openmausbot 0.1.95 → 0.1.97

package/dist-server/server/computer-engine-removal.js

@@ -0,0 +1,70 @@
+/** The removed engine's driver kind ("boxAgent" was Boat's historical name). */
+export const REMOVED_COMPUTER_DRIVER = "boxAgent";
+/** The instance id every default fleet gave it. */
+const REMOVED_COMPUTER_INSTANCE = "computer";
+/** Instance ids that named the Computer engine. A saved fleet may hold the
+ * default id or one of its own; an id the person reused for another engine
+ * is theirs and stays. */
+export function removedComputerInstanceIds(saved) {
+    const ids = new Set();
+    const reused = saved && Object.hasOwn(saved, REMOVED_COMPUTER_INSTANCE) &&
+        saved[REMOVED_COMPUTER_INSTANCE].driver !== REMOVED_COMPUTER_DRIVER;
+    if (!reused)
+        ids.add(REMOVED_COMPUTER_INSTANCE);
+    for (const [id, entry] of Object.entries(saved ?? {})) {
+        if (entry.driver === REMOVED_COMPUTER_DRIVER)
+            ids.add(id);
+    }
+    return ids;
+}
+/** A fleet without the removed engine: a saved entry for it is dropped, so
+ * it is never offered and the next save leaves it off disk. */
+export function withoutComputerEngine(map) {
+    for (const [id, entry] of Object.entries(map)) {
+        if (entry.driver === REMOVED_COMPUTER_DRIVER)
+            delete map[id];
+    }
+    return map;
+}
+/** The line a moved conversation shows, in plain words. It names the removed
+ * choice as people saw it in the model list ("Computer", not the panel's
+ * Computer tab), claims a cloud computer only where one is still used, says
+ * so when the new engine can't use the one it had, and names the one setting
+ * to change when a turn there would be refused. */
+export function computerEngineMoveText(move, botName, engine) {
+    const removed = "The Computer choice in the model list was removed.";
+    const bot = move.scope !== "conversation";
+    const head = move.scope === "conversation" ? `This conversation now uses ${engine}.`
+        : move.scope === "bot-only" ? `${botName} now uses ${engine}; this conversation keeps its own model.`
+            : `${botName} now uses ${engine}.`;
+    const noComputer = ` ${engine} can't use a computer, so`;
+    const place = move.cloud
+        ? bot ? ` ${botName} still works on its cloud computer.` : ` It still works on ${botName}'s cloud computer.`
+        : move.noComputer === "auto"
+            ? `${noComputer} ${bot ? `${botName} no longer works on its` : `it no longer works on ${botName}'s`}` +
+                " cloud computer. To use it again, choose a model that can use a computer."
+            : move.noComputer === "works-on"
+                ? `${noComputer} ${botName} can't reply on ${engine} while its Works on is Cloud computer.` +
+                    " Choose a model that can use a computer, or set Works on to Auto."
+                : move.noComputer === "pin"
+                    ? `${noComputer} ${botName} can't reply here while this conversation is pinned to its cloud computer.` +
+                        " Choose a model that can use a computer, or clear this conversation's place in the composer."
+                    : "";
+    const ask = !move.askNow ? ""
+        : move.scope === "bot-only" ? ` ${botName}'s permissions are now Ask, but this conversation's stay as they were.`
+            : " Its permissions are now Ask.";
+    return `${head} ${removed}${place}${ask}`;
+}
+/** Writes each moved conversation's line. The move is saved by then, so a
+ * later try never finds these conversations again: a line that fails is
+ * logged, and every other line is still written. */
+export function writeComputerEngineMoveLines(moves, write) {
+    for (const move of moves) {
+        try {
+            write(move);
+        }
+        catch (error) {
+            console.warn(`[engines] the Computer engine move line for ${move.threadId} was not written: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}

