openmausbot 0.1.94 → 0.1.96

package/dist-server/server/cloud-computer-tools.js

@@ -0,0 +1,110 @@
+import { isolatedRemoteCommand, runCommand, screenshotBoat } from "./boat.js";
+import { CONTROL_REFUSAL_PLAIN } from "./control-client.js";
+import { compileToolSchema } from "./drivers/chat-mcp-tools.js";
+const coordinate = { type: "integer", minimum: 0, maximum: 32767 };
+const tool = (name, description, properties = {}, required = []) => ({ name, description, inputSchema: { type: "object", properties, required, additionalProperties: false } });
+export const CLOUD_COMPUTER_TOOLS = [
+    tool("screenshot", "See the assigned cloud desktop at native pixel resolution."),
+    tool("get_screen_size", "Get the cloud desktop width and height."),
+    tool("click", "Click a point on the cloud desktop.", { x: coordinate, y: coordinate, button: { type: "string", enum: ["left", "middle", "right"] }, count: { type: "integer", minimum: 1, maximum: 3 } }, ["x", "y"]),
+    tool("move", "Move the cloud mouse pointer.", { x: coordinate, y: coordinate }, ["x", "y"]),
+    tool("drag", "Drag on the cloud desktop.", { x: coordinate, y: coordinate, to_x: coordinate, to_y: coordinate }, ["x", "y", "to_x", "to_y"]),
+    tool("type_text", "Type Unicode text into the focused cloud application.", { text: { type: "string", maxLength: 4000 } }, ["text"]),
+    tool("key_press", "Press an X11 key or shortcut.", { key: { type: "string", pattern: "^[A-Za-z0-9_+]+$", minLength: 1, maxLength: 100 } }, ["key"]),
+    tool("scroll", "Scroll at a point on the cloud desktop.", { x: coordinate, y: coordinate, direction: { type: "string", enum: ["up", "down", "left", "right"] }, amount: { type: "integer", minimum: 1, maximum: 30 } }, ["x", "y", "direction"]),
+    tool("open_url", "Request opening an HTTP or HTTPS URL in the cloud desktop browser; inspect the screen to confirm it loaded.", { url: { type: "string", pattern: "^https?://", maxLength: 2000 } }, ["url"]),
+    tool("exec", "Run a shell command on the assigned cloud computer.", { command: { type: "string", minLength: 1, maxLength: 4000 } }, ["command"]),
+];
+const quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
+const buttons = { left: 1, middle: 2, right: 3 };
+const scrollButtons = { up: 4, down: 5, left: 6, right: 7 };
+let validators;
+/** Why a call cannot run, or null. Checked before anything else touches the
+ * call: x and y reach the remote shell unquoted, so only the advertised
+ * integer schema stands between a model's arguments and a command line. */
+export function cloudComputerCallProblem(name, args) {
+    validators ??= new Map(CLOUD_COMPUTER_TOOLS.map(entry => [entry.name, compileToolSchema(entry.inputSchema)]));
+    const validate = typeof name === "string" ? validators.get(name) : undefined;
+    if (!validate)
+        return "Unknown cloud computer tool. Use one of the advertised computer tools.";
+    if (!args || typeof args !== "object" || Array.isArray(args) || !validate(args)) {
+        return "Tool arguments do not match the advertised input schema; use its required fields and types.";
+    }
+    return null;
+}
+/** One tool call on the given Boat with the server's own Boat account. The
+ * caller has already checked the arguments and the person's control. */
+export async function runCloudComputerTool(cfg, boxId, name, args, signal) {
+    const problem = cloudComputerCallProblem(name, args);
+    if (problem)
+        return { isError: true, content: [{ type: "text", text: problem }] };
