openmausbot 0.1.95 → 0.1.97

package/dist-server/server/chief-of-staff.js

@@ -8,7 +8,9 @@ const ROSTER_MAX_BOTS = 40;
 const sectionKey = (section) => section?.trim() || "";
 /** Dynamic system context for a section's Chief of Staff.
  * It names the current team on every turn, while list_bots remains the
- * authoritative tool for IDs and live availability at delegation time. */
+ * authoritative tool for IDs and live availability at delegation time.
+ * Who is busy right now is not part of it: that changes turn to turn, so it
+ * rides the volatile half (teammateAvailabilityPrompt in peer-roster.ts). */
 export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoordination = false) {
     const chief = bots.find((bot) => bot.id === chiefId);
     const chiefSection = sectionKey(chief?.section);
@@ -17,11 +19,10 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoor
     // the endpoints must agree, or the prompt names teammates the tools will
     // then refuse to reach.
     const team = reachablePeers(bots, chief ?? { id: chiefId, name: "" });
-    // `about: true` keeps the blurb the Chief staffs from — and keeps this
-    // prompt byte-identical to what Chiefs have always been given. The
-    // ordinary-bot roster drops it (peer-roster.ts); widening the Chief's
-    // existing exposure was never in scope, and narrowing it here would
-    // silently change how a Chief picks a specialist.
+    // `about: true` keeps the blurb the Chief staffs from. The ordinary-bot
+    // roster drops it (peer-roster.ts); widening the Chief's existing exposure
+    // was never in scope, and narrowing it here would silently change how a
+    // Chief picks a specialist.
     const roster = renderRoster(team, {
         max: ROSTER_MAX_BOTS,
         empty: "- No other visible bots are available yet.",

package/dist-server/server/cli-setup.js

@@ -118,7 +118,7 @@ const NATIVE = [
 async function connectNative(choice, id, entry, io, deps) {
     const cli = typeof rawObject(entry.config).cli === "string" ? rawObject(entry.config).cli : choice.cli;
     io.log("Connecting your account…");
-    io.log("Sign-in stays with your provider. Its account limits apply; OMB never asks for your password.");
+    io.log("Sign-in stays with your provider. Its account limits apply; OpenMausBot never asks for your password.");
     let state = await deps.inspect(id, entry);
     if (state.snapshot.state !== "available") {
         if (cli !== choice.cli)
@@ -143,7 +143,7 @@ async function connectNative(choice, id, entry, io, deps) {
         await deps.runCli(cli, args, entry.environment);
         state = await deps.inspect(id, entry);
         if (state.snapshot.state !== "available" || !state.snapshot.authenticated) {
-            throw new Error("Sign-in was not confirmed. Your OMB settings are unchanged; complete provider sign-in and try again.");
+            throw new Error("Sign-in was not confirmed. Your OpenMausBot settings are unchanged; complete provider sign-in and try again.");
         }
     }
     else {
@@ -294,7 +294,7 @@ export async function runSetup(options, io = defaultSetupIo(), deps = dependenci
     catch (error) {
         if (!(error instanceof SetupCancelled))
             throw error;
-        io.log("\nSetup cancelled. No OMB settings were changed. Provider sign-ins or installs already completed are kept.");
+        io.log("\nSetup cancelled. No OpenMausBot settings were changed. Provider sign-ins or installs already completed are kept.");
         return false;
     }
     finally {

