openmausbot 0.1.95 → 0.1.96

package/dist-server/server/cloud-home-start.js

@@ -8,7 +8,7 @@
 // forwards with X-Forwarded-*, so request-auth.ts never grants a remote
 // request loopback trust. If either child exits, both stop and the machine
 // restarts; the one exception is the server asking to be started again
-// after a restore.
+// after a restore (server/restart.ts).
 //
 // The machine's secrets (the signing secret, the relay tokens) arrive as
 // this process's environment. No child's environment ever carries them:
@@ -24,7 +24,8 @@ import { spawn } from "node:child_process";
 import { chownSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
+import { CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
+import { restartPolicy } from "./restart.js";
 const SERVICE_USER = "maus";
 /** The descriptor the server reads its secrets from. */
 const SECRETS_FD = 3;
@@ -112,11 +113,6 @@ export function spawnWithSecrets(command, args, env, secrets, ids) {
     pipe?.end(JSON.stringify(secrets));
     return child;
 }
-/** What the launcher does when the server child exits: start it again only
- * when it asked to (a committed restore), and only a few times in a row. */
-export function serverExitAction(code, stopping, restarts) {
-    return !stopping && code === CLOUD_HOME_RESTART_EXIT_CODE && restarts < 5 ? "restart" : "stop";
-}
 export function startCloudHome(env = process.env) {
     process.umask(0o077);
     const config = cloudHomeConfiguration(env);
@@ -189,14 +185,15 @@ export function startCloudHome(env = process.env) {
                 stop(true);
         });
     };
-    let restarts = 0;
-    const runServer = () => watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
-        if (serverExitAction(code, stopping, restarts) !== "restart")
-            return false;
-        restarts++;
-        runServer();
-        return true;
-    });
+    const policy = restartPolicy();
+    const runServer = () => {
+        watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
+            if (!policy.again(code, stopping))
+                return false;
+            runServer();
+            return true;
+        });
+    };
     runServer();
     watch(spawn(edgeBin, ["run", "--config", edgeConfig, "--adapter", "caddyfile"], { env: edge, stdio: "inherit", ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) }));
     process.once("SIGTERM", () => stop(false));

package/dist-server/server/cloud-home.js

@@ -45,10 +45,6 @@ export const CLOUD_PAIRING_SKEW_S = 300;
 export const CLOUD_PAIRING_NONCE_MS = 10 * 60_000;
 const MAX_NONCES = 10_000;
 export const CLOUD_HOME_MARKER = ".omb-cloud-home.json";
-/** The server exits with this after a restore commits (Move to Cloud): the
- * launcher then starts it again, and startup installs the restore. Any other
- * exit stops the machine for Fly to restart. */
-export const CLOUD_HOME_RESTART_EXIT_CODE = 75;
 export function cloudHomeConfigured(env = process.env) {
     return CLOUD_HOME_KEYS.some((key) => env[key] !== undefined);
 }

package/dist-server/server/cloud-move-http.js

@@ -1,9 +1,18 @@
 import { z } from "zod";
+import { sharedSignIn } from "./admin-activity.js";
 import { backupsBytes, beginUpload, CLOUD_MOVE_MAX_BYTES, CLOUD_MOVE_MAX_PART_BYTES, CLOUD_MOVE_PART_BYTES, completedUpload, discardNextPreviousCloud, discardUpload, enabledRoutineCount, forgetMoveRestore, freeVolumeBytes, isEmptyWorkspace, moveSpaceNeeded, noteMoveRestore, prepareNextPreviousCloud, previousCloud, previousCloudArchiveBytes, removeMoveFiles, stagePreviousCloud, tidyCloudMoveStorage, totalVolumeBytes, uploadStatus, validUploadDeclaration, workspaceContents, workspaceMoveSize, writeUploadPart, } from "./cloud-move.js";
 import { commitPendingWorkspaceRestore, createWorkspaceBackup, stageWorkspaceBackup } from "./workspace-backup.js";
 export const CLOUD_MOVE_PREFIX = "/api/cloud-move";
 const failure = (message, status) => Object.assign(new Error(message), { status });
 const HELD_CACHE_MS = 30_000;
+/** Shared with other people, so one person's copy must never replace it: a
+ * hosted organisation workspace, or (not on a Cloud home, whose sign-in is its
+ * owner's OMB Cloud account) an email sign-in list that lets someone else in
+ * (sharedSignIn: a member, a second admin, or a whole @domain). The owner's
+ * own address alone (`openmausbot access add you@example.com`) is not. */
+export function workspaceShared(input) {
+    return input.hosted || (!input.cloudHome && sharedSignIn(input.signIn));
+}
 export function createCloudMoveRoutes(options) {
     const freeBytes = options.freeBytes ?? freeVolumeBytes;
     const volumeBytes = (path) => { try {
@@ -12,16 +21,17 @@ export function createCloudMoveRoutes(options) {
     catch {
         return null;
     } };
-    // A move's restore that startup has installed keeps no safety copy or
-    // staged files; an abandoned upload goes after a day.
