openmausbot 0.1.94 → 0.1.96

package/dist-server/server/cloud-overflow.js

@@ -1,167 +0,0 @@
-/** Consent, cost, and idle-stop policy for overflowing a local computer
- * wait onto a per-second-billed cloud seat (#1655).
- *
- * Like server/claim-idle.ts this module is deliberately synchronous and
- * clock-injected: the server decides every transition on its single
- * thread and tests pin time exactly. Nothing here starts or stops a
- * machine — the wiring does, and only when the decision says to. Keep
- * this module free of server imports. */
-import { computerWaitDuration } from "./computer-wait.js";
-/** Default idle stop: a cloud seat no real screen work has touched for
- * this long is stopped (archived), because billing runs per second while
- * it runs. "A few idle minutes" per the issue. */
-export const CLOUD_SEAT_IDLE_STOP_MS = 5 * 60_000;
-/** Retry cadence for an idle stop that failed (#1655): the first retry
- * after one minute, doubling per failure up to ten. A failed stop keeps
- * its lease — the seat still bills — so the sweep always retries instead
- * of abandoning a running machine. */
-export const CLOUD_SEAT_SLEEP_RETRY_MS = 60_000;
-export const CLOUD_SEAT_SLEEP_RETRY_MAX_MS = 10 * 60_000;
-export function cloudOverflowAction(situation) {
-    if (!situation.featureEnabled || !situation.cloudConfigured || situation.perSecondCostUsd === null)
-        return { kind: "off" };
-    if (situation.started)
-        return { kind: "none" };
-    if (situation.consented)
-        return { kind: "start" };
-    if (situation.offered)
-        return { kind: "none" };
-    return { kind: "offer" };
-}
-/** Per-conversation consent plus the offer bookkeeping that keeps the
- * card to one per conversation until it is revoked. A thread the operator
- * allowlisted in config carries standing consent and never needs the
- * card. */
-export class CloudOverflowConsent {
-    grants = new Map();
-    offers = new Map();
-    revocations = new Set();
-    /** Consent for this conversation. With `perSecondCostUsd`, a card
-     * consent counts only at the rate its card showed — an allowlisted
-     * thread carries the operator's standing consent, and the operator is
-     * also the one who sets the rate. */
-    consented(threadId, allowlistedThreads = new Set(), perSecondCostUsd) {
-        if (this.revocations.has(threadId))
-            return false;
-        if (allowlistedThreads.has(threadId))
-            return true;
-        const grant = this.grants.get(threadId);
-        if (!grant)
-            return false;
-        return perSecondCostUsd === undefined || grant.perSecondCostUsd === perSecondCostUsd;
-    }
-    /** `perSecondCostUsd` is the rate the answered card showed. */
-    grant(threadId, perSecondCostUsd, now = Date.now()) {
-        this.revocations.delete(threadId);
-        this.grants.set(threadId, { at: now, perSecondCostUsd });
-    }
-    /** Revoking also clears the offered mark, so a later wait in the same
-     * conversation may ask again instead of meeting silence. */
-    revoke(threadId) {
-        const had = this.grants.delete(threadId);
-        this.revocations.add(threadId);
-        this.offers.delete(threadId);
-        return had;
-    }
-    /** A card is outstanding for this conversation — at the given rate
-     * when one is supplied, so a config change re-offers with the new
-     * price instead of meeting silence at the old one. */
-    offered(threadId, perSecondCostUsd) {
-        const offer = this.offers.get(threadId);
-        if (!offer)
-            return false;
-        return perSecondCostUsd === undefined || offer.perSecondCostUsd === perSecondCostUsd;
-    }
-    /** The rate the outstanding card showed, or null when no card is out. */
-    offeredRate(threadId) {
-        return this.offers.get(threadId)?.perSecondCostUsd ?? null;
-    }
-    markOffered(threadId, perSecondCostUsd, now = Date.now()) {
-        this.offers.set(threadId, { at: now, perSecondCostUsd });
-    }
-}
-/** One running cloud seat started by overflow. `touch` is called only
- * for real computer tool completions on that seat — screen-poller frames
- * never reach it, exactly like #1653's activity clock, so preview
- * traffic cannot keep a paid machine awake. */
-export class CloudSeatLease {
-    botId;
-    threadId;
-    /** The claim generation that started the seat: a stop releases the Box
-     * claim for exactly this owner, never a newer turn's. */
-    generation;
-    startedAt;
-    idleStopMs;
-    lastActivityAt;
-    sleepRetryNotBefore = 0;
-    sleepRetryMs = CLOUD_SEAT_SLEEP_RETRY_MS;
-    constructor(init) {
-        const idleStopMs = init.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-        if (!Number.isFinite(idleStopMs) || idleStopMs <= 0)
-            throw new Error("Cloud seat idle stop window must be positive");
-        this.botId = init.botId;
-        this.threadId = init.threadId;
-        this.generation = init.generation;
-        this.startedAt = init.now ?? Date.now();
-        this.lastActivityAt = this.startedAt;
-        this.idleStopMs = idleStopMs;
-    }
-    touch(now = Date.now()) {
-        this.lastActivityAt = now;
-        // Real work earns a fresh stop attempt: the backoff only paces
-        // retries against an idle seat that keeps failing to sleep.
