openmausbot 0.1.94 → 0.1.96

package/dist-server/server/checkpoints.js

@@ -2,17 +2,15 @@
 //
 // Before a turn's engine can touch files, the working folder is snapshotted
 // into a shadow repo at DATA_DIR/checkpoints/<botId>/<sha256(cwd)[..16]>/.git.
+// When the turn settles, its digest diffs the folder against that snapshot to
+// list the files the turn changed, added and deleted.
 // The user's own .git (if the folder is a repository) is never read, written,
 // or locked: every git call runs with GIT_DIR pointing at the shadow repo and
 // GIT_WORK_TREE pointing at the folder, so the shadow index is the only index
 // involved — and git always skips directories named .git when walking a work
 // tree, so the user's repository internals are invisible to the snapshot.
 //
-// Restore is redo-friendly on purpose: it commits a safety point, then moves
-// the index and work tree back with `git restore --source` + `git clean -fd`
-// while HEAD keeps the safety point — so the state just replaced is the one
-// retained checkpoint, and "undo the undo" is one more restore. Ignored/excluded files
-// (node_modules, .env, media) are never snapshotted and never removed by one.
+// Ignored/excluded files (node_modules, .env, media) are never snapshotted.
 //
 // Failure policy: checkpointing is best-effort convenience, never load-bearing.
 // Any git failure disables the feature for that bot for the rest of the
@@ -20,9 +18,9 @@
 //
 // Adapted from the checkpoint designs of Cline, Roo-Code, and Gemini CLI
 // (all Apache-2.0): the per-call GIT_DIR/GIT_WORK_TREE/GIT_CONFIG_* env
-// override and restore shape follow Gemini CLI's gitService, the sanitized
-// GIT_* env list and the exclude categories follow Roo-Code's checkpoint
-// service, and the snapshot-before-every-turn cadence follows Cline.
+// override follows Gemini CLI's gitService, the sanitized GIT_* env list and
+// the exclude categories follow Roo-Code's checkpoint service, and the
+// snapshot-before-every-turn cadence follows Cline.
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
@@ -30,15 +28,14 @@ import { homedir } from "node:os";
 import { isAbsolute, join, parse, resolve } from "node:path";
 import { DATA_DIR } from "./config.js";
 export const CHECKPOINTS_DIR = join(DATA_DIR, "checkpoints");
-/** Full sha1 hex only. The API hands out full hashes; accepting anything
- * looser would let arbitrary revspecs ("HEAD~3", "main@{u}") reach git. */
+/** Full sha1 hex only: accepting anything looser would let arbitrary
+ * revspecs ("HEAD~3", "main@{u}") reach git. */
 const COMMIT_HASH = /^[0-9a-f]{40}$/;
-// What a checkpoint deliberately does not carry. Restores must never delete
-// these either: `git clean -fd` (without -x) leaves ignored files alone, so
-// everything listed here survives a rollback untouched. Categories follow
-// Roo-Code's checkpoint excludes: VCS internals, dependency trees, build
-// output, caches, logs, secrets, media, archives, databases, model weights.
-const EXCLUDES = `# OpenMausBot checkpoint excludes — never snapshotted, never removed by restore
+// What a checkpoint deliberately does not carry, so a digest never lists
+// these either. Categories follow Roo-Code's checkpoint excludes: VCS
+// internals, dependency trees, build output, caches, logs, secrets, media,
+// archives, databases, model weights.
+const EXCLUDES = `# OpenMausBot checkpoint excludes — never snapshotted
 .git/
 .svn/
 .hg/
@@ -120,8 +117,8 @@ Thumbs.db
 `;
 // gpgsign off: the user's global config may demand signing, and a shadow
 // commit must never block on a passphrase prompt. Automatic GC stays off:
-// explicit GC runs inside the same serialization as snapshot/restore, after
-// their source objects are no longer needed.
