openmausbot 0.1.91 → 0.1.93

package/dist-server/server/vps-computer.js

@@ -85,6 +85,8 @@ const SCREENSHOT_CLEANUP_BUDGET_MS = 10_000;
 const PREPARATION_LOCK_TIMEOUT_MS = SCREENSHOT_BUDGET_MS + LOCK_ACQUIRE_TIMEOUT_MS;
 const pendingScreenshots = new Map();
 const viewerConnections = new Map();
+const REMOTE_VIEWER_GRACE_MS = 30_000;
+const NATIVE_VIEWER_LIFETIME_MS = 8 * 60 * 60_000;
 const desktopTunnels = new Map();
 function invalidateVpsStatus(key) {
     statusCache.delete(key);
@@ -198,12 +200,53 @@ function stopDesktopTunnel(botId) {
     return true;
 }
 export function closeVpsDesktopTunnel(botId) {
+    const tunnel = desktopTunnels.get(botId);
+    // Remote tabs still hold the tunnel; drop only the native claim and let
+    // the last tab's release start the grace period.
+    if (tunnel?.viewers) {
+        tunnel.localViewer = false;
+        clearTimeout(tunnel.expiry);
+        return { closed: false };
+    }
     return { closed: stopDesktopTunnel(botId) };
 }
 export function closeAllVpsDesktopTunnels() {
     for (const botId of desktopTunnels.keys())
         stopDesktopTunnel(botId);
 }
+/** Resolve only a tunnel opened by the authenticated join route. Multiple
+ * remote tabs share it; the final tab releases it unless a native viewer owns it. */
+export function vpsDesktopConnection(botId) {
+    const tunnel = desktopTunnels.get(botId);
+    if (!tunnel || tunnel.child.exitCode !== null || tunnel.child.killed)
+        return;
+    const url = new URL(tunnel.joinUrl);
+    return {
+        port: Number(url.port),
+        password: new URLSearchParams(url.hash.slice(1)).get("password"),
+        live: () => desktopTunnels.get(botId) === tunnel && tunnel.child.exitCode === null && !tunnel.child.killed,
+        retain: () => {
+            tunnel.viewers++;
+            if (!tunnel.localViewer)
+                clearTimeout(tunnel.expiry);
+            let released = false;
+            return () => {
+                if (released)
+                    return;
+                released = true;
+                tunnel.viewers--;
+                if (!tunnel.viewers && !tunnel.localViewer && desktopTunnels.get(botId) === tunnel) {
+                    // A short grace period lets a reload/reconnect reuse the tunnel.
+                    tunnel.expiry = setTimeout(() => {
+                        if (desktopTunnels.get(botId) === tunnel)
+                            stopDesktopTunnel(botId);
+                    }, REMOTE_VIEWER_GRACE_MS);
+                    tunnel.expiry.unref();
+                }
+            };
+        },
+    };
+}
 const STREAM_CAP_CHARS = 16 * 1024 * 1024;
 /** Keeps the LAST 16MB of a stream without rebuilding one giant string per
  * chunk (a 10-minute `docker build` stream made that rebuild quadratic).
@@ -317,7 +360,7 @@ function emptyStatus(botId, alias) {
         desktopReady: false,
         desktop_error: null,
         ready: false,
-        problem: alias ? "Docker over SSH is not reachable" : "Configure a VPS SSH alias in App Settings → Connections",
+        problem: alias ? "Docker over SSH is not reachable" : "Configure a VPS SSH alias in Settings → API keys",
         image_ref: VPS_IMAGE,
         base_image_ref: BASE_IMAGE,
         driver_version: CUA_DRIVER_VERSION,
@@ -335,6 +378,9 @@ function isMissingObjectMessage(message) {
     return /no such (object|image|container)/i.test(message);
 }
 function transportFailure(message) {
+    if (/timed out/i.test(message)) {
+        return "Docker over SSH failed while checking the VPS: the connection timed out. Check that the VPS is online, SSH is reachable from this computer, and Docker is running on the VPS, then retry. No computer was reset.";
+    }
     return `Docker over SSH failed while checking the VPS: ${message.trim().slice(0, 200) || "unknown transport error"}`;
 }
 function privateDockerIpv4(value) {
@@ -371,7 +417,7 @@ function hasNoPublishedPorts(config, networks) {
 }
 function statusProblem(status) {
     if (!status.configured)
-        return "Configure a VPS SSH alias in App Settings → Connections";
+        return "Configure a VPS SSH alias in Settings → API keys";
     if (!status.daemonUp)
         return "Docker over SSH could not reach the VPS; check the SSH alias and Docker on the VPS";
     if (!status.image)
@@ -412,9 +458,23 @@ async function computeVpsComputerStatus(cfg, botId, runner) {
         return status;
     viewerConnections.delete(`${alias}:${status.container_name}`);
     const run = (args, timeoutMs = 10_000, input) => runner(vpsDockerArgs(alias, args), { timeoutMs, input });
+    // Only repeat read-only Docker inspections, never an exec or lifecycle
+    // mutation whose outcome is unknown after a lost connection. Awaiting the
+    // runner also lets its owned SSH process finish cleanup before retrying.
+    const inspect = async (args) => {
+        try {
+            return await run(args);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!/timed out|connection reset by peer|broken pipe/i.test(message))
+                throw error;
+            return run(args);
+        }
+    };
     let inspectedImageId = null;
     try {
-        const inspected = JSON.parse((await run(["image", "inspect", VPS_IMAGE])).stdout);
+        const inspected = JSON.parse((await inspect(["image", "inspect", VPS_IMAGE])).stdout);