package/dist-server/server/computer-selection.js

@@ -0,0 +1,18 @@
+/** The option a request picks, and whether it is the computer this turn
+ * already has. `current` is the turn's mounted place. `startsOnFirstCall`
+ * says that place's computer is the one this turn's first computer call
+ * creates or wakes (the bot's own cloud computer): it is this turn's before
+ * it is up, so asking for it, or for Auto, keeps it instead of restarting
+ * the request somewhere else. */
+export function pickComputer(options, requested, current, startsOnFirstCall) {
+    const isCurrent = (option) => option.surface === current && (option.ready || (startsOnFirstCall && option.available));
+    const option = requested === "auto"
+        ? options.find(isCurrent)
+            ?? options.find((candidate) => candidate.ready && candidate.surface === "vm")
+            ?? options.find((candidate) => candidate.ready)
+            ?? options.find((candidate) => candidate.canStart)
+            ?? options.find((candidate) => candidate.canCreate && candidate.surface === "vm")
+            ?? options.find((candidate) => candidate.canCreate)
+        : options.find((candidate) => candidate.surface === requested);
+    return { option, current: option !== undefined && isCurrent(option) };
+}

package/dist-server/server/config.js

@@ -7,13 +7,13 @@ import { join } from "node:path";
 import { z } from "zod";
 import { normalizeImageGenerationUrl } from "../shared/image-generation.js";
 import { writeFileAtomic } from "./atomic.js";
+import { withoutComputerEngine } from "./computer-engine-removal.js";
 import { newBotDefaultsSchema } from "./new-bot-defaults.js";
 import { EFFORT_LEVELS } from "../shared/wire.js";
 import { isModelVariant } from "./contracts.js";
 import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-icon.js";
 import { isRemoteMcpServer, parseStoredMcpServer } from "./mcp-registry.js";
 import { parseJson, schemaIssue } from "./schema.js";
-import { CLOUD_SEAT_IDLE_STOP_MS } from "./cloud-overflow.js";
 const optionalText = z.string().optional();
 const SSH_ALIAS = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 const LEGACY_BROWSER_PROFILE_ID = /^[A-Za-z0-9_-]{1,40}$/;
@@ -292,17 +292,6 @@ const featureConfigSchema = z.object({
      * conversations that share words with the message ride into the turn.
      * Read-only; on unless explicitly switched off — see autoRecallEnabled. */
     autoRecall: z.boolean().optional(),
-    /** Idle release for computer claims (#1653): a desktop seat that stays
-     * screen-quiet for 90 seconds is released to waiting turns while its
-     * holder's turn still lives; the previous holder re-claims directly
-     * for 10 minutes and yields to an occupied seat. Off until baked; see
-     * computerClaimIdleReleaseEnabled for how to enable it by hand. */
-    computerClaimIdleRelease: z.boolean().optional(),
-    /** Consented cloud overflow for local computer waits (#1655): a wait
-     * may offer a per-second-billed cloud seat, but only through an explicit
-     * consent card or a configured allowlist — never a silent Auto default.
-     * Off until baked; see cloudOverflowEnabled for how to enable it by hand. */
-    cloudOverflow: z.boolean().optional(),
     /** Opt-in shared skills library: one store at the data dir that bots
      * read by assignment instead of per-workspace copies. Off until
      * explicitly enabled — see skillsLibraryEnabled. */
@@ -436,8 +425,12 @@ const appConfigSchema = z.object({
      * provider is Boat now and the key is kept for compatibility. */
     box: z.object({ token: optionalText }).optional(),
     vps: vpsConfigSchema.optional(),
-    /** Optional OpenCode key; persisted write-only and passed only to its child. */
-    opencodeGo: z.object({ apiKey: optionalText }).optional(),
+    /** Optional OpenCode key; persisted write-only and passed only to its child.
+     * `providerKeys`: keys for OpenCode's other providers (Venice, Groq…) by the
+     * environment name OpenCode reads, also write-only and only for its child.
+     * Settings changes go through mergeOpenCodeProviderKeys; the stored copy
