openmausbot 0.1.94 → 0.1.96

package/dist-server/server/computer-observation.js

@@ -10,80 +10,6 @@ export const emptyObservationMetrics = () => ({
     verificationSuccesses: 0,
     verificationFailures: 0,
 });
-export function normalizeCrop(raw, maxWidth, maxHeight) {
-    if (!raw || typeof raw !== "object")
-        return null;
-    const value = raw;
-    const x = Math.round(Number(value.x));
-    const y = Math.round(Number(value.y));
-    const width = Math.round(Number(value.width));
-    const height = Math.round(Number(value.height));
-    if (![x, y, width, height, maxWidth, maxHeight].every(Number.isFinite) ||
-        maxWidth <= 0 ||
-        maxHeight <= 0 ||
-        x < 0 ||
-        y < 0 ||
-        width < 32 ||
-        height < 32) {
-        return null;
-    }
-    if (x + width > maxWidth || y + height > maxHeight)
-        return null;
-    return { x, y, width, height };
-}
-/** Canonical value for internal navigation checks. Credentials are never
- * needed for equality and are removed here; query and fragment remain so
- * two distinct application states cannot verify as the same destination. */
-export function normalizeBrowserUrl(value) {
-    if (typeof value !== "string" || !value || value.length > 8_192)
-        return null;
-    try {
-        const url = new URL(value);
-        if (!/^https?:$/.test(url.protocol))
-            return null;
-        url.username = "";
-        url.password = "";
-        return url.toString();
-    }
-    catch {
-        return null;
-    }
-}
-/** Removes credentials, query, and fragment before browser state reaches a model or log. */
-export function safeBrowserUrl(value) {
-    const normalized = normalizeBrowserUrl(value);
-    if (!normalized)
-        return null;
-    const url = new URL(normalized);
-    url.search = "";
-    url.hash = "";
-    const safe = url.toString();
-    return safe.length <= 2_048 ? safe : null;
-}
-/** Parses Chrome's /json/list response into a small, safe structured observation. */
-export function parseBrowserTargets(raw) {
-    if (raw.length > 1_000_000)
-        return [];
-    try {
-        const parsed = JSON.parse(raw);
-        if (!Array.isArray(parsed))
-            return [];
-        return parsed.slice(0, 20).flatMap((item) => {
-            if (!item || typeof item !== "object")
-                return [];
-            const value = item;
-            const comparisonUrl = normalizeBrowserUrl(value.url);
-            const url = safeBrowserUrl(value.url);
-            if (value.type !== "page" || !url || !comparisonUrl || typeof value.id !== "string")
-                return [];
-            const title = typeof value.title === "string" ? value.title.replace(/\s+/g, " ").trim().slice(0, 200) : "";
-            return [{ id: value.id.slice(0, 100), title, url, comparisonUrl }];
-        });
-    }
-    catch {
-        return [];
-    }
-}
 /**
  * Keeps observations cheap without claiming the screen is immutable. Every
  * requested observation still captures fresh pixels (pages can change without