-        this.sleepRetryNotBefore = 0;
-        this.sleepRetryMs = CLOUD_SEAT_SLEEP_RETRY_MS;
-    }
-    /** An idle stop may run now — true until a failure defers it. */
-    sleepDue(now = Date.now()) {
-        return now >= this.sleepRetryNotBefore;
-    }
-    /** The idle stop failed: keep the lease and back off, bounded, so the
-     * sweep retries gently instead of hammering a sick Box — and never
-     * abandons a seat that still bills. */
-    deferSleep(now = Date.now()) {
-        this.sleepRetryNotBefore = now + this.sleepRetryMs;
-        this.sleepRetryMs = Math.min(this.sleepRetryMs * 2, CLOUD_SEAT_SLEEP_RETRY_MAX_MS);
-    }
-    idleFor(now = Date.now()) {
-        return Math.max(0, now - this.lastActivityAt);
-    }
-    idleElapsed(now = Date.now()) {
-        return now - this.lastActivityAt >= this.idleStopMs;
-    }
-}
-/** Dollars per second at rate-card precision: enough places for small
- * per-second rates to stay visible, trailing zeros trimmed but never
- * past two decimals. */
-export function formatPerSecondUsd(perSecondCostUsd) {
-    let text = perSecondCostUsd.toFixed(6).replace(/0+$/, "");
-    if (text.endsWith("."))
-        text += "00";
-    else {
-        const decimals = text.length - text.indexOf(".") - 1;
-        if (decimals < 2)
-            text += "0".repeat(2 - decimals);
-    }
-    return "$" + text;
-}
-/** The consent card (#1655): the per-second cost sits beside the local
- * wait picture before any choice is made, and nothing starts without an
- * explicit consent the person still has to give. */
-export function cloudOverflowOfferText(opts) {
-    const idleStopMs = opts.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-    const estimate = opts.waitEstimateMs === undefined ? "" : ` Recent local waits here have taken about ${computerWaitDuration(opts.waitEstimateMs)}.`;
-    return `This computer is busy. Its work can overflow to a cloud computer for ${formatPerSecondUsd(opts.perSecondCostUsd)} per second.${estimate} Nothing starts without your consent — allow cloud overflow for this conversation to start it; the cloud computer stops after ${computerWaitDuration(idleStopMs)} idle.`;
-}
-export function cloudSeatStartedText(opts) {
-    const idleStopMs = opts.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-    return `Cloud computer started at ${formatPerSecondUsd(opts.perSecondCostUsd)} per second. It stops automatically after ${computerWaitDuration(idleStopMs)} idle, and the local wait continues until this computer is free.`;
-}
-export function cloudSeatStoppedText(idleMs) {
-    return `Cloud computer stopped after ${computerWaitDuration(idleMs)} idle — billing pauses while it sleeps.`;
-}
-export function cloudOverflowConsentText(allowed, idleStopMs = CLOUD_SEAT_IDLE_STOP_MS) {
-    return allowed
-        ? `Cloud overflow allowed for this conversation. A waiting turn may start the cloud computer; it stops after ${computerWaitDuration(idleStopMs)} idle.`
-        : "Cloud overflow consent revoked. Waits stay local, and no cloud computer starts without a new consent.";
-}

package/dist-server/server/drivers/chat-boat-tools.js

@@ -1,90 +0,0 @@
-import { isolatedRemoteCommand, runCommand, screenshotBoat } from "../boat.js";
-import { createControlClient, CONTROL_REFUSAL_PLAIN } from "../control-client.js";
-const coordinate = { type: "integer", minimum: 0, maximum: 32767 };
-const tool = (name, description, properties = {}, required = []) => ({ name, description, inputSchema: { type: "object", properties, required, additionalProperties: false } });