+     * is read loosely (storedAppConfigSchema). */
+    opencodeGo: z.object({ apiKey: optionalText, providerKeys: z.record(z.string(), z.string()).optional() }).optional(),
     /** Voice settings and the selected voice id. `provider` picks the
      * engine: "elevenlabs" (default; needs `key`), "fish" (needs its own
      * `fishKey`; `fishModel` picks its speech model), "system" (the Mac's
@@ -526,15 +519,6 @@ const appConfigSchema = z.object({
     /** The authorization decision log (server/decision-log.ts): days of month
      * files kept, at least; OMB_DECISION_RETENTION_DAYS wins when set. */
     decisions: z.object({ retentionDays: z.number().int().min(1).max(3650).optional() }).strict().optional(),
-    /** #1655 cloud-overflow settings. perSecondCostUsd is the operator's own
-     * verified rate: with no price configured the feature stays inert rather
-     * than show an invented one. allowlistedThreads carries standing consent
-     * for exact thread ids. */
-    cloudOverflow: z.object({
-        perSecondCostUsd: z.number().positive().max(10).optional(),
-        idleStopMs: z.number().int().positive().max(24 * 60 * 60_000).optional(),
-        allowlistedThreads: z.array(z.string().min(1)).max(1000).optional(),
-    }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     onboarding: onboardingConfigSchema.optional(),
@@ -550,6 +534,15 @@ const appConfigSchema = z.object({
 });
 const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
+    /** Read loosely, like mcpServers: a hand-edited provider key that isn't
+     * text is dropped here, and a bad name or key later
+     * (openCodeProviderKeys), never the whole file. */
+    opencodeGo: z.object({
+        apiKey: optionalText,
+        providerKeys: z.record(z.string(), z.unknown()).catch({})
+            .transform((keys) => Object.fromEntries(Object.entries(keys).filter((entry) => typeof entry[1] === "string")))
+            .optional(),
+    }).optional(),
 });
 const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true })
     .extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() });
@@ -749,43 +742,6 @@ export function claudeUserMcpEnabled(cfg) {
 export function llmThreadTitlesEnabled(cfg) {
     return cfg.features?.llmThreadTitles === true;
 }
-/** Idle release for computer claims (#1653): a whole-turn desktop hold
- * ends after a screen-quiet window (default 90 seconds, screen-poller
- * frames excluded) instead of at turn settle, and the previous holder
- * re-claims directly inside a reclaim window (default 10 minutes) while
- * yielding to a seat another turn already holds. Off unless an explicit
- * `true` — bake it as a maintainer-only flag first, exactly like
- * sharedComputers: enable by hand in ~/.openmausbot/config.json
- * (`{"features": {"computerClaimIdleRelease": true}}`) and restart. */
-export function computerClaimIdleReleaseEnabled(cfg) {
-    return cfg.features?.computerClaimIdleRelease === true;
-}
-/** Consented cloud overflow for local computer waits (#1655): while a turn
- * waits for a local desktop, it may offer overflow to a per-second-billed
- * cloud seat — never silently: the card names the cost, and only an
- * explicit per-conversation consent or a configured allowlist thread may
- * start the machine, which then hard-stops after an idle window. Off
- * unless an explicit `true`, like computerClaimIdleRelease: enable by
- * hand in ~/.openmausbot/config.json
- * (`{"features": {"cloudOverflow": true}, "cloudOverflow": {"perSecondCostUsd": 0.0004}}`)
- * and restart. */
-export function cloudOverflowEnabled(cfg) {
-    return cfg.features?.cloudOverflow === true;
-}
-/** The per-second rate shown on the card, or null when the operator has
- * not set one: the offer fails closed rather than guess a price. */
-export function cloudOverflowPerSecondCostUsd(cfg) {
-    const cost = cfg.cloudOverflow?.perSecondCostUsd;
-    return typeof cost === "number" && Number.isFinite(cost) && cost > 0 ? cost : null;
-}
-/** How long a cloud seat may stay screen-quiet before it is stopped. */
-export function cloudOverflowIdleStopMs(cfg) {
