openmausbot 0.1.92 → 0.1.93

package/dist-server/server/routes/desktop-viewer.js

@@ -10,6 +10,8 @@ const ROUTE = /^\/api\/desktop-viewer\/(local\/(?:shared|bot-[a-f0-9]{64}|pool-\
 const HANDSHAKE_MS = 10_000;
 const RECHECK_MS = 5_000;
 const WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+const BOT_ID = /^[\w-]+$/;
+const CONTROL_LEASE = /^[A-Za-z0-9_-]{16,120}$/;
 export function desktopViewerUrl(target, threadId) {
     const params = new URLSearchParams({ target, ...(threadId ? { threadId } : {}) });
     return `/desktop-viewer#${params}`;
@@ -67,7 +69,7 @@ export function createDesktopViewer(deps) {
             }).finally(() => clearTimeout(timeout));
         });
     }
-    const route = async ({ req, res, path, method, auth, json }) => {
+    const route = async ({ req, res, url, path, method, auth, json }) => {
         const match = ROUTE.exec(path);
         if (!match)
             return PASS;
@@ -78,12 +80,39 @@ export function createDesktopViewer(deps) {
         // to admin, like the existing Local VM status and control endpoints.
         if (!auth.scopes.includes("admin") || !isSameOrigin(req))
             return json(res, 403, { error: "forbidden" });
+        // A viewer bound to a control lease: both names or neither, well formed,
+        // and holding before anything is inspected. Checked again with every
+        // liveness pass, so handing back closes the desktop within seconds. The
+        // conversation, when named, picks the VM seat the join picked.
+        const botId = url.searchParams.get("botId");
+        const controlLeaseId = url.searchParams.get("controlLeaseId");
+        const threadId = url.searchParams.get("threadId") ?? undefined;
+        if ((botId === null) !== (controlLeaseId === null)) {
+            return json(res, 400, { error: "botId and controlLeaseId go together" });
+        }
+        if (botId !== null && (!BOT_ID.test(botId) || !CONTROL_LEASE.test(controlLeaseId) || !deps.lease
+            || (threadId !== undefined && !BOT_ID.test(threadId)))) {
+            return json(res, 400, { error: "botId, threadId or controlLeaseId is not valid" });
+        }
+        if (botId === null && threadId !== undefined)
+            return json(res, 400, { error: "threadId needs botId and controlLeaseId" });
+        // Do not let a saved or constructed socket URL bypass the join refusal:
+        // a bot's control lease does not exclude other users of a shared desktop.
+        if (botId !== null && (match[1] === "local/shared" || match[1].startsWith("local/pool-"))) {
+            return json(res, 409, { error: "Phone control requires a per-bot Local VM. Select per-bot mode in Settings → Computers." });
+        }
+        const bound = botId === null ? undefined : deps.lease(match[1], botId, controlLeaseId, threadId);
+        if (botId !== null && !bound)
+            return json(res, 409, { error: "Take control of this computer first" });
+        const holds = () => bound?.() ?? true;
         const target = deps.target(match[1]);
         if (!target)
             return json(res, 404, { error: "Desktop not found" });
         const upgrade = upgrades.get(req);
         if (upgrade && auth.kind === "session")
             upgrade.owner = auth.session.id;
+        if (upgrade && botId !== null)
+            upgrade.botId = botId;
         let connection;
         try {
             connection = await target.resolve();
@@ -98,6 +127,8 @@ export function createDesktopViewer(deps) {
         const live = () => deps.live(auth) && deps.target(match[1])?.key === target.key && (connection.live?.() ?? true);
         if (!live())
             return json(res, 401, { error: "Viewer access expired" });
+        if (!holds())
+            return json(res, 409, { error: "Take control of this computer first" });
         if (!Number.isInteger(connection.port) || connection.port < 1 || connection.port > 65535) {
             return json(res, 409, { error: "The desktop viewer is not available." });
         }
@@ -150,7 +181,7 @@ export function createDesktopViewer(deps) {
         upstream.once("response", (answer) => { answer.resume(); fail(); });
         upstream.once("upgrade", (answer, remote, remoteHead) => {
             const accept = createHash("sha1").update(key + WS_GUID).digest("base64");
-            if (!live() || socket.destroyed || answer.headers["sec-websocket-accept"] !== accept
+            if (!live() || !holds() || socket.destroyed || answer.headers["sec-websocket-accept"] !== accept
                 || answer.headers.upgrade?.toLowerCase() !== "websocket") {
                 remote.destroy();
                 fail();
@@ -171,7 +202,7 @@ export function createDesktopViewer(deps) {
             socket.pipe(remote).pipe(socket);
             connection.touch?.();
             recheck = setInterval(() => {
-                if (!live())
+                if (!live() || !holds())
                     upgrade.close();
                 else
                     connection.touch?.();
@@ -182,9 +213,22 @@ export function createDesktopViewer(deps) {
     };
     return {
         route, attach,
-        closeForOwner: (owner) => { for (const upgrade of upgrades.values())
-            if (upgrade.owner === owner)
-                upgrade.close(); },
+        /** Close a session's viewers: all of them (sign-out, revocation), or only
+         * those it opened under a lease on one bot (that bot's hand-back). */
+        closeForOwner: (owner, botId) => {
+            let closed = 0;
+            for (const upgrade of upgrades.values()) {
+                if (upgrade.owner !== owner || (botId !== undefined && upgrade.botId !== botId))
+                    continue;
+                // A viewer already closed stays listed until its socket's close
+                // event, which arrives later on Windows: not closed or counted again.
+                if (upgrade.socket.destroyed)
+                    continue;
+                upgrade.close();
+                closed++;
+            }
+            return closed;
+        },
         closeAll: () => {
             stopped = true;
             for (const upgrade of upgrades.values())

