openmausbot 0.1.91 → 0.1.93

package/dist-server/src/lib/citations.js

@@ -0,0 +1,177 @@
+// Selection matching is adapted from T3 Code's assistantTextSelection.ts
+// (Copyright 2026 T3 Tools Inc., MIT License; see third_party/t3-code/LICENSE).
+export const CITATION_MAX_QUOTE_LENGTH = 12_000;
+export const CITATION_MAX_COMMENT_LENGTH = 4_000;
+const CITATION_CONTEXT_LENGTH = 64;
+const CITATION_MARKER = "<!--omb-citation-v1:";
+const CITATION_MARKER_RE = /<!--omb-citation-v1:([A-Za-z0-9_-]{1,100000})-->/g;
+function boundedString(value, max, allowEmpty = false) {
+    return typeof value === "string" && value.length <= max && (allowEmpty || value.length > 0);
+}
+export function isCitationAttachment(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const citation = value;
+    const source = citation.source;
+    return citation.kind === "citation" &&
+        citation.version === 1 &&
+        boundedString(citation.id, 200) &&
+        boundedString(citation.quote, CITATION_MAX_QUOTE_LENGTH) &&
+        (citation.comment === undefined || boundedString(citation.comment, CITATION_MAX_COMMENT_LENGTH, true)) &&
+        typeof citation.size === "number" && Number.isFinite(citation.size) && citation.size >= 0 &&
+        Boolean(source) &&
+        (source.ownerType === "bot" || source.ownerType === "group") &&
+        boundedString(source.ownerId, 200) &&
+        boundedString(source.threadId, 200) &&
+        boundedString(source.messageId, 200) &&
+        Number.isSafeInteger(source.start) && Number(source.start) >= 0 &&
+        Number.isSafeInteger(source.end) && Number(source.end) >= Number(source.start) &&
+        boundedString(source.prefix, CITATION_CONTEXT_LENGTH, true) &&
+        boundedString(source.suffix, CITATION_CONTEXT_LENGTH, true);
+}
+function newId() {
+    return globalThis.crypto?.randomUUID?.() ?? `c${Math.random().toString(36).slice(2)}`;
+}
+function byteLength(text) {
+    return new TextEncoder().encode(text).length;
+}
+export function citationAttachment(source, selector, comment = "") {
+    const trimmedComment = comment.trim();
+    if (!selector.text.trim() || selector.text.length > CITATION_MAX_QUOTE_LENGTH) {
+        throw new Error("Citation quote is empty or too long");
+    }
+    if (trimmedComment.length > CITATION_MAX_COMMENT_LENGTH)
+        throw new Error("Citation comment is too long");
+    return {
+        kind: "citation",
+        version: 1,
+        id: newId(),
+        quote: selector.text,
+        ...(trimmedComment ? { comment: trimmedComment } : {}),
+        source: { ...source, start: selector.start, end: selector.end, prefix: selector.prefix, suffix: selector.suffix },
+        size: byteLength(selector.text) + byteLength(trimmedComment),
+    };
+}
+export function withCitationComment(citation, comment) {
+    const trimmed = comment.trim();
+    if (trimmed.length > CITATION_MAX_COMMENT_LENGTH)
+        throw new Error("Citation comment is too long");
+    const { comment: _old, ...rest } = citation;
+    return { ...rest, ...(trimmed ? { comment: trimmed } : {}), size: byteLength(citation.quote) + byteLength(trimmed) };
+}
+function base64UrlEncode(value) {
+    const bytes = new TextEncoder().encode(JSON.stringify(value));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    return JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (character) => character.charCodeAt(0))));
+}
+/** Readable in clients without citation UI and unambiguous to model providers. */
+export function citationFallback(citation) {
+    const quote = citation.quote.split("\n").map((line) => `> ${line}`).join("\n");
+    return `> Quoted message:\n${quote}${citation.comment ? `\n\nComment:\n${citation.comment}` : ""}`;
+}
+export function serializeCitation(citation) {
+    return `${CITATION_MARKER}${base64UrlEncode(citation)}-->\n${citationFallback(citation)}`;
+}
+export function splitTranscriptCitations(text) {
+    const citations = [];
+    let display = "";
+    let cursor = 0;
+    for (const match of text.matchAll(CITATION_MARKER_RE)) {
+        if (match.index < cursor)
+            continue;
+        let citation;
+        try {
+            const decoded = base64UrlDecode(match[1]);
+            if (!isCitationAttachment(decoded))
+                continue;
+            citation = decoded;
+        }
+        catch {
+            continue;
+        }
+        const block = `${match[0]}\n${citationFallback(citation)}`;
+        if (!text.startsWith(block, match.index))
+            continue;
+        display += text.slice(cursor, match.index);
+        cursor = match.index + block.length;
+        citations.push(citation);
+    }