         status.daemonUp = true;
         const image = inspected[0];
         const labels = image?.Config?.Labels ?? image?.config?.Labels ?? image?.config?.labels;
@@ -434,7 +494,7 @@ async function computeVpsComputerStatus(cfg, botId, runner) {
         status.image = false;
     }
     try {
-        const inspected = JSON.parse((await run(["inspect", status.container_name])).stdout);
+        const inspected = JSON.parse((await inspect(["inspect", status.container_name])).stdout);
         const detail = inspected[0];
         const labels = detail?.Config?.Labels;
         const containerId = detail?.Id ?? detail?.id;
@@ -757,7 +817,7 @@ export function vpsContainerRunArgs(containerName, imageRef = VPS_IMAGE, viewerS
         // someone opens the panel. unless-stopped survives reboots while still
         // honoring an explicit Stop. The shared hardening check accepts exactly
         // this policy for the VPS caller (and only "no"/unset for the Local VM,
-        // whose desktop cannot safely resume).
+        // whose starts are controlled by OMB's turn lifecycle).
         "--restart",
         "unless-stopped",
         "-e",
@@ -897,7 +957,7 @@ export async function removeManagedVpsComputer(cfg, owners, containerName, confi
     cfg = snapshotVpsConfig(cfg);
     const alias = vpsSshAlias(cfg);
     if (!alias) {
-        throw Object.assign(new Error("VPS is not configured — add an SSH config alias in Connections"), { status: 409 });
+        throw Object.assign(new Error("VPS is not configured — add an SSH config alias in Settings → API keys"), { status: 409 });
     }
     if (!MANAGED_VPS_CONTAINER_NAME.test(containerName)) {
         throw Object.assign(new Error("invalid managed VPS computer name"), { status: 400 });
@@ -948,7 +1008,7 @@ export async function vpsComputerAction(action, cfg, botId, runner = defaultRunn
     cfg = snapshotVpsConfig(cfg);
     const alias = vpsSshAlias(cfg);
     if (!alias)
-        throw Object.assign(new Error("VPS is not configured — add an SSH config alias in App Settings → Connections"), { status: 409 });
+        throw Object.assign(new Error("VPS is not configured — add an SSH config alias in Settings → API keys"), { status: 409 });
     const key = `${alias}:${vpsContainerName(botId)}`;
     const pending = action === "provision" ? pendingProvisions.get(key) : undefined;
     if (pending)
@@ -1054,13 +1114,20 @@ export async function inspectVpsForAuto(cfg, botId, runner = defaultRunner) {
  * returned URL is loopback-only and contains the per-container password in
  * its fragment (never sent in HTTP). Closing the app viewer calls the paired
  * close endpoint, and process shutdown closes every remaining child. */
-export async function vpsComputerJoin(cfg, botId, runner = defaultRunner) {
+export async function vpsComputerJoin(cfg, botId, runner = defaultRunner, remoteViewer = false) {
     cfg = snapshotVpsConfig(cfg);
     const alias = vpsSshAlias(cfg);
     if (!alias)
         throw Object.assign(new Error("VPS is not configured"), { status: 409 });
     const existing = desktopTunnels.get(botId);
     if (existing && existing.child.exitCode === null && !existing.child.killed) {
+        if (!remoteViewer)
+            existing.localViewer = true;
+        if (!existing.viewers || existing.localViewer) {
+            clearTimeout(existing.expiry);
+            existing.expiry = setTimeout(() => stopDesktopTunnel(botId), existing.localViewer ? NATIVE_VIEWER_LIFETIME_MS : REMOTE_VIEWER_GRACE_MS);
+            existing.expiry.unref();
+        }
         return { joinUrl: existing.joinUrl, state: "running" };
     }
     stopDesktopTunnel(botId);
@@ -1114,11 +1181,11 @@ export async function vpsComputerJoin(cfg, botId, runner = defaultRunner) {
         throw Object.assign(new Error(`Could not open the VPS live desktop: ${detail}`), { status: 502 });
     }
     const joinUrl = `http://127.0.0.1:${localPort}/vnc.html#autoconnect=true&resize=scale&password=${encodeURIComponent(connection.password)}`;
-    // Viewer-close is the normal cleanup. This unref'd ceiling is a backstop
-    // for a renderer crash or an old browser client that cannot signal close.
-    const expiry = setTimeout(() => stopDesktopTunnel(botId), 8 * 60 * 60_000);
+    // Remote tabs retain the tunnel when their WebSocket opens. Reclaim an
+    // abandoned join promptly; native windows retain the existing close/ceiling.
+    const expiry = setTimeout(() => stopDesktopTunnel(botId), remoteViewer ? REMOTE_VIEWER_GRACE_MS : NATIVE_VIEWER_LIFETIME_MS);
     expiry.unref?.();
-    desktopTunnels.set(botId, { child, joinUrl, expiry });
+    desktopTunnels.set(botId, { child, joinUrl, expiry, viewers: 0, localViewer: !remoteViewer });
     return { joinUrl, state: "running" };
 }
 export function vpsContainerMcpArgs(alias, containerName) {
@@ -1142,7 +1209,7 @@ export function vpsDriverError(driverKind, computerMcp) {
         return "The Computer engine runs its agent on Boat and cannot use a self-hosted VPS — choose Claude or an ACP engine";
     }
     if (!computerMcp) {
-        return "This model engine cannot mount a self-hosted VPS computer — choose Claude or an ACP engine";
+        return "This model cannot mount a self-hosted VPS computer — choose Claude or an ACP model provider";
     }
     return null;
 }