+// explicit GC runs inside the same serialization as each snapshot, after the
+// previous snapshot's objects are no longer needed.
 const GITCONFIG = "[commit]\n\tgpgsign = false\n[core]\n\tautocrlf = false\n[gc]\n\tauto = 0\n";
 /** One failed git call disables checkpoints for that bot until restart —
  * a broken shadow repo must cost the user one log line, not a failed turn. */
@@ -140,8 +137,7 @@ function gitAvailable() {
 }
 /** Folders a checkpoint must never be taken in: missing paths, the sprawling
  * personal folders (home, Desktop, Documents, Downloads), and the filesystem
- * root — snapshotting those would trawl unbounded personal data into a repo,
- * and a restore's `git clean -fd` there would be an act of vandalism. */
+ * root — snapshotting those would trawl unbounded personal data into a repo. */
 export function refusalReason(cwd) {
     if (!isAbsolute(cwd))
         return "the working folder must be an absolute path";
@@ -161,7 +157,7 @@ export function refusalReason(cwd) {
     // the refusal while git still follows the symlink into the protected tree.
     // The native realpath also settles Windows' spellings of one folder —
     // c:\users\me, C:\Users\me\DOCUME~1 — and names compare case-insensitively
-    // there, as turn-resources.ts does for workspace claims.
+    // there.
     const same = (a, b) => process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     if (dir === parse(dir).root)
         return "checkpoints are not taken at the filesystem root";
@@ -203,9 +199,9 @@ function gitEnv(shadow, cwd) {
     return env;
 }
 /** Run one git command against the shadow repo. cwd is the WORK TREE — the
- * "." pathspec in add/restore resolves relative to it. A hung git (index
- * lock, dead network filesystem) would otherwise jam the per-repo queue for
- * the whole session, so every call carries a hard timeout. */
+ * "." pathspec in add resolves relative to it. A hung git (index lock, dead
+ * network filesystem) would otherwise jam the per-repo queue for the whole
+ * session, so every call carries a hard timeout. */
 function runGit(args, cwd, env, signal) {
     return new Promise((resolvePromise, rejectPromise) => {
         signal?.throwIfAborted();
@@ -234,10 +230,10 @@ function hasStagedChanges(cwd, env, signal) {
         });
     });
 }
-// One operation at a time per shadow repo: snapshots and restores against the
-// same folder queue behind each other (git's index lock would fail the loser
-// anyway — this turns a crash into a wait). The stored tail never rejects, so
-// one failed operation can't poison the queue.
+// One operation at a time per shadow repo: snapshots, diffs and pin releases
+// against the same folder queue behind each other (git's index lock would
+// fail the loser anyway — this turns a crash into a wait). The stored tail
+// never rejects, so one failed operation can't poison the queue.
 const chains = new Map();
 function serialize(key, fn) {
     const tail = chains.get(key) ?? Promise.resolve();
@@ -245,12 +241,32 @@ function serialize(key, fn) {
     chains.set(key, run.then(() => undefined, () => undefined));
     return run;
 }
+// A ref per running turn. Every snapshot parents only the empty base and the
+// cleanup after it prunes whatever HEAD no longer reaches — so when a bot's
+// threads work side by side in one folder, a sibling's snapshot would discard
+// the pre-turn commit a still-running turn diffs against at its end. A pin
+// keeps that commit reachable until release(). The pin's name is hashed so
+// any token is a legal ref name.
+const LIVE_REFS = "refs/omb-live/";
+function liveRef(pin) {
+    return LIVE_REFS + createHash("sha256").update(pin).digest("hex").slice(0, 16);
+}
+// Pins outlive the process that wrote them (a crash mid-turn), so the first
+// use of each shadow in this process drops every pin left behind: no turn of
+// ours can be live in a shadow this process has not touched yet.