-const TOOLS = [
-    tool("screenshot", "See the assigned cloud desktop at native pixel resolution."),
-    tool("get_screen_size", "Get the cloud desktop width and height."),
-    tool("click", "Click a point on the cloud desktop.", { x: coordinate, y: coordinate, button: { type: "string", enum: ["left", "middle", "right"] }, count: { type: "integer", minimum: 1, maximum: 3 } }, ["x", "y"]),
-    tool("move", "Move the cloud mouse pointer.", { x: coordinate, y: coordinate }, ["x", "y"]),
-    tool("drag", "Drag on the cloud desktop.", { x: coordinate, y: coordinate, to_x: coordinate, to_y: coordinate }, ["x", "y", "to_x", "to_y"]),
-    tool("type_text", "Type Unicode text into the focused cloud application.", { text: { type: "string", maxLength: 4000 } }, ["text"]),
-    tool("key_press", "Press an X11 key or shortcut.", { key: { type: "string", pattern: "^[A-Za-z0-9_+]+$", minLength: 1, maxLength: 100 } }, ["key"]),
-    tool("scroll", "Scroll at a point on the cloud desktop.", { x: coordinate, y: coordinate, direction: { type: "string", enum: ["up", "down", "left", "right"] }, amount: { type: "integer", minimum: 1, maximum: 30 } }, ["x", "y", "direction"]),
-    tool("open_url", "Request opening an HTTP or HTTPS URL in the cloud desktop browser; inspect the screen to confirm it loaded.", { url: { type: "string", pattern: "^https?://", maxLength: 2000 } }, ["url"]),
-    tool("exec", "Run a shell command on the assigned cloud computer.", { command: { type: "string", minLength: 1, maxLength: 4000 } }, ["command"]),
-];
-const quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
-const buttons = { left: 1, middle: 2, right: 3 };
-const scrollButtons = { up: 4, down: 5, left: 6, right: 7 };
-/** Uses only the leased descriptor supplied by the harness. Schema validation
- * and user approval happen in the shared chat tool executor before this call. */
-export class ChatBoatClient {
-    closed = false;
-    control;
-    descriptor;
-    constructor(descriptor) {
-        this.descriptor = descriptor;
-        if (!descriptor.control?.url || !descriptor.control.token)
-            throw new Error("Cloud computer control gate missing");
-        this.control = createControlClient(descriptor.control);
-    }
-    async tools() { return TOOLS; }
-    async close() { this.closed = true; }
-    async call(_method, params, signal) {
-        signal.throwIfAborted();
-        if (this.closed)
-            throw new Error("Cloud computer session closed");
-        const state = await this.control.state(true);
-        signal.throwIfAborted();
-        if (this.closed)
-            throw new Error("Cloud computer session closed");
-        if (state.held || state.blockedReason)
-            return { isError: true, content: [{ type: "text", text: state.blockedReason || CONTROL_REFUSAL_PLAIN }] };
-        const { name, arguments: a } = params;
-        const config = { box: { token: this.descriptor.token } };
-        const id = this.descriptor.boxId;
-        if (name === "screenshot") {
-            const shot = await screenshotBoat(config, "", id, { signal, nativeSize: true });
-            signal.throwIfAborted();
-            return { content: [{ type: "image", mimeType: "image/jpeg", data: shot.png }] };
-        }
-        const mouse = `xdotool mousemove --sync ${a.x} ${a.y}`;
-        let command;
-        switch (name) {
-            case "get_screen_size":
-                command = "xdotool getdisplaygeometry";
-                break;
-            case "click":
