openmausbot 0.1.91 → 0.1.92

package/dist-server/server/webhooks.js

@@ -51,6 +51,10 @@ const storedWebhookSchema = z.object({
     updatedAt: z.number().finite().nonnegative(),
     lastReceivedAt: z.number().finite().nonnegative().optional(),
     lastRunId: z.string().optional(),
+    /** delivery:"post" only: the stable destination thread, resolved once
+     *  via WebhookManagerOptions.resolvePostThread and reused forever
+     *  after -- see the `post`/`resolvePostThread` doc comments above. */
+    resultsThreadId: z.string().min(1).optional(),
     deliveryCount: z.number().int().nonnegative(),
     verificationPending: z.boolean().optional(),
     verifiedAt: z.number().finite().nonnegative().optional(),
@@ -429,9 +433,22 @@ export class WebhookManager {
             // without a post sink is a configuration error, not a run request.
             if (!this.options.post)
                 fail(503, "This server cannot post webhook messages to chat");
+            // Resolved on every dispatch, exactly like routines.ts's newRun calls
+            // resolveResultsThread on every run -- the resolver owns the
+            // reuse-vs-allocate decision from trigger.resultsThreadId, so a host
+            // without resolvePostThread wired can only fail closed here, never
+            // silently fall back to whatever thread the bot happens to have
+            // selected right now (the bug this replaces -- issue #2071).
+            const threadId = this.options.resolvePostThread?.(trigger, false);
+            if (!threadId)
+                fail(503, "This server could not resolve a destination thread for this delivery");
+            if (threadId !== trigger.resultsThreadId) {
+                trigger.resultsThreadId = threadId;
+                trigger.updatedAt = now;
+            }
             const raw = event.payload;
             const text = raw && typeof raw === "object" && typeof raw.text === "string" && raw.text.trim() ? raw.text : serializePayload(event.payload);
-            this.options.post(trigger.botId, text.slice(0, 20000));
+            this.options.post(trigger.botId, threadId, text.slice(0, 20000));
             this.deliveries.push({ key: `${trigger.endpointId}:${deliveryId}`, runId: "post", at: now });
             if (this.deliveries.length > MAX_DELIVERIES)
                 this.deliveries.splice(0, this.deliveries.length - MAX_DELIVERIES);

package/dist-server/server/workspace-backup-policy.js

@@ -41,6 +41,9 @@ export function excludedWorkspaceAuthPath(path) {
     // Machine/provider-specific execution grants are not portable template data.
     if (/^command-allowlist\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path))
         return true;
+    // MCP sign-in tokens belong to this machine's browser sign-ins.
+    if (/^mcp-oauth\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path))
+        return true;
     return /^(?:(?:providers|caddy|chrome-profile|\.agent-browser)(?:\/|$)|workspace-credentials\.json$|external-runtimes\.json$|browser-engine-key$)/.test(path) ||
         /^(?:config\.json|webhooks\.json|workspace-credentials\.json|external-runtimes\.json|browser-engine-key|sessions\.json|tunnel-account\.json)\.\d+(?:\.[0-9a-f-]+)?\.tmp$/.test(path) ||
         /^(?:vm-home|vm-homes\/[^/]+)\/\.browser-profiles(?:\/|$)/.test(path);

package/dist-server/server/workspace-backup.js

@@ -29,6 +29,9 @@ const EXCLUDED = new Set([
     // This machine's decision-model log (server/decider/log.ts): local
     // measurement of what the classifier picked, not workspace data.
     "decider-log",
+    // A Cloud home's record of who its owner was (server/cloud-owner.ts): this
+    // machine's own, kept in place by a restore, which settles what it brought.
+    "cloud-owner.json",
 ]);
 const EXCLUSION_NOTES = [
     "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",