-    if (options.cloudHome) {
-        try {
-            tidyCloudMoveStorage(options.dataDir, options.restored);
-        }
-        catch (error) {
-            console.warn(`cloud move: could not tidy backup storage (${error instanceof Error ? error.message : "unknown"})`);
-        }
+    // A copy's restore that startup has installed keeps no safety copy or
+    // staged files, and the workspace it replaced becomes the one to swap back
+    // to; an abandoned upload goes after a day. Only what a copy recorded is
+    // touched, so on a server that never received one this does nothing.
+    try {
+        tidyCloudMoveStorage(options.dataDir, options.restored);
+    }
+    catch (error) {
+        console.warn(`workspace copy: could not tidy backup storage (${error instanceof Error ? error.message : "unknown"})`);
     }
+    const identity = { appVersion: options.appVersion, environmentId: options.environmentId };
     // Staged here by a preview; restore accepts nothing else.
     const staged = new Set();
     let job = null;
@@ -33,16 +43,16 @@ export function createCloudMoveRoutes(options) {
     };
     const check = (req, auth) => {
         if (!options.authorized(req, auth))
-            throw failure("Your session changed. Start the move again.", 403);
+            throw failure("Your session changed. Start the copy again.", 403);
     };
     const ready = () => {
         if (job?.state === "running" || writing)
-            throw failure("Another move step is running on your Cloud. Wait for it to finish.", 409);
+            throw failure("Another copy step is running on this server. Wait for it to finish.", 409);
         const status = options.status();
         if (status.pendingRestore)
-            throw failure("Your Cloud is restarting to finish a restore. Try again in a minute.", 409);
+            throw failure("This server is restarting to finish a restore. Try again in a minute.", 409);
         if (status.busy)
-            throw failure("Your Cloud is busy with a backup. Try again when it finishes.", 409);
+            throw failure("This server is busy with a backup. Try again when it finishes.", 409);
     };
     /** Delete what earlier previews staged and no restore took. */
     const dropStaged = () => {
@@ -63,7 +73,7 @@ export function createCloudMoveRoutes(options) {
             after?.(result);
         }, (error) => {
             if (job === current)
-                job = { kind, state: "failed", error: error instanceof Error ? error.message : "The move could not finish." };
+                job = { kind, state: "failed", error: error instanceof Error ? error.message : "The copy could not finish." };
         });
     }
     // A person's own page can hold the workspace gate for a moment (an ordinary
@@ -106,7 +116,7 @@ export function createCloudMoveRoutes(options) {
     const roomFor = (archive, already = 0) => {
         const needed = moveSpaceNeeded(archive, workspaceMoveSize(options.dataDir).bytes, true) - already;
         const free = freeBytes(options.dataDir);
-        return free >= needed ? null : { error: "Your Cloud does not have enough free space for this.", freeBytes: free, neededBytes: needed };
+        return free >= needed ? null : { error: "This server does not have enough free space for this.", freeBytes: free, neededBytes: needed };
     };
     // The answer that the restore is ready goes out first; then the launcher
     // starts the server again, and startup installs the restore before anything else loads.