-                command = `${mouse} click --repeat ${a.count ?? 1} --delay 100 ${buttons[String(a.button ?? "left")]}`;
-                break;
-            case "move":
-                command = mouse;
-                break;
-            case "drag":
-                command = `${mouse} mousedown 1 mousemove --sync ${a.to_x} ${a.to_y} mouseup 1`;
-                break;
-            case "type_text":
-                command = `printf %s ${quote(Buffer.from(String(a.text)).toString("base64"))} | base64 -d | xclip -selection clipboard && xdotool key --clearmodifiers ctrl+v`;
-                break;
-            case "key_press":
-                command = `xdotool key --clearmodifiers ${quote(String(a.key))}`;
-                break;
-            case "scroll":
-                command = `${mouse} click --repeat ${a.amount ?? 3} --delay 80 ${scrollButtons[String(a.direction)]}`;
-                break;
-            case "open_url":
-                command = `nohup xdg-open ${quote(String(a.url))} >/dev/null 2>&1 </dev/null &`;
-                break;
-            case "exec":
-                command = String(a.command);
-                break;
-            default: throw new Error("Unknown cloud computer tool");
-        }
-        const result = await runCommand(config, id, isolatedRemoteCommand(command), { signal });
-        signal.throwIfAborted();
-        if (name === "open_url" && result.ok)
-            return { content: [{ type: "text", text: "Browser launch requested. Page loading is not confirmed; inspect the screen before continuing." }] };
-        return { isError: !result.ok, content: [{ type: "text", text: JSON.stringify(result) }] };
-    }
-}

package/dist-server/server/drivers/grokagent.js

@@ -1,4 +0,0 @@
-// Back-compat re-export: the Grok Build ACP driver moved to acp/grok.ts,
-// riding the shared acp/core.ts runtime. Kept here so existing imports and
-// dist-server references keep resolving.
-export { GrokAgentDriver } from "./acp/grok.js";

package/dist-server/server/openmaus-status-capsule.js

@@ -1,329 +0,0 @@
-import { createHash } from "node:crypto";
-import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { z } from "zod";
-import { parseJson } from "./schema.js";
-const SCHEMA = "aos.openmausbot_status.v1";
-const TTL_SECONDS = 300;
-const MAX_CACHE_BYTES = 16_384;
-const DIGEST = /^sha256:[a-f0-9]{64}$/;
-const UTC_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$/;
-const digestSchema = z.string().regex(DIGEST);
-const slotSchema = z.object({
-    slot: z.string().regex(/^vm-[1-4]$/),
-    container: z.enum(["running", "stopped", "missing"]),
-    readiness: z.enum(["ready", "not_ready"]),
-    network: z.enum(["loopback", "unsafe", "unknown"]),
-    security: z.enum(["hardened", "unsafe", "unknown"]),
-    persistence: z.enum(["durable", "unsafe", "unknown"]),
-}).strict();
-const uiSchema = z.object({
-    two_up: z.boolean(),
-    max_visible: z.union([z.literal(1), z.literal(2)]),
-    max_interactive: z.literal(1),
-    default_watch_only: z.boolean(),
-}).strict();
-const capsuleSchema = z.object({
-    schema: z.literal(SCHEMA),
-    observed_at: z.string().regex(UTC_TIMESTAMP),
-    fresh_until: z.string().regex(UTC_TIMESTAMP),
-    ttl_seconds: z.literal(TTL_SECONDS),
-    source_sha256: digestSchema.nullable(),
-    dual_view_sha256: digestSchema.nullable(),
-    receipt_sha256: digestSchema,
-    refresh_status: z.enum(["success", "failed"]),
-    failure_reason: z.enum([
-        "config_unavailable",
-        "bots_unavailable",
-        "vm_status_unavailable",
-        "capacity_exceeded",
