openmausbot 0.1.91 → 0.1.93

package/dist-server/server/cloud-lending.js

@@ -9,10 +9,10 @@
 //   session with admin scope), or
 // - a scheduled run of a routine whose instructions the owner wrote (created
 //   or edited from one of those devices), or a run the owner started by hand;
-// and the conversation holds nobody else's words, ever: a resumed session
-// carries everything said in it, so one line (or card answer) from a guest,
-// a teammate bot or a local process, before or during the turn, takes that
-// conversation out of lending. The owner starts a new one to lend again.
+// and the conversation was opened by them and holds nobody else's words,
+// ever: a resumed session carries everything said in it, so one line (or
+// card answer) from a guest, a teammate bot or a local process, before or
+// during the turn, takes that conversation out of lending. The owner starts a new one to lend again.
 // Webhook runs, guests, rooms, a bot's delegated or peer turn, and anything
 // unprovable never can.
 // Everything here is pure; server/index.ts supplies the records.
@@ -42,14 +42,27 @@ export function cloudHomeLendingRefusal(turn) {
     }
     if (!owner)
         return "not-owner";
+    // A conversation someone else opened (and named) is theirs, whoever writes in it.
+    if (turn.starters?.some((person) => person !== undefined && !turn.ownerPerson(person)))
+        return "someone-else";
+    if (turn.reportsFromOthers)
+        return "someone-else";
     // Nothing anyone else wrote (a guest, a teammate bot, a local process) may
     // be anywhere in this conversation, before or after the request, as a line
     // (sent, queued, steered or handed in) or as the answer to a card. A
     // routine's own prompt line names nobody; its provenance was proven above.
-    const clean = turn.thread.every((line, at) => (line.role !== "user" || (at === index && request.automation !== undefined) || turn.ownerPerson(personOf(line))) &&
-        (!answeredByPerson(line.card) || turn.ownerPerson(turn.cardAnswerer(line.card))));
+    const clean = ownerOnlyConversation(turn.thread, turn.ownerPerson, turn.cardAnswerer, request.automation !== undefined ? request.messageId : undefined);
     return clean ? null : "someone-else";
 }
+/** A conversation only the owner has written in: every user line is theirs
+ * and every card someone answered was answered by them (`exempt`: one line,
+ * a routine's own prompt, that names nobody). The same test decides which of
+ * a bot's other conversations may feed a turn on a Cloud home (recall, the
+ * recent-work brief, memory capture, the daily log). */
+export function ownerOnlyConversation(thread, ownerPerson, cardAnswerer, exempt) {
+    return thread.every(line => (line.role !== "user" || line.id === exempt || ownerPerson(personOf(line))) &&
+        (!answeredByPerson(line.card) || ownerPerson(cardAnswerer(line.card))));
+}
 /** A card someone answered: a person's verdict or words. The harness's own
  * settlements (automatic approvals, a turn that ended) are marked dismissed
  * or unavailable and carry nobody's words. */
@@ -70,34 +83,85 @@ export function routineFingerprint(routine) {
         routine.schedule ?? null, routine.runOn ?? null,
     ])).digest("hex");
 }
-const authorsFile = z.object({ version: z.literal(1), routines: z.record(z.string().max(128), z.string().regex(/^[a-f0-9]{64}$/)) }).strict();
+const authorsFile = z.object({
+    version: z.literal(1),
+    routines: z.record(z.string().max(128), z.string().regex(/^[a-f0-9]{64}$/)),
+    /** Whoever last wrote each routine (a person key), owner or not. */
+    writers: z.record(z.string().max(128), z.string().regex(/^p_[\w-]{22}$/)).optional(),