package/dist-server/server/webhooks.js

@@ -51,6 +51,10 @@ const storedWebhookSchema = z.object({
     updatedAt: z.number().finite().nonnegative(),
     lastReceivedAt: z.number().finite().nonnegative().optional(),
     lastRunId: z.string().optional(),
+    /** delivery:"post" only: the stable destination thread, resolved once
+     *  via WebhookManagerOptions.resolvePostThread and reused forever
+     *  after -- see the `post`/`resolvePostThread` doc comments above. */
+    resultsThreadId: z.string().min(1).optional(),
     deliveryCount: z.number().int().nonnegative(),
     verificationPending: z.boolean().optional(),
     verifiedAt: z.number().finite().nonnegative().optional(),
@@ -429,9 +433,22 @@ export class WebhookManager {
             // without a post sink is a configuration error, not a run request.
             if (!this.options.post)
                 fail(503, "This server cannot post webhook messages to chat");
+            // Resolved on every dispatch, exactly like routines.ts's newRun calls
+            // resolveResultsThread on every run -- the resolver owns the
+            // reuse-vs-allocate decision from trigger.resultsThreadId, so a host
+            // without resolvePostThread wired can only fail closed here, never
+            // silently fall back to whatever thread the bot happens to have
+            // selected right now (the bug this replaces -- issue #2071).
+            const threadId = this.options.resolvePostThread?.(trigger, false);
+            if (!threadId)
+                fail(503, "This server could not resolve a destination thread for this delivery");
+            if (threadId !== trigger.resultsThreadId) {
+                trigger.resultsThreadId = threadId;
+                trigger.updatedAt = now;
+            }
             const raw = event.payload;
             const text = raw && typeof raw === "object" && typeof raw.text === "string" && raw.text.trim() ? raw.text : serializePayload(event.payload);
-            this.options.post(trigger.botId, text.slice(0, 20000));
+            this.options.post(trigger.botId, threadId, text.slice(0, 20000));
             this.deliveries.push({ key: `${trigger.endpointId}:${deliveryId}`, runId: "post", at: now });
             if (this.deliveries.length > MAX_DELIVERIES)
                 this.deliveries.splice(0, this.deliveries.length - MAX_DELIVERIES);