-        "source_hash_unavailable",
-        "source_hash_mismatch",
-    ]).optional(),
-    runtime_state: z.enum(["ready", "degraded", "unknown"]),
-    mode: z.enum(["shared", "per-bot", "unknown"]),
-    max_instances: z.number().int().min(1).max(4).nullable(),
-    ready_count: z.number().int().min(0).max(4),
-    slots: z.array(slotSchema).max(4),
-    ui: uiSchema,
-}).strict();
-const jsonObjectSchema = z.record(z.string(), z.custom());
-export const OPENMAUS_STATUS_CACHE_PATH = join(homedir(), ".local/state/aos-session-bridge/openmausbot/latest.json");
-function canonicalValue(value) {
-    if (Array.isArray(value))
-        return value.map(canonicalValue);
-    const parsedObject = jsonObjectSchema.safeParse(value);
-    if (!parsedObject.success)
-        return value;
-    const sorted = {};
-    for (const key of Object.keys(parsedObject.data).sort()) {
-        const child = parsedObject.data[key];
-        if (child !== undefined)
-            sorted[key] = canonicalValue(child);
-    }
-    return sorted;
-}
-function canonical(value) {
-    return JSON.stringify(canonicalValue(value));
-}
-function sha256(value) {
-    return `sha256:${createHash("sha256").update(value, "utf8").digest("hex")}`;
-}
-function timestamp(value) {
-    const parsed = Date.parse(value);
-    if (!Number.isFinite(parsed))
-        return null;
-    if (new Date(parsed).toISOString().replace(".000Z", "Z") !== value)
-        return null;
-    return parsed;
-}
-function expectedUi(twoUp) {
-    return {
-        two_up: twoUp,
-        max_visible: twoUp ? 2 : 1,
-        max_interactive: 1,
-        default_watch_only: twoUp,
-    };
-}
-function sameUi(left, right) {
-    return (left.two_up === right.two_up &&
-        left.max_visible === right.max_visible &&
-        left.max_interactive === right.max_interactive &&
-        left.default_watch_only === right.default_watch_only);
-}
-function unsignedDocument(capsule) {
-    const document = {
-        schema: capsule.schema,
-        observed_at: capsule.observed_at,
-        fresh_until: capsule.fresh_until,
-        ttl_seconds: capsule.ttl_seconds,
-        source_sha256: capsule.source_sha256,
-        dual_view_sha256: capsule.dual_view_sha256,
-        refresh_status: capsule.refresh_status,
-        runtime_state: capsule.runtime_state,
-        mode: capsule.mode,
-        max_instances: capsule.max_instances,
-        ready_count: capsule.ready_count,
-        slots: capsule.slots.map((slot) => ({
-            slot: slot.slot,
-            container: slot.container,
-            readiness: slot.readiness,
-            network: slot.network,
-            security: slot.security,
-            persistence: slot.persistence,
-        })),
-        ui: {
-            two_up: capsule.ui.two_up,
-            max_visible: capsule.ui.max_visible,
-            max_interactive: capsule.ui.max_interactive,
-            default_watch_only: capsule.ui.default_watch_only,
-        },
-    };
-    if (capsule.failure_reason !== undefined)
-        document.failure_reason = capsule.failure_reason;
-    return document;
-}
-function validSlotState(slot) {
-    return (slot.readiness !== "ready" ||
-        (slot.container === "running" &&
-            slot.network === "loopback" &&
-            slot.security === "hardened" &&
-            slot.persistence === "durable"));
-}
-function validateCapsule(value) {
-    const parsed = capsuleSchema.safeParse(value);
-    if (!parsed.success)
-        return null;
-    const capsule = parsed.data;
-    const observed = timestamp(capsule.observed_at);
