openmausbot 0.1.95 → 0.1.96

package/dist-server/server/admin-activity.js

@@ -20,16 +20,13 @@ import { appendFile, mkdir } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { actorLabel, boundRetentionDays, pruneMonthFiles } from "./decision-log.js";
 import { redactSecrets } from "./redact.js";
-import { csvCell } from "./usage-ledger.js";
+import { csvCell, monthKey } from "./usage-ledger.js";
 export const ADMIN_ACTIVITY_CATEGORIES = ["config", "people", "session", "webhook", "mcp", "engine", "bot", "budget", "visibility"];
 const DIR = "admin-activity";
 const MONTH_FILE = /^(\d{4})-(\d{2})\.ndjson$/;
 const PRUNE_EVERY_MS = 60 * 60_000;
 const writeQueues = new Map();
 const lastPrune = new Map();
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function adminActivityFileFor(dataDir, at) {
     return join(dataDir, DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/auto-approve.js

@@ -3,9 +3,11 @@
 // Nothing here decides whether an action is safe. Each approval level is a
 // provider's own permission mode passed straight through (Claude `auto`,
 // Grok `--permission-mode`, Codex `approvalsReviewer`, …), and a request that
-// reaches this process is one the provider left for a person. The only
-// grants the app applies are Full access and the person's exact saved commands.
-// Questions never come through here: a bot's question always reaches a human.
+// reaches this process is one the provider left for a person. The grants the
+// app applies are Full access and the person's exact saved commands. Approve
+// for me also allows a web search, and that is the one action the app itself
+// grants. Questions never come through here: a bot's question always reaches
+// a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
 import { isOutboundTool } from "../shared/outbound.js";
 /** A failed delivery is a runtime error, not another permission decision.
@@ -78,11 +80,19 @@ export function delegatedApprovalMode(input) {
 // produce an answer: the CLI runs the tool with none and the model is told
 // "The user did not answer the questions." — a question silently lost.
 const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user", "omb-ask"]);
+// A web search is a low-level read. Approve for me allows these names and
+// nothing wider: a bare search, a page fetch, and every other tool stay a
+// prompt. The name is the same shape as a question — one mcp__<server>__
+// prefix removed, then compared case-insensitively.
+const WEB_SEARCH = new Set(["websearch", "web_search", "web-search", "search_web"]);
+function bareToolName(tool) {
+    return tool.replace(/^mcp__[^_]+__/, "").toLowerCase();
+}
 export function autoVerdict(mode, tool, context) {
     // A question is for a person, whatever channel it arrived on — and
     // whatever the mode: even Full has no answer to give, only an approval
     // that would run the tool with none.
-    if (ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
+    if (ASKS_A_PERSON.has(bareToolName(tool))) {
         return { approve: null, source: "no-grant" };
     }
     // Full's promise is literal: even a sandbox widening is approved. Entering
@@ -96,6 +106,11 @@ export function autoVerdict(mode, tool, context) {
         return { approve: null, source: "outbound-guard" };
     if (context?.commandAllowed)
         return { approve: `approved ${tool} (saved command)`, source: "command-allowlist" };
+    // The one action the app itself grants. A fetch of an arbitrary URL is not
+    // a search and stays a prompt, in this mode and every other.
+    if (mode === "auto" && WEB_SEARCH.has(bareToolName(tool))) {
+        return { approve: `approved ${tool} (web search)`, source: "web-search" };
+    }
     if (mode === "auto" || mode === "custom")
         return { approve: null, source: "native-approval" };
     return { approve: null, source: "no-grant" };

package/dist-server/server/boat.js

@@ -88,9 +88,7 @@ function scopedBoatPrefix() {
 }
 /** Decide lifecycle work before a turn mounts Boat. Auto may observe and
  * attach an already-ready Boat, but only explicit Cloud may create or wake. */
-export function boatTurnLifecycleAction({ explicitCloud, canMount, state, }) {
-    if (!canMount)
-        return "none";
+export function boatTurnLifecycleAction({ explicitCloud, state, }) {
     if (state && READY.has(state))
         return "attach";
     if (!explicitCloud)
@@ -828,7 +826,9 @@ export async function findBoat(cfg, botId) {
     if (cachedId) {
         let direct = null;
         try {
-            direct = await boatJson(cfg, `/boxes/${cachedId}`);
+            // Bounded like every other Boat read: a relay that accepts the
+            // connection and stalls must not hold a turn's setup for minutes.