package/dist-server/server/workspace.js

@@ -8,7 +8,7 @@
 // memory/ holds topic files the bot reads on demand with its ordinary
 // file tools. Plain markdown on purpose — the user can open, edit, or
 // delete anything the bot believes.
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { isMemoryDate, untilMark, withoutExpired } from "./memory-entries.js";
@@ -58,6 +58,53 @@ export function ensureWorkspace(botId) {
 export function workspaceDir(botId) {
     return join(WORKSPACES_DIR, botId);
 }
+/** On an OMB Cloud home a bot's memory is read only from regular files,
+ * never through a link: server/lending-memory.ts judges a link by where it
+ * points, not by what is there, so a turn must never read through one.
+ * Elsewhere memory reads exactly as it always did. */
+let regularMemoryFilesOnly = false;
+export function readMemoryOnlyFromRegularFiles() {
+    regularMemoryFilesOnly = true;
+}
+/** A memory file's text. Throws like readFileSync when it cannot be read,
+ * and, on a Cloud home, when it is not a regular file. */
+export function readMemoryText(path) {
+    if (!regularMemoryFilesOnly)
+        return readFileSync(path, "utf8");
+    // O_NOFOLLOW refuses a link at open where there is one; Windows has none
+    // (and opens what a link points at), so the entry is looked at first too.
+    if (!lstatSync(path).isFile())
+        throw Object.assign(new Error(`not a regular file: ${path}`), { code: "EINVAL" });
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        if (!fstatSync(fd).isFile())
+            throw Object.assign(new Error(`not a regular file: ${path}`), { code: "EINVAL" });
+        return readFileSync(fd, "utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** A memory folder's entries; on a Cloud home, none when the folder itself
+ * is a link. */
+function memoryFolderEntries(dir) {
+    if (regularMemoryFilesOnly && !lstatSync(dir).isDirectory())
+        return [];
+    return readdirSync(dir);
+}
+function regularFile(path) {
+    try {
+        return lstatSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** The stat a listing trusts: on a Cloud home, the entry's own (a link is
+ * not a file); elsewhere what it points at, as before. */
+function memoryEntryStat(path) {
+    return regularMemoryFilesOnly ? lstatSync(path) : statSync(path);
+}
 /** File locations, not file contents or wider tool permissions. Threads keep
  * independent working directories; the same bot can find its earlier output
  * without assuming that a file absent from the current directory was lost. */
@@ -89,7 +136,7 @@ export function memoryOverBudget(text) {
 export function loadMemory(botId, opts = {}) {
     let raw;
     try {
-        raw = readFileSync(join(workspaceDir(botId), "MEMORY.md"), "utf8");
+        raw = readMemoryText(join(workspaceDir(botId), "MEMORY.md"));
     }
     catch {
         return null;
@@ -128,7 +175,7 @@ export const MEMORY_FILE_MAX_BYTES = 256 * 1024;
 export function readMemoryFile(botId) {
     let raw;
     try {
-        raw = readFileSync(join(workspaceDir(botId), "MEMORY.md"), "utf8");
+        raw = readMemoryText(join(workspaceDir(botId), "MEMORY.md"));
     }
     catch {
         return { text: "", truncated: false };
@@ -159,7 +206,7 @@ function indexWrittenMemoryFile(botId, relativePath) {
     try {
         const path = join(workspaceDir(botId), relativePath);
         const stat = statSync(path);
-        indexMemoryFile(botId, relativePath, searchableMemoryText(relativePath, readFileSync(path, "utf8")), { mtimeMs: stat.mtimeMs, bytes: stat.size });
+        indexMemoryFile(botId, relativePath, searchableMemoryText(relativePath, readMemoryText(path)), { mtimeMs: stat.mtimeMs, bytes: stat.size });
     }
     catch {
         // the next search's sync pass picks it up
@@ -176,7 +223,7 @@ function memoryFilesOnDisk(botId) {
     ];
     return names.flatMap((relativePath) => {
         try {
-            const stat = statSync(join(dir, relativePath));
+            const stat = memoryEntryStat(join(dir, relativePath));
             return stat.isFile() ? [{ path: relativePath, mtimeMs: stat.mtimeMs, bytes: stat.size }] : [];
         }
         catch {
@@ -206,7 +253,7 @@ export function syncMemoryIndex(botId) {
         if (!dateChanged && known && known.bytes === file.bytes && known.mtimeMs === Math.trunc(file.mtimeMs))