+    signal.throwIfAborted();
+    if (name === "screenshot") {
+        const shot = await screenshotBoat(cfg, "", boxId, { signal, nativeSize: true });
+        signal.throwIfAborted();
+        return { content: [{ type: "image", mimeType: "image/jpeg", data: shot.png }] };
+    }
+    const a = args;
+    const mouse = `xdotool mousemove --sync ${a.x} ${a.y}`;
+    let command;
+    switch (name) {
+        case "get_screen_size":
+            command = "xdotool getdisplaygeometry";
+            break;
+        case "click":
+            command = `${mouse} click --repeat ${a.count ?? 1} --delay 100 ${buttons[String(a.button ?? "left")]}`;
+            break;
+        case "move":
+            command = mouse;
+            break;
+        case "drag":
+            command = `${mouse} mousedown 1 mousemove --sync ${a.to_x} ${a.to_y} mouseup 1`;
+            break;
+        case "type_text":
+            command = `printf %s ${quote(Buffer.from(String(a.text)).toString("base64"))} | base64 -d | xclip -selection clipboard && xdotool key --clearmodifiers ctrl+v`;
+            break;
+        case "key_press":
+            command = `xdotool key --clearmodifiers ${quote(String(a.key))}`;
+            break;
+        case "scroll":
+            command = `${mouse} click --repeat ${a.amount ?? 3} --delay 80 ${scrollButtons[String(a.direction)]}`;
+            break;
+        case "open_url":
+            command = `nohup xdg-open ${quote(String(a.url))} >/dev/null 2>&1 </dev/null &`;
+            break;
+        case "exec":
+            command = String(a.command);
+            break;
+        default: return { isError: true, content: [{ type: "text", text: "Unknown cloud computer tool." }] };
+    }
+    const result = await runCommand(cfg, boxId, isolatedRemoteCommand(command), { signal });
+    signal.throwIfAborted();
+    if (name === "open_url" && result.ok)
+        return { content: [{ type: "text", text: "Browser launch requested. Page loading is not confirmed; inspect the screen before continuing." }] };
+    return { isError: !result.ok, content: [{ type: "text", text: JSON.stringify(result) }] };
+}
+/** One JSON-RPC request from harness-mcp-proxy, answered with its MCP
+ * `result`. The order is the safety argument: arguments are checked before
+ * the control gate (which may claim the seat), a person's control refuses
+ * the call before anything reaches the Boat, and the turn's capability must
+ * still be live before and after the Boat acts. */
+export async function cloudComputerRpc(request, deps) {
+    if (request?.method === "tools/list") {
+        deps.assertActive();
+        return { tools: CLOUD_COMPUTER_TOOLS };
+    }
+    if (request?.method !== "tools/call")
+        throw Object.assign(new Error("unsupported computer method"), { status: 400 });
+    const params = (request.params && typeof request.params === "object" ? request.params : {});
+    const args = params.arguments ?? {};
+    const problem = cloudComputerCallProblem(params.name, args);
+    if (problem)
+        return { isError: true, content: [{ type: "text", text: problem }] };
+    const control = await deps.gate();
+    deps.assertActive();
+    if (control.held)
+        return { isError: true, content: [{ type: "text", text: control.blockedReason || CONTROL_REFUSAL_PLAIN }] };
+    const result = await runCloudComputerTool(deps.cfg, deps.boxId, params.name, args, deps.signal);
+    deps.assertActive();
+    return result;
+}