-    return cfg.cloudOverflow?.idleStopMs ?? CLOUD_SEAT_IDLE_STOP_MS;
-}
-/** Threads with standing consent, by exact thread id. */
-export function cloudOverflowAllowlistedThreads(cfg) {
-    return new Set(cfg.cloudOverflow?.allowlistedThreads ?? []);
-}
 /** Opt-in shared skills library (skills lane S1): one store at the data dir
  * that bots reference by assignment instead of per-workspace copies. Off
  * unless enabled by hand in ~/.openmausbot/config.json
@@ -815,7 +771,6 @@ export const FLEET_NEUTRAL_KEYS = new Set([
     "memory",
     "localVm",
     "features",
-    "cloudOverflow",
     "browserProfiles",
     "onboarding",
 ]);
@@ -1151,6 +1106,75 @@ export const PROVIDER_CREDENTIAL_ENV = [
     "CURSOR_API_KEY",
     "CURSOR_AUTH_TOKEN",
 ];
+/** Provider keys OpenCode reads from its environment, as it does in a
+ * terminal: with ANTHROPIC_API_KEY set, `opencode` lists Anthropic's models.
+ * Keys OpenMaus saves for another engine (xAI, Mistral, the workspace
+ * Anthropic key) are workspace credentials under other names and never
+ * ride along. */
+export const OPENCODE_PROVIDER_ENV = [
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "KIMI_API_KEY",
+    "MOONSHOT_API_KEY",
+    "MINIMAX_API_KEY",
+];
+/** Keys the owner saves in Settings for OpenCode's other providers (Venice,
+ * Groq, DeepSeek…), each under the environment name OpenCode reads. A Cloud
+ * has no terminal to export them in. They go to OpenCode's process only,
+ * never to this server's own environment. */
+export const OPENCODE_PROVIDER_KEY_LIMIT = 20;
+const OPENCODE_PROVIDER_KEY_NAME = /^[A-Z][A-Z0-9_]{0,59}_(?:API_KEY|KEY|TOKEN)$/;
+/** Printable, no spaces: no provider key has any, and a pasted sentence is not a key. */
+const OPENCODE_PROVIDER_KEY_VALUE = /^[\x21-\x7e]{1,4096}$/;
+/** Why OpenCode can't be given a key under this name, or undefined. A name
+ * OpenMaus keeps for itself or another engine would never reach OpenCode:
+ * every engine keeps only the credential names it reads (credentialEnv). */
+function openCodeProviderKeyNameRefusal(name) {
+    if (!OPENCODE_PROVIDER_KEY_NAME.test(name)) {
+        return "Use the name the provider reads its key from: capitals, ending in _API_KEY, _KEY or _TOKEN, such as VENICE_API_KEY.";
+    }
+    if (name === "OPENCODE_API_KEY")
+        return "Save the OpenCode key in the OpenCode API key box instead.";
+    const reserved = name.startsWith("OPENCODE_") || name.startsWith("OMB_")
+        || WORKSPACE_CREDENTIAL_ENV.includes(name)
+        || (PROVIDER_CREDENTIAL_ENV.includes(name) && !OPENCODE_PROVIDER_ENV.includes(name));
+    return reserved ? `OpenMaus keeps ${name} for itself, so OpenCode can't be given it here. Put this key in opencode.json instead.` : undefined;
+}
+/** The saved OpenCode provider keys that can be used, by name. A hand-edited
+ * entry OpenCode could not be given, or whose value is not a key, is
+ * skipped; so is anything past the limit. */
+export function openCodeProviderKeys(cfg) {
+    const saved = cfg.opencodeGo?.providerKeys ?? {};
+    const usable = Object.keys(saved).sort()
+        .filter((name) => !openCodeProviderKeyNameRefusal(name) && OPENCODE_PROVIDER_KEY_VALUE.test(saved[name] ?? ""))
+        .slice(0, OPENCODE_PROVIDER_KEY_LIMIT);
+    return Object.fromEntries(usable.map((name) => [name, saved[name]]));
+}
+/** A Settings change to the saved OpenCode provider keys: a key saves or
+ * replaces its name, "" removes it, and every other saved key stays. Returns
+ * the whole new set to store, or why it was refused. */
+export function mergeOpenCodeProviderKeys(cfg, change) {
+    const keys = new Map(Object.entries(openCodeProviderKeys(cfg)));
+    for (const [name, raw] of Object.entries(change)) {
+        const value = raw.trim();
+        if (!value) {
+            keys.delete(name);
+            continue;
+        }
+        const refusal = openCodeProviderKeyNameRefusal(name);
+        if (refusal)
+            return { ok: false, error: refusal };
+        if (!OPENCODE_PROVIDER_KEY_VALUE.test(value))
+            return { ok: false, error: "That doesn't look like a key. Paste only the key, with no spaces." };