+    return { display: `${display}${text.slice(cursor)}`.trim(), citations };
+}
+export function citationPreviewText(text) {
+    const cited = splitTranscriptCitations(text);
+    if (!cited.citations.length)
+        return text;
+    return [
+        cited.display,
+        ...cited.citations.map((citation) => citation.comment
+            ? `${citation.quote} — ${citation.comment}`
+            : citation.quote),
+    ].filter(Boolean).join(" ");
+}
+function normalizeWhitespace(text) {
+    return text.replace(/\s+/g, " ");
+}
+function splitsSurrogatePair(text, offset) {
+    const before = text.charCodeAt(offset - 1);
+    const after = text.charCodeAt(offset);
+    return before >= 0xd800 && before <= 0xdbff && after >= 0xdc00 && after <= 0xdfff;
+}
+export function createCitationTextSelector(text, rawStart, rawEnd) {
+    const quote = text.slice(rawStart, rawEnd);
+    if (!quote.trim())
+        return null;
+    const normalized = normalizeWhitespace(text);
+    let start = normalizeWhitespace(text.slice(0, rawStart)).length;
+    if (rawStart > 0 && /\s/.test(text[rawStart - 1]) && /\s/.test(text[rawStart]))
+        start -= 1;
+    const end = normalizeWhitespace(text.slice(0, rawEnd)).length;
+    let prefixStart = Math.max(0, start - CITATION_CONTEXT_LENGTH);
+    let suffixEnd = Math.min(normalized.length, end + CITATION_CONTEXT_LENGTH);
+    if (splitsSurrogatePair(normalized, prefixStart))
+        prefixStart += 1;
+    if (splitsSurrogatePair(normalized, suffixEnd))
+        suffixEnd -= 1;
+    return {
+        text: quote,
+        start,
+        end,
+        prefix: normalized.slice(prefixStart, start),
+        suffix: normalized.slice(end, suffixEnd),
+    };
+}
+export function findCitationText(text, selector) {
+    const normalized = normalizeWhitespace(text);
+    const quote = normalizeWhitespace(selector.text);
+    if (!quote.trim())
+        return null;
+    const prefix = normalizeWhitespace(selector.prefix);
+    const suffix = normalizeWhitespace(selector.suffix);
+    const matchesContext = (start, end) => normalized.slice(Math.max(0, start - prefix.length), start) === prefix &&
+        normalized.slice(end, end + suffix.length) === suffix;
+    let match = Number.isSafeInteger(selector.start) && Number.isSafeInteger(selector.end) &&
+        selector.start >= 0 && selector.end - selector.start === quote.length &&
+        normalized.slice(selector.start, selector.end) === quote && matchesContext(selector.start, selector.end)
+        ? { start: selector.start, end: selector.end }
+        : null;
+    let onlyQuote = null;
+    let quoteCount = 0;
+    for (let start = normalized.indexOf(quote); start !== -1; start = normalized.indexOf(quote, start + 1)) {
+        const end = start + quote.length;
+        quoteCount += 1;
+        onlyQuote = { start, end };
+        if (!matchesContext(start, end))
+            continue;
+        if (match && match.start !== start)
+            return null;
+        match = { start, end };
+    }
+    return match ?? (quoteCount === 1 ? onlyQuote : null);
+}

package/dist-server/src/lib/composer-attachments.js

@@ -1,7 +1,10 @@
+import { isCitationAttachment, serializeCitation } from "./citations.js";
 export function isAttachment(value) {
     if (!value || typeof value !== "object")
         return false;
     const attachment = value;
+    if (attachment.kind === "citation")
+        return isCitationAttachment(value);
     if (typeof attachment.id !== "string" || !validSize(attachment.size))
         return false;
     if (attachment.kind === "paste") {
@@ -362,7 +365,10 @@ export function formatSize(bytes) {
 export function composeMessage(text, attachments) {
     const parts = [text.trim()];
     attachments.forEach((a, i) => {
-        if (a.kind === "paste") {
+        if (a.kind === "citation") {
+            parts.push(serializeCitation(a));
+        }
+        else if (a.kind === "paste") {
             parts.push(`<pasted-text index="${i + 1}">\n${a.text}\n</pasted-text>`);
         }
         else if (a.kind === "image") {

package/dist-server/vps-container-mcp.js

@@ -90,6 +90,9 @@ function nvmBinDirs() {
     return [];
   }
 }
+function sealedFixture() {
+  return process.env.OMB_TEST_SEALED_PATH === "1";
+}
 function knownDirs() {
   const home = homedir();
   return [
@@ -105,10 +108,13 @@ function knownDirs() {
     // opencode installer
     join(home, ".claude", "local"),
     // claude "local install"
-    "/opt/homebrew/bin",
-    // brew, Apple silicon
-    "/usr/local/bin",
-    // brew Intel / classic installs
+    // Machine-wide rather than under the (possibly temporary) home.
