openmausbot 0.1.91 → 0.1.93

package/dist-server/workspace-backup.worker.js

@@ -3169,6 +3169,7 @@ var WORKSPACE_BACKUP_CLIENT_KEYS = [
   "omb-draft-channel-modes",
   "omb-skin",
   "omb-show-threads",
+  "omb-show-run-card",
   "openmausbot.sidebarDensity",
   "openmausbot.sidebarCollapsedSections.v1",
   "openmausbot.sidebarSectionOrder.v1",
@@ -18683,15 +18684,27 @@ var stdioEntrySchema = external_exports.object({
 var stdioMutationSchema = stdioEntrySchema.extend({
   env: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
 });
+var CLIENT_ID = /^[\x20-\x7e]+$/;
+var SCOPE = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+var CLIENT_SECRET_MAX = 4096;
+var oauthClientSchema = external_exports.object({
+  clientId: external_exports.string().trim().min(1, "Enter the client ID of the app registered with this server's sign-in provider.").max(512).regex(CLIENT_ID, "A client ID is printable text on one line."),
+  clientSecret: external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line.").optional(),
+  scopes: external_exports.array(external_exports.string().max(256).regex(SCOPE, "Scopes are single words, like offline_access or api://my-app/mcp.read.")).max(32).optional()
+}).strict();
 var remoteEntrySchema = external_exports.object({
   /** Streamable HTTP unless the entry says the older SSE transport. */
   type: external_exports.enum(["http", "sse"]).optional(),
   url: external_exports.string().trim().min(1).max(2048),
   headers: external_exports.record(external_exports.string(), external_exports.string().max(16384)).optional(),
+  oauth: oauthClientSchema.optional(),
   enabled: external_exports.boolean().optional()
 }).strict();
 var remoteMutationSchema = remoteEntrySchema.extend({
-  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional()
+  headers: external_exports.record(external_exports.string(), external_exports.union([external_exports.string().max(16384), external_exports.literal(true)])).optional(),
+  oauth: oauthClientSchema.extend({
+    clientSecret: external_exports.union([external_exports.string().min(1).max(CLIENT_SECRET_MAX).regex(CLIENT_ID, "A client secret is printable text on one line."), external_exports.literal(true)]).optional()
+  }).optional()
 });
 
 // server/schema.ts
@@ -18765,7 +18778,11 @@ var sessionSchema = external_exports.object({
   userId: external_exports.string().max(256).optional(),
   email: external_exports.string().max(320).optional(),
   /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
-  membershipAuthority: external_exports.literal("portal").optional()
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
 });
 var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
 