package/dist-server/server/cli.js

@@ -30,11 +30,13 @@ import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
+import { phonePairingLink } from "../shared/pairing-link.js";
 import { parseAllowList } from "./account-signin.js";
 import { appendAdminAction, flushAdminActivity, sharedSignIn } from "./admin-activity.js";
 import { bindDecisionRetention, decisionRetentionDays } from "./decision-log.js";
 import { hostedWorkspaceConfigured } from "./enterprise.js";
 import { resolveLoopbackTrust } from "./request-auth.js";
+import { restartPolicy } from "./restart.js";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
 import { runServiceCommand } from "./service-cli.js";
@@ -466,15 +468,6 @@ export function pairingBlock(input) {
     }
     return lines.join("\n");
 }
-/** The scheme and host of a link, or null if it is not one we can dial. */
-function originOf(link) {
-    try {
-        return new URL(link).origin;
-    }
-    catch {
-        return null;
-    }
-}
 export function qrToString(text) {
     let out = "";
     qrcode.generate(text, { small: true }, (rendered) => {
@@ -494,20 +487,18 @@ async function mintPairing(port, options) {
     if (status !== 200)
         throw new Error(`server refused to mint a pairing code: ${typeof body?.error === "string" ? body.error : status}`);
     const url = options.publicUrl ? `${options.publicUrl}/pair#code=${body.code}` : typeof body.url === "string" ? body.url : null;
-    // A server too old to mint a credential simply has no invite: the web link
-    // still works, so an upgrade is never required to pair a browser.
-    // The address the phone will dial. `--public-url` wins, exactly as it does
-    // for the web link above: a server behind someone else's proxy often does
-    // not know its own public name, which is what that flag is for. Gate on the
-    // credential, never on the server's own invite — a server started without
-    // OMB_PUBLIC_URL returns a credential and no invite, and gating on the
-    // invite would throw away a secret the CLI has every part it needs to use.
-    const address = options.publicUrl ?? (typeof body.url === "string" ? originOf(body.url) : null);
-    // A server too old to mint a credential simply has no invite: the web link
-    // still works, so an upgrade is never required to pair a browser.
-    const invite = typeof body.credential === "string" && address
-        ? `openmausbot://pair?address=${encodeURIComponent(address)}&token=${encodeURIComponent(body.credential)}${typeof body.serverName === "string" ? `&name=${encodeURIComponent(body.serverName)}` : ""}`
-        : typeof body.inviteUrl === "string" ? body.inviteUrl : null;
+    // The phone-app invite. This command asks over loopback, so the server
+    // already built it from its own public address with the same builder; it is
+    // printed as it came. `--public-url` wins, exactly as it does for the web
+    // link above: a server behind someone else's proxy often does not know its
+    // own public name, which is what that flag is for. That case gates on the
+    // credential, never on the server's invite — a server started without
+    // OMB_PUBLIC_URL returns a credential and no invite. A server too old to
+    // mint a credential simply has no invite: the web link still works, so an
+    // upgrade is never required to pair a browser.
+    const invite = (options.publicUrl && typeof body.credential === "string"
+        ? phonePairingLink({ address: options.publicUrl, token: body.credential, name: typeof body.serverName === "string" ? body.serverName : undefined })
+        : null) ?? (typeof body.inviteUrl === "string" ? body.inviteUrl : null);
     return pairingBlock({ code: body.code, url, inviteUrl: invite, expiresAt: body.expiresAt, hint: typeof body.hint === "string" ? body.hint : null, phone: options.phone });
 }
 // ── commands ───────────────────────────────────────────────────────────
@@ -853,7 +844,7 @@ async function planTunnel(options, log, recovery) {
         }
     }
     else {
-        account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion(), recovery });
+        account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion(), recovery, log: (line) => log(`tunnel: ${line}`) });
         if (account.credentials.status === "unavailable")
             return fail(`${account.credentials.file} exists but could not be read; fix or remove it`);
         if (!describeTunnelAccount(account.credentials.read()).email) {
@@ -1156,9 +1147,25 @@ export async function runServe(options, log = console.log) {
         process.removeListener("SIGTERM", onSignal);
     }
 }
+/** `serve` until the server stops for good. A server that exits with
+ * RESTART_EXIT_CODE (a copied workspace committed; docs/copy-workspace.md)
+ * is started again in this process, with its tunnel, Tailscale or domain
+ * address unchanged, and without a second pairing code or browser tab; at
+ * most MAX_RESTARTS times in a row (server/restart.ts restartPolicy). */
+export async function serveUntilStopped(options, run = runServe, now = Date.now) {
+    const policy = restartPolicy(now);
+    let launch = options;
+    for (;;) {
+        const code = await run(launch);
+        if (!policy.again(code))
+            return code;
+        console.log("\nOpenMausBot is starting again to finish installing a copy from the desktop app…");
+        launch = { ...options, pair: false, open: false };
+    }
+}
 /** Keep setup imports behind the data-dir override: config binds its paths
  * when first imported. `serve` remains usable with stdin closed. */
-export async function runOnboardingCommand(options, io = defaultIo(), startServer = runServe, flow = {}) {
+export async function runOnboardingCommand(options, io = defaultIo(), startServer = serveUntilStopped, flow = {}) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
     if (options.command === "setup" && !interactive) {
         io.error("Setup needs an interactive terminal. Run `npx openmausbot setup` in a terminal, then use `npx openmausbot serve` for unattended starts.");
@@ -1235,7 +1242,7 @@ export async function main(argv = process.argv.slice(2)) {
         case "start":
             return runOnboardingCommand(options);
         case "serve":
-            return runServe(options);
+            return serveUntilStopped(options);
         case "pair":
             return runPair(options);
         case "sessions":