package/dist-server/server/workspace-backup-policy.js

@@ -41,6 +41,9 @@ export function excludedWorkspaceAuthPath(path) {
     // Machine/provider-specific execution grants are not portable template data.
     if (/^command-allowlist\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path))
         return true;
+    // MCP sign-in tokens belong to this machine's browser sign-ins.
+    if (/^mcp-oauth\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path))
+        return true;
     return /^(?:(?:providers|caddy|chrome-profile|\.agent-browser)(?:\/|$)|workspace-credentials\.json$|external-runtimes\.json$|browser-engine-key$)/.test(path) ||
         /^(?:config\.json|webhooks\.json|workspace-credentials\.json|external-runtimes\.json|browser-engine-key|sessions\.json|tunnel-account\.json)\.\d+(?:\.[0-9a-f-]+)?\.tmp$/.test(path) ||
         /^(?:vm-home|vm-homes\/[^/]+)\/\.browser-profiles(?:\/|$)/.test(path);

package/dist-server/server/workspace-backup.js

@@ -29,11 +29,15 @@ const EXCLUDED = new Set([
     // This machine's decision-model log (server/decider/log.ts): local
     // measurement of what the classifier picked, not workspace data.
     "decider-log",
+    // A Cloud home's record of who its owner was (server/cloud-owner.ts): this
+    // machine's own, kept in place by a restore, which settles what it brought.
+    "cloud-owner.json",
 ]);
 const EXCLUSION_NOTES = [
     "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",
     "Saved credentials, provider and MCP connections, managed provider login homes and browser login profiles are not transferred. Destination connections are preserved; reconnect on a new device.",
     "Downloaded tools and caches; these can be installed again.",
+    "Installed dependency folders (node_modules) and symbolic links inside conversation work folders; reinstall or recreate them in the project.",
     "External project folders, CLI login homes, browser session homes, OS keychains, companion devices and other servers.",
     "VM/container disk layers and remote cloud data; durable files inside this workspace are included.",
 ];
@@ -324,6 +328,8 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
     const warnings = ["Stop external editors and managed desktops before exporting; files written outside this server cannot be frozen by the backup gate.", "Conversation text and user files are not redacted and may contain secrets you pasted. Keep the encrypted backup private.", RESTORE_WARNING];
     let bytes = 0;
     let skippedLinks = 0;
+    let skippedDependencies = 0;
+    let skippedWorkLinks = 0;
     try {
         const root = realpathSync(dataDir);
         const sourceDb = join(root, "messages.db");
@@ -367,6 +373,21 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
                     throw new Error("A workspace filename cannot be safely restored on supported platforms.");
                 const source = join(directory, name);
                 const stat = lstatSync(source);
+                // Installed dependencies come back from the project's lockfile, can
+                // hold more files than this format allows, and are often a link an
+                // agent made to another checkout's install. Leave them out.
+                if (name === "node_modules" && (stat.isDirectory() || stat.isSymbolicLink())) {
+                    skippedDependencies++;
+                    continue;
+                }
+                // A conversation's work folder (task-workspaces/<bot>/<thread>) holds
+                // what an agent made there, and agents link things in (another
+                // checkout, a virtualenv). A link's target is not this workspace's
+                // data, so the link is left out rather than failing the backup.
+                if (stat.isSymbolicLink() && path.startsWith("task-workspaces/")) {
+                    skippedWorkLinks++;
+                    continue;
+                }
                 if (stat.isSymbolicLink()) {
                     let target;
                     try {
@@ -427,6 +448,10 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
         walk(root);
         if (skippedLinks)
             warnings.push(`${skippedLinks} managed skill discovery link(s) were omitted and are recreated by the app.`);
+        if (skippedDependencies)
+            warnings.push(`${skippedDependencies} installed dependency folder(s) (node_modules) were omitted; reinstall them in the project after restoring.`);
+        if (skippedWorkLinks)
+            warnings.push(`${skippedWorkLinks} symbolic link(s) in conversation work folders were omitted; what they point to is outside this backup.`);
         const summary = {
             format: "openmaus.workspace-backup", version: 1, id: job.id, createdAt: new Date().toISOString(),
             appVersion: options.appVersion ?? "unknown", files: entries.filter((entry) => entry.type === "file").length,