package/dist-server/server/config.js

@@ -1,7 +1,7 @@
 // Config + data dirs. One file, ~/.openmausbot/config.json, env fallbacks:
 //   { "xai": {"key":"xai-…"}, "composio": {"apiKey":"ak_…"}, "box": {"token":"…"},
 //     "instances": { "<instanceId>": {"driver":"grok", …} } }
-import { readFileSync, mkdirSync, existsSync, renameSync } from "node:fs";
+import { readFileSync, mkdirSync, existsSync, renameSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
@@ -13,7 +13,6 @@ import { isModelVariant } from "./contracts.js";
 import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-icon.js";
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
-import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -292,17 +291,6 @@ const featureConfigSchema = z.object({
      * conversations that share words with the message ride into the turn.
      * Read-only; on unless explicitly switched off — see autoRecallEnabled. */
     autoRecall: z.boolean().optional(),
-    /** Idle release for computer claims (#1653): a desktop seat that stays
-     * screen-quiet for 90 seconds is released to waiting turns while its
-     * holder's turn still lives; the previous holder re-claims directly
-     * for 10 minutes and yields to an occupied seat. Off until baked; see
-     * computerClaimIdleReleaseEnabled for how to enable it by hand. */
-    computerClaimIdleRelease: z.boolean().optional(),
-    /** Consented cloud overflow for local computer waits (#1655): a wait
-     * may offer a per-second-billed cloud seat, but only through an explicit
-     * consent card or a configured allowlist — never a silent Auto default.
-     * Off until baked; see cloudOverflowEnabled for how to enable it by hand. */
-    cloudOverflow: z.boolean().optional(),
     /** Opt-in shared skills library: one store at the data dir that bots
      * read by assignment instead of per-workspace copies. Off until
      * explicitly enabled — see skillsLibraryEnabled. */
@@ -436,8 +424,12 @@ const appConfigSchema = z.object({
      * provider is Boat now and the key is kept for compatibility. */
     box: z.object({ token: optionalText }).optional(),
     vps: vpsConfigSchema.optional(),
-    /** Optional OpenCode key; persisted write-only and passed only to its child. */
-    opencodeGo: z.object({ apiKey: optionalText }).optional(),
+    /** Optional OpenCode key; persisted write-only and passed only to its child.
+     * `providerKeys`: keys for OpenCode's other providers (Venice, Groq…) by the
+     * environment name OpenCode reads, also write-only and only for its child.
+     * Settings changes go through mergeOpenCodeProviderKeys; the stored copy
+     * is read loosely (storedAppConfigSchema). */
+    opencodeGo: z.object({ apiKey: optionalText, providerKeys: z.record(z.string(), z.string()).optional() }).optional(),
     /** Voice settings and the selected voice id. `provider` picks the
      * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
      * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
@@ -526,15 +518,6 @@ const appConfigSchema = z.object({
     /** The authorization decision log (server/decision-log.ts): days of month
      * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
     decisions: z.object({ retentionDays: z.number().int().min(1).max(3650).optional() }).strict().optional(),
-    /** #1655 cloud-overflow settings. perSecondCostUsd is the operator's own
-     * verified rate: with no price configured the feature stays inert rather
-     * than show an invented one. allowlistedThreads carries standing consent
-     * for exact thread ids. */
-    cloudOverflow: z.object({
-        perSecondCostUsd: z.number().positive().max(10).optional(),
-        idleStopMs: z.number().int().positive().max(24 * 60 * 60_000).optional(),
-        allowlistedThreads: z.array(z.string().min(1)).max(1000).optional(),
-    }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     onboarding: onboardingConfigSchema.optional(),
@@ -550,6 +533,15 @@ const appConfigSchema = z.object({
 });
 const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
+    /** Read loosely, like mcpServers: a hand-edited provider key that isn't
+     * text is dropped here, and a bad name or key later
+     * (openCodeProviderKeys), never the whole file. */
+    opencodeGo: z.object({
+        apiKey: optionalText,
+        providerKeys: z.record(z.string(), z.unknown()).catch({})
+            .transform((keys) => Object.fromEntries(Object.entries(keys).filter((entry) => typeof entry[1] === "string")))
+            .optional(),
+    }).optional(),
 });
 const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true })
     .extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() });
