencode",
+        catalogId: "opencode",
+        label: "OpenCode Zen",
+        api: "https://opencode.ai/zen/v1",
+        anthropic: { baseUrl: "https://opencode.ai/zen" },
+        checkedAt: CHECKED,
+    },
+];
+const BY_ID = new Map(PROVIDER_PRESETS.map((preset) => [preset.id, preset]));
+export function providerPreset(id) {
+    return BY_ID.get(id);
+}
+export function codexKeyAllowed(preset, key) {
+    const codex = preset?.codex;
+    return !(codex?.kind === "documented" && codex.denyKeyPrefixes?.some((prefix) => key.startsWith(prefix)));
+}
+export function codexModelAllowed(preset, model) {
+    const codex = preset?.codex;
+    return !(codex?.kind === "documented" && codex.denyModels?.test(model));
+}
+/** The models Codex may be offered for this provider. */
+export function codexModels(preset, models) {
+    return models.filter((model) => codexModelAllowed(preset, model));
+}
+/** Whether Codex can use a provider. `preset` is undefined for custom providers. */
+export function codexVerdict(input) {
+    const codex = input.preset?.codex;
+    if (codex?.kind === "unsupported") {
+        return { use: "no", reason: codex.reason === "no-responses-api" ? "provider-no-responses-api" : "provider-unsupported" };
+    }
+    if (input.key !== undefined && !codexKeyAllowed(input.preset, input.key))
+        return { use: "no", reason: "key-type" };
+    if (input.responses === "missing")
+        return { use: "no", reason: "route-missing" };
+    if (input.responses === "key-refused")
+        return { use: "no", reason: "key-refused" };
+    if (input.responses !== "works")
+        return { use: "no", reason: "not-checked" };
+    if (codex?.kind === "documented")
+        return { use: "yes" };
+    return input.experimental ? { use: "experimental" } : { use: "no", reason: "experimental-off" };
+}