package/dist-server/server/cloud-home-start.js

@@ -8,7 +8,7 @@
 // forwards with X-Forwarded-*, so request-auth.ts never grants a remote
 // request loopback trust. If either child exits, both stop and the machine
 // restarts; the one exception is the server asking to be started again
-// after a restore.
+// after a restore (server/restart.ts).
 //
 // The machine's secrets (the signing secret, the relay tokens) arrive as
 // this process's environment. No child's environment ever carries them:
@@ -24,7 +24,8 @@ import { spawn } from "node:child_process";
 import { chownSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
+import { CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
+import { restartPolicy } from "./restart.js";
 const SERVICE_USER = "maus";
 /** The descriptor the server reads its secrets from. */
 const SECRETS_FD = 3;
@@ -112,11 +113,6 @@ export function spawnWithSecrets(command, args, env, secrets, ids) {
     pipe?.end(JSON.stringify(secrets));
     return child;
 }
-/** What the launcher does when the server child exits: start it again only
- * when it asked to (a committed restore), and only a few times in a row. */
-export function serverExitAction(code, stopping, restarts) {
-    return !stopping && code === CLOUD_HOME_RESTART_EXIT_CODE && restarts < 5 ? "restart" : "stop";
-}
 export function startCloudHome(env = process.env) {
     process.umask(0o077);
     const config = cloudHomeConfiguration(env);
@@ -189,14 +185,15 @@ export function startCloudHome(env = process.env) {
                 stop(true);
         });
     };
-    let restarts = 0;
-    const runServer = () => watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
-        if (serverExitAction(code, stopping, restarts) !== "restart")
-            return false;
-        restarts++;
-        runServer();
-        return true;
-    });
+    const policy = restartPolicy();
+    const runServer = () => {
+        watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
+            if (!policy.again(code, stopping))
+                return false;
+            runServer();
+            return true;
+        });
+    };
     runServer();
     watch(spawn(edgeBin, ["run", "--config", edgeConfig, "--adapter", "caddyfile"], { env: edge, stdio: "inherit", ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) }));
     process.once("SIGTERM", () => stop(false));

package/dist-server/server/cloud-home.js

@@ -26,7 +26,6 @@ import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { hostedWorkspaceConfigured } from "./enterprise.js";
 import { formatPairingCode } from "./sessions.js";
-export const CLOUD_HOME_CONTRACT_VERSION = 1;
 /** Any of these switches the server into Cloud home mode; then all are required. */
 export const CLOUD_HOME_KEYS = ["OMB_CLOUD_ROLE", "OMB_CLOUD_MACHINE_ID", "OMB_CLOUD_ADMIN_URL", "OMB_CLOUD_BOOTSTRAP_SECRET"];
 /** A platform model gateway's settings. A Cloud home never uses them: given
@@ -46,10 +45,6 @@ export const CLOUD_PAIRING_SKEW_S = 300;
 export const CLOUD_PAIRING_NONCE_MS = 10 * 60_000;
 const MAX_NONCES = 10_000;
 export const CLOUD_HOME_MARKER = ".omb-cloud-home.json";
-/** The server exits with this after a restore commits (Move to Cloud): the
- * launcher then starts it again, and startup installs the restore. Any other
- * exit stops the machine for Fly to restart. */
-export const CLOUD_HOME_RESTART_EXIT_CODE = 75;
 export function cloudHomeConfigured(env = process.env) {
     return CLOUD_HOME_KEYS.some((key) => env[key] !== undefined);
 }

package/dist-server/server/cloud-lending.js

@@ -21,9 +21,6 @@ import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.js";
 const personOf = (line) => line?.role === "user" && !line.peerAsk ? line.sender?.id : undefined;
-export function cloudHomeTurnMayLend(turn) {
-    return cloudHomeLendingRefusal(turn) === null;
-}
 export function cloudHomeLendingRefusal(turn) {
     const { request } = turn;
     if (!request?.messageId || request.stopped || !request.generations.has(turn.generation))