+            direct = await boatJson(cfg, `/boxes/${cachedId}`, { signal: AbortSignal.timeout(20_000) });
         }
         catch {
             // A direct read can fail while the account listing still succeeds.

package/dist-server/server/checkpoints.js

@@ -2,17 +2,15 @@
 //
 // Before a turn's engine can touch files, the working folder is snapshotted
 // into a shadow repo at DATA_DIR/checkpoints/<botId>/<sha256(cwd)[..16]>/.git.
+// When the turn settles, its digest diffs the folder against that snapshot to
+// list the files the turn changed, added and deleted.
 // The user's own .git (if the folder is a repository) is never read, written,
 // or locked: every git call runs with GIT_DIR pointing at the shadow repo and
 // GIT_WORK_TREE pointing at the folder, so the shadow index is the only index
 // involved — and git always skips directories named .git when walking a work
 // tree, so the user's repository internals are invisible to the snapshot.
 //
-// Restore is redo-friendly on purpose: it commits a safety point, then moves
-// the index and work tree back with `git restore --source` + `git clean -fd`
-// while HEAD keeps the safety point — so the state just replaced is the one
-// retained checkpoint, and "undo the undo" is one more restore. Ignored/excluded files
-// (node_modules, .env, media) are never snapshotted and never removed by one.
+// Ignored/excluded files (node_modules, .env, media) are never snapshotted.
 //
 // Failure policy: checkpointing is best-effort convenience, never load-bearing.
 // Any git failure disables the feature for that bot for the rest of the
@@ -20,9 +18,9 @@
 //
 // Adapted from the checkpoint designs of Cline, Roo-Code, and Gemini CLI
 // (all Apache-2.0): the per-call GIT_DIR/GIT_WORK_TREE/GIT_CONFIG_* env
-// override and restore shape follow Gemini CLI's gitService, the sanitized
-// GIT_* env list and the exclude categories follow Roo-Code's checkpoint
-// service, and the snapshot-before-every-turn cadence follows Cline.
+// override follows Gemini CLI's gitService, the sanitized GIT_* env list and
+// the exclude categories follow Roo-Code's checkpoint service, and the
+// snapshot-before-every-turn cadence follows Cline.
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
@@ -30,15 +28,14 @@ import { homedir } from "node:os";
 import { isAbsolute, join, parse, resolve } from "node:path";
 import { DATA_DIR } from "./config.js";
 export const CHECKPOINTS_DIR = join(DATA_DIR, "checkpoints");
-/** Full sha1 hex only. The API hands out full hashes; accepting anything
- * looser would let arbitrary revspecs ("HEAD~3", "main@{u}") reach git. */
+/** Full sha1 hex only: accepting anything looser would let arbitrary
+ * revspecs ("HEAD~3", "main@{u}") reach git. */
 const COMMIT_HASH = /^[0-9a-f]{40}$/;
-// What a checkpoint deliberately does not carry. Restores must never delete
-// these either: `git clean -fd` (without -x) leaves ignored files alone, so
-// everything listed here survives a rollback untouched. Categories follow
-// Roo-Code's checkpoint excludes: VCS internals, dependency trees, build
-// output, caches, logs, secrets, media, archives, databases, model weights.
-const EXCLUDES = `# OpenMausBot checkpoint excludes — never snapshotted, never removed by restore
+// What a checkpoint deliberately does not carry, so a digest never lists
+// these either. Categories follow Roo-Code's checkpoint excludes: VCS
+// internals, dependency trees, build output, caches, logs, secrets, media,
+// archives, databases, model weights.
+const EXCLUDES = `# OpenMausBot checkpoint excludes — never snapshotted
 .git/
 .svn/
 .hg/
@@ -120,8 +117,8 @@ Thumbs.db
 `;
 // gpgsign off: the user's global config may demand signing, and a shadow
 // commit must never block on a passphrase prompt. Automatic GC stays off:
-// explicit GC runs inside the same serialization as snapshot/restore, after
-// their source objects are no longer needed.