package/dist-server/server/cloud-computer-tools.js

@@ -15,6 +15,8 @@ export const CLOUD_COMPUTER_TOOLS = [
     tool("open_url", "Request opening an HTTP or HTTPS URL in the cloud desktop browser; inspect the screen to confirm it loaded.", { url: { type: "string", pattern: "^https?://", maxLength: 2000 } }, ["url"]),
     tool("exec", "Run a shell command on the assigned cloud computer.", { command: { type: "string", minLength: 1, maxLength: 4000 } }, ["command"]),
 ];
+/** A call the gate let through while no Boat had landed for the turn. */
+export const CLOUD_COMPUTER_NOT_READY = "The cloud computer is not ready. This call was not performed. Take a fresh screenshot in a moment.";
 const quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
 const buttons = { left: 1, middle: 2, right: 3 };
 const scrollButtons = { up: 4, down: 5, left: 6, right: 7 };
@@ -85,9 +87,11 @@ export async function runCloudComputerTool(cfg, boxId, name, args, signal) {
 }
 /** One JSON-RPC request from harness-mcp-proxy, answered with its MCP
  * `result`. The order is the safety argument: arguments are checked before
- * the control gate (which may claim the seat), a person's control refuses
- * the call before anything reaches the Boat, and the turn's capability must
- * still be live before and after the Boat acts. */
+ * the control gate (which may claim the seat, and for a cloud computer
+ * mounted before it existed, create or wake it), a person's control refuses
+ * the call before anything reaches the Boat, the Boat is read only once the
+ * gate has let the call through, and the turn's capability must still be
+ * live before and after the Boat acts. Listing the tools touches no Boat. */
 export async function cloudComputerRpc(request, deps) {
     if (request?.method === "tools/list") {
         deps.assertActive();
@@ -104,7 +108,10 @@ export async function cloudComputerRpc(request, deps) {
     deps.assertActive();
     if (control.held)
         return { isError: true, content: [{ type: "text", text: control.blockedReason || CONTROL_REFUSAL_PLAIN }] };
-    const result = await runCloudComputerTool(deps.cfg, deps.boxId, params.name, args, deps.signal);
+    const boxId = deps.boxId();
+    if (!boxId)
+        return { isError: true, content: [{ type: "text", text: CLOUD_COMPUTER_NOT_READY }] };
+    const result = await runCloudComputerTool(deps.cfg, boxId, params.name, args, deps.signal);
     deps.assertActive();
     return result;
 }

package/dist-server/server/cloud-home-start.js

@@ -8,7 +8,7 @@
 // forwards with X-Forwarded-*, so request-auth.ts never grants a remote
 // request loopback trust. If either child exits, both stop and the machine
 // restarts; the one exception is the server asking to be started again
-// after a restore.
+// after a restore (server/restart.ts).
 //
 // The machine's secrets (the signing secret, the relay tokens) arrive as
 // this process's environment. No child's environment ever carries them:
@@ -24,7 +24,8 @@ import { spawn } from "node:child_process";
 import { chownSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
+import { CLOUD_SECRETS_FD_ENV, cloudHomeConfiguration, cloudHomeHost, cloudHomeSecrets, prepareCloudHomeVolume, withoutCloudSecrets, withoutIgnoredCloudKeys, } from "./cloud-home.js";
+import { restartPolicy } from "./restart.js";
 const SERVICE_USER = "maus";
 /** The descriptor the server reads its secrets from. */
 const SECRETS_FD = 3;
@@ -112,16 +113,11 @@ export function spawnWithSecrets(command, args, env, secrets, ids) {
     pipe?.end(JSON.stringify(secrets));
     return child;
 }
-/** What the launcher does when the server child exits: start it again only
- * when it asked to (a committed restore), and only a few times in a row. */
-export function serverExitAction(code, stopping, restarts) {
-    return !stopping && code === CLOUD_HOME_RESTART_EXIT_CODE && restarts < 5 ? "restart" : "stop";
-}
 export function startCloudHome(env = process.env) {
     process.umask(0o077);
     const config = cloudHomeConfiguration(env);
     if (!config)
-        throw new Error("This image runs an OMB Cloud home machine; set its boot contract (docs/cloud-pro.md).");
+        throw new Error("This image runs a My Cloud machine for OpenMausBot Cloud; set its boot contract (docs/cloud-pro.md).");
     // Logged here once: the server child never sees what they are about.
     for (const warning of config.warnings)
         console.warn(`cloud home: ${warning}`);
@@ -189,14 +185,15 @@ export function startCloudHome(env = process.env) {
                 stop(true);
         });
     };
-    let restarts = 0;
-    const runServer = () => watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
-        if (serverExitAction(code, stopping, restarts) !== "restart")
-            return false;
-        restarts++;
-        runServer();
-        return true;
-    });
+    const policy = restartPolicy();
+    const runServer = () => {
+        watch(spawnWithSecrets(process.execPath, [join(here, "index.js")], server, secrets, ids), (code) => {
+            if (!policy.again(code, stopping))
+                return false;
+            runServer();
+            return true;
+        });
+    };
     runServer();
     watch(spawn(edgeBin, ["run", "--config", edgeConfig, "--adapter", "caddyfile"], { env: edge, stdio: "inherit", ...(ids ? { uid: ids.uid, gid: ids.gid } : {}) }));
     process.once("SIGTERM", () => stop(false));