package/dist-server/server/cloud-move-http.js

@@ -1,9 +1,18 @@
 import { z } from "zod";
+import { sharedSignIn } from "./admin-activity.js";
 import { backupsBytes, beginUpload, CLOUD_MOVE_MAX_BYTES, CLOUD_MOVE_MAX_PART_BYTES, CLOUD_MOVE_PART_BYTES, completedUpload, discardNextPreviousCloud, discardUpload, enabledRoutineCount, forgetMoveRestore, freeVolumeBytes, isEmptyWorkspace, moveSpaceNeeded, noteMoveRestore, prepareNextPreviousCloud, previousCloud, previousCloudArchiveBytes, removeMoveFiles, stagePreviousCloud, tidyCloudMoveStorage, totalVolumeBytes, uploadStatus, validUploadDeclaration, workspaceContents, workspaceMoveSize, writeUploadPart, } from "./cloud-move.js";
 import { commitPendingWorkspaceRestore, createWorkspaceBackup, stageWorkspaceBackup } from "./workspace-backup.js";
 export const CLOUD_MOVE_PREFIX = "/api/cloud-move";
 const failure = (message, status) => Object.assign(new Error(message), { status });
 const HELD_CACHE_MS = 30_000;
+/** Shared with other people, so one person's copy must never replace it: a
+ * hosted organisation workspace, or (not on a Cloud home, whose sign-in is its
+ * owner's OMB Cloud account) an email sign-in list that lets someone else in
+ * (sharedSignIn: a member, a second admin, or a whole @domain). The owner's
+ * own address alone (`openmausbot access add you@example.com`) is not. */
+export function workspaceShared(input) {
+    return input.hosted || (!input.cloudHome && sharedSignIn(input.signIn));
+}
 export function createCloudMoveRoutes(options) {
     const freeBytes = options.freeBytes ?? freeVolumeBytes;
     const volumeBytes = (path) => { try {
@@ -12,16 +21,17 @@ export function createCloudMoveRoutes(options) {
     catch {
         return null;
     } };
-    // A move's restore that startup has installed keeps no safety copy or
-    // staged files; an abandoned upload goes after a day.
-    if (options.cloudHome) {
-        try {
-            tidyCloudMoveStorage(options.dataDir, options.restored);
-        }
-        catch (error) {
-            console.warn(`cloud move: could not tidy backup storage (${error instanceof Error ? error.message : "unknown"})`);
-        }
+    // A copy's restore that startup has installed keeps no safety copy or
+    // staged files, and the workspace it replaced becomes the one to swap back
+    // to; an abandoned upload goes after a day. Only what a copy recorded is
+    // touched, so on a server that never received one this does nothing.
+    try {
+        tidyCloudMoveStorage(options.dataDir, options.restored);
+    }
+    catch (error) {
+        console.warn(`workspace copy: could not tidy backup storage (${error instanceof Error ? error.message : "unknown"})`);
     }
+    const identity = { appVersion: options.appVersion, environmentId: options.environmentId };
     // Staged here by a preview; restore accepts nothing else.
     const staged = new Set();
     let job = null;
@@ -33,16 +43,16 @@ export function createCloudMoveRoutes(options) {
     };
     const check = (req, auth) => {
         if (!options.authorized(req, auth))
-            throw failure("Your session changed. Start the move again.", 403);
+            throw failure("Your session changed. Start the copy again.", 403);
     };
     const ready = () => {
         if (job?.state === "running" || writing)
-            throw failure("Another move step is running on your Cloud. Wait for it to finish.", 409);
+            throw failure("Another copy step is running on this server. Wait for it to finish.", 409);
         const status = options.status();
         if (status.pendingRestore)
-            throw failure("Your Cloud is restarting to finish a restore. Try again in a minute.", 409);
+            throw failure("This server is restarting to finish a restore. Try again in a minute.", 409);
         if (status.busy)
-            throw failure("Your Cloud is busy with a backup. Try again when it finishes.", 409);
+            throw failure("This server is busy with a backup. Try again when it finishes.", 409);
     };