@@ -117,15 +127,16 @@ export function createCloudMoveRoutes(options) {
         const method = req.method ?? "GET";
         try {
             if (!auth.scopes.includes("admin"))
-                throw failure("Only the owner can move a workspace.", 403);
+                throw failure("Only the owner can copy a workspace.", 403);
             if (method === "GET" && path === `${CLOUD_MOVE_PREFIX}/estimate`) {
-                json(res, 200, { ...workspaceContents(options.dataDir), ...workspaceMoveSize(options.dataDir), routines: enabledRoutineCount(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES });
+                json(res, 200, { ...workspaceContents(options.dataDir), ...workspaceMoveSize(options.dataDir), routines: enabledRoutineCount(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES, ...identity });
                 return true;
             }
-            if (!options.cloudHome)
-                throw failure("Only an OMB Cloud home receives a moved workspace.", 404);
             if (auth.kind !== "session")
-                throw failure("Move to Cloud needs the owner's signed-in app.", 403);
+                throw failure("Copying a workspace needs the owner's signed-in app.", 403);
+            if (options.sharedWorkspace()) {
+                throw Object.assign(failure("This server is shared with other people, so it can't receive one computer's bots and chats. Copy to a server only you use.", 403), { code: "shared_workspace" });
+            }
             check(req, auth);
             if (method === "GET" && path === CLOUD_MOVE_PREFIX) {
                 const contents = workspaceContents(options.dataDir);
@@ -134,8 +145,10 @@ export function createCloudMoveRoutes(options) {
                 json(res, 200, {
                     contents, empty: isEmptyWorkspace(contents), freeBytes: freeBytes(options.dataDir), volumeBytes: volumeBytes(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES,
                     partBytes: CLOUD_MOVE_PART_BYTES, upload: uploadStatus(options.dataDir), previous: previousCloud(options.dataDir), job,
-                    // What backups and the previous Cloud hold on the volume.
+                    // What backups and the previous workspace hold on the volume.
                     heldBytes: held.bytes,
+                    // The app refuses a server older than itself, or its own, before exporting.
+                    ...identity,
                     ...options.status(),
                     lastRestoreId: options.restored.restored ? options.restored.id ?? null : null,
                     rolledBackId: options.restored.rolledBack ? options.restored.id ?? null : null,
@@ -191,7 +204,7 @@ export function createCloudMoveRoutes(options) {
                     }
                     if (discardPreview) {
                         removeMoveFiles(options.dataDir, result.id);
-                        throw failure("The move was stopped; what it staged was removed.", 409);
+                        throw failure("The copy was stopped; what it staged was removed.", 409);
                     }
                     try {
                         check(req, auth);
@@ -213,7 +226,7 @@ export function createCloudMoveRoutes(options) {
             if (method === "POST" && path === `${CLOUD_MOVE_PREFIX}/discard`) {
                 await options.readBody(req, 4096);
                 if (job?.state === "running" && job.kind !== "preview")
-                    throw failure("Your Cloud is already replacing its workspace.", 409);
+                    throw failure("This server is already replacing its workspace.", 409);
                 // A preview still running removes what it stages when it ends.
                 if (job?.state === "running")
                     discardPreview = true;
@@ -226,7 +239,7 @@ export function createCloudMoveRoutes(options) {
                 const body = z.object({ id: z.string().uuid() }).parse(await options.readBody(req, 4096));
                 ready();
                 if (!staged.has(body.id))
-                    throw failure("This move is no longer ready on your Cloud. Start it again.", 404);
+                    throw failure("This copy is no longer ready on this server. Start it again.", 404);
                 start("restore", async () => {
                     const { committed, previous } = await replaceWith(body.id, req, auth);
                     return { kind: "restore", state: "done", id: committed.id, previous };
@@ -238,15 +251,15 @@ export function createCloudMoveRoutes(options) {
                 await options.readBody(req, 4096);
                 ready();
                 if (!previousCloud(options.dataDir))
-                    throw failure("There is no previous Cloud to restore.", 404);
+                    throw failure("There is nothing on this server to swap back to.", 404);
                 const refused = roomFor(previousCloudArchiveBytes(options.dataDir));
                 if (refused) {
                     json(res, 507, refused);
                     return true;
                 }
                 dropStaged();
-                // A swap: what the Cloud has now becomes the previous Cloud, so this
-                // can be undone the same way.