package/dist-server/server/model-catalog/trim.js

@@ -0,0 +1,219 @@
+// Trims models.dev's api.json down to what OpenMausBot needs and drops
+// anything unsafe to hand to OpenCode. Both the build script that makes the
+// bundled snapshot (scripts/build-model-catalog.mjs) and the runtime refresh
+// (catalog.ts) run their data through trimModelsDevCatalog, so a catalog
+// fetched later passes exactly the same filter as the one we ship.
+//
+// Why braces matter: OpenCode expands `{env:NAME}` and `{file:path}` anywhere
+// in its config text, and writing the brace as { in JSON does not stop it
+// (verified on OpenCode 1.18.27). A provider or model string carrying a brace
+// could make OpenCode read another provider's key or any file the user can
+// read into a model name. So any provider or model with a `{` or `}` in any of
+// its strings (or object keys) is dropped here, before anything else sees it.
+//
+// The trimmed shape keeps models.dev's own field names, so trimming is
+// idempotent: a trimmed catalog passes through unchanged. That lets catalog.ts
+// run every source (our cache, OpenCode's raw cache, the snapshot) through the
+// same function. On disk each model also leaves out `id` (it is the key) and
+// `tool_call` (every kept model has it); packCatalog/unpackCatalog convert,
+// which keeps the shipped snapshot under its 150 KB gzipped budget.
+import { normalizeApiUrl } from "../cli-api-setup.js";
+export const MODEL_CATALOG_SCHEMA = 1;
+// Generous caps: models.dev's largest provider lists about 600 models today.
+const MAX_PROVIDERS = 2_000;
+const MAX_MODELS_PER_PROVIDER = 5_000;
+const MAX_DEPTH = 8;
+const PROVIDER_ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+const ENV_NAME = /^[A-Za-z0-9_]{1,128}$/;
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u001f\u007f]/u;
+const RELEASE_DATE = /^\d{4}-\d{2}(?:-\d{2})?$/;
+/** True when the text holds a brace OpenCode could treat as a substitution. */
+export function hasBrace(value) {
+    return value.includes("{") || value.includes("}");
+}
+/** True when any string or object key inside `value` holds a brace. Values
+ * nested deeper than models.dev ever goes count as unsafe too. */
+export function containsBrace(value, depth = 0) {
+    if (typeof value === "string")
+        return hasBrace(value);
+    if (value === null || typeof value !== "object")
+        return false;
+    if (depth > MAX_DEPTH)
+        return true;
+    if (Array.isArray(value))
+        return value.some((item) => containsBrace(item, depth + 1));
+    return Object.entries(value).some(([key, item]) => hasBrace(key) || containsBrace(item, depth + 1));
+}
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** A map keyed by provider or model id. It has no prototype, so an id such as
+ * `constructor` or `toString` finds nothing unless the catalog lists it, and a
+ * `__proto__` key could not replace the prototype (it is also rejected). */
+const idMap = () => Object.create(null);
+/** Never a real id; as a plain-object key it would set the prototype. */
+const RESERVED_KEY = "__proto__";
+const finite = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+/** A display name: control characters removed, trimmed, capped. */
+function displayName(value, fallback) {
+    if (typeof value !== "string")
+        return fallback;
+    const clean = value.replace(new RegExp(CONTROL.source, "gu"), "").trim().slice(0, 128);
+    return clean || fallback;
+}
+function httpsUrl(value) {
+    if (typeof value !== "string")
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password ? url.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function apiUrl(value) {
+    if (typeof value !== "string")
+        return undefined;
+    try {
+        return normalizeApiUrl(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function trimModel(key, raw) {
+    if (!isRecord(raw))
+        return "invalid";
+    if (raw.id !== undefined && raw.id !== key)
+        return "invalid";
+    // The caller already drops a key with a brace; this is the backstop.
+    if (!key || key.length > 256 || key === RESERVED_KEY || hasBrace(key) || CONTROL.test(key) || /\s/u.test(key))
+        return "invalid";
+    // Only models an agent can drive: current, tool-calling, text in.
+    if (raw.status === "deprecated" || raw.tool_call !== true)
+        return "skip";
+    const modalities = isRecord(raw.modalities) ? raw.modalities : undefined;
+    const input = Array.isArray(modalities?.input)
+        ? modalities.input.filter((item) => typeof item === "string" && item.length <= 32).slice(0, 8)
+        : [];
+    if (!input.includes("text"))
+        return "skip";
+    const model = {
+        id: key,
+        name: displayName(raw.name, key),
+        tool_call: true,
+        reasoning: raw.reasoning === true,
+        attachment: raw.attachment === true,
+        modalities: { input },