+// explicit GC runs inside the same serialization as each snapshot, after the
+// previous snapshot's objects are no longer needed.
 const GITCONFIG = "[commit]\n\tgpgsign = false\n[core]\n\tautocrlf = false\n[gc]\n\tauto = 0\n";
 /** One failed git call disables checkpoints for that bot until restart —
  * a broken shadow repo must cost the user one log line, not a failed turn. */
@@ -140,8 +137,7 @@ function gitAvailable() {
 }
 /** Folders a checkpoint must never be taken in: missing paths, the sprawling
  * personal folders (home, Desktop, Documents, Downloads), and the filesystem
- * root — snapshotting those would trawl unbounded personal data into a repo,
- * and a restore's `git clean -fd` there would be an act of vandalism. */
+ * root — snapshotting those would trawl unbounded personal data into a repo. */
 export function refusalReason(cwd) {
     if (!isAbsolute(cwd))
         return "the working folder must be an absolute path";
@@ -161,7 +157,7 @@ export function refusalReason(cwd) {
     // the refusal while git still follows the symlink into the protected tree.
     // The native realpath also settles Windows' spellings of one folder —
     // c:\users\me, C:\Users\me\DOCUME~1 — and names compare case-insensitively
-    // there, as turn-resources.ts does for workspace claims.
+    // there.
     const same = (a, b) => process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
     if (dir === parse(dir).root)
         return "checkpoints are not taken at the filesystem root";
@@ -203,9 +199,9 @@ function gitEnv(shadow, cwd) {
     return env;
 }
 /** Run one git command against the shadow repo. cwd is the WORK TREE — the
- * "." pathspec in add/restore resolves relative to it. A hung git (index
- * lock, dead network filesystem) would otherwise jam the per-repo queue for
- * the whole session, so every call carries a hard timeout. */
+ * "." pathspec in add resolves relative to it. A hung git (index lock, dead
+ * network filesystem) would otherwise jam the per-repo queue for the whole
+ * session, so every call carries a hard timeout. */
 function runGit(args, cwd, env, signal) {
     return new Promise((resolvePromise, rejectPromise) => {
         signal?.throwIfAborted();
@@ -234,10 +230,10 @@ function hasStagedChanges(cwd, env, signal) {
         });
     });
 }
-// One operation at a time per shadow repo: snapshots and restores against the
-// same folder queue behind each other (git's index lock would fail the loser
-// anyway — this turns a crash into a wait). The stored tail never rejects, so
-// one failed operation can't poison the queue.
+// One operation at a time per shadow repo: snapshots, diffs and pin releases
+// against the same folder queue behind each other (git's index lock would
+// fail the loser anyway — this turns a crash into a wait). The stored tail
+// never rejects, so one failed operation can't poison the queue.
 const chains = new Map();
 function serialize(key, fn) {
     const tail = chains.get(key) ?? Promise.resolve();
@@ -245,12 +241,32 @@ function serialize(key, fn) {
     chains.set(key, run.then(() => undefined, () => undefined));
     return run;
 }
+// A ref per running turn. Every snapshot parents only the empty base and the
+// cleanup after it prunes whatever HEAD no longer reaches — so when a bot's
+// threads work side by side in one folder, a sibling's snapshot would discard
+// the pre-turn commit a still-running turn diffs against at its end. A pin
+// keeps that commit reachable until release(). The pin's name is hashed so
+// any token is a legal ref name.
+const LIVE_REFS = "refs/omb-live/";
+function liveRef(pin) {
+    return LIVE_REFS + createHash("sha256").update(pin).digest("hex").slice(0, 16);
+}
+// Pins outlive the process that wrote them (a crash mid-turn), so the first
+// use of each shadow in this process drops every pin left behind: no turn of
+// ours can be live in a shadow this process has not touched yet.