+                // A swap: what this server has now becomes the previous workspace, so
+                // this can be undone the same way.
                 start("undo", async () => {
                     const prepared = await stagePreviousCloud(options.dataDir, options.appVersion);
                     const { committed, previous } = await replaceWith(prepared.id, req, auth);
@@ -255,7 +268,7 @@ export function createCloudMoveRoutes(options) {
                 json(res, 202, { job });
                 return true;
             }
-            json(res, 404, { error: "Unknown move operation." });
+            json(res, 404, { error: "Unknown copy operation." });
         }
         catch (error) {
             if (res.headersSent) {
@@ -263,10 +276,11 @@ export function createCloudMoveRoutes(options) {
                 return true;
             }
             const status = error instanceof z.ZodError ? 400 : error.status ?? 400;
-            const received = error.received;
+            const received = error.received, code = error.code;
             json(res, status, {
-                error: error instanceof z.ZodError ? "Invalid move request." : error instanceof Error ? error.message : "The move failed.",
+                error: error instanceof z.ZodError ? "Invalid copy request." : error instanceof Error ? error.message : "The copy failed.",
                 ...(Number.isSafeInteger(received) ? { received } : {}),
+                ...(code === "shared_workspace" ? { code } : {}),
             });
         }
         return true;

package/dist-server/server/cloud-move.js

@@ -1,16 +1,18 @@
-// Move to Cloud (docs/cloud-pro.md): a person's one-time copy of their local
-// workspace onto their OMB Cloud home. The desktop exports the ordinary
-// encrypted workspace backup (workspace-backup.ts) and uploads it here in
-// parts; this machine then previews and restores it like any other backup,
-// so everything that backup policy keeps out (credentials, sign-ins, pairing
-// and sessions, runtime state) stays where it is on both sides.
+// Copy this computer here (docs/copy-workspace.md): a person's copy of their
+// desktop's workspace onto a server they own and added in the desktop app, an
+// OMB Cloud home included. The desktop exports the ordinary encrypted
+// workspace backup (workspace-backup.ts) and uploads it here in parts; this
+// server then previews and restores it like any other backup, so everything
+// that backup policy keeps out (credentials, sign-ins, pairing and sessions,
+// runtime state) stays where it is on both sides.
 //
 // What this file adds: the workspace's size and contents, a resumable upload
-// slot, the space check for the machine's fixed-size volume, a backup of the
-// Cloud's own workspace taken before it is replaced ("Restore previous Cloud"
-// swaps it back), and the tidying that keeps that backup the only copy left
-// behind. Everything lives under `.backups`, which no snapshot includes and
-// no restore replaces.
+// slot, the space check for the server's volume, a backup of this server's
+// own workspace taken before it is replaced (Swap back puts it back), and the
+// tidying that keeps that backup the only copy left behind. Everything lives
+// under `.backups`, which no snapshot includes and no restore replaces. The
+// file and folder names still say "cloud" (`cloud-move`, `cloud-previous`):
+// renaming them would orphan the swap back on servers already running.