+const sweptShadows = new Set();
+async function sweepLiveRefs(cwd, env, shadow, signal) {
+    if (sweptShadows.has(shadow))
+        return;
+    const stale = (await runGit(["for-each-ref", "--format=%(refname)", LIVE_REFS], cwd, env, signal)).split("\n").filter(Boolean);
+    for (const ref of stale)
+        await runGit(["update-ref", "-d", ref], cwd, env, signal);
+    sweptShadows.add(shadow);
+}
 /** Create the shadow repo on first use; self-heal its config files on every
  * use (they are tiny, and rewriting them lets exclude-list updates reach
  * shadows that already exist). The base commit is an EMPTY marker so HEAD
- * always resolves — it is filtered from listings and refused as a restore
- * target, because "restore to empty" on a user's own project folder would
- * delete their files. */
+ * always resolves; every snapshot parents only it. */
 async function ensureShadow(cwd, env, shadow, signal) {
     signal?.throwIfAborted();
     mkdirSync(shadow, { recursive: true, mode: 0o700 });
@@ -291,9 +307,11 @@ async function ensureShadow(cwd, env, shadow, signal) {
         // brand-new repo (or a crash between init and first commit)
         await runGit(["commit", "--no-verify", "--allow-empty", "-m", "checkpoint base"], cwd, env, signal);
     }
+    await sweepLiveRefs(cwd, env, shadow, signal);
 }
-/** Capture fully before advancing HEAD. A partial add must never replace
- * the last usable checkpoint or authorize removal of its objects. */
+/** Capture fully before advancing HEAD: null when the add was partial, so a
+ * partial capture never replaces the last usable checkpoint or authorizes
+ * removal of its objects. */
 async function commitAll(cwd, env, label, signal) {
     const previous = (await runGit(["rev-parse", "HEAD"], cwd, env, signal)).trim();
     try {
@@ -303,37 +321,40 @@ async function commitAll(cwd, env, label, signal) {
         await runGit(["add", "-A", "--ignore-errors", "."], cwd, env, signal);
     }
     catch {
-        return { hash: previous, complete: false };
+        return null;
     }
     const changed = await hasStagedChanges(cwd, env, signal);
     const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
     const count = (await runGit(["rev-list", "--count", "HEAD"], cwd, env, signal)).trim();
     if (!changed && Number(count) <= 2)
-        return { hash: previous, complete: true };
+        return previous;
     const tree = (await runGit(["write-tree"], cwd, env, signal)).trim();
     const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
     // Parent only the empty marker, never the previous snapshot: keeping the
     // previous commit as an ancestor would retain every old tree indefinitely.
     const hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
     await runGit(["update-ref", "HEAD", hash, previous], cwd, env, signal);
-    return { hash, complete: true };
+    return hash;
 }
 async function collectObsolete(cwd, env) {
-    // No caller may still need the previous tree. In particular, restore runs
-    // this only AFTER using its source; the safety checkpoint stays reachable.
+    // No caller may still need an unpinned previous tree: HEAD stays reachable,
+    // and so does every commit a live turn still pins.
     try {
         await runGit(["reflog", "expire", "--expire=now", "--all"], cwd, env);
         await runGit(["gc", "--prune=now", "--quiet"], cwd, env);
     }
     catch {
-        // A busy/full disk must not hide an otherwise usable restore point.
-        console.warn("checkpoint cleanup deferred; the latest restore point is preserved");
+        // A busy/full disk must not hide an otherwise usable snapshot.
+        console.warn("checkpoint cleanup deferred; the latest snapshot is preserved");
     }
 }
 /** Snapshot the folder. Returns the checkpoint hash, or null when the
- * feature is off for this bot, git is missing, or the folder is refused.
- * Never throws — this is called fire-and-forget on the turn path. */
-export async function snapshot(botId, cwd, label, signal) {
+ * feature is off for this bot, git is missing, the folder is refused, or a
+ * file could not be read.
+ * With `pin`, the returned commit stays reachable through later snapshots of
+ * the same folder until release(pin) — for a turn that will diff against it
+ * when it ends. Never throws — this is called fire-and-forget on the turn path. */
+export async function snapshot(botId, cwd, label, signal, opts) {
     if (signal?.aborted)
         return null;
     if (disabledBots.has(botId))
@@ -348,11 +369,13 @@ export async function snapshot(botId, cwd, label, signal) {
         return await serialize(shadow, async () => {
             const env = gitEnv(shadow, worktree);
             await ensureShadow(worktree, env, shadow, signal);
-            const result = await commitAll(worktree, env, label, signal);
-            if (!result.complete)
+            const hash = await commitAll(worktree, env, label, signal);
+            if (!hash)
                 return null;
+            if (opts?.pin)
+                await runGit(["update-ref", liveRef(opts.pin), hash], worktree, env, signal);
             await collectObsolete(worktree, env);
-            return result.hash;
+            return hash;
         });
     }
     catch (e) {
@@ -361,7 +384,27 @@ export async function snapshot(botId, cwd, label, signal) {
         return null;
     }
 }
-/** Diff the settled workspace without replacing its pre-turn restore point.