     /** Delete what earlier previews staged and no restore took. */
     const dropStaged = () => {
@@ -63,7 +73,7 @@ export function createCloudMoveRoutes(options) {
             after?.(result);
         }, (error) => {
             if (job === current)
-                job = { kind, state: "failed", error: error instanceof Error ? error.message : "The move could not finish." };
+                job = { kind, state: "failed", error: error instanceof Error ? error.message : "The copy could not finish." };
         });
     }
     // A person's own page can hold the workspace gate for a moment (an ordinary
@@ -106,7 +116,7 @@ export function createCloudMoveRoutes(options) {
     const roomFor = (archive, already = 0) => {
         const needed = moveSpaceNeeded(archive, workspaceMoveSize(options.dataDir).bytes, true) - already;
         const free = freeBytes(options.dataDir);
-        return free >= needed ? null : { error: "Your Cloud does not have enough free space for this.", freeBytes: free, neededBytes: needed };
+        return free >= needed ? null : { error: "This server does not have enough free space for this.", freeBytes: free, neededBytes: needed };
     };
     // The answer that the restore is ready goes out first; then the launcher
     // starts the server again, and startup installs the restore before anything else loads.
@@ -117,15 +127,16 @@ export function createCloudMoveRoutes(options) {
         const method = req.method ?? "GET";
         try {
             if (!auth.scopes.includes("admin"))
-                throw failure("Only the owner can move a workspace.", 403);
+                throw failure("Only the owner can copy a workspace.", 403);
             if (method === "GET" && path === `${CLOUD_MOVE_PREFIX}/estimate`) {
-                json(res, 200, { ...workspaceContents(options.dataDir), ...workspaceMoveSize(options.dataDir), routines: enabledRoutineCount(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES });
+                json(res, 200, { ...workspaceContents(options.dataDir), ...workspaceMoveSize(options.dataDir), routines: enabledRoutineCount(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES, ...identity });
                 return true;
             }
-            if (!options.cloudHome)
-                throw failure("Only an OMB Cloud home receives a moved workspace.", 404);
             if (auth.kind !== "session")
-                throw failure("Move to Cloud needs the owner's signed-in app.", 403);
+                throw failure("Copying a workspace needs the owner's signed-in app.", 403);
+            if (options.sharedWorkspace()) {
+                throw Object.assign(failure("This server is shared with other people, so it can't receive one computer's bots and chats. Copy to a server only you use.", 403), { code: "shared_workspace" });
+            }
             check(req, auth);
             if (method === "GET" && path === CLOUD_MOVE_PREFIX) {
                 const contents = workspaceContents(options.dataDir);
@@ -134,8 +145,10 @@ export function createCloudMoveRoutes(options) {
                 json(res, 200, {
                     contents, empty: isEmptyWorkspace(contents), freeBytes: freeBytes(options.dataDir), volumeBytes: volumeBytes(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES,
                     partBytes: CLOUD_MOVE_PART_BYTES, upload: uploadStatus(options.dataDir), previous: previousCloud(options.dataDir), job,
-                    // What backups and the previous Cloud hold on the volume.
+                    // What backups and the previous workspace hold on the volume.
                     heldBytes: held.bytes,
+                    // The app refuses a server older than itself, or its own, before exporting.
+                    ...identity,
                     ...options.status(),
                     lastRestoreId: options.restored.restored ? options.restored.id ?? null : null,
                     rolledBackId: options.restored.rolledBack ? options.restored.id ?? null : null,
@@ -191,7 +204,7 @@ export function createCloudMoveRoutes(options) {