package/dist-server/server/cloud-home.js

@@ -45,10 +45,6 @@ export const CLOUD_PAIRING_SKEW_S = 300;
 export const CLOUD_PAIRING_NONCE_MS = 10 * 60_000;
 const MAX_NONCES = 10_000;
 export const CLOUD_HOME_MARKER = ".omb-cloud-home.json";
-/** The server exits with this after a restore commits (Move to Cloud): the
- * launcher then starts it again, and startup installs the restore. Any other
- * exit stops the machine for Fly to restart. */
-export const CLOUD_HOME_RESTART_EXIT_CODE = 75;
 export function cloudHomeConfigured(env = process.env) {
     return CLOUD_HOME_KEYS.some((key) => env[key] !== undefined);
 }
@@ -113,17 +109,11 @@ export { cloudHomeOffersPlace } from "../shared/cloud-home.js";
  * place it offers. A turn's error shows 160 characters, so each fits. */
 export function cloudHomePlaceRefusal(place) {
     if (place === "local")
-        return "This computer isn't a place on your OMB Cloud: its bots run in the cloud. Set Works on to Auto, Cloud or Browser, or lend your Mac under Settings → OMB Cloud.";
+        return "This computer isn't a place on My Cloud. Set Works on to Auto, Cloud computer or Browser, or lend your Mac under Settings → OpenMausBot Cloud.";
     if (place === "vm")
-        return "Bots on your OMB Cloud can't use a Local VM: the cloud machine has no container runtime. Set Works on to Auto, Cloud or Browser.";
+        return "Bots on My Cloud can't use a Local VM. Set Works on to Auto, Cloud computer or Browser.";
     return undefined;
 }
-/** What a turn is told when Cloud is chosen but no Boat account is set up (no
- * key of the person's and no included Boat). A Cloud home has no Local VM to
- * suggest instead. */
-export function boatNotConfiguredMessage(cloudHome) {
-    return `Cloud Boat is not configured — add a Boat API key or choose ${cloudHome ? "Browser" : "Local VM"}`;
-}
 /** The Cloud's setup checklist (docs/cloud-pro.md) has a "try something"
  * step that is done once a bot's turn finishes on the machine itself. The
  * server records when, once, in this Cloud's own onboarding record: that
@@ -202,7 +192,7 @@ export function createCloudPairing(options) {
             const ttl = Math.min(ttlSeconds ?? CLOUD_PAIRING_DEFAULT_TTL_S, browser ? CLOUD_BROWSER_SIGN_IN_MAX_TTL_S : CLOUD_PAIRING_MAX_TTL_S);
             const opened = sessions.openPairing({
                 scopes: ["admin", "client"],
-                label: typeof label === "string" && label.trim() ? label.trim() : "OMB Cloud",
+                label: typeof label === "string" && label.trim() ? label.trim() : "OpenMausBot Cloud",
                 ttlMs: ttl * 1000,
                 browser,
                 ...(browser ? { owner: owner } : {}),