+const sweptShadows = new Set();
+async function sweepLiveRefs(cwd, env, shadow, signal) {
+    if (sweptShadows.has(shadow))
+        return;
+    const stale = (await runGit(["for-each-ref", "--format=%(refname)", LIVE_REFS], cwd, env, signal)).split("\n").filter(Boolean);
+    for (const ref of stale)
+        await runGit(["update-ref", "-d", ref], cwd, env, signal);
+    sweptShadows.add(shadow);
+}
 /** Create the shadow repo on first use; self-heal its config files on every
  * use (they are tiny, and rewriting them lets exclude-list updates reach
  * shadows that already exist). The base commit is an EMPTY marker so HEAD
- * always resolves — it is filtered from listings and refused as a restore
- * target, because "restore to empty" on a user's own project folder would
- * delete their files. */
+ * always resolves; every snapshot parents only it. */
 async function ensureShadow(cwd, env, shadow, signal) {
     signal?.throwIfAborted();
     mkdirSync(shadow, { recursive: true, mode: 0o700 });
@@ -291,9 +307,11 @@ async function ensureShadow(cwd, env, shadow, signal) {
         // brand-new repo (or a crash between init and first commit)
         await runGit(["commit", "--no-verify", "--allow-empty", "-m", "checkpoint base"], cwd, env, signal);
     }
+    await sweepLiveRefs(cwd, env, shadow, signal);
 }
-/** Capture fully before advancing HEAD. A partial add must never replace
- * the last usable checkpoint or authorize removal of its objects. */
+/** Capture fully before advancing HEAD: null when the add was partial, so a
+ * partial capture never replaces the last usable checkpoint or authorizes
+ * removal of its objects. */
 async function commitAll(cwd, env, label, signal) {
     const previous = (await runGit(["rev-parse", "HEAD"], cwd, env, signal)).trim();
     try {
@@ -303,37 +321,40 @@ async function commitAll(cwd, env, label, signal) {
         await runGit(["add", "-A", "--ignore-errors", "."], cwd, env, signal);
     }
     catch {
-        return { hash: previous, complete: false };
+        return null;
     }
     const changed = await hasStagedChanges(cwd, env, signal);
     const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
     const count = (await runGit(["rev-list", "--count", "HEAD"], cwd, env, signal)).trim();
     if (!changed && Number(count) <= 2)
-        return { hash: previous, complete: true };
+        return previous;
     const tree = (await runGit(["write-tree"], cwd, env, signal)).trim();
     const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
     // Parent only the empty marker, never the previous snapshot: keeping the
     // previous commit as an ancestor would retain every old tree indefinitely.
     const hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
     await runGit(["update-ref", "HEAD", hash, previous], cwd, env, signal);
-    return { hash, complete: true };
+    return hash;
 }
 async function collectObsolete(cwd, env) {
-    // No caller may still need the previous tree. In particular, restore runs
-    // this only AFTER using its source; the safety checkpoint stays reachable.
+    // No caller may still need an unpinned previous tree: HEAD stays reachable,
+    // and so does every commit a live turn still pins.
     try {
         await runGit(["reflog", "expire", "--expire=now", "--all"], cwd, env);
         await runGit(["gc", "--prune=now", "--quiet"], cwd, env);
     }
     catch {
-        // A busy/full disk must not hide an otherwise usable restore point.
-        console.warn("checkpoint cleanup deferred; the latest restore point is preserved");
+        // A busy/full disk must not hide an otherwise usable snapshot.
+        console.warn("checkpoint cleanup deferred; the latest snapshot is preserved");
     }
 }
 /** Snapshot the folder. Returns the checkpoint hash, or null when the
- * feature is off for this bot, git is missing, or the folder is refused.
- * Never throws — this is called fire-and-forget on the turn path. */
-export async function snapshot(botId, cwd, label, signal) {
+ * feature is off for this bot, git is missing, the folder is refused, or a
+ * file could not be read.
+ * With `pin`, the returned commit stays reachable through later snapshots of
+ * the same folder until release(pin) — for a turn that will diff against it
+ * when it ends. Never throws — this is called fire-and-forget on the turn path. */
+export async function snapshot(botId, cwd, label, signal, opts) {
     if (signal?.aborted)
         return null;
     if (disabledBots.has(botId))
@@ -348,11 +369,13 @@ export async function snapshot(botId, cwd, label, signal) {
         return await serialize(shadow, async () => {
             const env = gitEnv(shadow, worktree);
             await ensureShadow(worktree, env, shadow, signal);
-            const result = await commitAll(worktree, env, label, signal);
-            if (!result.complete)
+            const hash = await commitAll(worktree, env, label, signal);
+            if (!hash)
                 return null;
+            if (opts?.pin)
+                await runGit(["update-ref", liveRef(opts.pin), hash], worktree, env, signal);
             await collectObsolete(worktree, env);
-            return result.hash;
+            return hash;
         });
     }
     catch (e) {
@@ -361,7 +384,27 @@ export async function snapshot(botId, cwd, label, signal) {
         return null;
     }
 }
-/** Diff the settled workspace without replacing its pre-turn restore point.