                     }
                     if (discardPreview) {
                         removeMoveFiles(options.dataDir, result.id);
-                        throw failure("The move was stopped; what it staged was removed.", 409);
+                        throw failure("The copy was stopped; what it staged was removed.", 409);
                     }
                     try {
                         check(req, auth);
@@ -213,7 +226,7 @@ export function createCloudMoveRoutes(options) {
             if (method === "POST" && path === `${CLOUD_MOVE_PREFIX}/discard`) {
                 await options.readBody(req, 4096);
                 if (job?.state === "running" && job.kind !== "preview")
-                    throw failure("Your Cloud is already replacing its workspace.", 409);
+                    throw failure("This server is already replacing its workspace.", 409);
                 // A preview still running removes what it stages when it ends.
                 if (job?.state === "running")
                     discardPreview = true;
@@ -226,7 +239,7 @@ export function createCloudMoveRoutes(options) {
                 const body = z.object({ id: z.string().uuid() }).parse(await options.readBody(req, 4096));
                 ready();
                 if (!staged.has(body.id))
-                    throw failure("This move is no longer ready on your Cloud. Start it again.", 404);
+                    throw failure("This copy is no longer ready on this server. Start it again.", 404);
                 start("restore", async () => {
                     const { committed, previous } = await replaceWith(body.id, req, auth);
                     return { kind: "restore", state: "done", id: committed.id, previous };
@@ -238,15 +251,15 @@ export function createCloudMoveRoutes(options) {
                 await options.readBody(req, 4096);
                 ready();
                 if (!previousCloud(options.dataDir))
-                    throw failure("There is no previous Cloud to restore.", 404);
+                    throw failure("There is nothing on this server to swap back to.", 404);
                 const refused = roomFor(previousCloudArchiveBytes(options.dataDir));
                 if (refused) {
                     json(res, 507, refused);
                     return true;
                 }
                 dropStaged();
-                // A swap: what the Cloud has now becomes the previous Cloud, so this
-                // can be undone the same way.
+                // A swap: what this server has now becomes the previous workspace, so
+                // this can be undone the same way.
                 start("undo", async () => {
                     const prepared = await stagePreviousCloud(options.dataDir, options.appVersion);
                     const { committed, previous } = await replaceWith(prepared.id, req, auth);
@@ -255,7 +268,7 @@ export function createCloudMoveRoutes(options) {
                 json(res, 202, { job });
                 return true;
             }
-            json(res, 404, { error: "Unknown move operation." });
+            json(res, 404, { error: "Unknown copy operation." });
         }
         catch (error) {
             if (res.headersSent) {
@@ -263,10 +276,11 @@ export function createCloudMoveRoutes(options) {
                 return true;
             }
             const status = error instanceof z.ZodError ? 400 : error.status ?? 400;
-            const received = error.received;
+            const received = error.received, code = error.code;
             json(res, status, {
-                error: error instanceof z.ZodError ? "Invalid move request." : error instanceof Error ? error.message : "The move failed.",
+                error: error instanceof z.ZodError ? "Invalid copy request." : error instanceof Error ? error.message : "The copy failed.",
                 ...(Number.isSafeInteger(received) ? { received } : {}),
+                ...(code === "shared_workspace" ? { code } : {}),
             });
         }
         return true;