@@ -18777,6 +18794,7 @@ var optionalText = external_exports.string().optional();
 var SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 var LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
 var BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
+var FISH_TTS_MODELS = ["s2.1-pro", "s2.1-pro-free"];
 var MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 var MAX_ROOM_TURN_TIMEOUT_MINUTES = 1440;
 var DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
@@ -18787,6 +18805,8 @@ var MIN_THREAD_EVENT_LOG_BYTES = 256 * 1024;
 var MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
 var MIN_LOCAL_VM_MAX_INSTANCES = 1;
 var MAX_LOCAL_VM_MAX_INSTANCES = 8;
+var MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 5;
+var MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES = 1440;
 function isValidSshAlias(value) {
   return typeof value === "string" && SSH_ALIAS.test(value);
 }
@@ -18824,7 +18844,8 @@ var roomConfigSchema = external_exports.object({
 );
 var localVmConfigSchema = external_exports.object({
   mode: external_exports.enum(["shared", "per-bot", "pool"]).optional(),
-  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional()
+  maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional(),
+  idleTimeoutMinutes: external_exports.number().int().min(MIN_LOCAL_VM_IDLE_TIMEOUT_MINUTES).max(MAX_LOCAL_VM_IDLE_TIMEOUT_MINUTES).optional()
 });
 var browserProfileSchema = external_exports.object({
   // "guest" is the throwaway session's reserved id, never a saved profile
@@ -18983,7 +19004,11 @@ var onboardingConfigSchema = external_exports.object({
   /** Which welcome flow was completed; a newer flow may re-show itself. */
   version: external_exports.number().int().min(0).max(1e3).optional(),
   reelSeen: external_exports.boolean().optional(),
-  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional()
+  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional(),
+  /** OMB Cloud home only: when a bot's turn first finished on this machine
+   * (cloud-home.ts firstCloudTurnPatch). Written by the server, read by the
+   * Cloud's setup checklist. */
+  firstTurnAt: external_exports.string().trim().max(40).optional()
 }).strict();
 var instanceConfigSchema = external_exports.object({
   driver: external_exports.string().min(1),
@@ -18995,6 +19020,7 @@ var instanceConfigSchema = external_exports.object({
   ]).optional(),
   environment: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   enabled: external_exports.boolean().optional(),
+  access: external_exports.enum(["subscription", "custom", "api"]).optional(),
   config: external_exports.json().optional()
 });
 var instanceConfigMapSchema = external_exports.record(external_exports.string(), instanceConfigSchema);
@@ -19052,11 +19078,17 @@ var appConfigSchema = external_exports.object({
     phone: external_exports.enum(["ios", "android"]).optional()
   }).optional(),
   mistral: external_exports.object({ key: optionalText }).optional(),
+  cerebras: external_exports.object({ key: optionalText }).optional(),
   xai: external_exports.object({ key: optionalText, url: optionalText }).optional(),
   /** Anthropic API key for Claude Code billed per token, handed only to
    * Claude instances; `url` only for a proxy or a test double. Never a
    * personal-login OAuth token. */
-  anthropic: external_exports.object({ key: optionalText, url: optionalText }).optional(),
+  anthropic: external_exports.object({ key: optionalText, url: optionalText, everyClaudeBot: external_exports.boolean().optional() }).optional(),
+  /** OpenAI's own API key, for the `openai` instance only. Codex keeps its
+   * own ChatGPT or API login and never reads this. */
+  openai: external_exports.object({ key: optionalText }).optional(),
+  /** OpenRouter key, for the `openrouter` instance only. */
+  openrouter: external_exports.object({ key: optionalText }).optional(),
   /** Monthly spend limit for the whole workspace, against the cost engines
    * report to the usage ledger. Enforced only with the `budgets` entitlement. */
   budgets: external_exports.object({
@@ -19090,8 +19122,8 @@ var appConfigSchema = external_exports.object({
   opencodeGo: external_exports.object({ apiKey: optionalText }).optional(),
   /** Voice settings and the selected voice id. `provider` picks the
    * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
-   * `fishKey`), "system" (the Mac's built-in voices, no key), or
-   * "xai" (Grok TTS, reusing `xai.key`), or
+   * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
+   * built-in voices, no key), "xai" (Grok TTS, reusing `xai.key`), or
    * "chatterbox" (a local OpenAI-compatible Chatterbox server; `baseUrl`
    * and `model` are settings, not secrets). Cloud keys stay separate so
    * switching providers never overwrites or misuses the other key. */
@@ -19101,7 +19133,8 @@ var appConfigSchema = external_exports.object({
     voice: optionalText,
     provider: external_exports.enum(["elevenlabs", "fish", "system", "chatterbox", "xai"]).optional(),
     baseUrl: external_exports.string().trim().max(2048).refine((value) => !value || /^https?:\/\//i.test(value), "the Chatterbox server address must start with http:// or https://").optional(),
-    model: optionalText
+    model: optionalText,
+    fishModel: external_exports.enum(FISH_TTS_MODELS).optional()
   }).optional(),
   /** The decision model (server/decider): a fast classifier that picks
    * things for bots, starting with who answers a room message. `key` is
@@ -19194,6 +19227,34 @@ var DATA_DIR = process.env.OMB_DATA_DIR ?? join2(homedir(), ".openmausbot");
 var LEGACY_DATA_DIR = join2(homedir(), ".opengrokbot");
 var EVENTS_DIR = join2(DATA_DIR, "events");
 var NATIVE_DIR = join2(DATA_DIR, "native");
+var OPENAI_API_INSTANCE = "openai";
+var OPENROUTER_API_INSTANCE = "openrouter";
+var XAI_API_INSTANCE = "xaiApi";
+var CLAUDE_API_INSTANCE = "claudeApi";
+var API_KEY_FLEET = {
+  [OPENAI_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenAI",
+    access: "api",
+    icon: { kind: "preset", preset: "openai" },
+    config: { url: "https://api.openai.com/v1", apiKeyEnv: "OMB_OPENAI_API_KEY", catalog: "openai" }
+  },
+  [CLAUDE_API_INSTANCE]: {
+    driver: "claudeAgent",
+    displayName: "Claude (API key)",
+    access: "api",
+    icon: { kind: "preset", preset: "anthropic" },
+    config: { requireApiKey: true }
+  },
+  [XAI_API_INSTANCE]: { driver: "grok", displayName: "xAI", access: "api", icon: { kind: "preset", preset: "xai" } },
+  [OPENROUTER_API_INSTANCE]: {
+    driver: "openai-compat",
+    displayName: "OpenRouter",
+    access: "api",
+    icon: { kind: "preset", preset: "openrouter" },
+    config: { url: "https://openrouter.ai/api/v1", apiKeyEnv: "OMB_OPENROUTER_API_KEY" }
+  }
+};
 