+/** Let go of a pinned pre-turn commit: the next snapshot's cleanup may
+ * reclaim it. Queued behind the shadow's pending operations, so a digest's
+ * diff already in that queue still finds its commit. Best-effort like the
+ * rest of this module — a pin that cannot be dropped costs one log line and
+ * is swept on the next start. */
+export async function release(botId, cwd, pin) {
+    if (!(await gitAvailable()))
+        return;
+    try {
+        const worktree = realpathSync(resolve(cwd));
+        const shadow = shadowDir(botId, worktree);
+        if (!existsSync(join(shadow, ".git", "HEAD")))
+            return;
+        const env = gitEnv(shadow, worktree);
+        await serialize(shadow, () => runGit(["update-ref", "-d", liveRef(pin)], worktree, env));
+    }
+    catch (e) {
+        console.warn(`checkpoint pin not released for bot ${botId}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/** Diff the settled workspace without replacing its pre-turn snapshot.
  * Staging is confined to the shadow index; the user's files and Git are untouched. */
 export async function diffWorkingTree(botId, cwd, fromHash, signal) {
     if (signal?.aborted || !COMMIT_HASH.test(fromHash))
@@ -396,104 +439,3 @@ export async function diffWorkingTree(botId, cwd, fromHash, signal) {
         return null;
     }
 }
-/** The latest usable checkpoint (plus legacy history until the next snapshot). Empty when nothing
- * was ever snapshotted (listing never creates the shadow repo). The empty
- * base marker is omitted — it is not a state anyone should return to. */
-export async function listCheckpoints(botId, cwd) {
-    if (disabledBots.has(botId))
-        return [];
-    if (!(await gitAvailable()))
-        return [];
-    if (refusalReason(cwd) !== null)
-        return [];
-    try {
-        const worktree = realpathSync(resolve(cwd));
-        const shadow = shadowDir(botId, worktree);
-        if (!existsSync(join(shadow, ".git", "HEAD")))
-            return [];
-        return await serialize(shadow, async () => {
-            const env = gitEnv(shadow, worktree);
-            const out = await runGit(["log", "--format=%H%x09%ct%x09%s"], worktree, env);
-            const lines = out.split("\n").filter((line) => line.trim() !== "");
-            lines.pop(); // the root of the log is always the empty base marker
-            return lines.flatMap((line) => {
-                const [hash, seconds, ...subject] = line.split("\t");
-                if (!hash || !COMMIT_HASH.test(hash))
-                    return [];
-                return [{ hash, at: Number(seconds) * 1000, label: subject.join("\t") }];
-            });
-        });
-    }
-    catch (e) {
-        disable(botId, e instanceof Error ? e.message : String(e));
-        return [];
-    }
-}
-/** Can this bot take/restore checkpoints in this folder right now? */
-export async function checkpointsEnabled(botId, cwd) {
-    return !disabledBots.has(botId) && (await gitAvailable()) && refusalReason(cwd) === null;
-}
-/** Move the folder's files back to a checkpoint. The current state is
- * committed first ("before restore"), so the restore itself shows up as a
- * checkpoint and can be undone; HEAD never moves backwards, only forward
- * over the "restored" commit. Excluded and gitignored files are untouched. */
-export async function restore(botId, cwd, hash) {
-    if (disabledBots.has(botId)) {
-        return { ok: false, error: "checkpoints are disabled for this bot until the app restarts (an earlier snapshot failed — see the server log)" };
-    }
-    if (!(await gitAvailable()))
-        return { ok: false, error: "git is not installed on this machine" };
-    const reason = refusalReason(cwd);
-    if (reason !== null)
-        return { ok: false, error: reason };
-    if (!COMMIT_HASH.test(hash))
-        return { ok: false, error: "hash must be a full 40-character checkpoint hash" };
-    try {
-        const worktree = realpathSync(resolve(cwd));
-        const shadow = shadowDir(botId, worktree);
-        if (!existsSync(join(shadow, ".git", "HEAD"))) {
-            return { ok: false, error: "no checkpoints exist for this folder" };
-        }
-        return await serialize(shadow, async () => {
-            const env = gitEnv(shadow, worktree);
-            try {
-                await runGit(["cat-file", "-e", `${hash}^{commit}`], worktree, env);
-            }
-            catch {
-                return { ok: false, error: "no such checkpoint" };
-            }
-            const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], worktree, env)).trim();
-            if (base === hash)
-                return { ok: false, error: "that is the empty base marker, not a checkpoint" };
-            // safety point: whatever is about to be overwritten becomes restorable
-            await ensureShadow(worktree, env, shadow);
-            const safety = await commitAll(worktree, env, "before restore");
-            if (!safety.complete) {
-                return {
-                    ok: false,
-                    error: "restore stopped because some current files could not be added to the safety checkpoint",
-                };
-            }
-            // Index AND work tree move to the source; HEAD stays put. --staged
-            // matters: with a work-tree-only restore, a file that exists in the
-            // source but not in the index (deleted in a later checkpoint, now
-            // resurrected) would be untracked the moment restore recreates it —
-            // and the clean below would delete it right back. Restoring the index
-            // too makes clean blind to everything the checkpoint owns; what clean
-            // then sweeps is exactly the strays the safety commit could not stage
-            // (unreadable files, add races) — never ignored/excluded files (no -x).