 import { createHash, randomBytes } from "node:crypto";
 import { createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statfsSync, writeFileSync } from "node:fs";
 import { open } from "node:fs/promises";
@@ -167,9 +169,9 @@ export function validUploadDeclaration(input) {
     if (!Number.isSafeInteger(input.bytes) || input.bytes < MIN_BYTES)
         throw fail("This is not a workspace backup.", 400);
     if (input.bytes > CLOUD_MOVE_MAX_BYTES)
-        throw fail("This workspace is larger than the 10 GB a move can carry.", 413);
+        throw fail("This workspace is larger than the 10 GB a copy can carry.", 413);
     if (input.files !== undefined && (!Number.isSafeInteger(input.files) || input.files < 0 || input.files > CLOUD_MOVE_MAX_FILES)) {
-        throw fail("This workspace has more than the 100,000 files a move can carry.", 413);
+        throw fail("This workspace has more than the 100,000 files a copy can carry.", 413);
     }
     return { sha256: input.sha256, bytes: input.bytes };
 }
@@ -193,7 +195,7 @@ export function beginUpload(dataDir, declared, now = Date.now()) {
 export async function writeUploadPart(dataDir, sha256, offset, length, body, now = Date.now()) {
     const meta = readUploadMeta(dataDir);
     if (!meta || meta.sha256 !== sha256)
-        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+        throw fail("This upload is not in progress on this server. Start the copy again.", 404);
     if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length <= 0 || length > CLOUD_MOVE_MAX_PART_BYTES) {
         throw fail("Invalid upload part.", 400);
     }
@@ -238,7 +240,7 @@ export async function writeUploadPart(dataDir, sha256, offset, length, body, now
 export async function completedUpload(dataDir, sha256) {
     const status = uploadStatus(dataDir);
     if (!status || status.sha256 !== sha256)
-        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+        throw fail("This upload is not in progress on this server. Start the copy again.", 404);
     if (status.received !== status.bytes)
         throw fail("The upload is not complete yet.", 409, { received: status.received });
     const hash = createHash("sha256");
@@ -246,7 +248,7 @@ export async function completedUpload(dataDir, sha256) {
         hash.update(chunk);
     if (hash.digest("hex") !== sha256) {
         discardUpload(dataDir);
-        throw fail("The uploaded file was damaged on the way. Start the move again.", 400);
+        throw fail("The uploaded file was damaged on the way. Start the copy again.", 400);
     }
     return uploadPartPath(dataDir);
 }
@@ -312,7 +314,7 @@ export function discardNextPreviousCloud(dataDir) {
 export async function stagePreviousCloud(dataDir, appVersion) {
     const previous = readPrevious(previousFolder(dataDir));
     if (!previous || isEmptyWorkspace(previous.contents))
-        throw fail("There is no previous Cloud to restore.", 404);
+        throw fail("There is nothing on this server to swap back to.", 404);
     const archive = join(previousFolder(dataDir), "workspace.ombbackup");
     const staged = await stageWorkspaceBackup(dataDir, archive, { password: previous.password, currentAppVersion: appVersion });
     return { ...staged, bytes: lstatSync(archive).size };
@@ -373,7 +375,7 @@ function pendingRestoreId(dataDir) {
         return null;
     }
 }
-/** At a Cloud home's startup, after any pending restore was applied:
+/** At every server's startup, after any pending restore was applied:
  * - a next previous Cloud becomes the previous Cloud once its restore is
  *   installed, and is dropped otherwise;
  * - moves' and swaps' restores, once settled, keep no safety copy or staged

package/dist-server/server/composio.js

@@ -1106,7 +1106,7 @@ export async function removeAccount(cfg, slug, accountId) {
 }
 /** Mint a browser auth link for one service. Returns { url } or throws. */
 export async function authorizeService(cfg, slug, requestedAlias) {
-    const alias = normalizeAccountAlias(requestedAlias);
+    let alias = normalizeAccountAlias(requestedAlias);
     const toolkit = canonicalToolkitSlug(slug);
     const mode = connectionMode(cfg);
     const unavailable = managedConnectorUnavailableReason(mode, toolkit);
@@ -1136,8 +1136,15 @@ export async function authorizeService(cfg, slug, requestedAlias) {
     if (usableAccounts.length >= MULTI_ACCOUNT_CONFIG.max_accounts_per_toolkit) {
         throw inputError(`${toolkit} already has the maximum of ${MULTI_ACCOUNT_CONFIG.max_accounts_per_toolkit} accounts`, 409);
     }
-    if (usableAccounts.length > 0 && !alias) {
-        throw inputError("Add an account alias so the existing connection is not replaced");
+    if (serviceAccounts.length > 0 && !alias) {
+        if (serviceAccounts.every((account) => /^(initializing|initiated|expired)$/i.test(account.status ?? ""))) {
+            // Retry without replacing a named account or revoking a former grant:
+            // EXPIRED can describe either an abandoned flow or an expired credential.