             continue;
         try {
-            const text = readFileSync(join(workspaceDir(botId), file.path), "utf8");
+            const text = readMemoryText(join(workspaceDir(botId), file.path));
             indexMemoryFile(botId, file.path, searchableMemoryText(file.path, text), file);
         }
         catch {
@@ -318,7 +365,7 @@ export function updateMemory(botId, update, opts = {}) {
     const dir = ensureWorkspace(botId);
     // Do not use readMemoryFile's editor-friendly missing/read-error fallback:
     // a failed read must never turn into a successful overwrite of old notes.
-    const raw = readFileSync(join(dir, "MEMORY.md"), "utf8");
+    const raw = readMemoryText(join(dir, "MEMORY.md"));
     const current = raw === MEMORY_SEED ? "" : raw;
     const today = memoryDate(opts.now);
     // Every appended entry ends its own line; a file the person left without
@@ -419,7 +466,7 @@ export function appendMemoryLog(botId, text, opts = {}) {
     const path = join(dir, file);
     let current = "";
     try {
-        current = readFileSync(path, "utf8");
+        current = readMemoryText(path);
     }
     catch {
         // first line of the day
@@ -442,7 +489,8 @@ export function writeMemoryLog(botId, name, text) {
 /** The bot's daily log files, oldest first, by day name. */
 export function listMemoryLogs(botId) {
     try {
-        return readdirSync(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR)).filter((name) => LOG_FILE_NAME.test(name)).sort();
+        const dir = join(workspaceDir(botId), "memory", MEMORY_LOG_DIR);
+        return memoryFolderEntries(dir).filter((name) => LOG_FILE_NAME.test(name) && (!regularMemoryFilesOnly || regularFile(join(dir, name)))).sort();
     }
     catch {
         return [];
@@ -453,7 +501,7 @@ export function readMemoryLog(botId, name) {
     if (!LOG_FILE_NAME.test(name))
         return null;
     try {
-        return readFileSync(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR, name), "utf8");
+        return readMemoryText(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR, name));
     }
     catch {
         return null;
@@ -472,7 +520,7 @@ export function isMemoryTopicName(name) {
 export function listMemoryTopics(botId) {
     let entries;
     try {
-        entries = readdirSync(join(workspaceDir(botId), "memory"));
+        entries = memoryFolderEntries(join(workspaceDir(botId), "memory"));
     }
     catch {
         return [];
@@ -481,7 +529,7 @@ export function listMemoryTopics(botId) {
         .filter(isMemoryTopicName)
         .flatMap((name) => {
         try {
-            const stat = statSync(join(workspaceDir(botId), "memory", name));
+            const stat = memoryEntryStat(join(workspaceDir(botId), "memory", name));
             return stat.isFile() ? [{ name, bytes: stat.size }] : [];
         }
         catch {
@@ -507,7 +555,7 @@ export function readMemoryTopic(botId, name) {
     if (!isMemoryTopicName(name))
         return null;
     try {
-        return readFileSync(join(workspaceDir(botId), "memory", name), "utf8");
+        return readMemoryText(join(workspaceDir(botId), "memory", name));
     }
     catch {
         return null;
@@ -541,12 +589,14 @@ export function memoryTopicIndex(botId) {
     const dir = join(workspaceDir(botId), "memory");
     return renderTopicIndex(listMemoryTopics(botId).map((topic) => ({ name: topic.name, header: parseTopicHeader(readTopicHead(join(dir, topic.name))) })));
 }
-/** The memory block appended to a bot's system prompt. Always present for
- * bots with a workspace, so the bot knows the mechanism exists even before
+/** The memory block appended to a bot's system prompt when enabled. Present for
+ * enabled bots with a workspace, so the bot knows the mechanism exists even before
  * it has written anything. Content from other bots or imported files must
  * never be recorded as fact — memory is a prompt-injection persistence
  * vector the moment a bot copies untrusted text into it. */
 export function memorySystemPrompt(botId, opts = {}) {
+    if (opts.enabled === false)
+        return "";
     const memory = loadMemory(botId);
     const memoryFile = join(workspaceDir(botId), "MEMORY.md");
     const topicDir = join(workspaceDir(botId), "memory");