+    ...sealedFixture() ? [] : [
+      "/opt/homebrew/bin",
+      // brew, Apple silicon
+      "/usr/local/bin"
+      // brew Intel / classic installs
+    ],
     join(home, ".volta", "bin"),
     join(home, ".bun", "bin"),
     join(home, ".asdf", "shims"),
@@ -130,6 +136,8 @@ function windowsKnownDirs() {
     // x.ai installer
     join(localAppData, "agy", "bin"),
     // Antigravity installer
+    // Cursor installer: cursor-agent.* and its `agent` copies (MOCA-272)
+    join(localAppData, "cursor-agent"),
     join(home, ".local", "bin"),
     // claude native installer
     join(home, ".claude", "local"),
@@ -137,7 +145,9 @@ function windowsKnownDirs() {
     // Factory droid installer (%USERPROFILE%\bin)
     join(home, ".bun", "bin"),
     join(home, ".deno", "bin"),
-    join(home, "go", "bin")
+    join(home, "go", "bin"),
+    join(process.env.ProgramFiles ?? "C:\\Program Files", "Docker", "Docker", "resources", "bin")
+    // Docker Desktop installer
   ];
 }
 var cached = null;
@@ -160,7 +170,7 @@ function augmentedPath() {
       ...(process.platform === "win32" ? windowsKnownDirs() : knownDirs()).filter((d) => existsSync(d))
     ]);
   }
-  if (!probed && !process.env.VITEST && process.platform !== "win32") {
+  if (!probed && !process.env.VITEST && !sealedFixture() && process.platform !== "win32") {
     probed = true;
     probeLoginShellPath();
   }
@@ -184,6 +194,119 @@ function probeLoginShellPath() {
     }
   );
 }
+function splitCliString(cli) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  for (const ch of cli.trim()) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+    } else if (/\s/.test(ch)) {
+      if (cur) out.push(cur);
+      cur = "";
+    } else {
+      cur += ch;
+    }
+  }
+  if (cur) out.push(cur);
+  return out;
+}
+function isFile(p2) {
+  try {
+    return statSync(p2, { throwIfNoEntry: false })?.isFile() ?? false;
+  } catch {
+    return false;
+  }
+}
+function whichWin(cli, env) {
+  const exts = ((env ?? process.env).PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const probe = (base) => {
+    const order = extname(base) ? [base, ...exts.map((e) => base + e)] : [...exts.map((e) => base + e), base];
+    return order.find(isFile) ?? null;
+  };
+  if (/[\\/]/.test(cli) || /^[a-zA-Z]:/.test(cli)) return probe(cli);
+  const path = env ? env.PATH ?? env.Path ?? "" : augmentedPath();
+  for (const dir of path.split(delimiter)) {
+    if (!dir) continue;
+    const hit = probe(join(dir, cli));
+    if (hit) return hit;
+  }
+  return null;
+}
+function nodeExe(near, env) {
+  const local = join(near, "node.exe");
+  if (isFile(local)) return local;
+  const onPath = whichWin("node.exe", env);
+  if (onPath && extname(onPath).toLowerCase() === ".exe") return onPath;
+  return process.versions.electron ? null : process.execPath;
+}
+function parseCmdShim(shim, env) {
+  let text;
+  try {
+    text = readFileSync(shim, "utf8");
+  } catch {
+    return null;
+  }
+  const dir = dirname(shim);
+  const npmEntry = /^SET "NP[MX]_CLI_JS=%~dp0\\([^"]+)"/im.exec(text);
+  const targets = [...npmEntry ? [npmEntry] : [], ...text.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m2) => join(dir, m2[1])).filter((p2) => isFile(p2) && basename(p2).toLowerCase() !== "node.exe");
+  const script = targets.find((p2) => /\.[cm]?js$/i.test(p2));
+  if (script) {
+    const node = nodeExe(dir, env);
+    if (node) return { command: node, args: [script] };
+  }
+  const exe = targets.find((p2) => extname(p2).toLowerCase() === ".exe");
+  return exe ? { command: exe, args: [] } : null;
+}
+function parseNodeShebang(file2, env) {
+  let head = "";
+  let fd = null;
+  try {
+    fd = openSync(file2, "r");
+    const buf = Buffer.alloc(128);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    head = buf.subarray(0, n).toString("utf8").split("\n", 1)[0];