 // server/workspace-backup-policy.ts
 var PORTABLE_CONFIG_KEYS = [
@@ -19214,6 +19275,7 @@ function portableWorkspaceConfig(value) {
 }
 function excludedWorkspaceAuthPath(path) {
   if (/^command-allowlist\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path)) return true;
+  if (/^mcp-oauth\.json(?:$|\.\d+\.[0-9a-f-]+\.tmp$)/.test(path)) return true;
   return /^(?:(?:providers|caddy|chrome-profile|\.agent-browser)(?:\/|$)|workspace-credentials\.json$|external-runtimes\.json$|browser-engine-key$)/.test(path) || /^(?:config\.json|webhooks\.json|workspace-credentials\.json|external-runtimes\.json|browser-engine-key|sessions\.json|tunnel-account\.json)\.\d+(?:\.[0-9a-f-]+)?\.tmp$/.test(path) || /^(?:vm-home|vm-homes\/[^/]+)\/\.browser-profiles(?:\/|$)/.test(path);
 }
 function redownloadedOrgLibraryPath(path) {
@@ -19251,12 +19313,16 @@ var EXCLUDED = /* @__PURE__ */ new Set([
   "messages.db-shm",
   // This machine's decision-model log (server/decider/log.ts): local
   // measurement of what the classifier picked, not workspace data.
-  "decider-log"
+  "decider-log",
+  // A Cloud home's record of who its owner was (server/cloud-owner.ts): this
+  // machine's own, kept in place by a restore, which settles what it brought.
+  "cloud-owner.json"
 ]);
 var EXCLUSION_NOTES = [
   "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",
   "Saved credentials, provider and MCP connections, managed provider login homes and browser login profiles are not transferred. Destination connections are preserved; reconnect on a new device.",
   "Downloaded tools and caches; these can be installed again.",
+  "Installed dependency folders (node_modules) and symbolic links inside conversation work folders; reinstall or recreate them in the project.",
   "External project folders, CLI login homes, browser session homes, OS keychains, companion devices and other servers.",
   "VM/container disk layers and remote cloud data; durable files inside this workspace are included."
 ];
@@ -19451,6 +19517,8 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
   const warnings = ["Stop external editors and managed desktops before exporting; files written outside this server cannot be frozen by the backup gate.", "Conversation text and user files are not redacted and may contain secrets you pasted. Keep the encrypted backup private.", RESTORE_WARNING];
   let bytes = 0;
   let skippedLinks = 0;
+  let skippedDependencies = 0;
+  let skippedWorkLinks = 0;
   try {
     const root = realpathSync(dataDir2);
     const sourceDb = join3(root, "messages.db");
@@ -19481,6 +19549,14 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
         if (!validRelative(path2)) throw new Error("A workspace filename cannot be safely restored on supported platforms.");
         const source = join3(directory, name);
         const stat = lstatSync(source);
+        if (name === "node_modules" && (stat.isDirectory() || stat.isSymbolicLink())) {
+          skippedDependencies++;
+          continue;
+        }
+        if (stat.isSymbolicLink() && path2.startsWith("task-workspaces/")) {
+          skippedWorkLinks++;
+          continue;
+        }
         if (stat.isSymbolicLink()) {
           let target;
           try {
@@ -19526,6 +19602,8 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
     };
     walk(root);
     if (skippedLinks) warnings.push(`${skippedLinks} managed skill discovery link(s) were omitted and are recreated by the app.`);
+    if (skippedDependencies) warnings.push(`${skippedDependencies} installed dependency folder(s) (node_modules) were omitted; reinstall them in the project after restoring.`);
+    if (skippedWorkLinks) warnings.push(`${skippedWorkLinks} symbolic link(s) in conversation work folders were omitted; what they point to is outside this backup.`);
     const summary = {
       format: "openmaus.workspace-backup",
       version: 1,

package/enterprise/server/index.js

@@ -14728,7 +14728,11 @@ var sessionSchema = external_exports.object({
   userId: external_exports.string().max(256).optional(),
   email: external_exports.string().max(320).optional(),
   /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
-  membershipAuthority: external_exports.literal("portal").optional()
+  membershipAuthority: external_exports.literal("portal").optional(),
+  /** A browser sign-in (PairingCode `browser`): accepted only as its browser's cookie, never as a bearer token. */
+  cookieOnly: external_exports.literal(true).optional(),
+  /** Whose OMB Cloud a browser sign-in signed in to (its PairingCode `owner`). */
+  owner: external_exports.string().max(254).optional()
 });
 var fileSchema = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-DrfGMu7X.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-VhEMkSND.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};