+        keys.set(name, value);
+    }
+    if (keys.size > OPENCODE_PROVIDER_KEY_LIMIT) {
+        return { ok: false, error: `OpenCode can hold up to ${OPENCODE_PROVIDER_KEY_LIMIT} provider keys. Remove one you no longer use, then add this one.` };
+    }
+    return { ok: true, keys: Object.fromEntries([...keys].sort(([a], [b]) => (a < b ? -1 : 1))) };
+}
 const configSaveListeners = new Set();
 /** Told, synchronously, what each saveConfig wrote: the file before and
  * after. The admin activity log (server/admin-activity.ts) records the
@@ -1180,7 +1204,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "cloudOverflow", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
+    for (const key of ["xai", "anthropic", "mistral", "cerebras", "openai", "openrouter", "openaiCompat", "composio", "box", "opencodeGo", "tts", "decider", "imageGen", "live", "profile", "rooms", "threads", "context", "memory", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -1420,10 +1444,10 @@ export function instanceOwnsRouting(cfg, entry, routingDefaults) {
 }
 /** The credential env instanceConfigs() injects for one driver at runtime.
  * Each secret goes only to the driver that actually reads it: the API-key
- * Grok driver reads XAI_API_KEY, the Computer driver reads BOX_TOKEN, and
- * OpenCode reads OPENCODE_API_KEY. Every other engine brings its own
- * login, so handing it a key it never uses would only put that key in the
- * environment of an unrelated child process. */
+ * Grok driver reads XAI_API_KEY and OpenCode reads OPENCODE_API_KEY. Every
+ * other engine brings its own login, so handing it a key it never uses would
+ * only put that key in the environment of an unrelated child process. The
+ * Boat token reaches no engine at all: the harness alone talks to Boat. */
 function injectedEnvironment(cfg, instanceId, driver) {
     const environment = new Map();
     if (driver === "mistral" && cfg.mistral?.key)
@@ -1462,13 +1486,13 @@ function injectedEnvironment(cfg, instanceId, driver) {
         if (driver === "openai-compat" && cfg.openaiCompat?.url)
             environment.set("OPENAI_COMPAT_URL", cfg.openaiCompat.url);
     }
-    // driverKind "boxAgent" and env BOX_TOKEN keep their historical names.
-    // Only the person's own token: without one the driver itself falls back
-    // to Cloud Pro's included token, which never enters an environment map.
-    if (driver === "boxAgent" && cfg.box?.token)
-        environment.set("BOX_TOKEN", cfg.box.token);
-    if (driver === "opencodeGo" && cfg.opencodeGo?.apiKey)
-        environment.set("OPENCODE_API_KEY", cfg.opencodeGo.apiKey);
+    if (driver === "opencodeGo") {
+        // Keys for OpenCode's other providers, under the names OpenCode reads.
+        for (const [name, key] of Object.entries(openCodeProviderKeys(cfg)))
+            environment.set(name, key);
+        if (cfg.opencodeGo?.apiKey)
+            environment.set("OPENCODE_API_KEY", cfg.opencodeGo.apiKey);
+    }
     return environment;
 }
 /** One instance per pasted provider key, each running only on its own key.
@@ -1523,7 +1547,6 @@ export function instanceConfigs(cfg) {
         chatgpt: { driver: "codex", displayName: "ChatGPT plan", config: { authMode: "chatgpt-plan" } },
         antigravity: { driver: "antigravityAgent" },
         opencodeGo: { driver: "opencodeGo" },
-        computer: { driver: "boxAgent" },
         openaiCompat: { driver: "openai-compat" },
         mistral: { driver: "mistral" },
         cerebras: { driver: "cerebras" },
@@ -1550,7 +1573,8 @@ export function instanceConfigs(cfg) {
         ...CUSTOM_ONLY,
     };
     const configured = cfg.instances && Object.keys(cfg.instances).length ? cfg.instances : null;
-    const map = configured ? { ...configured } : { ...DEFAULT_FLEET };
+    // A fleet saved before the Computer engine was removed may still name it.
+    const map = withoutComputerEngine(configured ? { ...configured } : { ...DEFAULT_FLEET });
     // Product fleets pick up newly shipped engines. A one-off test/shadow map
     // (no claude/grok/codex) is left exactly as written.
     if (configured &&