+/** Let go of a pinned pre-turn commit: the next snapshot's cleanup may
+ * reclaim it. Queued behind the shadow's pending operations, so a digest's
+ * diff already in that queue still finds its commit. Best-effort like the
+ * rest of this module — a pin that cannot be dropped costs one log line and
+ * is swept on the next start. */
+export async function release(botId, cwd, pin) {
+    if (!(await gitAvailable()))
+        return;
+    try {
+        const worktree = realpathSync(resolve(cwd));
+        const shadow = shadowDir(botId, worktree);
+        if (!existsSync(join(shadow, ".git", "HEAD")))
+            return;
+        const env = gitEnv(shadow, worktree);
+        await serialize(shadow, () => runGit(["update-ref", "-d", liveRef(pin)], worktree, env));
+    }
+    catch (e) {
+        console.warn(`checkpoint pin not released for bot ${botId}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/** Diff the settled workspace without replacing its pre-turn snapshot.
  * Staging is confined to the shadow index; the user's files and Git are untouched. */
 export async function diffWorkingTree(botId, cwd, fromHash, signal) {
     if (signal?.aborted || !COMMIT_HASH.test(fromHash))
@@ -396,104 +439,3 @@ export async function diffWorkingTree(botId, cwd, fromHash, signal) {
         return null;
     }
 }
-/** The latest usable checkpoint (plus legacy history until the next snapshot). Empty when nothing
- * was ever snapshotted (listing never creates the shadow repo). The empty
- * base marker is omitted — it is not a state anyone should return to. */
-export async function listCheckpoints(botId, cwd) {
-    if (disabledBots.has(botId))
-        return [];
-    if (!(await gitAvailable()))
-        return [];
-    if (refusalReason(cwd) !== null)
-        return [];
-    try {
-        const worktree = realpathSync(resolve(cwd));
-        const shadow = shadowDir(botId, worktree);
-        if (!existsSync(join(shadow, ".git", "HEAD")))
-            return [];
-        return await serialize(shadow, async () => {
-            const env = gitEnv(shadow, worktree);
-            const out = await runGit(["log", "--format=%H%x09%ct%x09%s"], worktree, env);
-            const lines = out.split("\n").filter((line) => line.trim() !== "");
-            lines.pop(); // the root of the log is always the empty base marker
-            return lines.flatMap((line) => {
-                const [hash, seconds, ...subject] = line.split("\t");
-                if (!hash || !COMMIT_HASH.test(hash))
-                    return [];
-                return [{ hash, at: Number(seconds) * 1000, label: subject.join("\t") }];
-            });
-        });
-    }
-    catch (e) {
-        disable(botId, e instanceof Error ? e.message : String(e));
-        return [];
-    }
-}
-/** Can this bot take/restore checkpoints in this folder right now? */
-export async function checkpointsEnabled(botId, cwd) {
-    return !disabledBots.has(botId) && (await gitAvailable()) && refusalReason(cwd) === null;
-}
-/** Move the folder's files back to a checkpoint. The current state is
- * committed first ("before restore"), so the restore itself shows up as a
- * checkpoint and can be undone; HEAD never moves backwards, only forward
- * over the "restored" commit. Excluded and gitignored files are untouched. */
-export async function restore(botId, cwd, hash) {
-    if (disabledBots.has(botId)) {
-        return { ok: false, error: "checkpoints are disabled for this bot until the app restarts (an earlier snapshot failed — see the server log)" };
-    }
-    if (!(await gitAvailable()))
-        return { ok: false, error: "git is not installed on this machine" };
-    const reason = refusalReason(cwd);
-    if (reason !== null)
-        return { ok: false, error: reason };
-    if (!COMMIT_HASH.test(hash))
-        return { ok: false, error: "hash must be a full 40-character checkpoint hash" };
-    try {
-        const worktree = realpathSync(resolve(cwd));
-        const shadow = shadowDir(botId, worktree);
-        if (!existsSync(join(shadow, ".git", "HEAD"))) {