+    };
+    if (typeof raw.release_date === "string" && RELEASE_DATE.test(raw.release_date))
+        model.release_date = raw.release_date;
+    const context = finite(isRecord(raw.limit) ? raw.limit.context : undefined);
+    if (context !== undefined)
+        model.limit = { context };
+    if (isRecord(raw.cost)) {
+        const cost = {};
+        for (const field of ["input", "output"]) {
+            const price = finite(raw.cost[field]);
+            if (price !== undefined)
+                cost[field] = price;
+        }
+        if (Object.keys(cost).length)
+            model.cost = cost;
+    }
+    if (raw.status === "alpha" || raw.status === "beta")
+        model.status = raw.status;
+    return model;
+}
+function trimProvider(key, raw, options) {
+    const drop = (reason) => {
+        options.onDrop?.({ provider: key, reason });
+        return undefined;
+    };
+    if (!isRecord(raw))
+        return drop("invalid");
+    // Every provider-level string, not only the fields kept below: a brace
+    // anywhere means the entry was written for a templating system.
+    const { models: rawModels, ...fields } = raw;
+    if (hasBrace(key) || containsBrace(fields))
+        return drop("brace");
+    if (!PROVIDER_ID.test(key) || (raw.id !== undefined && raw.id !== key))
+        return drop("invalid");
+    const env = Array.isArray(raw.env) ? raw.env : [];
+    if (!env.every((name) => typeof name === "string" && ENV_NAME.test(name)))
+        return drop("invalid");
+    const models = idMap();
+    if (isRecord(rawModels)) {
+        let kept = 0;
+        for (const modelKey of Object.keys(rawModels).sort()) {
+            const rawModel = rawModels[modelKey];
+            if (hasBrace(modelKey) || containsBrace(rawModel)) {
+                options.onDrop?.({ provider: key, model: modelKey, reason: "brace" });
+                continue;
+            }
+            const model = trimModel(modelKey, rawModel);
+            if (model === "invalid")
+                options.onDrop?.({ provider: key, model: modelKey, reason: "invalid" });
+            if (typeof model === "string")
+                continue;
+            models[modelKey] = model;
+            if (++kept >= MAX_MODELS_PER_PROVIDER)
+                break;
+        }
+    }
+    // Field order is fixed (models last) so the snapshot text is stable.
+    const provider = { id: key, name: displayName(raw.name, key), env: env.slice(0, 8) };
+    if (typeof raw.npm === "string" && raw.npm.length <= 214 && !CONTROL.test(raw.npm))
+        provider.npm = raw.npm;
+    const api = apiUrl(raw.api);
+    if (api)
+        provider.api = api;
+    const doc = httpsUrl(raw.doc);
+    if (doc)
+        provider.doc = doc;
+    return { ...provider, models };
+}
+/** models.dev api.json (or an already-trimmed catalog) → the trimmed,
+ * brace-free provider map, sorted by provider and model id. Anything that is
+ * not an object yields an empty map. The provider map and every model map
+ * have no prototype, so looking up an id the catalog lacks gives undefined. */
+export function trimModelsDevCatalog(raw, options = {}) {
+    const providers = idMap();
+    if (!isRecord(raw))
+        return providers;
+    for (const key of Object.keys(raw).sort().slice(0, MAX_PROVIDERS)) {
+        const provider = trimProvider(key, raw[key], options);
+        if (provider)
+            providers[key] = provider;
+    }
+    return providers;
+}
+/** Counts for logs and the build script's report. */
+export function catalogStats(providers) {
+    let models = 0;
+    for (const provider of Object.values(providers))
+        models += Object.keys(provider.models).length;
+    return { providers: Object.keys(providers).length, models };
+}
+/** The on-disk form of a trimmed catalog. */
+export function packCatalog(providers) {
+    return Object.fromEntries(Object.entries(providers).map(([id, provider]) => [id, {
+            ...provider,
+            models: Object.fromEntries(Object.entries(provider.models).map(([modelId, model]) => {
+                const { id: _id, tool_call: _toolCall, ...stored } = model;
+                return [modelId, stored];
+            })),
+        }]));
+}
+/** A stored catalog back in models.dev's shape, ready for trimModelsDevCatalog.
+ * It only restores the two packed fields; trimming still validates the rest. */
+export function unpackCatalog(stored) {
+    if (!isRecord(stored))
+        return stored;
+    return Object.fromEntries(Object.entries(stored).map(([id, provider]) => {
+        if (!isRecord(provider) || !isRecord(provider.models))
+            return [id, provider];
+        const models = Object.fromEntries(Object.entries(provider.models).map(([modelId, model]) => [modelId, isRecord(model) ? { ...model, id: modelId, tool_call: true } : model]));
+        return [id, { ...provider, models }];
+    }));
+}