-    const freshUntil = timestamp(capsule.fresh_until);
-    if (observed === null || freshUntil === null || freshUntil - observed !== TTL_SECONDS * 1000)
-        return null;
-    if (capsule.receipt_sha256 !== sha256(canonical(unsignedDocument(capsule))))
-        return null;
-    if (!capsule.slots.every((slot, index) => slot.slot === `vm-${index + 1}` && validSlotState(slot))) {
-        return null;
-    }
-    const readyCount = capsule.slots.filter((slot) => slot.readiness === "ready").length;
-    if (capsule.ready_count !== readyCount)
-        return null;
-    const twoUp = Boolean(capsule.refresh_status === "success" &&
-        capsule.mode === "per-bot" &&
-        capsule.max_instances !== null &&
-        capsule.max_instances >= 2 &&
-        capsule.source_sha256 !== null &&
-        capsule.dual_view_sha256 !== null &&
-        capsule.source_sha256 === capsule.dual_view_sha256);
-    if (!sameUi(capsule.ui, expectedUi(twoUp)))
-        return null;
-    if (capsule.refresh_status === "failed") {
-        if (capsule.failure_reason === undefined ||
-            capsule.runtime_state !== "unknown" ||
-            capsule.mode !== "unknown" ||
-            capsule.max_instances !== null ||
-            capsule.ready_count !== 0 ||
-            capsule.slots.length !== 0 ||
-            !sameUi(capsule.ui, expectedUi(false)))
-            return null;
-    }
-    else {
-        const expectedRuntime = capsule.slots.length > 0 && readyCount === capsule.slots.length ? "ready" : "degraded";
-        if (capsule.failure_reason !== undefined ||
-            capsule.runtime_state !== expectedRuntime ||
-            (capsule.mode !== "shared" && capsule.mode !== "per-bot") ||
-            capsule.max_instances === null ||
-            readyCount > capsule.max_instances ||
-            capsule.source_sha256 === null ||
-            capsule.dual_view_sha256 === null ||
-            capsule.source_sha256 !== capsule.dual_view_sha256)
-            return null;
-    }
-    return capsule;
-}
-function privateCache(path) {
-    const uid = process.getuid?.();
-    if (uid === undefined)
-        return null;
-    let descriptor = null;
-    try {
-        const parentStatus = lstatSync(dirname(path));
-        const fileStatus = lstatSync(path);
-        if (parentStatus.isSymbolicLink() ||
-            !parentStatus.isDirectory() ||
-            parentStatus.uid !== uid ||
-            (parentStatus.mode & 0o777) !== 0o700)
-            return null;
-        if (fileStatus.isSymbolicLink() ||
-            !fileStatus.isFile() ||
-            fileStatus.uid !== uid ||
-            (fileStatus.mode & 0o777) !== 0o600 ||
-            fileStatus.size > MAX_CACHE_BYTES)
-            return null;
-        descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-        const openedStatus = fstatSync(descriptor);
-        if (!openedStatus.isFile() ||
-            openedStatus.uid !== uid ||
-            (openedStatus.mode & 0o777) !== 0o600 ||
-            openedStatus.dev !== fileStatus.dev ||
-            openedStatus.ino !== fileStatus.ino ||
-            openedStatus.size > MAX_CACHE_BYTES)
-            return null;
-        const contents = readFileSync(descriptor);
-        return contents.length <= MAX_CACHE_BYTES ? contents : null;
-    }
-    catch {
-        return null;
-    }
-    finally {
-        if (descriptor !== null) {
-            try {
-                closeSync(descriptor);
-            }
-            catch {
-                // Cleanup failures must not escape the fail-closed cache read.