+}).strict();
 /** Which routines the owner wrote, as the fingerprint of what they wrote.
  * Persisted beside the routines (owner-only). A missing or damaged file
  * means none: it never grants anything by being absent. */
 export function createCloudRoutineAuthors(file) {
     let routines = {};
+    let writers = {};
     try {
         if (existsSync(file)) {
             const stat = lstatSync(file);
-            if (stat.isFile() && !stat.isSymbolicLink() && stat.size <= 1_000_000)
-                routines = authorsFile.parse(JSON.parse(readFileSync(file, "utf8"))).routines;
+            if (stat.isFile() && !stat.isSymbolicLink() && stat.size <= 1_000_000) {
+                const parsed = authorsFile.parse(JSON.parse(readFileSync(file, "utf8")));
+                routines = parsed.routines;
+                writers = parsed.writers ?? {};
+            }
         }
     }
     catch {
         routines = {};
+        writers = {};
     }
-    const save = () => writeFileAtomic(file, JSON.stringify({ version: 1, routines }), { mode: 0o600 });
+    const save = () => writeFileAtomic(file, JSON.stringify({ version: 1, routines, writers }), { mode: 0o600 });
     return {
         /** The owner wrote this routine as it stands now. */
         record(id, routine) { routines = { ...routines, [id]: routineFingerprint(routine) }; save(); },
+        /** The owner's authorship ends; whoever wrote it last is still named. */
         forget(id) { if (Object.hasOwn(routines, id)) {
             const next = { ...routines };
             delete next[id];
             routines = next;
             save();
         } },
+        /** Someone (a person key) created or edited this routine. */
+        wrote(id, person) { if (writers[id] !== person) {
+            writers = { ...writers, [id]: person };
+            save();
+        } },
+        /** Who last wrote this routine, when that is known. */
+        writer(id) { return Object.hasOwn(writers, id) ? writers[id] : undefined; },
+        /** The routine is gone: nothing about it is kept. */
+        remove(id) {
+            if (!Object.hasOwn(routines, id) && !Object.hasOwn(writers, id))
+                return;
+            const nextRoutines = { ...routines };
+            delete nextRoutines[id];
+            routines = nextRoutines;
+            const nextWriters = { ...writers };
+            delete nextWriters[id];
+            writers = nextWriters;
+            save();
+        },
         /** Whether this routine, as it stands (or as a run snapshotted it), is
          * exactly what the owner wrote. */
         authored(id, routine) { return Object.hasOwn(routines, id) && routines[id] === routineFingerprint(routine); },
+        /** Whether the owner's fingerprint is on record for this routine at all,
+         * matching what it runs now or not. */
+        recorded(id) { return Object.hasOwn(routines, id); },
+        /** Everyone named as a writer (server/cloud-owner.ts). */
+        people() { return new Set(Object.values(writers)); },
+        /** Name `to` as the writer wherever `move` accepts the writer: a one-time
+         * migration (server/cloud-owner.ts). The routines that changed. */
+        reassign(move, to) {
+            const moved = [];
+            const next = { ...writers };
+            for (const [id, person] of Object.entries(writers))
+                if (person !== to && move(person)) {
+                    next[id] = to;
+                    moved.push(id);
+                }
+            if (moved.length) {
+                writers = next;
+                save();
+            }
+            return moved;
+        },
     };
 }