package/dist-server/server/connector-scope-hint.js

@@ -0,0 +1,83 @@
+// A connected-app call refused for a missing OAuth permission (MOCA-273).
+//
+// Google answers 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT when the account's grant
+// lacks a scope the action needs, such as gmail.settings.basic for a filter.
+// Composio's default auth config for a toolkit never asks for that scope, so
+// reconnecting cannot fix it and a bot that only sees the 403 retries or
+// asks the person to reconnect. The fix is the person's own auth config in
+// their Composio project, which OpenMausBot already prefers
+// (listCustomAuthConfigs). This appends that explanation to the tool result,
+// leaving the provider's own error untouched.
+const SCOPE_ERROR = /ACCESS_TOKEN_SCOPE_INSUFFICIENT|insufficient authentication scopes|insufficientPermissions/i;
+/** The Google scope a known tool needs, when the tool name says which. */
+function requiredScope(slug) {
+    if (!slug.startsWith("GMAIL_"))
+        return null;
+    if (/FORWARD|SEND_AS|DELEGATE/.test(slug))
+        return "https://www.googleapis.com/auth/gmail.settings.sharing";
+    if (/FILTER|VACATION|AUTO_REPLY|IMAP|POP|LANGUAGE/.test(slug))
+        return "https://www.googleapis.com/auth/gmail.settings.basic";
+    return null;
+}
+function appName(slug) {
+    const toolkit = slug.split("_")[0] ?? "";
+    if (toolkit === "GMAIL")
+        return "Gmail";
+    if (toolkit.startsWith("GOOGLE"))
+        return "Google";
+    return toolkit.charAt(0) + toolkit.slice(1).toLowerCase();
+}
+/** The note a bot reads after its call was refused for a missing permission. */
+export function scopeHint(slugs) {
+    const slug = slugs.find((candidate) => requiredScope(candidate)) ?? slugs[0] ?? "";
+    const app = slug ? appName(slug) : "This app";
+    const scope = slug ? requiredScope(slug) : null;
+    const permission = scope ? `the ${scope} permission` : "the permission this action needs";
+    return `OpenMausBot note: ${app} refused this because the connected account has not granted ${permission}. ` +
+        `Reconnecting will not add it: the default Composio connection never asks for it. ` +
+        `To allow it, the person creates their own ${app} auth config in their Composio project that includes ${permission}, ` +
+        `then reconnects ${app} under Connected apps; OpenMausBot uses that config automatically. ` +
+        `Tell the person this. Do not retry this call.`;
+}
+/** Adds the note to one JSON-RPC frame whose tool result is a scope refusal. */
+function annotateFrame(frame, slugs) {
+    const result = frame?.result;
+    if (!result || !Array.isArray(result.content))
+        return false;
+    const refused = result.content.some((item) => item && typeof item === "object" && typeof item.text === "string" &&
+        SCOPE_ERROR.test(item.text));
+    if (!refused)
+        return false;
+    result.content.push({ type: "text", text: scopeHint(slugs) });
+    return true;
+}
+/**
+ * The relayed MCP response, with the note added when a tool call came back
+ * refused for a missing OAuth permission. Anything else, including a body it
+ * cannot read, is returned byte for byte.
+ */
+export function withScopeHint(bytes, contentType, slugs) {
+    const text = new TextDecoder().decode(bytes);
+    if (!SCOPE_ERROR.test(text))
+        return bytes;
+    try {
+        if (/text\/event-stream/i.test(contentType)) {
+            let changed = false;
+            const lines = text.split("\n").map((line) => {
+                if (!line.startsWith("data:"))
+                    return line;
+                const frame = JSON.parse(line.slice(5));
+                if (!annotateFrame(frame, slugs))
+                    return line;
+                changed = true;
+                return `data: ${JSON.stringify(frame)}`;
+            });
+            return changed ? new TextEncoder().encode(lines.join("\n")) : bytes;
+        }
+        const frame = JSON.parse(text);
+        return annotateFrame(frame, slugs) ? new TextEncoder().encode(JSON.stringify(frame)) : bytes;
+    }
+    catch {
+        return bytes;
+    }
+}