@@ -749,43 +741,6 @@ export function claudeUserMcpEnabled(cfg) {
 export function llmThreadTitlesEnabled(cfg) {
     return cfg.features?.llmThreadTitles === true;
 }
-/** Idle release for computer claims (#1653): a whole-turn desktop hold
- * ends after a screen-quiet window (default 90 seconds, screen-poller
- * frames excluded) instead of at turn settle, and the previous holder
- * re-claims directly inside a reclaim window (default 10 minutes) while
- * yielding to a seat another turn already holds. Off unless an explicit
- * `true` — bake it as a maintainer-only flag first, exactly like
- * sharedComputers: enable by hand in ~/.openmausbot/config.json
- * (`{"features": {"computerClaimIdleRelease": true}}`) and restart. */
-export function computerClaimIdleReleaseEnabled(cfg) {
-    return cfg.features?.computerClaimIdleRelease === true;
-}
-/** Consented cloud overflow for local computer waits (#1655): while a turn
- * waits for a local desktop, it may offer overflow to a per-second-billed
- * cloud seat — never silently: the card names the cost, and only an
- * explicit per-conversation consent or a configured allowlist thread may
- * start the machine, which then hard-stops after an idle window. Off
- * unless an explicit `true`, like computerClaimIdleRelease: enable by
- * hand in ~/.openmausbot/config.json
- * (`{"features": {"cloudOverflow": true}, "cloudOverflow": {"perSecondCostUsd": 0.0004}}`)
- * and restart. */
-export function cloudOverflowEnabled(cfg) {
-    return cfg.features?.cloudOverflow === true;
-}
-/** The per-second rate shown on the card, or null when the operator has
- * not set one: the offer fails closed rather than guess a price. */
-export function cloudOverflowPerSecondCostUsd(cfg) {
-    const cost = cfg.cloudOverflow?.perSecondCostUsd;
-    return typeof cost === "number" && Number.isFinite(cost) && cost > 0 ? cost : null;
-}
-/** How long a cloud seat may stay screen-quiet before it is stopped. */
-export function cloudOverflowIdleStopMs(cfg) {
-    return cfg.cloudOverflow?.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-}
-/** Threads with standing consent, by exact thread id. */
-export function cloudOverflowAllowlistedThreads(cfg) {
-    return new Set(cfg.cloudOverflow?.allowlistedThreads ?? []);
-}
 /** Opt-in shared skills library (skills lane S1): one store at the data dir
  * that bots reference by assignment instead of per-workspace copies. Off
  * unless enabled by hand in ~/.openmausbot/config.json
@@ -815,7 +770,6 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     "memory",
     "localVm",
     "features",
-    "cloudOverflow",
     "browserProfiles",
     "onboarding",
 ]);
@@ -986,6 +940,34 @@ export function loadConfig() {
     }
     return cfg;
 }
+/** `derive(loadConfig())`, worked out again only when config.json changes:
+ * a new file (every save renames one into place), a new size, a new
+ * modification time, or new permissions or owner. For values read on every
+ * request or stream frame, where parsing the file each time costs more than
+ * the work itself. A file that is missing, saved in the last two seconds, or
+ * that loadConfig() could not use (unreadable, a failed read, invalid JSON)
+ * is read on every call: a second write inside one clock tick is never
+ * missed, and a file that is fixed is used again on the next call. */
+export function cacheUntilConfigChanges(derive) {
+    let cached = null;
+    return () => {
+        let stamp = null;
+        try {
+            const file = statSync(join(DATA_DIR, "config.json"), { bigint: true });
+            if (Date.now() - Number(file.mtimeMs) >= 2_000)
+                stamp = `${file.ino}:${file.size}:${file.mtimeNs}:${file.ctimeNs}`;
+        }
+        catch {
+            // Missing or out of reach: read it the way loadConfig() always has.
+        }
+        if (stamp !== null && cached?.stamp === stamp)
+            return cached.value;
+        const value = derive(loadConfig());
+        // A warning means loadConfig() ignored the file and ran on defaults.
+        cached = stamp === null || lastIgnoredConfigWarning !== "" ? null : { stamp, value };
+        return value;
+    };
+}
 /** After saveConfig() writes a credential, the running process's env must
  * follow the newest value — loadConfig() prefers env, so the secret injected
  * at boot would otherwise shadow the save until relaunch: the UI would show
@@ -1123,6 +1105,75 @@ export const PROVIDER_CREDENTIAL_ENV = [
     "CURSOR_API_KEY",
     "CURSOR_AUTH_TOKEN",
 ];
+/** Provider keys OpenCode reads from its environment, as it does in a
+ * terminal: with ANTHROPIC_API_KEY set, `opencode` lists Anthropic's models.