package/dist-server/server/cloud-owner.js

@@ -0,0 +1,196 @@
+// An OMB Cloud home is personal (docs/cloud-pro.md): only the owner's own
+// devices connect, each with an admin session the Admin's signed pairing
+// gave it. No pairing, sign-in or session without admin scope is minted or
+// redeemed there (server/sessions.ts requireAdmin), and at every boot any
+// that is stored is revoked: what it opened or wrote is nobody's from then
+// on, and its key is recorded first, so no crash can ever make it the
+// owner's.
+//
+// Before, every device carried its own key (v0.1.91), so a device the owner
+// unpaired made the owner's conversations read as someone else's. Once, at
+// the first boot of a personal Cloud home, and again after a restore, the
+// keys named until then are settled, in two tiers:
+// - adopted: every key that opened a conversation, wrote a line or answered
+//   a card, except a revoked one. Its conversations are the owner's for who
+//   opened them, their approval level and their folder (so the owner's rooms
+//   and conversations keep Auto or Full, and their project folder);
+// - proven: only a key with proof it was the owner's, an admin session
+//   still paired, or one that answered a card (only the owner's devices
+//   could, on a Cloud home). Only those feed lending, memory, recall and the
+//   recent-work brief (cloud-lending.ts ownerOnlyConversation): a guest the
+//   owner unpaired before is indistinguishable from an owner's old device,
+//   so its lines never count as the owner's there.
+// Routines fail closed: a routine's writer is the owner only with proof (the
+// owner's key as its writer, the owner's fingerprint, #2023, a proposal the
+// owner approved on its card, or a restore the owner started whose results
+// conversation is theirs); every other routine is nobody's, and runs
+// confined. What a revoked session opened loses its working folder (its next
+// turn gets a private one), and its routines are paused.
+import { lstatSync, readFileSync } from "node:fs";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+export const CLOUD_PERSONAL_REFUSAL = "OMB Cloud is personal: only your own devices can connect.";
+const KEY = /^p_[\w-]{22}$/;
+const keys = z.array(z.string().regex(KEY)).max(100_000);
+const recordFile = z.object({
+    version: z.literal(2),
+    machineId: z.string().max(128),
+    /** Revoked here, ever: never anyone's but nobody's. */
+    revokedKeys: keys,
+    adoptedKeys: keys,
+    provenKeys: keys,
+    /** The earlier keys are settled (and routines named). */
+    settled: z.boolean(),
+    /** A restore applied here whose data is not settled yet. */
+    pendingRestore: z.string().max(128).optional(),
+    /** The last restore whose data is settled (a restore applied at a start
+     * that ended before recording it is found this way at the next). */
+    settledRestore: z.string().max(128).optional(),
+}).strict();
+function readRecord(options) {
+    const fresh = { version: 2, machineId: options.machineId, revokedKeys: [], adoptedKeys: [], provenKeys: [], settled: false, fresh: true };
+    let stat;
+    try {
+        stat = lstatSync(options.file, { throwIfNoEntry: false });
+    }
+    catch {
+        stat = null;
+    }
+    if (stat === undefined)
+        return fresh;
+    try {
+        if (!stat || !stat.isFile() || stat.size > 16_000_000)
+            throw new Error("not a file");
+        const record = recordFile.parse(JSON.parse(readFileSync(options.file, "utf8")));
+        // Another machine's (never carried by a backup): nothing in it is ours.
+        if (record.machineId !== options.machineId) {
+            options.log(`cloud home: ${options.file} is another machine's; settling this one's own`);
+            return fresh;
+        }
+        return record;
+    }
+    catch {
+        // Settled before, and unreadable now: nothing earlier is the owner's, and
+        // running the settlement again could make a revoked key theirs.
+        options.log(`cloud home: ${options.file} is unreadable, so nothing from before is treated as the owner's`);
+        return { ...fresh, settled: true };
+    }
+}
+function save(options, record) {
+    try {
+        writeFileAtomic(options.file, JSON.stringify(record), { mode: 0o600 });
+        return true;
+    }
+    catch (error) {
+        options.log(`cloud home: could not record who is the owner (${error instanceof Error ? error.message : String(error)}); trying again at the next start`);
+        return false;
+    }
+}
+/** A step that never stops the server from starting: logged when it fails
+ * (`failed` is then called), and done again at the next start (every step
+ * can be). */
+function attempt(options, what, step, fallback, failed) {
+    try {
+        return step();
+    }
+    catch (error) {
+        options.log(`cloud home: could not ${what} (${error instanceof Error ? error.message : String(error)})`);
+        failed?.();
+        return fallback;
+    }
+}
+/** The settled keys, never one revoked since. */
+function settledSets(record) {
+    const revoked = new Set(record.revokedKeys);
+    return { adopted: new Set(record.adoptedKeys.filter((key) => !revoked.has(key))), proven: new Set(record.provenKeys.filter((key) => !revoked.has(key))) };
+}
+/** Revoke every session that is not one of the owner's devices, and settle
+ * the earlier keys (once, and after a restore). Every step is recorded
+ * before it is taken, so a crash anywhere, or a failed save, only ever
+ * leaves a key less trusted, and the next start carries on. */
+export function settleCloudOwnership(options) {
+    const { fresh, ...read } = readRecord(options);
+    let record = read;
+    const others = options.sessions.list().filter((session) => !session.scopes.includes("admin"));
+    const revoked = new Set([...record.revokedKeys, ...others.map((session) => options.personKey(session))]);