package/dist-server/server/provider-key-check.js

@@ -1,6 +1,8 @@
-export const PROVIDER_KEY_KINDS = ["anthropic", "openaiCompat", "xai", "mistral"];
+export const PROVIDER_KEY_KINDS = ["anthropic", "openai", "openrouter", "openaiCompat", "xai", "mistral"];
 const DEFAULT_URLS = {
     anthropic: "https://api.anthropic.com",
+    openai: "https://api.openai.com/v1",
+    openrouter: "https://openrouter.ai/api/v1",
     openaiCompat: "https://openrouter.ai/api/v1",
     xai: "https://api.x.ai/v1",
     mistral: "https://api.mistral.ai/v1",
@@ -44,7 +46,7 @@ export async function checkProviderKey(input, fetchImpl = fetch, timeoutMs = 10_
     if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url.hostname))) {
         return { ok: false, reason: "unexpected" };
     }
-    const authenticate = input.provider === "openaiCompat"
+    const authenticate = (input.provider === "openaiCompat" || input.provider === "openrouter")
         && url.origin === "https://openrouter.ai" && url.pathname === "/api/v1/models";
     if (authenticate)
         url.pathname = "/api/v1/key";

package/dist-server/server/recent-work.js

@@ -64,7 +64,7 @@ export function recentWorkLines(threads, latest) {
 }
 /** The bot's recent work outside the conversation it is in now. */
 export function recentWork(store, bot, opts) {
-    const threads = botThreads(store, bot, opts.userName).filter((thread) => thread.threadId !== opts.currentThreadId);
+    const threads = botThreads(store, bot, opts.userName).filter((thread) => thread.threadId !== opts.currentThreadId && (!opts.include || opts.include(thread.threadId)));
     if (!threads.length)
         return [];
     const since = (opts.now ?? Date.now()) - (opts.windowMs ?? RECENT_WORK_WINDOW_MS);

package/dist-server/server/request-auth.js

@@ -60,6 +60,9 @@ export function serviceAllowed(method, path) {
 export function resolveLoopbackTrust(input) {
     const raw = (input.env ?? process.env).OMB_LOOPBACK_TRUST;
     const requested = raw?.trim().toLowerCase();
+    if (input.cloudHome) {
+        return { trust: "service", reason: "OMB Cloud home", ...(raw !== undefined && requested !== "service" ? { warning: "OMB_LOOPBACK_TRUST is ignored on an OMB Cloud home: a local request is always a service" } : {}) };
+    }
     if (input.desktopManaged) {
         return { trust: "owner", reason: "desktop app", ...(raw !== undefined ? { warning: "OMB_LOOPBACK_TRUST is ignored in the desktop app" } : {}) };
     }
@@ -156,6 +159,14 @@ export function isSameOrigin(req) {
     const own = requestOrigin(req);
     return own !== null && origin.trim().toLowerCase() === own;
 }
+/** A browser says this request came from this origin's own page: an
+ * `Origin` equal to this request's origin, or `Sec-Fetch-Site: same-origin`.
+ * Unlike isSameOrigin, a request that carries neither does not pass. */
+export function provesSameOrigin(req) {
+    if (headerValue(req.headers.origin))
+        return isSameOrigin(req);
+    return headerValue(req.headers["sec-fetch-site"])?.trim().toLowerCase() === "same-origin";
+}
 /** Who to count a pairing attempt against. The server binds loopback, so a
  * remote client always arrives through a proxy or tunnel on this machine;
  * that proxy's X-Forwarded-For (Caddy overwrites any the client sent) names
@@ -266,6 +277,7 @@ export const CLIENT_ALLOW = [
     { methods: ["DELETE"], path: /^\/api\/bots\/[\w-]+\/queue\/[\w-]+$/ },
     { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/tasks$/ },
     { methods: ["POST", "PATCH", "DELETE"], path: /^\/api\/bots\/[\w-]+\/tasks\/[\w-]+$/ },
+    { methods: ["POST"], path: /^\/api\/bots\/[\w-]+\/tasks\/[\w-]+\/title$/ }, // Regenerate title: a rename by the bot's own engine
     { methods: ["PATCH"], path: /^\/api\/bots\/[\w-]+\/profile$/ },
     { methods: ["PATCH"], path: /^\/api\/bots\/[\w-]+$/ }, // display fields only: see clientBotPatchViolation
     // approvals and cards
@@ -349,6 +361,10 @@ function mutatingPublicRoute(method, path) {
     if (upper === "GET" &&
         /^\/api\/bots\/[\w-]+\/connector-cards\/[\w-]+\/status$/.test(path))
         return true;
+    // Remote viewer config and its WebSocket upgrade hand out a desktop's VNC
+    // password and control. Native owners open the direct viewer instead.
+    if (path.startsWith("/api/desktop-viewer/"))
+        return true;
     if (["GET", "HEAD", "OPTIONS"].includes(upper))
         return false;
     // Agent integrations have their own high-entropy, per-boot authorization
@@ -394,6 +410,13 @@ export function resolveRequestAuth(req, options) {
     if (session && via) {
         if (via === "cookie" && !isSameOrigin(req))
             return deny(403, "forbidden: cross-origin request");
+        // A browser sign-in's session is its browser's cookie, never a bearer token, and
+        // its changes come from this origin's own page, which a browser says so.
+        if (via === "bearer" && session.cookieOnly)
+            return deny(401, "unauthorized: this session belongs to a browser; sign in with a pairing code");
+        if (via === "cookie" && session.cookieOnly && !["GET", "HEAD", "OPTIONS"].includes(method) && !provesSameOrigin(req)) {
+            return deny(403, "forbidden: this browser's session makes changes only from its own page");
+        }
         const needed = requiredScope(method, path, options.features ?? {});
         if (!session.scopes.includes(needed)) {
             return deny(403, `forbidden: this session lacks the ${needed} scope`);