package/dist-server/server/routines.js

@@ -1286,14 +1286,17 @@ export class RoutineManager {
                 // A webhook is an incoming message, so make its task the bot's live
                 // chat immediately. Scheduled work stays in its own task unless the
                 // workspace has asked for runs to join the conversation they report to.
+                const startedAt = this.now();
+                const suffix = ` · ${new Date(startedAt).toLocaleString("en-US", { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" })}`;
+                const title = `${run.routineName.slice(0, 80 - suffix.length).trimEnd()}${suffix}`;
                 const joined = run.target === "room-goal" ? null : this.options.joinConversation?.(run) || null;
                 const task = joined
                     ? { threadId: joined }
                     : run.target === "room-goal"
                         ? run.groupId
-                            ? this.options.createGoalTask?.(run.groupId, run.routineName) ?? null
+                            ? this.options.createGoalTask?.(run.groupId, title) ?? null
                             : null
-                        : this.options.createTask(run.botId, run.routineName, run.triggerSource === "webhook", run.routineId);
+                        : this.options.createTask(run.botId, title, run.triggerSource === "webhook", run.routineId);
                 if (!task) {
                     this.failRun(run, run.target === "room-goal"
                         ? "Could not create a room task for this goal"
@@ -1301,7 +1304,7 @@ export class RoutineManager {
                     continue;
                 }
                 run.threadId = task.threadId;
-                run.startedAt = this.now();
+                run.startedAt = startedAt;
                 run.status = "running";
                 this.save();
                 this.emitRun(run);