-            return { ok: false, error: "no checkpoints exist for this folder" };
-        }
-        return await serialize(shadow, async () => {
-            const env = gitEnv(shadow, worktree);
-            try {
-                await runGit(["cat-file", "-e", `${hash}^{commit}`], worktree, env);
-            }
-            catch {
-                return { ok: false, error: "no such checkpoint" };
-            }
-            const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], worktree, env)).trim();
-            if (base === hash)
-                return { ok: false, error: "that is the empty base marker, not a checkpoint" };
-            // safety point: whatever is about to be overwritten becomes restorable
-            await ensureShadow(worktree, env, shadow);
-            const safety = await commitAll(worktree, env, "before restore");
-            if (!safety.complete) {
-                return {
-                    ok: false,
-                    error: "restore stopped because some current files could not be added to the safety checkpoint",
-                };
-            }
-            // Index AND work tree move to the source; HEAD stays put. --staged
-            // matters: with a work-tree-only restore, a file that exists in the
-            // source but not in the index (deleted in a later checkpoint, now
-            // resurrected) would be untracked the moment restore recreates it —
-            // and the clean below would delete it right back. Restoring the index
-            // too makes clean blind to everything the checkpoint owns; what clean
-            // then sweeps is exactly the strays the safety commit could not stage
-            // (unreadable files, add races) — never ignored/excluded files (no -x).
-            await runGit(["restore", "--source", hash, "--staged", "--worktree", "--", "."], worktree, env);
-            await runGit(["clean", "-fd"], worktree, env);
-            // Retain the pre-restore safety point, not another copy of the state
-            // now on disk. Reset only the shadow index so it cannot pin old blobs.
-            await runGit(["read-tree", "HEAD"], worktree, env);
-            await collectObsolete(worktree, env);
-            return { ok: true };
-        });
-    }
-    catch (e) {
-        const message = e instanceof Error ? e.message : String(e);
-        disable(botId, message);
-        return { ok: false, error: `restore failed: ${message}` };
-    }
-}

package/dist-server/server/chief-of-staff.js

@@ -8,8 +8,10 @@ const ROSTER_MAX_BOTS = 40;
 const sectionKey = (section) => section?.trim() || "";
 /** Dynamic system context for a section's Chief of Staff.
  * It names the current team on every turn, while list_bots remains the
- * authoritative tool for IDs and live availability at delegation time. */
-export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpenMausStatus = "", boundedCoordination = false) {
+ * authoritative tool for IDs and live availability at delegation time.
+ * Who is busy right now is not part of it: that changes turn to turn, so it
+ * rides the volatile half (teammateAvailabilityPrompt in peer-roster.ts). */
+export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoordination = false) {
     const chief = bots.find((bot) => bot.id === chiefId);
     const chiefSection = sectionKey(chief?.section);
     const sectionName = peerName(chiefSection) || "General";
@@ -17,11 +19,10 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
     // the endpoints must agree, or the prompt names teammates the tools will
     // then refuse to reach.
     const team = reachablePeers(bots, chief ?? { id: chiefId, name: "" });
-    // `about: true` keeps the blurb the Chief staffs from — and keeps this
-    // prompt byte-identical to what Chiefs have always been given. The
-    // ordinary-bot roster drops it (peer-roster.ts); widening the Chief's
-    // existing exposure was never in scope, and narrowing it here would
-    // silently change how a Chief picks a specialist.