package/dist-server/server/cloud-move-http.js

@@ -1,9 +1,18 @@
 import { z } from "zod";
+import { sharedSignIn } from "./admin-activity.js";
 import { backupsBytes, beginUpload, CLOUD_MOVE_MAX_BYTES, CLOUD_MOVE_MAX_PART_BYTES, CLOUD_MOVE_PART_BYTES, completedUpload, discardNextPreviousCloud, discardUpload, enabledRoutineCount, forgetMoveRestore, freeVolumeBytes, isEmptyWorkspace, moveSpaceNeeded, noteMoveRestore, prepareNextPreviousCloud, previousCloud, previousCloudArchiveBytes, removeMoveFiles, stagePreviousCloud, tidyCloudMoveStorage, totalVolumeBytes, uploadStatus, validUploadDeclaration, workspaceContents, workspaceMoveSize, writeUploadPart, } from "./cloud-move.js";
 import { commitPendingWorkspaceRestore, createWorkspaceBackup, stageWorkspaceBackup } from "./workspace-backup.js";
 export const CLOUD_MOVE_PREFIX = "/api/cloud-move";
 const failure = (message, status) => Object.assign(new Error(message), { status });
 const HELD_CACHE_MS = 30_000;
+/** Shared with other people, so one person's copy must never replace it: a
+ * hosted organisation workspace, or (not on a Cloud home, whose sign-in is its
+ * owner's OMB Cloud account) an email sign-in list that lets someone else in
+ * (sharedSignIn: a member, a second admin, or a whole @domain). The owner's
+ * own address alone (`openmausbot access add you@example.com`) is not. */
+export function workspaceShared(input) {
+    return input.hosted || (!input.cloudHome && sharedSignIn(input.signIn));
+}
 export function createCloudMoveRoutes(options) {
     const freeBytes = options.freeBytes ?? freeVolumeBytes;
     const volumeBytes = (path) => { try {
@@ -12,16 +21,17 @@ export function createCloudMoveRoutes(options) {
     catch {
         return null;
     } };
-    // A move's restore that startup has installed keeps no safety copy or
-    // staged files; an abandoned upload goes after a day.
-    if (options.cloudHome) {
-        try {
-            tidyCloudMoveStorage(options.dataDir, options.restored);
-        }
-        catch (error) {
-            console.warn(`cloud move: could not tidy backup storage (${error instanceof Error ? error.message : "unknown"})`);
-        }
+    // A copy's restore that startup has installed keeps no safety copy or
+    // staged files, and the workspace it replaced becomes the one to swap back
+    // to; an abandoned upload goes after a day. Only what a copy recorded is
+    // touched, so on a server that never received one this does nothing.
+    try {
+        tidyCloudMoveStorage(options.dataDir, options.restored);
+    }
+    catch (error) {
+        console.warn(`workspace copy: could not tidy backup storage (${error instanceof Error ? error.message : "unknown"})`);
     }
+    const identity = { appVersion: options.appVersion, environmentId: options.environmentId };
     // Staged here by a preview; restore accepts nothing else.
     const staged = new Set();
     let job = null;
@@ -33,16 +43,16 @@ export function createCloudMoveRoutes(options) {
     };
     const check = (req, auth) => {
         if (!options.authorized(req, auth))
-            throw failure("Your session changed. Start the move again.", 403);
+            throw failure("Your session changed. Start the copy again.", 403);
     };
     const ready = () => {
         if (job?.state === "running" || writing)
-            throw failure("Another move step is running on your Cloud. Wait for it to finish.", 409);
+            throw failure("Another copy step is running on this server. Wait for it to finish.", 409);
         const status = options.status();
         if (status.pendingRestore)
-            throw failure("Your Cloud is restarting to finish a restore. Try again in a minute.", 409);
+            throw failure("This server is restarting to finish a restore. Try again in a minute.", 409);
         if (status.busy)
-            throw failure("Your Cloud is busy with a backup. Try again when it finishes.", 409);
+            throw failure("This server is busy with a backup. Try again when it finishes.", 409);
     };
     /** Delete what earlier previews staged and no restore took. */
     const dropStaged = () => {
@@ -63,7 +73,7 @@ export function createCloudMoveRoutes(options) {
             after?.(result);
         }, (error) => {
             if (job === current)
-                job = { kind, state: "failed", error: error instanceof Error ? error.message : "The move could not finish." };
+                job = { kind, state: "failed", error: error instanceof Error ? error.message : "The copy could not finish." };
         });
     }
     // A person's own page can hold the workspace gate for a moment (an ordinary
@@ -106,7 +116,7 @@ export function createCloudMoveRoutes(options) {
     const roomFor = (archive, already = 0) => {
         const needed = moveSpaceNeeded(archive, workspaceMoveSize(options.dataDir).bytes, true) - already;
         const free = freeBytes(options.dataDir);
-        return free >= needed ? null : { error: "Your Cloud does not have enough free space for this.", freeBytes: free, neededBytes: needed };
+        return free >= needed ? null : { error: "This server does not have enough free space for this.", freeBytes: free, neededBytes: needed };
     };
     // The answer that the restore is ready goes out first; then the launcher
     // starts the server again, and startup installs the restore before anything else loads.
@@ -117,15 +127,16 @@ export function createCloudMoveRoutes(options) {
         const method = req.method ?? "GET";
         try {
             if (!auth.scopes.includes("admin"))
-                throw failure("Only the owner can move a workspace.", 403);
+                throw failure("Only the owner can copy a workspace.", 403);
             if (method === "GET" && path === `${CLOUD_MOVE_PREFIX}/estimate`) {
-                json(res, 200, { ...workspaceContents(options.dataDir), ...workspaceMoveSize(options.dataDir), routines: enabledRoutineCount(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES });
+                json(res, 200, { ...workspaceContents(options.dataDir), ...workspaceMoveSize(options.dataDir), routines: enabledRoutineCount(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES, ...identity });
                 return true;
             }
-            if (!options.cloudHome)
-                throw failure("Only an OMB Cloud home receives a moved workspace.", 404);
             if (auth.kind !== "session")
-                throw failure("Move to Cloud needs the owner's signed-in app.", 403);
+                throw failure("Copying a workspace needs the owner's signed-in app.", 403);
+            if (options.sharedWorkspace()) {
+                throw Object.assign(failure("This server is shared with other people, so it can't receive one computer's bots and chats. Copy to a server only you use.", 403), { code: "shared_workspace" });
+            }
             check(req, auth);
             if (method === "GET" && path === CLOUD_MOVE_PREFIX) {
                 const contents = workspaceContents(options.dataDir);
@@ -134,8 +145,10 @@ export function createCloudMoveRoutes(options) {
                 json(res, 200, {
                     contents, empty: isEmptyWorkspace(contents), freeBytes: freeBytes(options.dataDir), volumeBytes: volumeBytes(options.dataDir), maxBytes: CLOUD_MOVE_MAX_BYTES,
                     partBytes: CLOUD_MOVE_PART_BYTES, upload: uploadStatus(options.dataDir), previous: previousCloud(options.dataDir), job,
-                    // What backups and the previous Cloud hold on the volume.
+                    // What backups and the previous workspace hold on the volume.
                     heldBytes: held.bytes,
+                    // The app refuses a server older than itself, or its own, before exporting.
+                    ...identity,
                     ...options.status(),
                     lastRestoreId: options.restored.restored ? options.restored.id ?? null : null,
                     rolledBackId: options.restored.rolledBack ? options.restored.id ?? null : null,
@@ -191,7 +204,7 @@ export function createCloudMoveRoutes(options) {
                     }
                     if (discardPreview) {
                         removeMoveFiles(options.dataDir, result.id);
-                        throw failure("The move was stopped; what it staged was removed.", 409);
+                        throw failure("The copy was stopped; what it staged was removed.", 409);
                     }
                     try {
                         check(req, auth);
@@ -213,7 +226,7 @@ export function createCloudMoveRoutes(options) {
             if (method === "POST" && path === `${CLOUD_MOVE_PREFIX}/discard`) {
                 await options.readBody(req, 4096);
                 if (job?.state === "running" && job.kind !== "preview")
-                    throw failure("Your Cloud is already replacing its workspace.", 409);
+                    throw failure("This server is already replacing its workspace.", 409);
                 // A preview still running removes what it stages when it ends.
                 if (job?.state === "running")
                     discardPreview = true;
@@ -226,7 +239,7 @@ export function createCloudMoveRoutes(options) {
                 const body = z.object({ id: z.string().uuid() }).parse(await options.readBody(req, 4096));
                 ready();
                 if (!staged.has(body.id))
-                    throw failure("This move is no longer ready on your Cloud. Start it again.", 404);
+                    throw failure("This copy is no longer ready on this server. Start it again.", 404);
                 start("restore", async () => {
                     const { committed, previous } = await replaceWith(body.id, req, auth);
                     return { kind: "restore", state: "done", id: committed.id, previous };
@@ -238,15 +251,15 @@ export function createCloudMoveRoutes(options) {
                 await options.readBody(req, 4096);
                 ready();
                 if (!previousCloud(options.dataDir))
-                    throw failure("There is no previous Cloud to restore.", 404);
+                    throw failure("There is nothing on this server to swap back to.", 404);
                 const refused = roomFor(previousCloudArchiveBytes(options.dataDir));
                 if (refused) {
                     json(res, 507, refused);
                     return true;
                 }
                 dropStaged();
-                // A swap: what the Cloud has now becomes the previous Cloud, so this
-                // can be undone the same way.
+                // A swap: what this server has now becomes the previous workspace, so
+                // this can be undone the same way.
                 start("undo", async () => {
                     const prepared = await stagePreviousCloud(options.dataDir, options.appVersion);
                     const { committed, previous } = await replaceWith(prepared.id, req, auth);
@@ -255,7 +268,7 @@ export function createCloudMoveRoutes(options) {
                 json(res, 202, { job });
                 return true;
             }
-            json(res, 404, { error: "Unknown move operation." });
+            json(res, 404, { error: "Unknown copy operation." });
         }
         catch (error) {
             if (res.headersSent) {
@@ -263,10 +276,11 @@ export function createCloudMoveRoutes(options) {
                 return true;
             }
             const status = error instanceof z.ZodError ? 400 : error.status ?? 400;
-            const received = error.received;
+            const received = error.received, code = error.code;
             json(res, status, {
-                error: error instanceof z.ZodError ? "Invalid move request." : error instanceof Error ? error.message : "The move failed.",
+                error: error instanceof z.ZodError ? "Invalid copy request." : error instanceof Error ? error.message : "The copy failed.",
                 ...(Number.isSafeInteger(received) ? { received } : {}),
+                ...(code === "shared_workspace" ? { code } : {}),
             });
         }
         return true;