+            alias = `omb-retry-${randomUUID()}`;
+        }
+        else {
+            throw inputError("Add an account alias so the existing connection is not replaced");
+        }
     }
     if (alias && serviceAccounts.some((account) => account.alias?.trim().toLowerCase() === alias.toLowerCase())) {
         throw inputError(`Account alias "${alias}" is already in use for ${toolkit}`, 409);

package/dist-server/server/config.js

@@ -13,7 +13,6 @@ import { isModelVariant } from "./contracts.js";
 import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-icon.js";
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
-import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -292,17 +291,6 @@ const featureConfigSchema = z.object({
      * conversations that share words with the message ride into the turn.
      * Read-only; on unless explicitly switched off — see autoRecallEnabled. */
     autoRecall: z.boolean().optional(),
-    /** Idle release for computer claims (#1653): a desktop seat that stays
-     * screen-quiet for 90 seconds is released to waiting turns while its
-     * holder's turn still lives; the previous holder re-claims directly
-     * for 10 minutes and yields to an occupied seat. Off until baked; see
-     * computerClaimIdleReleaseEnabled for how to enable it by hand. */
-    computerClaimIdleRelease: z.boolean().optional(),
-    /** Consented cloud overflow for local computer waits (#1655): a wait
-     * may offer a per-second-billed cloud seat, but only through an explicit
-     * consent card or a configured allowlist — never a silent Auto default.
-     * Off until baked; see cloudOverflowEnabled for how to enable it by hand. */
-    cloudOverflow: z.boolean().optional(),
     /** Opt-in shared skills library: one store at the data dir that bots
      * read by assignment instead of per-workspace copies. Off until
      * explicitly enabled — see skillsLibraryEnabled. */
@@ -436,8 +424,12 @@ const appConfigSchema = z.object({
      * provider is Boat now and the key is kept for compatibility. */
     box: z.object({ token: optionalText }).optional(),
     vps: vpsConfigSchema.optional(),
-    /** Optional OpenCode key; persisted write-only and passed only to its child. */
-    opencodeGo: z.object({ apiKey: optionalText }).optional(),
+    /** Optional OpenCode key; persisted write-only and passed only to its child.
+     * `providerKeys`: keys for OpenCode's other providers (Venice, Groq…) by the
+     * environment name OpenCode reads, also write-only and only for its child.
+     * Settings changes go through mergeOpenCodeProviderKeys; the stored copy
+     * is read loosely (storedAppConfigSchema). */
+    opencodeGo: z.object({ apiKey: optionalText, providerKeys: z.record(z.string(), z.string()).optional() }).optional(),
     /** Voice settings and the selected voice id. `provider` picks the
      * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
      * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
@@ -526,15 +518,6 @@ const appConfigSchema = z.object({
     /** The authorization decision log (server/decision-log.ts): days of month
      * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
     decisions: z.object({ retentionDays: z.number().int().min(1).max(3650).optional() }).strict().optional(),
-    /** #1655 cloud-overflow settings. perSecondCostUsd is the operator's own
-     * verified rate: with no price configured the feature stays inert rather
-     * than show an invented one. allowlistedThreads carries standing consent
-     * for exact thread ids. */
-    cloudOverflow: z.object({
-        perSecondCostUsd: z.number().positive().max(10).optional(),
-        idleStopMs: z.number().int().positive().max(24 * 60 * 60_000).optional(),
-        allowlistedThreads: z.array(z.string().min(1)).max(1000).optional(),