+ * Keys OpenMaus saves for another engine (xAI, Mistral, the workspace
+ * Anthropic key) are workspace credentials under other names and never
+ * ride along. */
+export const OPENCODE_PROVIDER_ENV = [
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "KIMI_API_KEY",
+    "MOONSHOT_API_KEY",
+    "MINIMAX_API_KEY",
+];
+/** Keys the owner saves in Settings for OpenCode's other providers (Venice,
+ * Groq, DeepSeek…), each under the environment name OpenCode reads. A Cloud
+ * has no terminal to export them in. They go to OpenCode's process only,
+ * never to this server's own environment. */
+export const OPENCODE_PROVIDER_KEY_LIMIT = 20;
+const OPENCODE_PROVIDER_KEY_NAME = /^[A-Z][A-Z0-9_]{0,59}_(?:API_KEY|KEY|TOKEN)$/;
+/** Printable, no spaces: no provider key has any, and a pasted sentence is not a key. */
+const OPENCODE_PROVIDER_KEY_VALUE = /^[\x21-\x7e]{1,4096}$/;
+/** Why OpenCode can't be given a key under this name, or undefined. A name
+ * OpenMaus keeps for itself or another engine would never reach OpenCode:
+ * every engine keeps only the credential names it reads (credentialEnv). */
+function openCodeProviderKeyNameRefusal(name) {
+    if (!OPENCODE_PROVIDER_KEY_NAME.test(name)) {
+        return "Use the name the provider reads its key from: capitals, ending in _API_KEY, _KEY or _TOKEN, such as VENICE_API_KEY.";
+    }
+    if (name === "OPENCODE_API_KEY")
+        return "Save the OpenCode key in the OpenCode API key box instead.";
+    const reserved = name.startsWith("OPENCODE_") || name.startsWith("OMB_")
+        || WORKSPACE_CREDENTIAL_ENV.includes(name)
+        || (PROVIDER_CREDENTIAL_ENV.includes(name) && !OPENCODE_PROVIDER_ENV.includes(name));
+    return reserved ? `OpenMaus keeps ${name} for itself, so OpenCode can't be given it here. Put this key in opencode.json instead.` : undefined;
+}
+/** The saved OpenCode provider keys that can be used, by name. A hand-edited
+ * entry OpenCode could not be given, or whose value is not a key, is
+ * skipped; so is anything past the limit. */
+export function openCodeProviderKeys(cfg) {
+    const saved = cfg.opencodeGo?.providerKeys ?? {};
+    const usable = Object.keys(saved).sort()
+        .filter((name) => !openCodeProviderKeyNameRefusal(name) && OPENCODE_PROVIDER_KEY_VALUE.test(saved[name] ?? ""))
+        .slice(0, OPENCODE_PROVIDER_KEY_LIMIT);
+    return Object.fromEntries(usable.map((name) => [name, saved[name]]));
+}
+/** A Settings change to the saved OpenCode provider keys: a key saves or
+ * replaces its name, "" removes it, and every other saved key stays. Returns
+ * the whole new set to store, or why it was refused. */
+export function mergeOpenCodeProviderKeys(cfg, change) {
+    const keys = new Map(Object.entries(openCodeProviderKeys(cfg)));
+    for (const [name, raw] of Object.entries(change)) {
+        const value = raw.trim();
+        if (!value) {
+            keys.delete(name);
+            continue;
+        }
+        const refusal = openCodeProviderKeyNameRefusal(name);
+        if (refusal)
+            return { ok: false, error: refusal };
+        if (!OPENCODE_PROVIDER_KEY_VALUE.test(value))
+            return { ok: false, error: "That doesn't look like a key. Paste only the key, with no spaces." };
+        keys.set(name, value);
+    }
+    if (keys.size > OPENCODE_PROVIDER_KEY_LIMIT) {
+        return { ok: false, error: `OpenCode can hold up to ${OPENCODE_PROVIDER_KEY_LIMIT} provider keys. Remove one you no longer use, then add this one.` };
+    }
+    return { ok: true, keys: Object.fromEntries([...keys].sort(([a], [b]) => (a < b ? -1 : 1))) };
+}
 const configSaveListeners = new Set();
 /** Told, synchronously, what each saveConfig wrote: the file before and
  * after. The admin activity log (server/admin-activity.ts) records the
@@ -1152,7 +1203,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -1439,8 +1490,13 @@ function injectedEnvironment(cfg, instanceId, driver) {
     // to Cloud Pro's included token, which never enters an environment map.
     if (driver === "boxAgent" && cfg.box?.token)
         environment.set("BOX_TOKEN", cfg.box.token);
-    if (driver === "opencodeGo" && cfg.opencodeGo?.apiKey)
-        environment.set("OPENCODE_API_KEY", cfg.opencodeGo.apiKey);
+    if (driver === "opencodeGo") {
+        // Keys for OpenCode's other providers, under the names OpenCode reads.
+        for (const [name, key] of Object.entries(openCodeProviderKeys(cfg)))
+            environment.set(name, key);
+        if (cfg.opencodeGo?.apiKey)
+            environment.set("OPENCODE_API_KEY", cfg.opencodeGo.apiKey);
+    }
     return environment;
 }
 /** One instance per pasted provider key, each running only on its own key.