-            }
-        }
-    }
-}
-function unknownDigest(reason, freshness = "unknown", receipt) {
-    return {
-        schema: SCHEMA,
-        freshness,
-        reason,
-        ...receipt,
-        runtimeState: "unknown",
-        mode: "unknown",
-        maxInstances: null,
-        readyCount: 0,
-        slots: [],
-        ui: {
-            twoUp: false,
-            maxVisible: 1,
-            maxInteractive: 1,
-            defaultWatchOnly: false,
-            oneActiveController: true,
-        },
-    };
-}
-export function readOpenMausStatus(options = {}) {
-    const raw = privateCache(options.cachePath ?? OPENMAUS_STATUS_CACHE_PATH);
-    if (raw === null)
-        return unknownDigest("missing_or_insecure");
-    let capsule;
-    try {
-        capsule = validateCapsule(parseJson(raw.toString("utf8")));
-    }
-    catch {
-        capsule = null;
-    }
-    if (capsule === null)
-        return unknownDigest("invalid");
-    const observed = timestamp(capsule.observed_at);
-    const freshUntil = timestamp(capsule.fresh_until);
-    const now = (options.now ?? new Date()).getTime();
-    const receipt = { observedAt: capsule.observed_at, receiptSha256: capsule.receipt_sha256 };
-    if (!Number.isFinite(now) || now < observed)
-        return unknownDigest("clock_skew");
-    if (now >= freshUntil)
-        return unknownDigest("stale", "stale", receipt);
-    if (capsule.refresh_status === "failed")
-        return unknownDigest("refresh_failed", "fresh", receipt);
-    const result = {
-        schema: SCHEMA,
-        freshness: "fresh",
-        ...receipt,
-        runtimeState: capsule.runtime_state,
-        mode: capsule.mode,
-        maxInstances: capsule.max_instances,
-        readyCount: capsule.ready_count,
-        slots: capsule.slots,
-        ui: {
-            twoUp: capsule.ui.two_up,
-            maxVisible: capsule.ui.max_visible,
-            maxInteractive: 1,
-            defaultWatchOnly: capsule.ui.default_watch_only,
-            oneActiveController: true,
-        },
-    };
-    if (capsule.source_sha256 !== null)
-        result.sourceSha256 = capsule.source_sha256;
-    if (capsule.dual_view_sha256 !== null)
-        result.dualViewSha256 = capsule.dual_view_sha256;
-    return result;
-}
-export function openMausStatusSystemPrompt(options = {}) {
-    const status = readOpenMausStatus(options);
-    const receipt = [
-        status.observedAt ? `observed_at=${status.observedAt}` : null,
-        status.receiptSha256 ? `receipt_sha256=${status.receiptSha256}` : null,
-        status.sourceSha256 ? `source_sha256=${status.sourceSha256}` : null,
-        status.dualViewSha256 ? `accepted_dual_view_sha256=${status.dualViewSha256}` : null,
-        status.sourceSha256 && status.dualViewSha256
-            ? `source_match=${status.sourceSha256 === status.dualViewSha256}`
-            : null,
-    ].filter(Boolean).join("; ");
-    const runtime = status.freshness === "fresh" && status.reason === undefined
-        ? [
-            `runtime_state=${status.runtimeState}`,
-            `mode=${status.mode}`,
-            `maximum_instances=${status.maxInstances}`,
-            `ready_count=${status.readyCount}`,
-        ].join("; ")
-        : "runtime_state=unknown; mode=unknown; maximum_instances=unknown; ready_count=0";
-    const slots = status.slots.length
-        ? status.slots
-            .map((slot) => `${slot.slot}(container=${slot.container},readiness=${slot.readiness},network=${slot.network},security=${slot.security},persistence=${slot.persistence})`)
-            .join(",")
-        : "none";
-    return [
-        "TRUSTED OPENMAUSBOT STATUS (read-only, validated, no transcript or credential data):",
-        `schema=${status.schema}; freshness=${status.freshness}${status.reason ? `; reason=${status.reason}` : ""}`,
-        receipt || "receipt=unavailable",
-        runtime,
-        `anonymous_slots=${slots}`,
-        `ui.two_up=${status.ui.twoUp}; ui.max_visible=${status.ui.maxVisible}; ui.max_interactive=1; ui.default_watch_only=${status.ui.defaultWatchOnly}; one_active_controller=true`,
-        "Opening a viewer or two-up workspace never starts or provisions a VM. Only one pane may be interactive at a time; switching control must release the previous pane before activating the next.",
-        "Treat missing, stale, failed, clock-skewed, malformed, or receipt-hash-mismatched runtime data as unknown. Do not infer bot identities, viewer URLs, paths, messages, models, accounts, or credentials from this block.",
-    ].join("\n");
-}