+    // A restore to settle: one applied at this start, or a later one than the
+    // last settled (its start ended before it was recorded). At the very first
+    // start, only one applied now: what came before settles the strict way.
+    const restore = options.restoredNow ??
+        (!fresh && options.lastRestore && options.lastRestore !== record.settledRestore && options.lastRestore !== record.pendingRestore ? options.lastRestore : undefined);
+    record = { ...record, revokedKeys: [...revoked], ...(restore ? { pendingRestore: restore } : {}),
+        ...(fresh && !options.restoredNow && options.lastRestore ? { settledRestore: options.lastRestore } : {}) };
+    // 1. The keys about to be revoked are recorded first.
+    if (!save(options, record))
+        return settledSets(record);
+    // 2. Their sessions go.
+    let count = 0;
+    for (const session of others)
+        if (attempt(options, "revoke a session", () => options.sessions.revoke(session.id), false))
+            count += 1;
+    options.log(`cloud home: revoked ${count} session${count === 1 ? "" : "s"} that ${count === 1 ? "was" : "were"} not the owner's own device${count === 1 ? "" : "s"}`);
+    // 3. What any revoked key opened or wrote is nobody's: its conversations
+    // lose their working folder (the owner's project, often), its routines stop.
+    const orphans = attempt(options, "mark conversations as nobody's", () => options.starters.reassign((person) => revoked.has(person), options.nobodyKey), []);
+    if (orphans.length)
+        attempt(options, "unpin their folders", () => options.unpin(orphans), undefined);
+    const stopped = attempt(options, "mark routines as nobody's", () => options.writers.reassign((person) => revoked.has(person), options.nobodyKey), []);
+    if (stopped.length)
+        attempt(options, "pause their routines", () => options.routines.pause(stopped), undefined);
+    if (fresh) {
+        options.log("cloud home: only your own devices can connect now. Review Settings → Remote access → Paired devices, and sign out any device that isn't yours.");
+    }
+    const restoring = record.pendingRestore !== undefined;
+    if (record.settled && !restoring)
+        return settledSets(record);
+    // 4. The earlier keys, recorded before anything is rewritten.
+    const eligible = (person) => KEY.test(person) && person !== options.ownerKey && person !== options.nobodyKey && !revoked.has(person);
+    // Settled only once every step below is done; else the next start does it again.
+    let complete = true;
+    const incomplete = () => { complete = false; };
+    const lines = attempt(options, "read who wrote in each conversation", () => options.lines(), { senders: [], answerers: [], approvals: [] }, incomplete);
+    const admins = options.sessions.list().filter((session) => session.scopes.includes("admin")).map((session) => options.personKey(session));
+    const proven = new Set([...record.provenKeys, ...admins, ...lines.answerers].filter(eligible));
+    const adopted = new Set([...record.adoptedKeys, ...proven, ...options.starters.people(), ...lines.senders].filter(eligible));
+    record = { ...record, adoptedKeys: [...adopted], provenKeys: [...proven] };
+    if (!save(options, record))
+        return settledSets(record);
+    // 5. Conversations the owner provably opened name the owner; routines are
+    // the owner's only with proof, else nobody's.
+    const moved = attempt(options, "name the owner on their conversations", () => options.starters.reassign((person) => proven.has(person), options.ownerKey), [], incomplete).length;
+    const ownersKey = (person) => person !== undefined && (person === options.ownerKey || proven.has(person));
+    // A card the owner allowed is proof of what it showed them: only while the
+    // routine still runs exactly that (its instructions, bot, schedule, where
+    // it runs and no attachment: anyone could change a routine on v0.1.91
+    // without being recorded).
+    const approved = new Set();
+    for (const [id, person, shape] of lines.approvals) {
+        if (ownersKey(person) && options.routines.shape(id) === shape)
+            approved.add(id);
+    }
+    let owners = 0, nobodys = 0;
+    attempt(options, "name each routine's writer", () => {
+        for (const id of options.routines.ids()) {
+            const writer = options.routines.writer(id);
+            // A restore is proof only for a routine reporting into a conversation
+            // that names nobody yet, or the owner (a backup from before can hold a
+            // guest's routine and its conversation).
+            const opener = options.routines.resultsOpener(id);
+            const owner = writer === options.ownerKey || options.routines.fingerprinted(id) || approved.has(id) ||
+                (restoring && writer !== options.nobodyKey && !(writer !== undefined && revoked.has(writer)) && (opener === undefined || ownersKey(opener)));
+            if (writer !== (owner ? options.ownerKey : options.nobodyKey))
+                options.routines.name(id, owner ? options.ownerKey : options.nobodyKey);
+            if (owner)
+                owners += 1;
+            else
+                nobodys += 1;
+        }
+    }, undefined, incomplete);
+    if (!complete)
+        return settledSets(record);
+    const { pendingRestore: done, ...rest } = record;
+    record = { ...rest, settled: true, ...(done ? { settledRestore: done } : {}) };
+    save(options, record);
+    options.log(`cloud home: settled what came before${restoring ? " (a restore)" : ""}: ${adopted.size} earlier device key${adopted.size === 1 ? "" : "s"} (${proven.size} proven), ${moved} conversation${moved === 1 ? "" : "s"} named the owner's, ${owners} routine${owners === 1 ? "" : "s"} the owner's and ${nobodys} nobody's`);
+    return settledSets(record);
+}