package/dist-server/server/container-computer.js

@@ -372,11 +372,19 @@ function containerOwnershipLabelsMatch(labels, target) {
 function normalizeImageId(id) {
     return id?.trim().replace(/^sha256:/, "") || null;
 }
-function inspectedImage(stdout) {
+function inspectedImage(stdout, runtime) {
     const parsed = JSON.parse(stdout);
     const image = parsed[0];
+    // Apple container runs on Apple Silicon and puts image labels inside each
+    // platform variant. Never accept another platform's labels or guess between
+    // multiple matching variants. Docker/Podman keep their existing inspect paths.
+    const variants = runtime === "container" && Array.isArray(image?.variants)
+        ? image.variants.filter(variant => variant?.platform?.os === "linux" && variant.platform.architecture === "arm64")
+        : [];
     return {
-        labels: image?.Config?.Labels ?? image?.config?.Labels ?? image?.config?.labels ?? image?.configuration?.labels,
+        labels: runtime === "container"
+            ? (variants.length === 1 ? variants[0]?.config?.config?.Labels : undefined)
+            : image?.Config?.Labels ?? image?.config?.Labels ?? image?.config?.labels ?? image?.configuration?.labels,
         id: normalizeImageId(image?.Id ?? image?.id ?? image?.configuration?.descriptor?.digest),
     };
 }
@@ -430,7 +438,7 @@ export async function containerComputerStatus(runner = sh, platform = process.pl
     }
     try {
         const { stdout } = await runner(status.runtime, ["image", "inspect", IMAGE]);
-        const image = inspectedImage(stdout);
+        const image = inspectedImage(stdout, status.runtime);
         status.image = imageLabelsMatch(image.labels);
         status.image_id = image.id;
     }
@@ -699,8 +707,11 @@ async function ensureVmWorkspace(platform, target) {
     if (platform !== "win32")
         await chmod(target.workspaceDir, 0o700);
 }
+function baseImagePullArgs(runtime) {
+    return runtime === "container" ? ["image", "pull", BASE_IMAGE] : ["pull", BASE_IMAGE];
+}
 async function prepareManagedImage(runtime, runner) {
-    await runner(runtime, ["pull", BASE_IMAGE], 10 * 60_000);
+    await runner(runtime, baseImagePullArgs(runtime), 10 * 60_000);
     const context = await mkdtemp(join(tmpdir(), "openmausbot-cua-image-"));
     try {
         await writeFile(join(context, "Dockerfile"), managedImageDockerfile(), { mode: 0o600 });
@@ -938,7 +949,7 @@ export function setupCommands(runtime, platform = process.platform, target = SHA
         runtimeStart,
         // This is the inspectable base download. The normal Prepare button also
         // builds the checksum-pinned 0.20.0 derivative automatically.
-        pull: command(["pull", BASE_IMAGE]),
+        pull: command(baseImagePullArgs(runtime)),
         run: runtime === "container" && target.key !== SHARED_LOCAL_VM_TARGET.key
             ? null
             : command(containerRunArgs(runtime, "CHANGE_ME", target)),

package/dist-server/server/contracts.js

@@ -49,15 +49,6 @@ export function qualifiedModelLabel(id, qualifier, options = {}) {
         return id;
     return `${id}${decorate(qualifier)}`;
 }
-/** True when this driver's turn can run against a cloud computer — natively
- * (remoteAgent) or through its computer tools (computerMcp), where the cloud
- * computer is one more stdio server. The one rule for Hosted desktop: every
- * cloud attach path refuses an engine without it before anything is
- * provisioned (cloudPlaceDriverError). Derived, so no driver can declare it
- * out of step with the two fields it reads. */
-export function usesCloudComputer(capabilities) {
-    return capabilities.remoteAgent === true || capabilities.computerMcp === true;
-}
 let eventCounter = 0;
 export const newEventId = () => `ev-${Date.now().toString(36)}-${(eventCounter++).toString(36)}`;
 export const newId = () => crypto.randomUUID();

package/dist-server/server/decider/jev.js

@@ -1,12 +1,9 @@
+import { isLoopback } from "../provider-key-check.js";
 export const JEV_DEFAULT_BASE_URL = "https://api.typesafe.ai";
 export const JEV_MODEL = "jev-latest";
 export const JEV_MAX_OPTIONS = 255;
 export const JEV_MIN_LEVELS = 2;
 export const JEV_MAX_LEVELS = 10;
-function isLoopback(hostname) {
-    const host = hostname.replace(/^\[|\]$/g, "");
-    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
-}
 /** The endpoint for a base URL, or null when the key must not be sent there:
  * https anywhere, plain http only to this machine (a local Jev-compatible
  * server or a test double). */

package/dist-server/server/decider/log.js

@@ -14,6 +14,7 @@ import { createHash } from "node:crypto";
 import { appendFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { boundRetentionDays, pruneMonthFiles } from "../decision-log.js";
+import { monthKey } from "../usage-ledger.js";
 export const DECIDER_LOG_DIR = "decider-log";
 const PRUNE_EVERY_MS = 60 * 60_000;
 const writeQueues = new Map();
@@ -28,9 +29,6 @@ export function stateHash(state) {
     }
     return createHash("sha256").update(text).digest("hex").slice(0, 16);
 }
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function deciderLogFileFor(dataDir, at) {
     return join(dataDir, DECIDER_LOG_DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/decision-log.js