package/dist-server/shared/workspace-backup-client.js

@@ -7,6 +7,7 @@ export const WORKSPACE_BACKUP_CLIENT_KEYS = [
     "omb-draft-channel-modes",
     "omb-skin",
     "omb-show-threads",
+    "omb-show-run-card",
     "openmausbot.sidebarDensity",
     "openmausbot.sidebarCollapsedSections.v1",
     "openmausbot.sidebarSectionOrder.v1",

package/dist-server/src/lib/citations.js

@@ -0,0 +1,177 @@
+// Selection matching is adapted from T3 Code's assistantTextSelection.ts
+// (Copyright 2026 T3 Tools Inc., MIT License; see third_party/t3-code/LICENSE).
+export const CITATION_MAX_QUOTE_LENGTH = 12_000;
+export const CITATION_MAX_COMMENT_LENGTH = 4_000;
+const CITATION_CONTEXT_LENGTH = 64;
+const CITATION_MARKER = "<!--omb-citation-v1:";
+const CITATION_MARKER_RE = /<!--omb-citation-v1:([A-Za-z0-9_-]{1,100000})-->/g;
+function boundedString(value, max, allowEmpty = false) {
+    return typeof value === "string" && value.length <= max && (allowEmpty || value.length > 0);
+}
+export function isCitationAttachment(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const citation = value;
+    const source = citation.source;
+    return citation.kind === "citation" &&
+        citation.version === 1 &&
+        boundedString(citation.id, 200) &&
+        boundedString(citation.quote, CITATION_MAX_QUOTE_LENGTH) &&
+        (citation.comment === undefined || boundedString(citation.comment, CITATION_MAX_COMMENT_LENGTH, true)) &&
+        typeof citation.size === "number" && Number.isFinite(citation.size) && citation.size >= 0 &&
+        Boolean(source) &&
+        (source.ownerType === "bot" || source.ownerType === "group") &&
+        boundedString(source.ownerId, 200) &&
+        boundedString(source.threadId, 200) &&
+        boundedString(source.messageId, 200) &&
+        Number.isSafeInteger(source.start) && Number(source.start) >= 0 &&
+        Number.isSafeInteger(source.end) && Number(source.end) >= Number(source.start) &&
+        boundedString(source.prefix, CITATION_CONTEXT_LENGTH, true) &&
+        boundedString(source.suffix, CITATION_CONTEXT_LENGTH, true);
+}
+function newId() {
+    return globalThis.crypto?.randomUUID?.() ?? `c${Math.random().toString(36).slice(2)}`;
+}
+function byteLength(text) {
+    return new TextEncoder().encode(text).length;
+}
+export function citationAttachment(source, selector, comment = "") {
+    const trimmedComment = comment.trim();
+    if (!selector.text.trim() || selector.text.length > CITATION_MAX_QUOTE_LENGTH) {
+        throw new Error("Citation quote is empty or too long");
+    }
+    if (trimmedComment.length > CITATION_MAX_COMMENT_LENGTH)
+        throw new Error("Citation comment is too long");
+    return {
+        kind: "citation",
+        version: 1,
+        id: newId(),
+        quote: selector.text,
+        ...(trimmedComment ? { comment: trimmedComment } : {}),
+        source: { ...source, start: selector.start, end: selector.end, prefix: selector.prefix, suffix: selector.suffix },
+        size: byteLength(selector.text) + byteLength(trimmedComment),
+    };
+}
+export function withCitationComment(citation, comment) {
+    const trimmed = comment.trim();
+    if (trimmed.length > CITATION_MAX_COMMENT_LENGTH)
+        throw new Error("Citation comment is too long");
+    const { comment: _old, ...rest } = citation;
+    return { ...rest, ...(trimmed ? { comment: trimmed } : {}), size: byteLength(citation.quote) + byteLength(trimmed) };
+}
+function base64UrlEncode(value) {
+    const bytes = new TextEncoder().encode(JSON.stringify(value));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    return JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (character) => character.charCodeAt(0))));
+}
+/** Readable in clients without citation UI and unambiguous to model providers. */
+export function citationFallback(citation) {
+    const quote = citation.quote.split("\n").map((line) => `> ${line}`).join("\n");
+    return `> Quoted message:\n${quote}${citation.comment ? `\n\nComment:\n${citation.comment}` : ""}`;
+}
+export function serializeCitation(citation) {
+    return `${CITATION_MARKER}${base64UrlEncode(citation)}-->\n${citationFallback(citation)}`;
+}
+export function splitTranscriptCitations(text) {
+    const citations = [];
+    let display = "";
+    let cursor = 0;
+    for (const match of text.matchAll(CITATION_MARKER_RE)) {
+        if (match.index < cursor)
+            continue;
+        let citation;
+        try {
+            const decoded = base64UrlDecode(match[1]);