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+  if (!/^#!.*\bnode(\.exe)?\b/.test(head)) return null;
+  const node = nodeExe(dirname(file2), env);
+  return node ? { command: node, args: [file2] } : null;
+}
+function resolveWord(cli, args2, env) {
+  if (process.platform !== "win32") return { command: cli, args: args2 };
+  const file2 = whichWin(cli, env);
+  if (!file2) return { command: cli, args: args2 };
+  const ext = extname(file2).toLowerCase();
+  if (ext === ".cmd" || ext === ".bat") {
+    const direct = parseCmdShim(file2, env);
+    return direct ? { command: direct.command, args: [...direct.args, ...args2] } : { command: file2, args: args2 };
+  }
+  if (ext === ".exe" || ext === ".com") return { command: file2, args: args2 };
+  const viaNode = parseNodeShebang(file2, env);
+  return viaNode ? { command: viaNode.command, args: [...viaNode.args, ...args2] } : { command: file2, args: args2 };
+}
+function resolveCliSpawn(cli, args2, env) {
+  const trimmed = cli.trim();
+  if (trimmed.includes(" ") && existsSync(trimmed)) return resolveWord(trimmed, args2, env);
+  const split = splitCliString(cli);
+  if (split.length > 1 || split[0] !== trimmed) {
+    const [head, ...fixed] = split;
+    if (!head) return { command: cli, args: args2 };
+    return resolveWord(head, [...fixed, ...args2], env);
+  }
+  return resolveWord(cli, args2, env);
+}
 
 // server/mcp-tool-schema.ts
 var ROOT_COMBINATORS = ["anyOf", "oneOf", "allOf", "not"];
@@ -407,9 +530,11 @@ function createMcpBridgeInterceptor(options) {
   };
 }
 function runMcpBridge(options) {
-  const child = spawn(options.command, options.args, {
+  const env = options.env ?? { ...process.env, PATH: augmentedPath() };
+  const { command, args: args2 } = resolveCliSpawn(options.command, options.args, env);
+  const child = spawn(command, args2, {
     shell: false,
-    env: options.env ?? { ...process.env, PATH: augmentedPath() },
+    env,
     stdio: ["pipe", "pipe", "pipe"]
   });
   child.stdin.on("error", () => {
@@ -16008,15 +16133,27 @@ var stdioEntrySchema = external_exports.object({
 var stdioMutationSchema = stdioEntrySchema.extend({
   env: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
 });
+var CLIENT_ID = /^[\x20-\x7e]+$/;
+var SCOPE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+var CLIENT_SECRET_MAX = 4096;
+var oauthClientSchema = external_exports.object({
+  clientId: external_exports.string().trim().min(1, "Enter the client ID of the app registered with this server's sign-in provider.").max(512).regex(CLIENT_ID, "A client ID is printable text on one line."),
+  clientSecret: external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line.").optional(),
+  scopes: external_exports.array(external_exports.string().max(256).regex(SCOPE, "Scopes are single words, like offline_access or api://my-app/mcp.read.")).max(32).optional()
+}).strict();
 var remoteEntrySchema = external_exports.object({
   /** Streamable HTTP unless the entry says the older SSE transport. */
   type: external_exports.enum(["http", "sse"]).optional(),
   url: external_exports.string().trim().min(1).max(2048),
   headers: external_exports.record(external_exports.string(), external_exports.string().max(16384)).optional(),
+  oauth: oauthClientSchema.optional(),
   enabled: external_exports.boolean().optional()
 }).strict();
 var remoteMutationSchema = remoteEntrySchema.extend({
-  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
+  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional(),
+  oauth: oauthClientSchema.extend({
+    clientSecret: external_exports.union([external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line."), external_exports.literal(true)]).optional()
+  }).optional()
 });
 
 // server/cloud-overflow.ts