@@ -32,7 +32,7 @@ import { readdirSync, readFileSync } from "node:fs";
 import { appendFile, mkdir, readdir, stat, unlink } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { redactSecrets } from "./redact.js";
-import { csvCell } from "./usage-ledger.js";
+import { csvCell, monthKey } from "./usage-ledger.js";
 const DIR = "decisions";
 const LEGACY_FILE = "decisions.ndjson";
 const MONTH_FILE = /^(\d{4})-(\d{2})\.ndjson$/;
@@ -70,9 +70,6 @@ const actorScope = new AsyncLocalStorage();
 export function withDecisionActor(actor, work, via) {
     return actorScope.run(via ? { actor, via } : { actor }, work);
 }
-function monthKey(at) {
-    return `${at.getUTCFullYear()}-${String(at.getUTCMonth() + 1).padStart(2, "0")}`;
-}
 export function decisionFileFor(dataDir, at) {
     return join(dataDir, DIR, `${monthKey(at)}.ndjson`);
 }

package/dist-server/server/default-model-selection.js

@@ -1,6 +1,19 @@
 const claudeFirst = (instances) => instances.find((instance) => instance.driverKind === "claudeAgent") ?? instances[0];
-/** A saved choice is intentional: an unavailable provider or removed model
- * sends new bots to setup instead of silently changing their provider. */
+/** The ready rule: an engine can run a turn now when it is available, the
+ * organisation allows it, and it is not signed out. A custom endpoint brings
+ * its own credential, so its sign-in state does not count. */
+export function readyToRun(instance, context = {}) {
+    return instance.snapshot.state === "available" && context.refusal?.(instance) === undefined &&
+        (instance.access === "custom" || instance.snapshot.authenticated !== false);
+}
+/** The engine a new bot gets, and the one a bot moved off a removed engine
+ * gets (computer-engine-removal.ts): one picker for both.
+ *
+ * A saved choice is intentional: an unavailable provider or removed model
+ * sends new bots to setup instead of silently changing their provider.
+ * Without one, an engine that can run a turn now wins (Claude first), then the
+ * first available one. On an enrolled desktop a working personal engine
+ * still beats a Company one, so billing stays the person's explicit choice. */
 export function selectDefaultModelSelection(instances, preferred, context = {}) {
     if (preferred) {
         const instance = instances.find((candidate) => candidate.instanceId === preferred.instanceId);
@@ -22,19 +35,12 @@ export function selectDefaultModelSelection(instances, preferred, context = {})
     }
     // The organisation's policy is inert (no refusal) unless this desktop is enrolled.
     const available = instances.filter((instance) => instance.snapshot.state === "available" && context.refusal?.(instance) === undefined);
+    const ready = available.filter((instance) => readyToRun(instance, context));
     const company = context.company;
-    let pick;
-    if (company && instances.some((instance) => company(instance.instanceId))) {
-        // Enrolled: an installed but signed-out personal Claude would send every
-        // new bot to setup although a Company model can run. Prefer instances that
-        // can run a turn now; a working personal engine still wins, so billing
-        // stays the person's explicit choice.
-        const ready = available.filter((instance) => instance.access === "custom" || instance.snapshot.authenticated !== false);
-        pick = claudeFirst(ready.filter((instance) => !company(instance.instanceId))) ?? claudeFirst(ready) ?? claudeFirst(available);
-    }
-    else {
-        pick = claudeFirst(available);
-    }
+    const personal = company && instances.some((instance) => company(instance.instanceId))
+        ? claudeFirst(ready.filter((instance) => !company(instance.instanceId)))
+        : undefined;
+    const pick = personal ?? claudeFirst(ready) ?? claudeFirst(available);
     return { instanceId: pick?.instanceId ?? "", model: pick?.models.default ?? "" };
 }
 /** Complete a new bot's selection with the workspace's new-bot effort. An