package/dist-server/server/routes/antigravity-leftovers.js

@@ -0,0 +1,45 @@
+import { HOSTED_PROVIDER_SETTINGS_ERROR } from "../hosted-models.js";
+import { PASS } from "./table.js";
+const ROUTE = /^\/api\/instances\/([\w.-]+)\/leftover-files(\/remove)?$/u;
+export const BUSY_LEFTOVER_ERROR = "Already looking for leftover files. Try again in a moment.";
+export function createAntigravityLeftoverRoutes(deps) {
+    // One scan or delete at a time: both walk thousands of files.
+    let busy = false;
+    return async ({ req, res, path, method, json, readBody }) => {
+        const match = ROUTE.exec(path);
+        if (!match)
+            return PASS;
+        const removing = Boolean(match[2]);
+        if (method !== (removing ? "POST" : "GET"))
+            return PASS;
+        if (deps.hosted)
+            return json(res, 403, { error: HOSTED_PROVIDER_SETTINGS_ERROR });
+        if (removing) {
+            // Same non-simple-request gate as the other instance actions.
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            await readBody(req, 4096);
+        }
+        if (!deps.isAntigravity(match[1]))
+            return json(res, 404, { error: "Only Antigravity has leftover files to clear." });
+        if (busy)
+            return json(res, 409, { error: BUSY_LEFTOVER_ERROR });
+        busy = true;
+        res.setHeader("cache-control", "no-store");
+        try {
+            if (!removing) {
+                const scan = await deps.find();
+                return json(res, 200, { bytes: scan.bytes, folders: scan.folders.length, complete: scan.complete });
+            }
+            const removed = await deps.remove();
+            return json(res, 200, { freedBytes: removed.freedBytes, removed: removed.removed, remaining: removed.remaining });
+        }
+        catch (error) {
+            return json(res, 500, { error: error instanceof Error ? error.message : String(error) });
+        }
+        finally {
+            busy = false;
+        }
+    };
+}