-    }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     onboarding: onboardingConfigSchema.optional(),
@@ -550,6 +533,15 @@ const appConfigSchema = z.object({
 });
 const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
+    /** Read loosely, like mcpServers: a hand-edited provider key that isn't
+     * text is dropped here, and a bad name or key later
+     * (openCodeProviderKeys), never the whole file. */
+    opencodeGo: z.object({
+        apiKey: optionalText,
+        providerKeys: z.record(z.string(), z.unknown()).catch({})
+            .transform((keys) => Object.fromEntries(Object.entries(keys).filter((entry) => typeof entry[1] === "string")))
+            .optional(),
+    }).optional(),
 });
 const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true })
     .extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() });
@@ -749,43 +741,6 @@ export function claudeUserMcpEnabled(cfg) {
 export function llmThreadTitlesEnabled(cfg) {
     return cfg.features?.llmThreadTitles === true;
 }
-/** Idle release for computer claims (#1653): a whole-turn desktop hold
- * ends after a screen-quiet window (default 90 seconds, screen-poller
- * frames excluded) instead of at turn settle, and the previous holder
- * re-claims directly inside a reclaim window (default 10 minutes) while
- * yielding to a seat another turn already holds. Off unless an explicit
- * `true` — bake it as a maintainer-only flag first, exactly like
- * sharedComputers: enable by hand in ~/.openmausbot/config.json
- * (`{"features": {"computerClaimIdleRelease": true}}`) and restart. */
-export function computerClaimIdleReleaseEnabled(cfg) {
-    return cfg.features?.computerClaimIdleRelease === true;
-}
-/** Consented cloud overflow for local computer waits (#1655): while a turn
- * waits for a local desktop, it may offer overflow to a per-second-billed
- * cloud seat — never silently: the card names the cost, and only an
- * explicit per-conversation consent or a configured allowlist thread may
- * start the machine, which then hard-stops after an idle window. Off
- * unless an explicit `true`, like computerClaimIdleRelease: enable by
- * hand in ~/.openmausbot/config.json
- * (`{"features": {"cloudOverflow": true}, "cloudOverflow": {"perSecondCostUsd": 0.0004}}`)
- * and restart. */
-export function cloudOverflowEnabled(cfg) {
-    return cfg.features?.cloudOverflow === true;
-}
-/** The per-second rate shown on the card, or null when the operator has
- * not set one: the offer fails closed rather than guess a price. */
-export function cloudOverflowPerSecondCostUsd(cfg) {
-    const cost = cfg.cloudOverflow?.perSecondCostUsd;
-    return typeof cost === "number" && Number.isFinite(cost) && cost > 0 ? cost : null;
-}
-/** How long a cloud seat may stay screen-quiet before it is stopped. */
-export function cloudOverflowIdleStopMs(cfg) {
-    return cfg.cloudOverflow?.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-}
-/** Threads with standing consent, by exact thread id. */
-export function cloudOverflowAllowlistedThreads(cfg) {
-    return new Set(cfg.cloudOverflow?.allowlistedThreads ?? []);
-}
 /** Opt-in shared skills library (skills lane S1): one store at the data dir
  * that bots reference by assignment instead of per-workspace copies. Off
  * unless enabled by hand in ~/.openmausbot/config.json
@@ -815,7 +770,6 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     "memory",
     "localVm",
     "features",
-    "cloudOverflow",
     "browserProfiles",
     "onboarding",
 ]);
@@ -1151,6 +1105,75 @@ export const PROVIDER_CREDENTIAL_ENV = [
     "CURSOR_API_KEY",
     "CURSOR_AUTH_TOKEN",
 ];
+/** Provider keys OpenCode reads from its environment, as it does in a
+ * terminal: with ANTHROPIC_API_KEY set, `opencode` lists Anthropic's models.