package/dist-server/server/container-computer.js

@@ -46,9 +46,7 @@ const RUNTIMES = ["docker", "podman", "container"];
 const INTERNAL_VIEWER_PORT = 6901;
 const HOST_VIEWER_PORT = 6080;
 const MEMORY_BYTES = 4 * 1024 * 1024 * 1024;
-const NANO_CPUS = 2_000_000_000;
 const PIDS_LIMIT = 512;
-const SHM_BYTES = 512 * 1024 * 1024;
 export const SHARED_LOCAL_VM_TARGET = {
     key: "shared",
     containerName: CONTAINER,
@@ -374,11 +372,19 @@ function containerOwnershipLabelsMatch(labels, target) {
 function normalizeImageId(id) {
     return id?.trim().replace(/^sha256:/, "") || null;
 }
-function inspectedImage(stdout) {
+function inspectedImage(stdout, runtime) {
     const parsed = JSON.parse(stdout);
     const image = parsed[0];
+    // Apple container runs on Apple Silicon and puts image labels inside each
+    // platform variant. Never accept another platform's labels or guess between
+    // multiple matching variants. Docker/Podman keep their existing inspect paths.
+    const variants = runtime === "container" && Array.isArray(image?.variants)
+        ? image.variants.filter(variant => variant?.platform?.os === "linux" && variant.platform.architecture === "arm64")
+        : [];
     return {
-        labels: image?.Config?.Labels ?? image?.config?.Labels ?? image?.config?.labels ?? image?.configuration?.labels,
+        labels: runtime === "container"
+            ? (variants.length === 1 ? variants[0]?.config?.config?.Labels : undefined)
+            : image?.Config?.Labels ?? image?.config?.Labels ?? image?.config?.labels ?? image?.configuration?.labels,
         id: normalizeImageId(image?.Id ?? image?.id ?? image?.configuration?.descriptor?.digest),
     };
 }
@@ -432,7 +438,7 @@ export async function containerComputerStatus(runner = sh, platform = process.pl
     }
     try {
         const { stdout } = await runner(status.runtime, ["image", "inspect", IMAGE]);
-        const image = inspectedImage(stdout);
+        const image = inspectedImage(stdout, status.runtime);
         status.image = imageLabelsMatch(image.labels);
         status.image_id = image.id;
     }
@@ -604,14 +610,10 @@ function appleWorkspaceMountIsSafe(mounts, platform, expectedWorkspace) {
         mounts[0]?.destination === VM_WORKSPACE_GUEST &&
         !options.some((option) => option === "ro" || option === "readonly"));
 }
-/** One hardening contract for both managed containers (Local VM here, the
- * BYO-VPS backend in vps-computer.ts): exact resource limits, no privilege,
- * no host namespaces or devices, no disabled security profiles. The only
- * runtime-specific capability exception is Podman's Firefox sandbox chroot.
- * Callers also differ on restart policy — the VPS
- * container must survive a reboot nobody is watching ("unless-stopped"),
- * while Local VM starts remain controlled by OMB's idle policy and turn
- * lifecycle rather than a daemon restart policy. */
+/** Shared isolation contract for Local VM and BYO-VPS containers. Resource
+ * budgets are creation defaults, not an isolation requirement. Podman alone