package/dist-server/server/store.js

@@ -467,8 +467,13 @@ export class Store {
         mkdirSync(DATA_DIR, { recursive: true });
         for (const file of [BOTS_FILE, GROUPS_FILE])
             tightenRegistryFile(file);
+        // Whether the bot list is the real one. Room repair below trusts it to
+        // say which members no longer exist; an unreadable file must never read
+        // as "every member was deleted".
+        let botsLoaded = false;
         try {
             this.bots = JSON.parse(readFileSync(BOTS_FILE, "utf8"));
+            botsLoaded = Array.isArray(this.bots);
         }
         catch {
             this.bots = [];
@@ -637,9 +642,17 @@ export class Store {
                 botsMigrated = true;
             }
         }
+        const botIds = new Set(this.bots.map((b) => b.id));
         for (const g of this.groups) {
             g.busyBotId = null;
             delete g.turnStartedAt;
+            // A deleted bot used to stay a member for good: counted on the room's
+            // Save button and refused by the roster check on every save (MOCA-264).
+            // Bot-to-bot channels keep their pair; they are not edited as rooms.
+            if (botsLoaded && !g.dm && g.memberIds.some((id) => !botIds.has(id))) {
+                g.memberIds = g.memberIds.filter((id) => botIds.has(id));
+                groupsMigrated = true;
+            }
             const normalized = normalizeGroupDefaultResponder(g.defaultResponder, g.memberIds, Boolean(g.dm));
             if (JSON.stringify(normalized) !== JSON.stringify(g.defaultResponder))
                 groupsMigrated = true;
@@ -1764,6 +1777,27 @@ export class Store {
         this.saveBots(nextBots);
         this.bots = nextBots;
         this.legacyActivities.delete(id);
+        // A deleted bot leaves every room it was in, and a room it led falls back
+        // to its next member. Bot-to-bot channels keep their pair.
+        const rooms = this.groups.filter((g) => !g.dm && g.memberIds.includes(id));
+        for (const g of rooms) {
+            g.memberIds = g.memberIds.filter((member) => member !== id);
+            if (g.busyBotId === id) {
+                g.busyBotId = null;
+                delete g.turnStartedAt;
+            }
+            g.defaultResponder = normalizeGroupDefaultResponder(g.defaultResponder, g.memberIds, false);
+        }
+        if (rooms.length) {
+            // Bot removal is already durable. Finish erasing its data even if this
+            // write fails; startup repair removes these stale memberships later.
+            try {
+                this.saveGroups();
+            }
+            catch (error) {
+                console.warn("store: room cleanup will retry on restart", error);
+            }
+        }
         // every task's transcript goes with the bot, not just the open one
         for (const threadId of new Set([bot.threadId, ...(bot.tasks ?? []).map((t) => t.threadId)])) {
             this.deleteThreadRecord(threadId);
@@ -1786,6 +1820,8 @@ export class Store {
         // The bot folder (SOUL.md mirror) is the bot's too.
         removeBotFolder(id);
         this.emit({ type: "bot.deleted", botId: id });
+        for (const g of rooms)
+            this.emit({ type: "group", groupId: g.id });
         return true;
     }
     patchBot(id, patch) {
@@ -2435,6 +2471,24 @@ export class Store {
         this.emit({ type: "bot", botId });
         return bot;
     }
+    /** Copy this bot's saved approval level and standing approvals onto one
+     * thread. A new thread already gets them; this is how an existing
+     * conversation catches up. Other threads, the transcript, and the bot
+     * default stay put. A grant that has not committed yet is ignored, so a
+     * refresh cannot copy the temporary Ask mask. */
+    refreshTaskPermissions(botId, threadId) {
+        const bot = this.bot(botId);
+        const task = this.taskByThread(botId, threadId);
+        if (!bot || !task)
+            return null;
+        const mode = approvalModeFor({ ...bot, approvalGrant: undefined });
+        const alwaysAllow = structuredClone(bot.alwaysAllow ?? []);
+        const autoApprove = mode === "auto";
+        const sameAllow = JSON.stringify(task.alwaysAllow ?? []) === JSON.stringify(alwaysAllow);
+        if (task.approvalMode === mode && task.autoApprove === autoApprove && sameAllow)
+            return task;
+        return this.patchTask(botId, threadId, { approvalMode: mode, autoApprove, alwaysAllow });
+    }
     mirrorActiveTask(bot, task) {
         bot.threadId = task.threadId;
         bot.resumeCursors = structuredClone(task.resumeCursors);

package/dist-server/server/vps-computer.js

@@ -817,7 +817,7 @@ export function vpsContainerRunArgs(containerName, imageRef = VPS_IMAGE, viewerS
         // someone opens the panel. unless-stopped survives reboots while still
         // honoring an explicit Stop. The shared hardening check accepts exactly
         // this policy for the VPS caller (and only "no"/unset for the Local VM,
-        // whose desktop cannot safely resume).
+        // whose starts are controlled by OMB's turn lifecycle).
         "--restart",
         "unless-stopped",
         "-e",

package/dist-server/server/workspace-backup.js

@@ -37,6 +37,7 @@ const EXCLUSION_NOTES = [
     "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",
     "Saved credentials, provider and MCP connections, managed provider login homes and browser login profiles are not transferred. Destination connections are preserved; reconnect on a new device.",
     "Downloaded tools and caches; these can be installed again.",
+    "Installed dependency folders (node_modules) and symbolic links inside conversation work folders; reinstall or recreate them in the project.",
     "External project folders, CLI login homes, browser session homes, OS keychains, companion devices and other servers.",
     "VM/container disk layers and remote cloud data; durable files inside this workspace are included.",
 ];
@@ -327,6 +328,8 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
     const warnings = ["Stop external editors and managed desktops before exporting; files written outside this server cannot be frozen by the backup gate.", "Conversation text and user files are not redacted and may contain secrets you pasted. Keep the encrypted backup private.", RESTORE_WARNING];
     let bytes = 0;
     let skippedLinks = 0;
+    let skippedDependencies = 0;
+    let skippedWorkLinks = 0;
     try {
         const root = realpathSync(dataDir);
         const sourceDb = join(root, "messages.db");
@@ -370,6 +373,21 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
                     throw new Error("A workspace filename cannot be safely restored on supported platforms.");
                 const source = join(directory, name);
                 const stat = lstatSync(source);
+                // Installed dependencies come back from the project's lockfile, can
+                // hold more files than this format allows, and are often a link an
+                // agent made to another checkout's install. Leave them out.
+                if (name === "node_modules" && (stat.isDirectory() || stat.isSymbolicLink())) {
+                    skippedDependencies++;
+                    continue;
+                }
+                // A conversation's work folder (task-workspaces/<bot>/<thread>) holds
+                // what an agent made there, and agents link things in (another
+                // checkout, a virtualenv). A link's target is not this workspace's
+                // data, so the link is left out rather than failing the backup.
+                if (stat.isSymbolicLink() && path.startsWith("task-workspaces/")) {
+                    skippedWorkLinks++;
+                    continue;
+                }
                 if (stat.isSymbolicLink()) {
                     let target;
                     try {
@@ -430,6 +448,10 @@ export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
         walk(root);
         if (skippedLinks)
             warnings.push(`${skippedLinks} managed skill discovery link(s) were omitted and are recreated by the app.`);
+        if (skippedDependencies)
+            warnings.push(`${skippedDependencies} installed dependency folder(s) (node_modules) were omitted; reinstall them in the project after restoring.`);
+        if (skippedWorkLinks)
+            warnings.push(`${skippedWorkLinks} symbolic link(s) in conversation work folders were omitted; what they point to is outside this backup.`);
         const summary = {
             format: "openmaus.workspace-backup", version: 1, id: job.id, createdAt: new Date().toISOString(),
             appVersion: options.appVersion ?? "unknown", files: entries.filter((entry) => entry.type === "file").length,