@@ -16082,7 +16219,11 @@ var sessionSchema = external_exports.object({
   userId: external_exports.string().max(256).optional(),
   email: external_exports.string().max(320).optional(),
   /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
-  membershipAuthority: external_exports.literal("portal").optional()
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
 });
 var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
 
@@ -16094,6 +16235,7 @@ var optionalText = external_exports.string().optional();
 var SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 var LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
 var BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
+var FISH_TTS_MODELS = ["s2.1-pro", "s2.1-pro-free"];
 var MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 var MAX_ROOM_TURN_TIMEOUT_MINUTES = 1440;
 var DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
@@ -16104,6 +16246,8 @@ var MIN_THREAD_EVENT_LOG_BYTES = 256 * 1024;
 var MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
 var MIN_LOCAL_VM_MAX_INSTANCES = 1;
 var MAX_LOCAL_VM_MAX_INSTANCES = 8;
+var MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 5;
+var MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 1440;
 function isValidSshAlias(value) {
   return typeof value === "string" && SSH_ALIAS.test(value);
 }
@@ -16141,7 +16285,8 @@ var roomConfigSchema = external_exports.object({
 );
 var localVmConfigSchema = external_exports.object({
   mode: external_exports.enum(["shared", "per-bot", "pool"]).optional(),
-  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional()
+  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional(),
+  idleTimeoutMinutes: external_exports.number().int().min(MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES).max(MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES).optional()
 });
 var browserProfileSchema = external_exports.object({
   // "guest" is the throwaway session's reserved id, never a saved profile
@@ -16300,7 +16445,11 @@ var onboardingConfigSchema = external_exports.object({
   /** Which welcome flow was completed; a newer flow may re-show itself. */
   version: external_exports.number().int().min(0).max(1e3).optional(),
   reelSeen: external_exports.boolean().optional(),
-  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional()
+  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional(),
+  /** OMB Cloud home only: when a bot's turn first finished on this machine
+   * (cloud-home.ts firstCloudTurnPatch). Written by the server, read by the
+   * Cloud's setup checklist. */
+  firstTurnAt: external_exports.string().trim().max(40).optional()
 }).strict();
 var instanceConfigSchema = external_exports.object({
   driver: external_exports.string().min(1),
@@ -16312,6 +16461,7 @@ var instanceConfigSchema = external_exports.object({
   ]).optional(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   enabled: external_exports.boolean().optional(),
+  access: external_exports.enum(["subscription", "custom", "api"]).optional(),
   config: external_exports.json().optional()
 });
 var instanceConfigMapSchema = external_exports.record(external_exports.string(), instanceConfigSchema);
@@ -16369,11 +16519,17 @@ var appConfigSchema = external_exports.object({
     phone: external_exports.enum(["ios", "android"]).optional()
   }).optional(),
   mistral: external_exports.object({ key: optionalText }).optional(),
+  cerebras: external_exports.object({ key: optionalText }).optional(),
   xai: external_exports.object({ key: optionalText, url: optionalText }).optional(),
   /** Anthropic API key for Claude Code billed per token, handed only to
    * Claude instances; `url` only for a proxy or a test double. Never a
    * personal-login OAuth token. */