package/dist-server/server/cloud-move.js

@@ -1,16 +1,18 @@
-// Move to Cloud (docs/cloud-pro.md): a person's one-time copy of their local
-// workspace onto their OMB Cloud home. The desktop exports the ordinary
-// encrypted workspace backup (workspace-backup.ts) and uploads it here in
-// parts; this machine then previews and restores it like any other backup,
-// so everything that backup policy keeps out (credentials, sign-ins, pairing
-// and sessions, runtime state) stays where it is on both sides.
+// Copy this computer here (docs/copy-workspace.md): a person's copy of their
+// desktop's workspace onto a server they own and added in the desktop app, an
+// OMB Cloud home included. The desktop exports the ordinary encrypted
+// workspace backup (workspace-backup.ts) and uploads it here in parts; this
+// server then previews and restores it like any other backup, so everything
+// that backup policy keeps out (credentials, sign-ins, pairing and sessions,
+// runtime state) stays where it is on both sides.
 //
 // What this file adds: the workspace's size and contents, a resumable upload
-// slot, the space check for the machine's fixed-size volume, a backup of the
-// Cloud's own workspace taken before it is replaced ("Restore previous Cloud"
-// swaps it back), and the tidying that keeps that backup the only copy left
-// behind. Everything lives under `.backups`, which no snapshot includes and
-// no restore replaces.
+// slot, the space check for the server's volume, a backup of this server's
+// own workspace taken before it is replaced (Swap back puts it back), and the
+// tidying that keeps that backup the only copy left behind. Everything lives
+// under `.backups`, which no snapshot includes and no restore replaces. The
+// file and folder names still say "cloud" (`cloud-move`, `cloud-previous`):
+// renaming them would orphan the swap back on servers already running.
 import { createHash, randomBytes } from "node:crypto";
 import { createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statfsSync, writeFileSync } from "node:fs";
 import { open } from "node:fs/promises";
@@ -167,9 +169,9 @@ export function validUploadDeclaration(input) {
     if (!Number.isSafeInteger(input.bytes) || input.bytes < MIN_BYTES)
         throw fail("This is not a workspace backup.", 400);
     if (input.bytes > CLOUD_MOVE_MAX_BYTES)
-        throw fail("This workspace is larger than the 10 GB a move can carry.", 413);
+        throw fail("This workspace is larger than the 10 GB a copy can carry.", 413);
     if (input.files !== undefined && (!Number.isSafeInteger(input.files) || input.files < 0 || input.files > CLOUD_MOVE_MAX_FILES)) {
-        throw fail("This workspace has more than the 100,000 files a move can carry.", 413);
+        throw fail("This workspace has more than the 100,000 files a copy can carry.", 413);
     }
     return { sha256: input.sha256, bytes: input.bytes };
 }
@@ -193,7 +195,7 @@ export function beginUpload(dataDir, declared, now = Date.now()) {
 export async function writeUploadPart(dataDir, sha256, offset, length, body, now = Date.now()) {
     const meta = readUploadMeta(dataDir);
     if (!meta || meta.sha256 !== sha256)
-        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+        throw fail("This upload is not in progress on this server. Start the copy again.", 404);
     if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length <= 0 || length > CLOUD_MOVE_MAX_PART_BYTES) {
         throw fail("Invalid upload part.", 400);
     }
@@ -238,7 +240,7 @@ export async function writeUploadPart(dataDir, sha256, offset, length, body, now
 export async function completedUpload(dataDir, sha256) {
     const status = uploadStatus(dataDir);
     if (!status || status.sha256 !== sha256)
-        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+        throw fail("This upload is not in progress on this server. Start the copy again.", 404);
     if (status.received !== status.bytes)
         throw fail("The upload is not complete yet.", 409, { received: status.received });
     const hash = createHash("sha256");
@@ -246,7 +248,7 @@ export async function completedUpload(dataDir, sha256) {
         hash.update(chunk);
     if (hash.digest("hex") !== sha256) {
         discardUpload(dataDir);
-        throw fail("The uploaded file was damaged on the way. Start the move again.", 400);
+        throw fail("The uploaded file was damaged on the way. Start the copy again.", 400);
     }
     return uploadPartPath(dataDir);
 }
@@ -312,7 +314,7 @@ export function discardNextPreviousCloud(dataDir) {
 export async function stagePreviousCloud(dataDir, appVersion) {
     const previous = readPrevious(previousFolder(dataDir));
     if (!previous || isEmptyWorkspace(previous.contents))
-        throw fail("There is no previous Cloud to restore.", 404);
+        throw fail("There is nothing on this server to swap back to.", 404);
     const archive = join(previousFolder(dataDir), "workspace.ombbackup");
     const staged = await stageWorkspaceBackup(dataDir, archive, { password: previous.password, currentAppVersion: appVersion });
     return { ...staged, bytes: lstatSync(archive).size };
@@ -373,7 +375,7 @@ function pendingRestoreId(dataDir) {
         return null;
     }
 }
-/** At a Cloud home's startup, after any pending restore was applied:
+/** At every server's startup, after any pending restore was applied:
  * - a next previous Cloud becomes the previous Cloud once its restore is
  *   installed, and is dropped otherwise;
  * - moves' and swaps' restores, once settled, keep no safety copy or staged