+ * Keys OpenMaus saves for another engine (xAI, Mistral, the workspace
+ * Anthropic key) are workspace credentials under other names and never
+ * ride along. */
+export const OPENCODE_PROVIDER_ENV = [
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "KIMI_API_KEY",
+    "MOONSHOT_API_KEY",
+    "MINIMAX_API_KEY",
+];
+/** Keys the owner saves in Settings for OpenCode's other providers (Venice,
+ * Groq, DeepSeek…), each under the environment name OpenCode reads. A Cloud
+ * has no terminal to export them in. They go to OpenCode's process only,
+ * never to this server's own environment. */
+export const OPENCODE_PROVIDER_KEY_LIMIT = 20;
+const OPENCODE_PROVIDER_KEY_NAME = /^[A-Z][A-Z0-9_]{0,59}_(?:API_KEY|KEY|TOKEN)$/;
+/** Printable, no spaces: no provider key has any, and a pasted sentence is not a key. */
+const OPENCODE_PROVIDER_KEY_VALUE = /^[\x21-\x7e]{1,4096}$/;
+/** Why OpenCode can't be given a key under this name, or undefined. A name
+ * OpenMaus keeps for itself or another engine would never reach OpenCode:
+ * every engine keeps only the credential names it reads (credentialEnv). */
+function openCodeProviderKeyNameRefusal(name) {
+    if (!OPENCODE_PROVIDER_KEY_NAME.test(name)) {
+        return "Use the name the provider reads its key from: capitals, ending in _API_KEY, _KEY or _TOKEN, such as VENICE_API_KEY.";
+    }
+    if (name === "OPENCODE_API_KEY")
+        return "Save the OpenCode key in the OpenCode API key box instead.";
+    const reserved = name.startsWith("OPENCODE_") || name.startsWith("OMB_")
+        || WORKSPACE_CREDENTIAL_ENV.includes(name)
+        || (PROVIDER_CREDENTIAL_ENV.includes(name) && !OPENCODE_PROVIDER_ENV.includes(name));
+    return reserved ? `OpenMaus keeps ${name} for itself, so OpenCode can't be given it here. Put this key in opencode.json instead.` : undefined;
+}
+/** The saved OpenCode provider keys that can be used, by name. A hand-edited
+ * entry OpenCode could not be given, or whose value is not a key, is
+ * skipped; so is anything past the limit. */
+export function openCodeProviderKeys(cfg) {
+    const saved = cfg.opencodeGo?.providerKeys ?? {};
+    const usable = Object.keys(saved).sort()
+        .filter((name) => !openCodeProviderKeyNameRefusal(name) && OPENCODE_PROVIDER_KEY_VALUE.test(saved[name] ?? ""))
+        .slice(0, OPENCODE_PROVIDER_KEY_LIMIT);
+    return Object.fromEntries(usable.map((name) => [name, saved[name]]));
+}
+/** A Settings change to the saved OpenCode provider keys: a key saves or
+ * replaces its name, "" removes it, and every other saved key stays. Returns
+ * the whole new set to store, or why it was refused. */
+export function mergeOpenCodeProviderKeys(cfg, change) {
+    const keys = new Map(Object.entries(openCodeProviderKeys(cfg)));
+    for (const [name, raw] of Object.entries(change)) {
+        const value = raw.trim();
+        if (!value) {
+            keys.delete(name);
+            continue;
+        }
+        const refusal = openCodeProviderKeyNameRefusal(name);
+        if (refusal)
+            return { ok: false, error: refusal };
+        if (!OPENCODE_PROVIDER_KEY_VALUE.test(value))
+            return { ok: false, error: "That doesn't look like a key. Paste only the key, with no spaces." };
+        keys.set(name, value);
+    }
+    if (keys.size > OPENCODE_PROVIDER_KEY_LIMIT) {
+        return { ok: false, error: `OpenCode can hold up to ${OPENCODE_PROVIDER_KEY_LIMIT} provider keys. Remove one you no longer use, then add this one.` };
+    }
+    return { ok: true, keys: Object.fromEntries([...keys].sort(([a], [b]) => (a < b ? -1 : 1))) };
+}
 const configSaveListeners = new Set();
 /** Told, synchronously, what each saveConfig wrote: the file before and
  * after. The admin activity log (server/admin-activity.ts) records the
@@ -1180,7 +1203,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -1467,8 +1490,13 @@ function injectedEnvironment(cfg, instanceId, driver) {
     // to Cloud Pro's included token, which never enters an environment map.
     if (driver === "boxAgent" && cfg.box?.token)
         environment.set("BOX_TOKEN", cfg.box.token);
-    if (driver === "opencodeGo" && cfg.opencodeGo?.apiKey)
-        environment.set("OPENCODE_API_KEY", cfg.opencodeGo.apiKey);
+    if (driver === "opencodeGo") {
+        // Keys for OpenCode's other providers, under the names OpenCode reads.
+        for (const [name, key] of Object.entries(openCodeProviderKeys(cfg)))
+            environment.set(name, key);
+        if (cfg.opencodeGo?.apiKey)
+            environment.set("OPENCODE_API_KEY", cfg.opencodeGo.apiKey);
+    }
     return environment;
 }
 /** One instance per pasted provider key, each running only on its own key.