-  anthropic: external_exports.object({ key: optionalText, url: optionalText }).optional(),
+  anthropic: external_exports.object({ key: optionalText, url: optionalText, everyClaudeBot: external_exports.boolean().optional() }).optional(),
+  /** OpenAI's own API key, for the `openai` instance only. Codex keeps its
+   * own ChatGPT or API login and never reads this. */
+  openai: external_exports.object({ key: optionalText }).optional(),
+  /** OpenRouter key, for the `openrouter` instance only. */
+  openrouter: external_exports.object({ key: optionalText }).optional(),
   /** Monthly spend limit for the whole workspace, against the cost engines
    * report to the usage ledger. Enforced only with the `budgets` entitlement. */
   budgets: external_exports.object({
@@ -16407,8 +16563,8 @@ var appConfigSchema = external_exports.object({
   opencodeGo: external_exports.object({ apiKey: optionalText }).optional(),
   /** Voice settings and the selected voice id. `provider` picks the
    * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
-   * `fishKey`), "system" (the Mac's built-in voices, no key), or
-   * "xai" (Grok TTS, reusing `xai.key`), or
+   * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
+   * built-in voices, no key), "xai" (Grok TTS, reusing `xai.key`), or
    * "chatterbox" (a local OpenAI-compatible Chatterbox server; `baseUrl`
    * and `model` are settings, not secrets). Cloud keys stay separate so
    * switching providers never overwrites or misuses the other key. */
@@ -16418,7 +16574,8 @@ var appConfigSchema = external_exports.object({
     voice: optionalText,
     provider: external_exports.enum(["elevenlabs", "fish", "system", "chatterbox", "xai"]).optional(),
     baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the Chatterbox server address must start with http:// or https://").optional(),
-    model: optionalText
+    model: optionalText,
+    fishModel: external_exports.enum(FISH_TTS_MODELS).optional()
   }).optional(),
   /** The decision model (server/decider): a fast classifier that picks
    * things for bots, starting with who answers a room message. `key` is
@@ -16506,6 +16663,34 @@ var DATA_DIR = process.env.OMB_DATA_DIR ?? join3(homedir2(), ".openmausbot");
 var LEGACY_DATA_DIR = join3(homedir2(), ".opengrokbot");
 var EVENTS_DIR = join3(DATA_DIR, "events");
 var NATIVE_DIR = join3(DATA_DIR, "native");
+var OPENAI_API_INSTANCE = "openai";
+var OPENROUTER_API_INSTANCE = "openrouter";
+var XAI_API_INSTANCE = "xaiApi";
+var CLAUDE_API_INSTANCE = "claudeApi";
+var API_KEY_FLEET = {
+  [OPENAI_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenAI",
+    access: "api",
+    icon: { kind: "preset", preset: "openai" },
+    config: { url: "https://api.openai.com/v1", apiKeyEnv: "OMB_OPENAI_API_KEY", catalog: "openai" }
+  },
+  [CLAUDE_API_INSTANCE]: {
+    driver: "claudeAgent",
+    displayName: "Claude (API key)",
+    access: "api",
+    icon: { kind: "preset", preset: "anthropic" },
+    config: { requireApiKey: true }
+  },
+  [XAI_API_INSTANCE]: { driver: "grok", displayName: "xAI", access: "api", icon: { kind: "preset", preset: "xai" } },
+  [OPENROUTER_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenRouter",
+    access: "api",
+    icon: { kind: "preset", preset: "openrouter" },
+    config: { url: "https://openrouter.ai/api/v1", apiKeyEnv: "OMB_OPENROUTER_API_KEY" }
+  }
+};
 
 // server/container-computer.ts
 var run = promisify(execFile2);
@@ -16637,6 +16822,7 @@ var CONTAINER_ID = /^[a-f0-9]{12,64}$/i;
 var LOCK_ACQUIRE_TIMEOUT_MS = 5e3;
 var SCREENSHOT_BUDGET_MS = 45e3;
 var PREPARATION_LOCK_TIMEOUT_MS = SCREENSHOT_BUDGET_MS + LOCK_ACQUIRE_TIMEOUT_MS;
+var NATIVE_VIEWER_LIFETIME_MS = 8 * 60 * 6e4;
 function vpsDockerArgs(alias2, args2) {
   if (!isValidSshAlias(alias2)) {
     throw new Error("invalid VPS SSH config alias");