+ * needs chroot for Firefox's sandbox. Local VM starts stay controlled by
+ * OMB's idle policy; VPS restart policy belongs to the server operator. */
 export function dockerSecurityIsHardened(config, options = {}) {
     if (!config)
         return false;
@@ -621,26 +623,20 @@ export function dockerSecurityIsHardened(config, options = {}) {
         .sort();
     const unsafeSecurityOption = (config.SecurityOpt ?? []).some((option) => /(?:^|=)(?:unconfined|disable)$/i.test(option));
     const restartPolicy = config.RestartPolicy?.Name;
-    const restartPolicyOk = options.restartPolicy === "unless-stopped"
+    const restartPolicyOk = options.restartPolicy === "any" || (options.restartPolicy === "unless-stopped"
         ? restartPolicy === "unless-stopped"
-        : restartPolicy === undefined || restartPolicy === "" || restartPolicy === "no";
-    return (config.Memory === MEMORY_BYTES &&
-        (config.MemorySwap ?? 0) === MEMORY_BYTES &&
-        (config.NanoCpus ?? 0) === NANO_CPUS &&
-        config.PidsLimit === PIDS_LIMIT &&
-        capDrop.includes("all") &&
+        : restartPolicy === undefined || restartPolicy === "" || restartPolicy === "no");
+    return (capDrop.includes("all") &&
         capAdd.join(",") === (options.podmanBrowserSandbox ? "setgid,setuid,sys_chroot" : "setgid,setuid") &&
         config.Privileged === false &&
         !config.PidMode &&
         config.IpcMode === "private" &&
         !config.UTSMode &&
-        config.ShmSize === SHM_BYTES &&
         (!config.Devices || config.Devices.length === 0) &&
         (!config.DeviceRequests || config.DeviceRequests.length === 0) &&
         !unsafeSecurityOption &&
         !config.UsernsMode &&
         config.CgroupnsMode === "private" &&
-        config.OomKillDisable !== true &&
         config.AutoRemove !== true &&
         restartPolicyOk);
 }
@@ -711,8 +707,11 @@ async function ensureVmWorkspace(platform, target) {
     if (platform !== "win32")
         await chmod(target.workspaceDir, 0o700);
 }
+function baseImagePullArgs(runtime) {
+    return runtime === "container" ? ["image", "pull", BASE_IMAGE] : ["pull", BASE_IMAGE];
+}
 async function prepareManagedImage(runtime, runner) {
-    await runner(runtime, ["pull", BASE_IMAGE], 10 * 60_000);
+    await runner(runtime, baseImagePullArgs(runtime), 10 * 60_000);
     const context = await mkdtemp(join(tmpdir(), "openmausbot-cua-image-"));
     try {
         await writeFile(join(context, "Dockerfile"), managedImageDockerfile(), { mode: 0o600 });
@@ -950,7 +949,7 @@ export function setupCommands(runtime, platform = process.platform, target = SHA
         runtimeStart,
         // This is the inspectable base download. The normal Prepare button also
         // builds the checksum-pinned 0.20.0 derivative automatically.
-        pull: command(["pull", BASE_IMAGE]),
+        pull: command(baseImagePullArgs(runtime)),
         run: runtime === "container" && target.key !== SHARED_LOCAL_VM_TARGET.key
             ? null
             : command(containerRunArgs(runtime, "CHANGE_ME", target)),