package/dist-server/server/workspace.js

@@ -20,7 +20,7 @@ export const WORKSPACES_DIR = join(DATA_DIR, "workspaces");
 export const TASK_WORKSPACES_DIR = join(DATA_DIR, "task-workspaces");
 /** MCP support does not imply native filesystem tools or a local working directory. */
 export function supportsWorkspaceFiles(driverKind) {
-    return !["grok", "openai-compat", "minimax", "mistral", "boxAgent"].includes(driverKind);
+    return !["grok", "openai-compat", "minimax", "mistral", "cerebras", "boxAgent"].includes(driverKind);
 }
 /** Default task files are private to the thread, outside the bot's shared
  * memory folder. This is directory organization, not a shell sandbox. */

package/dist-server/shared/approval-mode.js

@@ -21,7 +21,7 @@ export function supportsApprovalMode(driverKind, mode) {
     // engines could never stop asking — not by its own level, and not through
     // a Chief's delegated Full access either.
     return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo", "qwenAgent", "geminiAgent",
-        "openai-compat", "grok", "minimax", "mistral"].includes(driverKind ?? "");
+        "openai-compat", "grok", "minimax", "mistral", "cerebras"].includes(driverKind ?? "");
 }
 /** A Full/Custom grant belongs to one provider's tool semantics. Other
  * modes carry across only when the destination actually implements them.

package/dist-server/shared/redact.js

@@ -21,6 +21,7 @@ const KEY_PREFIXES = [
     /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, // anthropic / openai / stripe
     /\bxai-[A-Za-z0-9_-]{20,}/g, // xai (grok)
     /\bgsk_[A-Za-z0-9]{40,}/g, // groq
+    /\bcsk-[A-Za-z0-9]{32,}/g, // cerebras
     /\bhf_[A-Za-z0-9]{30,}/g, // hugging face
     /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, // github classic
     /\bgithub_pat_[A-Za-z0-9_]{20,}/g, // github fine-grained

package/dist-server/shared/tool-name.js

@@ -0,0 +1,22 @@
+// A tool chip's display title is not a tool identity. Codex titles a
+// commandExecution chip with the whole command line (drivers/codex.ts) and
+// the ACP core prefers `rawInput.command` over the call's own name
+// (drivers/acp/core.ts), because in a transcript the command IS the useful
+// label. Anything that counts or groups tool calls needs the identity
+// instead, so both readers share one predicate rather than guessing twice.
+/** The generic identity every command-titled chip counts under. */
+export const SHELL_TOOL = "shell";
+/** A tool name that is itself a command line rather than a bare tool name
+ * such as `Bash`. Whitespace or a slash: no provider names a tool that way,
+ * and every shell command has one by the time it carries an argument or a
+ * path. */
+export function nameIsCommand(name) {
+    return /[\s/]/.test(name);
+}
+/** What a tool chip should be counted as. Command-titled chips collapse to
+ * one `shell` bucket: keyed on the raw command they never aggregate (a turn
+ * that ran one tool twelve times reads as twelve tools), and the raw title
+ * is unredacted — unlike `tool.summary`, which drivers bound and redact. */
+export function toolIdentity(name) {
+    return nameIsCommand(name) ? SHELL_TOOL : name;
+}