package/dist-server/server/routes/bot-memory.js

@@ -41,6 +41,7 @@ export function createBotMemoryRoutes(deps) {
     return async ({ req, res, url, path, method, auth, json, readBody }) => {
         /** scratch for route matches, shared by every `path.match` below */
         let m = null;
+        const write = (botId, change) => deps.ownersWrite ? deps.ownersWrite(auth, botId, change) : change();
         m = path.match(/^\/api\/bots\/([\w-]+)\/memory$/);
         if (m && method === "GET") {
             if (!deps.bot(m[1]))
@@ -49,7 +50,9 @@ export function createBotMemoryRoutes(deps) {
                 const overview = memoryOverview(m[1]);
                 // `text` and `truncated` ride along one release for clients of the
                 // old whole-file shape; the panel reads the file through /memory/file
-                return json(res, 200, { ...overview, text: readMemoryDoc(m[1], MEMORY_INDEX).text, truncated: overview.index.truncated });
+                const review = deps.lendingReview?.needed(m[1]);
+                return json(res, 200, { ...overview, text: readMemoryDoc(m[1], MEMORY_INDEX).text, truncated: overview.index.truncated,
+                    ...(review ? { lendingReview: review } : {}) });
             }
             catch (error) {
                 return replyMemoryError(res, error);
@@ -65,7 +68,8 @@ export function createBotMemoryRoutes(deps) {
             if (!parsed.success)
                 return json(res, 400, { error: "text must be a string" });
             try {
-                const { doc } = journalMemoryWrite(m[1], MEMORY_INDEX, parsed.data.text, { actor: "person", via: "api" });
+                const botId = m[1];
+                const { doc } = write(botId, () => journalMemoryWrite(botId, MEMORY_INDEX, parsed.data.text, { actor: "person", via: "api" }));
                 return json(res, 200, { ok: true, hash: doc.hash, truncated: memoryCapacity(doc.text).truncated });
             }
             catch (error) {
@@ -76,6 +80,24 @@ export function createBotMemoryRoutes(deps) {
                 return replyMemoryError(res, error);
             }
         }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/reviewed$/);
+        if (m && method === "POST" && deps.lendingReview) {
+            if (!deps.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            if (!deps.lendingReview.owner(auth)) {
+                return json(res, 403, { error: "Only the owner of this Cloud can review this bot's memory, from one of their own devices." });
+            }
+            // Bound to what the owner was shown: the token names the files exactly
+            // as the panel read them. Anything changed since is shown again.
+            const parsed = z.object({ token: z.string().regex(/^[a-f0-9]{64}$/) }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "token is required: the lendingReview token the Memory panel was shown" });
+            if (!deps.lendingReview.accept(m[1], parsed.data.token)) {
+                return json(res, 409, { error: "This bot's memory changed since you looked. Review it again.", code: "changed",
+                    lendingReview: deps.lendingReview.needed(m[1]) });
+            }
+            return json(res, 200, { ok: true, lendingReview: false });
+        }
         m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/file$/);
         if (m && method === "GET") {
             if (!deps.bot(m[1]))
@@ -96,11 +118,12 @@ export function createBotMemoryRoutes(deps) {
             if (!parsed.success)
                 return json(res, 400, { error: "text must be a string; path and expectedHash are optional strings" });
             try {
-                const { doc, entry } = journalMemoryWrite(m[1], parsed.data.path, parsed.data.text, {
+                const botId = m[1];
+                const { doc, entry } = write(botId, () => journalMemoryWrite(botId, parsed.data.path, parsed.data.text, {
                     actor: "person",
                     via: "ui",
                     expectedHash: parsed.data.expectedHash,
-                });
+                }));
                 return json(res, 200, { ok: true, ...doc, entry: entry ? journalEntryForClient(m[1], entry) : null, overview: memoryOverview(m[1]) });
             }
             catch (error) {
@@ -112,7 +135,8 @@ export function createBotMemoryRoutes(deps) {
                 return json(res, 404, { error: "no such bot" });
             const file = url.searchParams.get("path") ?? "";
             try {
-                const entry = journalMemoryDelete(m[1], file, { actor: "person", via: "ui" });
+                const botId = m[1];
+                const entry = write(botId, () => journalMemoryDelete(botId, file, { actor: "person", via: "ui" }));
                 return json(res, 200, { ok: true, path: file, entry: entry ? journalEntryForClient(m[1], entry) : null, overview: memoryOverview(m[1]) });
             }
             catch (error) {
@@ -134,7 +158,8 @@ export function createBotMemoryRoutes(deps) {
             if (!deps.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
             await flushMemoryJournal(m[1]);
-            const result = revertMemoryChange(m[1], m[2]);
+            const botId = m[1], changeId = m[2];
+            const result = write(botId, () => revertMemoryChange(botId, changeId));
             if (!result.ok)
                 return json(res, result.status, { error: result.error });
             return json(res, 200, { ok: true, ...result.doc, entry: result.entry ? journalEntryForClient(m[1], result.entry) : null, overview: memoryOverview(m[1]) });