+            if (!isCitationAttachment(decoded))
+                continue;
+            citation = decoded;
+        }
+        catch {
+            continue;
+        }
+        const block = `${match[0]}\n${citationFallback(citation)}`;
+        if (!text.startsWith(block, match.index))
+            continue;
+        display += text.slice(cursor, match.index);
+        cursor = match.index + block.length;
+        citations.push(citation);
+    }
+    return { display: `${display}${text.slice(cursor)}`.trim(), citations };
+}
+export function citationPreviewText(text) {
+    const cited = splitTranscriptCitations(text);
+    if (!cited.citations.length)
+        return text;
+    return [
+        cited.display,
+        ...cited.citations.map((citation) => citation.comment
+            ? `${citation.quote} — ${citation.comment}`
+            : citation.quote),
+    ].filter(Boolean).join(" ");
+}
+function normalizeWhitespace(text) {
+    return text.replace(/\s+/g, " ");
+}
+function splitsSurrogatePair(text, offset) {
+    const before = text.charCodeAt(offset - 1);
+    const after = text.charCodeAt(offset);
+    return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff;
+}
+export function createCitationTextSelector(text, rawStart, rawEnd) {
+    const quote = text.slice(rawStart, rawEnd);
+    if (!quote.trim())
+        return null;
+    const normalized = normalizeWhitespace(text);
+    let start = normalizeWhitespace(text.slice(0, rawStart)).length;
+    if (rawStart > 0 && /\s/.test(text[rawStart - 1]) && /\s/.test(text[rawStart]))
+        start -= 1;
+    const end = normalizeWhitespace(text.slice(0, rawEnd)).length;
+    let prefixStart = Math.max(0, start - CITATION_CONTEXT_LENGTH);
+    let suffixEnd = Math.min(normalized.length, end + CITATION_CONTEXT_LENGTH);
+    if (splitsSurrogatePair(normalized, prefixStart))
+        prefixStart += 1;
+    if (splitsSurrogatePair(normalized, suffixEnd))
+        suffixEnd -= 1;
+    return {
+        text: quote,
+        start,
+        end,
+        prefix: normalized.slice(prefixStart, start),
+        suffix: normalized.slice(end, suffixEnd),
+    };
+}
+export function findCitationText(text, selector) {
+    const normalized = normalizeWhitespace(text);
+    const quote = normalizeWhitespace(selector.text);
+    if (!quote.trim())
+        return null;
+    const prefix = normalizeWhitespace(selector.prefix);
+    const suffix = normalizeWhitespace(selector.suffix);
+    const matchesContext = (start, end) => normalized.slice(Math.max(0, start - prefix.length), start) === prefix &&
+        normalized.slice(end, end + suffix.length) === suffix;
+    let match = Number.isSafeInteger(selector.start) && Number.isSafeInteger(selector.end) &&
+        selector.start >= 0 && selector.end - selector.start === quote.length &&
+        normalized.slice(selector.start, selector.end) === quote && matchesContext(selector.start, selector.end)
+        ? { start: selector.start, end: selector.end }
+        : null;
+    let onlyQuote = null;
+    let quoteCount = 0;
+    for (let start = normalized.indexOf(quote); start !== -1; start = normalized.indexOf(quote, start + 1)) {
+        const end = start + quote.length;
+        quoteCount += 1;
+        onlyQuote = { start, end };
+        if (!matchesContext(start, end))
+            continue;
+        if (match && match.start !== start)
+            return null;
+        match = { start, end };
+    }
+    return match ?? (quoteCount === 1 ? onlyQuote : null);
+}

package/dist-server/src/lib/composer-attachments.js

@@ -1,7 +1,10 @@
+import { isCitationAttachment, serializeCitation } from "./citations.js";
 export function isAttachment(value) {
     if (!value || typeof value !== "object")
         return false;
     const attachment = value;
+    if (attachment.kind === "citation")
+        return isCitationAttachment(value);
     if (typeof attachment.id !== "string" || !validSize(attachment.size))
         return false;
     if (attachment.kind === "paste") {
@@ -362,7 +365,10 @@ export function formatSize(bytes) {
 export function composeMessage(text, attachments) {
     const parts = [text.trim()];
     attachments.forEach((a, i) => {
-        if (a.kind === "paste") {
+        if (a.kind === "citation") {
+            parts.push(serializeCitation(a));
+        }
+        else if (a.kind === "paste") {
             parts.push(`<pasted-text index="${i + 1}">\n${a.text}\n</pasted-text>`);
         }
         else if (a.kind === "image") {