package/dist-server/server/workspace.js

@@ -8,7 +8,7 @@
 // memory/ holds topic files the bot reads on demand with its ordinary
 // file tools. Plain markdown on purpose — the user can open, edit, or
 // delete anything the bot believes.
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { isMemoryDate, untilMark, withoutExpired } from "./memory-entries.js";
@@ -20,7 +20,7 @@ export const WORKSPACES_DIR = join(DATA_DIR, "workspaces");
 export const TASK_WORKSPACES_DIR = join(DATA_DIR, "task-workspaces");
 /** MCP support does not imply native filesystem tools or a local working directory. */
 export function supportsWorkspaceFiles(driverKind) {
-    return !["grok", "openai-compat", "minimax", "mistral", "boxAgent"].includes(driverKind);
+    return !["grok", "openai-compat", "minimax", "mistral", "cerebras", "boxAgent"].includes(driverKind);
 }
 /** Default task files are private to the thread, outside the bot's shared
  * memory folder. This is directory organization, not a shell sandbox. */
@@ -58,6 +58,53 @@ export function ensureWorkspace(botId) {
 export function workspaceDir(botId) {
     return join(WORKSPACES_DIR, botId);
 }
+/** On an OMB Cloud home a bot's memory is read only from regular files,
+ * never through a link: server/lending-memory.ts judges a link by where it
+ * points, not by what is there, so a turn must never read through one.
+ * Elsewhere memory reads exactly as it always did. */
+let regularMemoryFilesOnly = false;
+export function readMemoryOnlyFromRegularFiles() {
+    regularMemoryFilesOnly = true;
+}
+/** A memory file's text. Throws like readFileSync when it cannot be read,
+ * and, on a Cloud home, when it is not a regular file. */
+export function readMemoryText(path) {
+    if (!regularMemoryFilesOnly)
+        return readFileSync(path, "utf8");
+    // O_NOFOLLOW refuses a link at open where there is one; Windows has none
+    // (and opens what a link points at), so the entry is looked at first too.
+    if (!lstatSync(path).isFile())
+        throw Object.assign(new Error(`not a regular file: ${path}`), { code: "EINVAL" });
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        if (!fstatSync(fd).isFile())
+            throw Object.assign(new Error(`not a regular file: ${path}`), { code: "EINVAL" });
+        return readFileSync(fd, "utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** A memory folder's entries; on a Cloud home, none when the folder itself
+ * is a link. */
+function memoryFolderEntries(dir) {
+    if (regularMemoryFilesOnly && !lstatSync(dir).isDirectory())
+        return [];
+    return readdirSync(dir);
+}
+function regularFile(path) {
+    try {
+        return lstatSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** The stat a listing trusts: on a Cloud home, the entry's own (a link is
+ * not a file); elsewhere what it points at, as before. */
+function memoryEntryStat(path) {
+    return regularMemoryFilesOnly ? lstatSync(path) : statSync(path);
+}
 /** File locations, not file contents or wider tool permissions. Threads keep
  * independent working directories; the same bot can find its earlier output
  * without assuming that a file absent from the current directory was lost. */
@@ -89,7 +136,7 @@ export function memoryOverBudget(text) {
 export function loadMemory(botId, opts = {}) {
     let raw;
     try {
-        raw = readFileSync(join(workspaceDir(botId), "MEMORY.md"), "utf8");
+        raw = readMemoryText(join(workspaceDir(botId), "MEMORY.md"));
     }
     catch {
         return null;
@@ -128,7 +175,7 @@ export const MEMORY_FILE_MAX_BYTES = 256 * 1024;
 export function readMemoryFile(botId) {
     let raw;
     try {
-        raw = readFileSync(join(workspaceDir(botId), "MEMORY.md"), "utf8");
+        raw = readMemoryText(join(workspaceDir(botId), "MEMORY.md"));
     }
     catch {
         return { text: "", truncated: false };
@@ -159,7 +206,7 @@ function indexWrittenMemoryFile(botId, relativePath) {
     try {
         const path = join(workspaceDir(botId), relativePath);
         const stat = statSync(path);
-        indexMemoryFile(botId, relativePath, searchableMemoryText(relativePath, readFileSync(path, "utf8")), { mtimeMs: stat.mtimeMs, bytes: stat.size });
+        indexMemoryFile(botId, relativePath, searchableMemoryText(relativePath, readMemoryText(path)), { mtimeMs: stat.mtimeMs, bytes: stat.size });
     }
     catch {
         // the next search's sync pass picks it up
@@ -176,7 +223,7 @@ function memoryFilesOnDisk(botId) {
     ];
     return names.flatMap((relativePath) => {
         try {
-            const stat = statSync(join(dir, relativePath));