package/dist-server/server/cloud-secrets-boot.js

@@ -0,0 +1,6 @@
+// The server's first import (server/index.ts): on an OMB Cloud home, the
+// secrets the launcher hands over its pipe are read, and the pipe closed,
+// before any other module is loaded, so no process the server starts can
+// inherit it (cloud-secrets.ts, cloud-home-start.ts).
+import { takeCloudSecrets } from "./cloud-secrets.js";
+export const BOOT_CLOUD_SECRETS = takeCloudSecrets();

package/dist-server/server/cloud-secrets.js

@@ -0,0 +1,65 @@
+// The OMB Cloud home's secrets, and how the server gets them
+// (docs/cloud-pro.md). This module imports nothing but node:fs, so the
+// server can read them before anything else it loads can start a process
+// (cloud-secrets-boot.ts, the server's first import).
+import { closeSync, readFileSync } from "node:fs";
+/** The Cloud home's secrets: the signing secret and the included services'
+ * relay tokens (server/included-services.ts). The Admin sets them as Fly app
+ * secrets, which reach the machine as the launcher's environment; the
+ * launcher never puts them in a child's environment, because
+ * /proc/<pid>/environ keeps a process's starting environment for anything
+ * running as the same user to read. It hands them to the server over an
+ * inherited pipe instead (CLOUD_SECRETS_FD_ENV names its descriptor). */
+export const CLOUD_HOME_SECRET_KEYS = ["OMB_CLOUD_BOOTSTRAP_SECRET", "OMB_CLOUD_BOAT_TOKEN", "OMB_CLOUD_VOICE_TOKEN", "OMB_CLOUD_DECIDER_TOKEN"];
+export const CLOUD_SECRETS_FD_ENV = "OMB_CLOUD_SECRETS_FD";
+/** The secrets present in an environment (the launcher's). */
+export function cloudHomeSecrets(env) {
+    return Object.fromEntries(CLOUD_HOME_SECRET_KEYS.flatMap((key) => env[key] ? [[key, env[key]]] : []));
+}
+/** An environment with no Cloud home secret in it. */
+export function withoutCloudSecrets(env) {
+    const kept = { ...env };
+    for (const key of CLOUD_HOME_SECRET_KEYS)
+        delete kept[key];
+    return kept;
+}
+function invalid(why) {
+    throw new Error(`Cloud home configuration is invalid: ${why}.`);
+}
+/** At server startup: the secrets the launcher handed over its pipe (read
+ * to the end and closed, so no child inherits it), or none when the server
+ * was started another way and reads its environment as before. Only the
+ * known secret names are taken. */
+export function takeCloudSecrets(env = process.env) {
+    const named = env[CLOUD_SECRETS_FD_ENV];
+    if (named === undefined)
+        return {};
+    delete env[CLOUD_SECRETS_FD_ENV];
+    const fd = Number(named);
+    if (!Number.isInteger(fd) || fd < 3 || fd > 1024)
+        invalid(`${CLOUD_SECRETS_FD_ENV} must name an inherited descriptor`);
+    let raw;
+    try {
+        raw = readFileSync(fd, "utf8");
+    }
+    catch {
+        invalid("the Cloud home's secrets could not be read from the launcher");
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { /* already closed */ }
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        parsed = null;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        invalid("the Cloud home's secrets from the launcher are not readable");
+    const record = parsed;
+    return Object.fromEntries(CLOUD_HOME_SECRET_KEYS.flatMap((key) => typeof record[key] === "string" && record[key] ? [[key, record[key]]] : []));
+}

package/dist-server/server/computer-control.js

@@ -71,6 +71,12 @@ export class ComputerControl {
         });
         return { snapshot: this.changed(botId), owned: true, acquired: true };
     }
+    /** Whether this workspace lease is the one holding the wheel right now.
+     * Read-only: unlike `acquireLease`, a free computer is not taken. */
+    ownsLease(botId, controlLeaseId) {
+        const entry = this.entries.get(botId);
+        return entry?.heldSinceMs != null && entry.controlLeaseId === controlLeaseId;
+    }
     /** The person hands the wheel back. Also settles any open help request —
      * the waiting bot resumes from this one state change. */
     release(botId) {