+    // `about: true` keeps the blurb the Chief staffs from. The ordinary-bot
+    // roster drops it (peer-roster.ts); widening the Chief's existing exposure
+    // was never in scope, and narrowing it here would silently change how a
+    // Chief picks a specialist.
     const roster = renderRoster(team, {
         max: ROSTER_MAX_BOTS,
         empty: "- No other visible bots are available yet.",
@@ -29,7 +30,7 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
     });
     const delegation = canDelegate
         ? boundedCoordination
-            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, each distinct assignment starts a fresh thread for that teammate, using their own model and permissions. Include the context they need in each brief. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
+            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Give clear briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
             : [
                 "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
                 "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",
@@ -52,6 +53,5 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
         canDelegate ? "When the user asks you to assemble or configure a team, use list_team_setup for the exact authorized teams, bot IDs and model catalog, then propose_team_setup once with all named specialists and their profile/model changes. Include new teams explicitly; the plan covers their creation and your access. Existing thread models and other bots' execution permissions stay unchanged. Follow the tool result: granted Full Access may apply the plan immediately; after an applied result, continue already-requested work without another confirmation. Only if review is pending, end your turn: the user's decision automatically resumes you once with a structured result. Report failed or cancelled results honestly. Do not ask for another yes, poll, or repeat the proposal. After successful setup, use the available coordination tools for already requested work. Use create_bot only for a single specialist when no combined setup was requested. For explicitly requested bot deletion, use propose_bot_deletion separately and follow its applied or pending result too. Do not create duplicate or unnecessary bots." : "",
         chief?.managedSections?.length ? "Reachable teammates in your allowed teams:" : `Current ${sectionName} section team:`,
         roster,
-        trustedOpenMausStatus,
     ].filter(Boolean).join("\n");
 }

package/dist-server/server/cli.js

@@ -30,11 +30,13 @@ import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
+import { phonePairingLink } from "../shared/pairing-link.js";
 import { parseAllowList } from "./account-signin.js";
 import { appendAdminAction, flushAdminActivity, sharedSignIn } from "./admin-activity.js";
 import { bindDecisionRetention, decisionRetentionDays } from "./decision-log.js";
 import { hostedWorkspaceConfigured } from "./enterprise.js";
 import { resolveLoopbackTrust } from "./request-auth.js";
+import { restartPolicy } from "./restart.js";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
 import { runServiceCommand } from "./service-cli.js";
@@ -466,15 +468,6 @@ export function pairingBlock(input) {
     }
     return lines.join("\n");
 }
-/** The scheme and host of a link, or null if it is not one we can dial. */
-function originOf(link) {
-    try {
-        return new URL(link).origin;
-    }
-    catch {
-        return null;
-    }
-}
 export function qrToString(text) {
     let out = "";
     qrcode.generate(text, { small: true }, (rendered) => {
@@ -494,20 +487,18 @@ async function mintPairing(port, options) {
     if (status !== 200)
         throw new Error(`server refused to mint a pairing code: ${typeof body?.error === "string" ? body.error : status}`);
     const url = options.publicUrl ? `${options.publicUrl}/pair#code=${body.code}` : typeof body.url === "string" ? body.url : null;
-    // A server too old to mint a credential simply has no invite: the web link
-    // still works, so an upgrade is never required to pair a browser.
-    // The address the phone will dial. `--public-url` wins, exactly as it does
-    // for the web link above: a server behind someone else's proxy often does
-    // not know its own public name, which is what that flag is for. Gate on the
-    // credential, never on the server's own invite — a server started without
-    // OMB_PUBLIC_URL returns a credential and no invite, and gating on the
-    // invite would throw away a secret the CLI has every part it needs to use.
-    const address = options.publicUrl ?? (typeof body.url === "string" ? originOf(body.url) : null);
-    // A server too old to mint a credential simply has no invite: the web link
-    // still works, so an upgrade is never required to pair a browser.
-    const invite = typeof body.credential === "string" && address
-        ? `openmausbot://pair?address=${encodeURIComponent(address)}&token=${encodeURIComponent(body.credential)}${typeof body.serverName === "string" ? `&name=${encodeURIComponent(body.serverName)}` : ""}`
-        : typeof body.inviteUrl === "string" ? body.inviteUrl : null;
+    // The phone-app invite. This command asks over loopback, so the server
+    // already built it from its own public address with the same builder; it is
+    // printed as it came. `--public-url` wins, exactly as it does for the web
+    // link above: a server behind someone else's proxy often does not know its
+    // own public name, which is what that flag is for. That case gates on the
+    // credential, never on the server's invite — a server started without
+    // OMB_PUBLIC_URL returns a credential and no invite. A server too old to
+    // mint a credential simply has no invite: the web link still works, so an
+    // upgrade is never required to pair a browser.