package/dist-server/server/control-client.js

@@ -90,16 +90,10 @@ export function createControlClient(options) {
         },
     };
 }
-/** The one sentence every refused action gets. Deliberately does not vary
- * per tool: the model needs the same three facts every time — nothing
- * happened, don't retry blindly, and how to wait properly. */
-export const CONTROL_REFUSAL = "A person has taken control of this computer, so this call was NOT performed. " +
-    "Do not retry it — the screen is changing under their hands. " +
-    "Call computer_request_help (no reason needed) to wait for them to finish, " +
-    "then take a fresh screenshot before your next action.";
-/** The bridge-gated computers (Local VM, VPS) speak Cua Driver's own tool
- * surface, which has no wait tool to point at — so the guidance is to
- * pause, not to call anything. */
+/** The one sentence every refused computer action gets, on every computer.
+ * Deliberately does not vary per tool: the model needs the same three facts
+ * every time — nothing happened, don't retry blindly, and wait for the
+ * person. */
 export const CONTROL_REFUSAL_PLAIN = "A person has taken control of this computer, so this call was NOT performed. " +
     "Do not retry it — the screen is changing under their hands. " +
     "Pause this task, tell the person you are waiting for them to hand control back, " +

package/dist-server/server/decider/jev.js

@@ -1,12 +1,9 @@
+import { isLoopback } from "../provider-key-check.js";
 export const JEV_DEFAULT_BASE_URL = "https://api.typesafe.ai";
 export const JEV_MODEL = "jev-latest";
 export const JEV_MAX_OPTIONS = 255;
 export const JEV_MIN_LEVELS = 2;
 export const JEV_MAX_LEVELS = 10;
-function isLoopback(hostname) {
-    const host = hostname.replace(/^\[|\]$/g, "");
-    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
-}
 /** The endpoint for a base URL, or null when the key must not be sent there:
  * https anywhere, plain http only to this machine (a local Jev-compatible
  * server or a test double). */

package/dist-server/server/decider/log.js

@@ -14,6 +14,7 @@ import { createHash } from "node:crypto";
 import { appendFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { boundRetentionDays, pruneMonthFiles } from "../decision-log.js";
+import { monthKey } from "../usage-ledger.js";
 export const DECIDER_LOG_DIR = "decider-log";
 const PRUNE_EVERY_MS = 60 * 60_000;
 const writeQueues = new Map();
@@ -28,9 +29,6 @@ export function stateHash(state) {
     }
     return createHash("sha256").update(text).digest("hex").slice(0, 16);
 }
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function deciderLogFileFor(dataDir, at) {
     return join(dataDir, DECIDER_LOG_DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/decision-log.js

@@ -32,7 +32,7 @@ import { readdirSync, readFileSync } from "node:fs";
 import { appendFile, mkdir, readdir, stat, unlink } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { redactSecrets } from "./redact.js";
-import { csvCell } from "./usage-ledger.js";
+import { csvCell, monthKey } from "./usage-ledger.js";
 const DIR = "decisions";
 const LEGACY_FILE = "decisions.ndjson";
 const MONTH_FILE = /^(\d{4})-(\d{2})\.ndjson$/;
@@ -70,9 +70,6 @@ const actorScope = new AsyncLocalStorage();
 export function withDecisionActor(actor, work, via) {
     return actorScope.run(via ? { actor, via } : { actor }, work);
 }
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function decisionFileFor(dataDir, at) {
     return join(dataDir, DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/delegations.js