package/dist-server/server/composio.js

@@ -244,9 +244,35 @@ function trustedAuthUrl(value, slug) {
     }
     return url.toString();
 }
+/** Composio's own hosts are always trusted. A backend the operator pointed
+ * the app at explicitly (OMB_COMPOSIO_API — a dev or test stub) may hand back
+ * a Session on its own origin, since the API itself was already trusted that
+ * far; any other host is refused. */
+export function trustedSessionMcpUrl(value) {
+    let mcp;
+    try {
+        mcp = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (mcp.protocol === "https:" && (mcp.hostname === "composio.dev" || mcp.hostname.endsWith(".composio.dev")))
+        return true;
+    if (mcp.protocol !== "https:" && !(mcp.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(mcp.hostname)))
+        return false;
+    const override = process.env.OMB_COMPOSIO_API;
+    if (!override)
+        return false;
+    try {
+        return new URL(override).origin === mcp.origin;
+    }
+    catch {
+        return false;
+    }
+}
 function parseSessionResponse(session) {
     const mcp = new URL(session.mcp.url);
-    if (mcp.protocol !== "https:" || (mcp.hostname !== "composio.dev" && !mcp.hostname.endsWith(".composio.dev"))) {
+    if (!trustedSessionMcpUrl(session.mcp.url)) {
         throw new Error("Composio returned an untrusted Session MCP URL");
     }
     return { ...session, mcp: { ...session.mcp, url: mcp.toString() } };
@@ -497,7 +523,7 @@ export async function mcpIntegration(cfg, context) {
         },
     };
 }
-export async function relayMcp(cfg, payload, transportSessionId) {
+export async function relayMcp(cfg, payload, transportSessionId, beforeSend) {
     const apiKey = projectApiKey(cfg);
     let url;
     let identity;
@@ -529,6 +555,9 @@ export async function relayMcp(cfg, payload, transportSessionId) {
     if (forwardedTransportSessionId) {
         headers.set("mcp-session-id", forwardedTransportSessionId);
     }
+    // Session discovery can await network I/O. Turn authority and mutable
+    // permissions must be checked after it, immediately before dispatch.
+    beforeSend?.();
     const response = await fetch(url, {
         method: "POST",
         headers,
@@ -1077,7 +1106,7 @@ export async function removeAccount(cfg, slug, accountId) {
 }
 /** Mint a browser auth link for one service. Returns { url } or throws. */
 export async function authorizeService(cfg, slug, requestedAlias) {
-    const alias = normalizeAccountAlias(requestedAlias);
+    let alias = normalizeAccountAlias(requestedAlias);
     const toolkit = canonicalToolkitSlug(slug);
     const mode = connectionMode(cfg);
     const unavailable = managedConnectorUnavailableReason(mode, toolkit);
@@ -1107,8 +1136,15 @@ export async function authorizeService(cfg, slug, requestedAlias) {
     if (usableAccounts.length >= MULTI_ACCOUNT_CONFIG.max_accounts_per_toolkit) {
         throw inputError(`${toolkit} already has the maximum of ${MULTI_ACCOUNT_CONFIG.max_accounts_per_toolkit} accounts`, 409);
     }
-    if (usableAccounts.length > 0 && !alias) {
-        throw inputError("Add an account alias so the existing connection is not replaced");
+    if (serviceAccounts.length > 0 && !alias) {
+        if (serviceAccounts.every((account) => /^(initializing|initiated|expired)$/i.test(account.status ?? ""))) {
+            // Retry without replacing a named account or revoking a former grant:
+            // EXPIRED can describe either an abandoned flow or an expired credential.
+            alias = `omb-retry-${randomUUID()}`;
+        }
+        else {
+            throw inputError("Add an account alias so the existing connection is not replaced");
+        }
     }
     if (alias && serviceAccounts.some((account) => account.alias?.trim().toLowerCase() === alias.toLowerCase())) {
         throw inputError(`Account alias "${alias}" is already in use for ${toolkit}`, 409);

package/dist-server/server/computer-control.js

@@ -153,18 +153,3 @@ export class ComputerControl {
         return snapshot;
     }
 }
-/** Safely executes an async tool or desktop control call, catching runtime exceptions gracefully. */
-export async function executeToolSafely(toolName, fn) {
-    try {
-        const data = await fn();
-        return { success: true, data };
-    }
-    catch (err) {
-        const errorMessage = err?.message || String(err) || 'Unknown execution error';
-        console.error(`[Tool Execution Error] Name: ${toolName} | Details: ${errorMessage}`);
-        return {
-            success: false,
-            error: `Tool '${toolName}' failed to execute: ${errorMessage}`
-        };
-    }
-}