package/dist-server/vps-container-mcp.js

@@ -136,6 +136,8 @@ function windowsKnownDirs() {
     // x.ai installer
     join(localAppData, "agy", "bin"),
     // Antigravity installer
+    // Cursor installer: cursor-agent.* and its `agent` copies (MOCA-272)
+    join(localAppData, "cursor-agent"),
     join(home, ".local", "bin"),
     // claude native installer
     join(home, ".claude", "local"),
@@ -143,7 +145,9 @@ function windowsKnownDirs() {
     // Factory droid installer (%USERPROFILE%\bin)
     join(home, ".bun", "bin"),
     join(home, ".deno", "bin"),
-    join(home, "go", "bin")
+    join(home, "go", "bin"),
+    join(process.env.ProgramFiles ?? "C:\\Program Files", "Docker", "Docker", "resources", "bin")
+    // Docker Desktop installer
   ];
 }
 var cached = null;
@@ -16515,6 +16519,7 @@ var appConfigSchema = external_exports.object({
     phone: external_exports.enum(["ios", "android"]).optional()
   }).optional(),
   mistral: external_exports.object({ key: optionalText }).optional(),
+  cerebras: external_exports.object({ key: optionalText }).optional(),
   xai: external_exports.object({ key: optionalText, url: optionalText }).optional(),
   /** Anthropic API key for Claude Code billed per token, handed only to
    * Claude instances; `url` only for a proxy or a test double. Never a

package/dist-server/workspace-backup.worker.js

@@ -19078,6 +19078,7 @@ var appConfigSchema = external_exports.object({
     phone: external_exports.enum(["ios", "android"]).optional()
   }).optional(),
   mistral: external_exports.object({ key: optionalText }).optional(),
+  cerebras: external_exports.object({ key: optionalText }).optional(),
   xai: external_exports.object({ key: optionalText, url: optionalText }).optional(),
   /** Anthropic API key for Claude Code billed per token, handed only to
    * Claude instances; `url` only for a proxy or a test double. Never a
@@ -19321,6 +19322,7 @@ var EXCLUSION_NOTES = [
   "Device pairing, server identity, live leases and runtime files (existing destination identities are preserved).",
   "Saved credentials, provider and MCP connections, managed provider login homes and browser login profiles are not transferred. Destination connections are preserved; reconnect on a new device.",
   "Downloaded tools and caches; these can be installed again.",
+  "Installed dependency folders (node_modules) and symbolic links inside conversation work folders; reinstall or recreate them in the project.",
   "External project folders, CLI login homes, browser session homes, OS keychains, companion devices and other servers.",
   "VM/container disk layers and remote cloud data; durable files inside this workspace are included."
 ];
@@ -19515,6 +19517,8 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
   const warnings = ["Stop external editors and managed desktops before exporting; files written outside this server cannot be frozen by the backup gate.", "Conversation text and user files are not redacted and may contain secrets you pasted. Keep the encrypted backup private.", RESTORE_WARNING];
   let bytes = 0;
   let skippedLinks = 0;
+  let skippedDependencies = 0;
+  let skippedWorkLinks = 0;
   try {
     const root = realpathSync(dataDir2);
     const sourceDb = join3(root, "messages.db");
@@ -19545,6 +19549,14 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
         if (!validRelative(path2)) throw new Error("A workspace filename cannot be safely restored on supported platforms.");
         const source = join3(directory, name);
         const stat = lstatSync(source);
+        if (name === "node_modules" && (stat.isDirectory() || stat.isSymbolicLink())) {
+          skippedDependencies++;
+          continue;
+        }
+        if (stat.isSymbolicLink() && path2.startsWith("task-workspaces/")) {
+          skippedWorkLinks++;
+          continue;
+        }
         if (stat.isSymbolicLink()) {
           let target;
           try {
@@ -19590,6 +19602,8 @@ async function createWorkspaceBackupSnapshot(dataDir2, options2, jobId2) {
     };
     walk(root);
     if (skippedLinks) warnings.push(`${skippedLinks} managed skill discovery link(s) were omitted and are recreated by the app.`);
+    if (skippedDependencies) warnings.push(`${skippedDependencies} installed dependency folder(s) (node_modules) were omitted; reinstall them in the project after restoring.`);
+    if (skippedWorkLinks) warnings.push(`${skippedWorkLinks} symbolic link(s) in conversation work folders were omitted; what they point to is outside this backup.`);
     const summary = {
       format: "openmaus.workspace-backup",
       version: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.92",
+  "version": "0.1.93",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-Dtk5Mtic.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-CF1zwoQ-.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};