+            const stat = memoryEntryStat(join(dir, relativePath));
             return stat.isFile() ? [{ path: relativePath, mtimeMs: stat.mtimeMs, bytes: stat.size }] : [];
         }
         catch {
@@ -206,7 +253,7 @@ export function syncMemoryIndex(botId) {
         if (!dateChanged && known && known.bytes === file.bytes && known.mtimeMs === Math.trunc(file.mtimeMs))
             continue;
         try {
-            const text = readFileSync(join(workspaceDir(botId), file.path), "utf8");
+            const text = readMemoryText(join(workspaceDir(botId), file.path));
             indexMemoryFile(botId, file.path, searchableMemoryText(file.path, text), file);
         }
         catch {
@@ -318,7 +365,7 @@ export function updateMemory(botId, update, opts = {}) {
     const dir = ensureWorkspace(botId);
     // Do not use readMemoryFile's editor-friendly missing/read-error fallback:
     // a failed read must never turn into a successful overwrite of old notes.
-    const raw = readFileSync(join(dir, "MEMORY.md"), "utf8");
+    const raw = readMemoryText(join(dir, "MEMORY.md"));
     const current = raw === MEMORY_SEED ? "" : raw;
     const today = memoryDate(opts.now);
     // Every appended entry ends its own line; a file the person left without
@@ -419,7 +466,7 @@ export function appendMemoryLog(botId, text, opts = {}) {
     const path = join(dir, file);
     let current = "";
     try {
-        current = readFileSync(path, "utf8");
+        current = readMemoryText(path);
     }
     catch {
         // first line of the day
@@ -442,7 +489,8 @@ export function writeMemoryLog(botId, name, text) {
 /** The bot's daily log files, oldest first, by day name. */
 export function listMemoryLogs(botId) {
     try {
-        return readdirSync(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR)).filter((name) => LOG_FILE_NAME.test(name)).sort();
+        const dir = join(workspaceDir(botId), "memory", MEMORY_LOG_DIR);
+        return memoryFolderEntries(dir).filter((name) => LOG_FILE_NAME.test(name) && (!regularMemoryFilesOnly || regularFile(join(dir, name)))).sort();
     }
     catch {
         return [];
@@ -453,7 +501,7 @@ export function readMemoryLog(botId, name) {
     if (!LOG_FILE_NAME.test(name))
         return null;
     try {
-        return readFileSync(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR, name), "utf8");
+        return readMemoryText(join(workspaceDir(botId), "memory", MEMORY_LOG_DIR, name));
     }
     catch {
         return null;
@@ -472,7 +520,7 @@ export function isMemoryTopicName(name) {
 export function listMemoryTopics(botId) {
     let entries;
     try {
-        entries = readdirSync(join(workspaceDir(botId), "memory"));
+        entries = memoryFolderEntries(join(workspaceDir(botId), "memory"));
     }
     catch {
         return [];
@@ -481,7 +529,7 @@ export function listMemoryTopics(botId) {
         .filter(isMemoryTopicName)
         .flatMap((name) => {
         try {
-            const stat = statSync(join(workspaceDir(botId), "memory", name));
+            const stat = memoryEntryStat(join(workspaceDir(botId), "memory", name));
             return stat.isFile() ? [{ name, bytes: stat.size }] : [];
         }
         catch {
@@ -507,7 +555,7 @@ export function readMemoryTopic(botId, name) {
     if (!isMemoryTopicName(name))
         return null;
     try {
-        return readFileSync(join(workspaceDir(botId), "memory", name), "utf8");
+        return readMemoryText(join(workspaceDir(botId), "memory", name));
     }
     catch {
         return null;
@@ -541,12 +589,14 @@ export function memoryTopicIndex(botId) {
     const dir = join(workspaceDir(botId), "memory");
     return renderTopicIndex(listMemoryTopics(botId).map((topic) => ({ name: topic.name, header: parseTopicHeader(readTopicHead(join(dir, topic.name))) })));
 }
-/** The memory block appended to a bot's system prompt. Always present for
- * bots with a workspace, so the bot knows the mechanism exists even before
+/** The memory block appended to a bot's system prompt when enabled. Present for
+ * enabled bots with a workspace, so the bot knows the mechanism exists even before
  * it has written anything. Content from other bots or imported files must
  * never be recorded as fact — memory is a prompt-injection persistence
  * vector the moment a bot copies untrusted text into it. */
 export function memorySystemPrompt(botId, opts = {}) {
+    if (opts.enabled === false)
+        return "";
     const memory = loadMemory(botId);
     const memoryFile = join(workspaceDir(botId), "MEMORY.md");
     const topicDir = join(workspaceDir(botId), "memory");