-            await runGit(["restore", "--source", hash, "--staged", "--worktree", "--", "."], worktree, env);
-            await runGit(["clean", "-fd"], worktree, env);
-            // Retain the pre-restore safety point, not another copy of the state
-            // now on disk. Reset only the shadow index so it cannot pin old blobs.
-            await runGit(["read-tree", "HEAD"], worktree, env);
-            await collectObsolete(worktree, env);
-            return { ok: true };
-        });
-    }
-    catch (e) {
-        const message = e instanceof Error ? e.message : String(e);
-        disable(botId, message);
-        return { ok: false, error: `restore failed: ${message}` };
-    }
-}

package/dist-server/server/chief-of-staff.js

@@ -8,7 +8,9 @@ const ROSTER_MAX_BOTS = 40;
 const sectionKey = (section) => section?.trim() || "";
 /** Dynamic system context for a section's Chief of Staff.
  * It names the current team on every turn, while list_bots remains the
- * authoritative tool for IDs and live availability at delegation time. */
+ * authoritative tool for IDs and live availability at delegation time.
+ * Who is busy right now is not part of it: that changes turn to turn, so it
+ * rides the volatile half (teammateAvailabilityPrompt in peer-roster.ts). */
 export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoordination = false) {
     const chief = bots.find((bot) => bot.id === chiefId);
     const chiefSection = sectionKey(chief?.section);
@@ -17,11 +19,10 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoor
     // the endpoints must agree, or the prompt names teammates the tools will
     // then refuse to reach.
     const team = reachablePeers(bots, chief ?? { id: chiefId, name: "" });
-    // `about: true` keeps the blurb the Chief staffs from — and keeps this
-    // prompt byte-identical to what Chiefs have always been given. The
-    // ordinary-bot roster drops it (peer-roster.ts); widening the Chief's
-    // existing exposure was never in scope, and narrowing it here would
-    // silently change how a Chief picks a specialist.
+    // `about: true` keeps the blurb the Chief staffs from. The ordinary-bot
+    // roster drops it (peer-roster.ts); widening the Chief's existing exposure
+    // was never in scope, and narrowing it here would silently change how a
+    // Chief picks a specialist.
     const roster = renderRoster(team, {
         max: ROSTER_MAX_BOTS,
         empty: "- No other visible bots are available yet.",

package/dist-server/server/cli.js

@@ -30,11 +30,13 @@ import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
+import { phonePairingLink } from "../shared/pairing-link.js";
 import { parseAllowList } from "./account-signin.js";
 import { appendAdminAction, flushAdminActivity, sharedSignIn } from "./admin-activity.js";
 import { bindDecisionRetention, decisionRetentionDays } from "./decision-log.js";
 import { hostedWorkspaceConfigured } from "./enterprise.js";
 import { resolveLoopbackTrust } from "./request-auth.js";
+import { restartPolicy } from "./restart.js";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
 import { runServiceCommand } from "./service-cli.js";
@@ -466,15 +468,6 @@ export function pairingBlock(input) {
     }
     return lines.join("\n");
 }
-/** The scheme and host of a link, or null if it is not one we can dial. */
-function originOf(link) {
-    try {
-        return new URL(link).origin;
-    }
-    catch {
-        return null;
-    }
-}
 export function qrToString(text) {
     let out = "";
     qrcode.generate(text, { small: true }, (rendered) => {
@@ -494,20 +487,18 @@ async function mintPairing(port, options) {
     if (status !== 200)
         throw new Error(`server refused to mint a pairing code: ${typeof body?.error === "string" ? body.error : status}`);
     const url = options.publicUrl ? `${options.publicUrl}/pair#code=${body.code}` : typeof body.url === "string" ? body.url : null;
-    // A server too old to mint a credential simply has no invite: the web link
-    // still works, so an upgrade is never required to pair a browser.