package/dist-server/server/cloud-move.js

@@ -1,16 +1,18 @@
-// Move to Cloud (docs/cloud-pro.md): a person's one-time copy of their local
-// workspace onto their OMB Cloud home. The desktop exports the ordinary
-// encrypted workspace backup (workspace-backup.ts) and uploads it here in
-// parts; this machine then previews and restores it like any other backup,
-// so everything that backup policy keeps out (credentials, sign-ins, pairing
-// and sessions, runtime state) stays where it is on both sides.
+// Copy this computer here (docs/copy-workspace.md): a person's copy of their
+// desktop's workspace onto a server they own and added in the desktop app, an
+// OMB Cloud home included. The desktop exports the ordinary encrypted
+// workspace backup (workspace-backup.ts) and uploads it here in parts; this
+// server then previews and restores it like any other backup, so everything
+// that backup policy keeps out (credentials, sign-ins, pairing and sessions,
+// runtime state) stays where it is on both sides.
 //
 // What this file adds: the workspace's size and contents, a resumable upload
-// slot, the space check for the machine's fixed-size volume, a backup of the
-// Cloud's own workspace taken before it is replaced ("Restore previous Cloud"
-// swaps it back), and the tidying that keeps that backup the only copy left
-// behind. Everything lives under `.backups`, which no snapshot includes and
-// no restore replaces.
+// slot, the space check for the server's volume, a backup of this server's
+// own workspace taken before it is replaced (Swap back puts it back), and the
+// tidying that keeps that backup the only copy left behind. Everything lives
+// under `.backups`, which no snapshot includes and no restore replaces. The
+// file and folder names still say "cloud" (`cloud-move`, `cloud-previous`):
+// renaming them would orphan the swap back on servers already running.
 import { createHash, randomBytes } from "node:crypto";
 import { createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statfsSync, writeFileSync } from "node:fs";
 import { open } from "node:fs/promises";
@@ -167,9 +169,9 @@ export function validUploadDeclaration(input) {
     if (!Number.isSafeInteger(input.bytes) || input.bytes < MIN_BYTES)
         throw fail("This is not a workspace backup.", 400);
     if (input.bytes > CLOUD_MOVE_MAX_BYTES)
-        throw fail("This workspace is larger than the 10 GB a move can carry.", 413);
+        throw fail("This workspace is larger than the 10 GB a copy can carry.", 413);
     if (input.files !== undefined && (!Number.isSafeInteger(input.files) || input.files < 0 || input.files > CLOUD_MOVE_MAX_FILES)) {
-        throw fail("This workspace has more than the 100,000 files a move can carry.", 413);
+        throw fail("This workspace has more than the 100,000 files a copy can carry.", 413);
     }
     return { sha256: input.sha256, bytes: input.bytes };
 }
@@ -193,7 +195,7 @@ export function beginUpload(dataDir, declared, now = Date.now()) {
 export async function writeUploadPart(dataDir, sha256, offset, length, body, now = Date.now()) {
     const meta = readUploadMeta(dataDir);
     if (!meta || meta.sha256 !== sha256)
-        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+        throw fail("This upload is not in progress on this server. Start the copy again.", 404);
     if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length <= 0 || length > CLOUD_MOVE_MAX_PART_BYTES) {
         throw fail("Invalid upload part.", 400);
     }
@@ -238,7 +240,7 @@ export async function writeUploadPart(dataDir, sha256, offset, length, body, now
 export async function completedUpload(dataDir, sha256) {
     const status = uploadStatus(dataDir);
     if (!status || status.sha256 !== sha256)
-        throw fail("This upload is not in progress on your Cloud. Start the move again.", 404);
+        throw fail("This upload is not in progress on this server. Start the copy again.", 404);
     if (status.received !== status.bytes)
         throw fail("The upload is not complete yet.", 409, { received: status.received });
     const hash = createHash("sha256");
@@ -246,7 +248,7 @@ export async function completedUpload(dataDir, sha256) {
         hash.update(chunk);
     if (hash.digest("hex") !== sha256) {
         discardUpload(dataDir);
-        throw fail("The uploaded file was damaged on the way. Start the move again.", 400);
+        throw fail("The uploaded file was damaged on the way. Start the copy again.", 400);
     }
     return uploadPartPath(dataDir);
 }
@@ -312,7 +314,7 @@ export function discardNextPreviousCloud(dataDir) {
 export async function stagePreviousCloud(dataDir, appVersion) {
     const previous = readPrevious(previousFolder(dataDir));
     if (!previous || isEmptyWorkspace(previous.contents))
-        throw fail("There is no previous Cloud to restore.", 404);
+        throw fail("There is nothing on this server to swap back to.", 404);
     const archive = join(previousFolder(dataDir), "workspace.ombbackup");
     const staged = await stageWorkspaceBackup(dataDir, archive, { password: previous.password, currentAppVersion: appVersion });
     return { ...staged, bytes: lstatSync(archive).size };
@@ -373,7 +375,7 @@ function pendingRestoreId(dataDir) {
         return null;
     }
 }
-/** At a Cloud home's startup, after any pending restore was applied:
+/** At every server's startup, after any pending restore was applied:
  * - a next previous Cloud becomes the previous Cloud once its restore is
  *   installed, and is dropped otherwise;
  * - moves' and swaps' restores, once settled, keep no safety copy or staged