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { getOrCreateChannel, mirrorExchange } from "./comms-visibility.js";
 import { DATA_DIR } from "./config.js";
+import { failedTurnTool } from "../shared/failed-turn.js";
 import { newId } from "./contracts.js";
 import { peerApprovalFailure, requestPeerApproval } from "./peer-approval.js";
 import { canAccessTeam, peerAllowed } from "./peer-roster.js";
@@ -383,7 +384,7 @@ onSettled) {
                     appendDeliveryMessage(bus, threadId, item, {
                         role: "bot",
                         kind: "activity",
-                        tool: { name: `error: delegation failed — ${why.slice(0, 120)}`, ok: false },
+                        tool: failedTurnTool(`delegation failed — ${why}`),
                     });
                 }
                 catch (reportError) {
@@ -607,7 +608,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
         appendDeliveryMessage(bus, sourceThreadId, item, {
             role: "bot",
             kind: "activity",
-            tool: { name: `error: delegation to ${item.toBotId} failed — no such bot`, ok: false },
+            tool: failedTurnTool(`delegation to ${item.toBotId} failed — no such bot`),
         });
         return "settled";
     }

package/dist-server/server/drivers/acp/core.js

@@ -91,10 +91,12 @@ function acpRpcError(value, method) {
     });
 }
 const envOr = (key, fallback) => Number(process.env[key] ?? fallback);
-const INIT_TIMEOUT = envOr("OPENMAUS_ACP_INIT_TIMEOUT_MS", 300_000);
-const SESSION_CONFIG_TIMEOUT = envOr("OPENMAUS_ACP_SESSION_CONFIG_TIMEOUT_MS", 300_000); // configureSession's per-request default
-const NEW_SESSION_TIMEOUT = envOr("OPENMAUS_ACP_NEW_SESSION_TIMEOUT_MS", 300_000);
-const LOAD_SESSION_TIMEOUT = envOr("OPENMAUS_ACP_LOAD_SESSION_TIMEOUT_MS", 120_000); // history replay on a long thread is slow
+const INIT_TIMEOUT = 300_000;
+const SESSION_CONFIG_TIMEOUT = 300_000; // configureSession's per-request default
+const NEW_SESSION_TIMEOUT = 300_000;
+const LOAD_SESSION_TIMEOUT = 120_000; // history replay on a long thread is slow
+/** How long a quiet agent shows no sign of life before it is called stuck. */
+const ACP_STUCK_AFTER_MS = 180_000;
 /** ACP agents may compact their own history without telling the client;
  * re-send the full prompt after this many bare turns as a backstop to
  * compaction detection. */
@@ -614,7 +616,7 @@ export function createAcpDriver(support) {
                     // "no sign of life" is called only once that has lasted minutes.
                     if (next.kind === "no-signs") {
                         noSignsSince ??= now;
-                        if (now - noSignsSince < envOr("OMB_ACP_STUCK_AFTER_MS", 180_000))
+                        if (now - noSignsSince < ACP_STUCK_AFTER_MS)
                             next = { kind: "between-requests" };
                     }
                     else {
@@ -1262,9 +1264,10 @@ export function createAcpDriver(support) {
                 // session, so the model is not a separate axis; fullAuto covers the
                 // transformEnv-policy supports (opencode). mcpServers are session
                 // establishment inputs — they ride session/new and session/load over
-                // the wire — and the harness mints fresh integration bearer tokens
-                // every turn. Most agents apply changes on live load; those that cache
-                // the old MCP clients must resume on a fresh process (see sessionKey).
+                // the wire — and change when a turn's integrations or their grants do
+                // (a thread keeps its integration credentials across turns). Most
+                // agents apply changes on live load; those that cache the old MCP
+                // clients must resume on a fresh process (see sessionKey).
                 // The env the spawned child actually receives is part of the
                 // contract too, and arrives hashed as envFingerprint for the same
                 // reason.