-    // The address the phone will dial. `--public-url` wins, exactly as it does
-    // for the web link above: a server behind someone else's proxy often does
-    // not know its own public name, which is what that flag is for. Gate on the
-    // credential, never on the server's own invite — a server started without
-    // OMB_PUBLIC_URL returns a credential and no invite, and gating on the
-    // invite would throw away a secret the CLI has every part it needs to use.
-    const address = options.publicUrl ?? (typeof body.url === "string" ? originOf(body.url) : null);
-    // A server too old to mint a credential simply has no invite: the web link
-    // still works, so an upgrade is never required to pair a browser.
-    const invite = typeof body.credential === "string" && address
-        ? `openmausbot://pair?address=${encodeURIComponent(address)}&token=${encodeURIComponent(body.credential)}${typeof body.serverName === "string" ? `&name=${encodeURIComponent(body.serverName)}` : ""}`
-        : typeof body.inviteUrl === "string" ? body.inviteUrl : null;
+    // The phone-app invite. This command asks over loopback, so the server
+    // already built it from its own public address with the same builder; it is
+    // printed as it came. `--public-url` wins, exactly as it does for the web
+    // link above: a server behind someone else's proxy often does not know its
+    // own public name, which is what that flag is for. That case gates on the
+    // credential, never on the server's invite — a server started without
+    // OMB_PUBLIC_URL returns a credential and no invite. A server too old to
+    // mint a credential simply has no invite: the web link still works, so an
+    // upgrade is never required to pair a browser.
+    const invite = (options.publicUrl && typeof body.credential === "string"
+        ? phonePairingLink({ address: options.publicUrl, token: body.credential, name: typeof body.serverName === "string" ? body.serverName : undefined })
+        : null) ?? (typeof body.inviteUrl === "string" ? body.inviteUrl : null);
     return pairingBlock({ code: body.code, url, inviteUrl: invite, expiresAt: body.expiresAt, hint: typeof body.hint === "string" ? body.hint : null, phone: options.phone });
 }
 // ── commands ───────────────────────────────────────────────────────────
@@ -853,7 +844,7 @@ async function planTunnel(options, log, recovery) {
         }
     }
     else {
-        account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion(), recovery });
+        account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion(), recovery, log: (line) => log(`tunnel: ${line}`) });
         if (account.credentials.status === "unavailable")
             return fail(`${account.credentials.file} exists but could not be read; fix or remove it`);
         if (!describeTunnelAccount(account.credentials.read()).email) {
@@ -1156,9 +1147,25 @@ export async function runServe(options, log = console.log) {
         process.removeListener("SIGTERM", onSignal);
     }
 }
+/** `serve` until the server stops for good. A server that exits with
+ * RESTART_EXIT_CODE (a copied workspace committed; docs/copy-workspace.md)
+ * is started again in this process, with its tunnel, Tailscale or domain
+ * address unchanged, and without a second pairing code or browser tab; at
+ * most MAX_RESTARTS times in a row (server/restart.ts restartPolicy). */
+export async function serveUntilStopped(options, run = runServe, now = Date.now) {
+    const policy = restartPolicy(now);
+    let launch = options;
+    for (;;) {
+        const code = await run(launch);
+        if (!policy.again(code))
+            return code;
+        console.log("\nOpenMausBot is starting again to finish installing a copy from the desktop app…");
+        launch = { ...options, pair: false, open: false };
+    }
+}
 /** Keep setup imports behind the data-dir override: config binds its paths
  * when first imported. `serve` remains usable with stdin closed. */
-export async function runOnboardingCommand(options, io = defaultIo(), startServer = runServe, flow = {}) {
+export async function runOnboardingCommand(options, io = defaultIo(), startServer = serveUntilStopped, flow = {}) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
     if (options.command === "setup" && !interactive) {
         io.error("Setup needs an interactive terminal. Run `npx openmausbot setup` in a terminal, then use `npx openmausbot serve` for unattended starts.");
@@ -1235,7 +1242,7 @@ export async function main(argv = process.argv.slice(2)) {
         case "start":
             return runOnboardingCommand(options);
         case "serve":
-            return runServe(options);
+            return serveUntilStopped(options);
         case "pair":
             return runPair(options);
         case "sessions":