package/dist-server/shared/approval-mode.js

@@ -21,7 +21,7 @@ export function supportsApprovalMode(driverKind, mode) {
     // engines could never stop asking — not by its own level, and not through
     // a Chief's delegated Full access either.
     return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo", "qwenAgent", "geminiAgent",
-        "openai-compat", "grok", "minimax", "mistral"].includes(driverKind ?? "");
+        "openai-compat", "grok", "minimax", "mistral", "cerebras"].includes(driverKind ?? "");
 }
 /** A Full/Custom grant belongs to one provider's tool semantics. Other
  * modes carry across only when the destination actually implements them.

package/dist-server/shared/redact.js

@@ -21,6 +21,7 @@ const KEY_PREFIXES = [
     /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, // anthropic / openai / stripe
     /\bxai-[A-Za-z0-9_-]{20,}/g, // xai (grok)
     /\bgsk_[A-Za-z0-9]{40,}/g, // groq
+    /\bcsk-[A-Za-z0-9]{32,}/g, // cerebras
     /\bhf_[A-Za-z0-9]{30,}/g, // hugging face
     /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, // github classic
     /\bgithub_pat_[A-Za-z0-9_]{20,}/g, // github fine-grained

package/dist-server/shared/tool-name.js

@@ -0,0 +1,22 @@
+// A tool chip's display title is not a tool identity. Codex titles a
+// commandExecution chip with the whole command line (drivers/codex.ts) and
+// the ACP core prefers `rawInput.command` over the call's own name
+// (drivers/acp/core.ts), because in a transcript the command IS the useful
+// label. Anything that counts or groups tool calls needs the identity
+// instead, so both readers share one predicate rather than guessing twice.
+/** The generic identity every command-titled chip counts under. */
+export const SHELL_TOOL = "shell";
+/** A tool name that is itself a command line rather than a bare tool name
+ * such as `Bash`. Whitespace or a slash: no provider names a tool that way,
+ * and every shell command has one by the time it carries an argument or a
+ * path. */
+export function nameIsCommand(name) {
+    return /[\s/]/.test(name);
+}
+/** What a tool chip should be counted as. Command-titled chips collapse to
+ * one `shell` bucket: keyed on the raw command they never aggregate (a turn
+ * that ran one tool twelve times reads as twelve tools), and the raw title
+ * is unredacted — unlike `tool.summary`, which drivers bound and redact. */
+export function toolIdentity(name) {
+    return nameIsCommand(name) ? SHELL_TOOL : name;
+}

package/dist-server/shared/workspace-backup-client.js

@@ -7,6 +7,7 @@ export const WORKSPACE_BACKUP_CLIENT_KEYS = [
     "omb-draft-channel-modes",
     "omb-skin",
     "omb-show-threads",
+    "omb-show-run-card",
     "openmausbot.sidebarDensity",
     "openmausbot.sidebarCollapsedSections.v1",
     "openmausbot.sidebarSectionOrder.v1",