package/dist-server/server/cloud-owner.js

@@ -29,7 +29,7 @@
 import { lstatSync, readFileSync } from "node:fs";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.js";
-export const CLOUD_PERSONAL_REFUSAL = "OMB Cloud is personal: only your own devices can connect.";
+export const CLOUD_PERSONAL_REFUSAL = "My Cloud is personal: only your own devices can connect.";
 const KEY = /^p_[\w-]{22}$/;
 const keys = z.array(z.string().regex(KEY)).max(100_000);
 const recordFile = z.object({

package/dist-server/server/composio.js

@@ -1106,7 +1106,7 @@ export async function removeAccount(cfg, slug, accountId) {
 }
 /** Mint a browser auth link for one service. Returns { url } or throws. */
 export async function authorizeService(cfg, slug, requestedAlias) {
-    const alias = normalizeAccountAlias(requestedAlias);
+    let alias = normalizeAccountAlias(requestedAlias);
     const toolkit = canonicalToolkitSlug(slug);
     const mode = connectionMode(cfg);
     const unavailable = managedConnectorUnavailableReason(mode, toolkit);
@@ -1136,8 +1136,15 @@ export async function authorizeService(cfg, slug, requestedAlias) {
     if (usableAccounts.length >= MULTI_ACCOUNT_CONFIG.max_accounts_per_toolkit) {
         throw inputError(`${toolkit} already has the maximum of ${MULTI_ACCOUNT_CONFIG.max_accounts_per_toolkit} accounts`, 409);
     }
-    if (usableAccounts.length > 0 && !alias) {
-        throw inputError("Add an account alias so the existing connection is not replaced");
+    if (serviceAccounts.length > 0 && !alias) {
+        if (serviceAccounts.every((account) => /^(initializing|initiated|expired)$/i.test(account.status ?? ""))) {
+            // Retry without replacing a named account or revoking a former grant:
+            // EXPIRED can describe either an abandoned flow or an expired credential.
+            alias = `omb-retry-${randomUUID()}`;
+        }
+        else {
+            throw inputError("Add an account alias so the existing connection is not replaced");
+        }
     }
     if (alias && serviceAccounts.some((account) => account.alias?.trim().toLowerCase() === alias.toLowerCase())) {
         throw inputError(`Account alias "${alias}" is already in use for ${toolkit}`, 409);