+    const invite = (options.publicUrl && typeof body.credential === "string"
+        ? phonePairingLink({ address: options.publicUrl, token: body.credential, name: typeof body.serverName === "string" ? body.serverName : undefined })
+        : null) ?? (typeof body.inviteUrl === "string" ? body.inviteUrl : null);
     return pairingBlock({ code: body.code, url, inviteUrl: invite, expiresAt: body.expiresAt, hint: typeof body.hint === "string" ? body.hint : null, phone: options.phone });
 }
 // ── commands ───────────────────────────────────────────────────────────
@@ -853,7 +844,7 @@ async function planTunnel(options, log, recovery) {
         }
     }
     else {
-        account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion(), recovery });
+        account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion(), recovery, log: (line) => log(`tunnel: ${line}`) });
         if (account.credentials.status === "unavailable")
             return fail(`${account.credentials.file} exists but could not be read; fix or remove it`);
         if (!describeTunnelAccount(account.credentials.read()).email) {
@@ -1156,9 +1147,25 @@ export async function runServe(options, log = console.log) {
         process.removeListener("SIGTERM", onSignal);
     }
 }
+/** `serve` until the server stops for good. A server that exits with
+ * RESTART_EXIT_CODE (a copied workspace committed; docs/copy-workspace.md)
+ * is started again in this process, with its tunnel, Tailscale or domain
+ * address unchanged, and without a second pairing code or browser tab; at
+ * most MAX_RESTARTS times in a row (server/restart.ts restartPolicy). */
+export async function serveUntilStopped(options, run = runServe, now = Date.now) {
+    const policy = restartPolicy(now);
+    let launch = options;
+    for (;;) {
+        const code = await run(launch);
+        if (!policy.again(code))
+            return code;
+        console.log("\nOpenMausBot is starting again to finish installing a copy from the desktop app…");
+        launch = { ...options, pair: false, open: false };
+    }
+}
 /** Keep setup imports behind the data-dir override: config binds its paths
  * when first imported. `serve` remains usable with stdin closed. */
-export async function runOnboardingCommand(options, io = defaultIo(), startServer = runServe, flow = {}) {
+export async function runOnboardingCommand(options, io = defaultIo(), startServer = serveUntilStopped, flow = {}) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
     if (options.command === "setup" && !interactive) {
         io.error("Setup needs an interactive terminal. Run `npx openmausbot setup` in a terminal, then use `npx openmausbot serve` for unattended starts.");
@@ -1235,7 +1242,7 @@ export async function main(argv = process.argv.slice(2)) {
         case "start":
             return runOnboardingCommand(options);
         case "serve":
-            return runServe(options);
+            return serveUntilStopped(options);
         case "pair":
             return runPair(options);
         case "sessions":

package/dist-server/server/cloud-backend.js

@@ -1,13 +1,9 @@
 export const CLOUD_BACKEND_CHANGE_ERROR = "stop the active turn before changing the cloud backend";
-export const VPS_ALIAS_CHANGE_ERROR = "stop the active VPS turn before changing the SSH config alias";
 export const BOAT_ACCOUNT_RESOURCES_ERROR = "remove this installation's cloud computers before changing or clearing the Boat account";
 export const VPS_ALIAS_RESOURCES_ERROR = "remove this installation's VPS computers before changing or clearing the SSH config alias";
 export function cloudBackendChangeError(botBusy, activeVpsThread) {
     return botBusy || activeVpsThread ? CLOUD_BACKEND_CHANGE_ERROR : null;
 }
-export function vpsAliasChangeError(currentAlias, nextAlias, activeVpsThread) {
-    return activeVpsThread && currentAlias !== nextAlias ? VPS_ALIAS_CHANGE_ERROR : null;
-}
 /** An old Boat account may be detached only when it owns no local resources.
  * Token rotation is safe when the replacement credential proves access to
  * the exact same provider identities. */