The desktop-protection shell guard only walked nested shell -c programs,
so interpreter inline code could still invoke kill/pkill. Inspect python/
node/perl/ruby/php -c/-e/-r payloads for the same lifecycle kills.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* Voice UX: simple speak toggle, onboarding pick, chat voice change
Replace Kokoro-branded settings with a Kann sprechen / Spricht nicht toggle,
onboarding voice personalization, and local chat commands for voice changes.
German voice presets (Eva, Bernd) surface as friendly names; Kokoro stays
under the hood via KOKORO_BASE_URL.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* Fix import order in voice onboarding and settings
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(adapters): stop desktop shell from inheriting host secrets
The this-mac shell spawned with the server process environment and ignored
the command environment, so Autopilot could read deployment credentials that
are not on the run redaction list. Drop credential-shaped host variables,
then apply the request environment.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* style(adapters): biome format desktop-sandbox after env scrub
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Extend the existing NewSpaceDialog project flow so an optional host
folder becomes the space workspace root. When .git metadata is present,
remote URL, default branch, and head commit are stored on the space.
Team Computer file APIs expose the linked folder under project/ without
a second VCS stack. Desktop adds a native folder picker; web falls back
to an absolute path field.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
When a run worker loses its lease while the runtime yields no events
(long tool or model work), lease loss was only detected on the next
heartbeat renewal (up to 60s). A reclaimed worker could execute in
parallel during that window.
Add a dedicated lease poll that aborts stale workers within a few
seconds and call runtime.abort so pi-runtime stops promptly.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
The executor calls finalizeRun with toolCallBudgetCount and
toolCallBudgetExceeded in the updateMany data clause, but these
fields were missing from the Prisma schema, causing an Invalid
updateMany invocation error that blocked all runs from completing.
Also updated CLAUDE-RESUME-NOW with full infrastructure status.
The executor loaded every agent secret in a Space and injected decrypted
values into shell environment variables for any member's bot run. Restore
agentSecretScopeForRun scoping accidentally dropped in 0a8a831.
Add an executor test that fails when findMany is scoped only by spaceId.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
When a user records a taught skill on one Team Computer bot, manual
takeover on another bot in the same space cleared the teaching lease
without stopping the session. Teaching input then failed silently and
skills/stop could not release the replacement takeover lease.
Reject computer/takeover while another bot on the same computer is
recording, matching the existing Stop teaching first messaging guard.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Team mode stores one disk per Space. computer/readFile and computer/files
only verified the caller owns the entry bot; an explicit bots/<otherBotId>/…
path let one member read another member's workspace. Wire existing path guards
into the API router and executor file/shell tools, and add a shared-Space
authorization regression test.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
claimSteering matched steering rows by runId even after they were
claimed, and still returned them when updateMany updated zero rows.
That could inject duplicate user context into an active run.
Filter findMany to claimedAt: null and return nothing when the claim
update does not land.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* fix(api): scope routine remove to acting user in shared Spaces
routines/remove only filtered by spaceId, so any member of a shared Space
could delete another member's routine by ID. Match update/testRun by also
requiring userId in the lookup.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* test: drop unused ownerActor in routine remove authz case
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
- Add teamBotWorkspaceDirectory import to router.ts
- Add exportOptions to scope team exports to one bot workspace
- Add authorization test: member export only sees their workspace files
- Add LocalAgentHomeStore and computerHomeKey imports to testkit
Non-owner shared-space members could read the space memory provider id
and internal endpoint origin via aiConsent/status, bypassing the owner-only
policy that draft PR #46 applies to memory/providerConfig.
Owners still see full provider disclosure; members get a generic Space
memory recipient when a provider is configured, without loading settings.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
- Replace findSpaceMemoryConfig inline call with getMemoryProviderConfig(deps, actor)
- Add owner gate: space members get 403, owners get config
- Add authorization tests for providerConfig/connectProvider/setDefaultScope/disconnectProvider
- Add wiring test to ensure router.ts uses the owner-gated handler
Group intros were stamped as posted before the outbox drain ran. When
delivery enqueue failed or the intro row exhausted retries, the channel
stayed marked and no retry path existed — unlinked participants never saw
the onboarding message.
Stamp introPostedAt in the drain path after a successful provider send,
matching the messagingMirroredAt pattern from #42.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
answerRunInput already blocked cross-member answers for credential
secret asks and always-allow approvals, but one-time allow/deny and
generic OTP secret asks had no run.userId check. Align the DB gate so
shared-space prompt answers cannot be hijacked at the persistence layer.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
spawnKey is unique per Space, not per user. createBot already rejects
cross-member replay, but spawnBot caught that error and returned the
other member's bot anyway. Match createBot by requiring existing.userId
=== spawnedBy.userId before treating a spawnKey conflict as idempotent.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Team mode shares one disk per Space. export/bot walked the entire
team home, so a member exporting their own bot received every other
member's workspace files too.
Scope exportHome with the exporting bot's bots/<id>/ prefix and add
regression coverage for the shared-Space case.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Computer-busy requeues previously retried forever via retryForever,
which could hang runs and burn worker cycles on a stuck computer.
Add a small retry policy helper that tracks consecutive busy waits in
an internal run.error marker, preserves that marker across lease claims,
caps retries at 24 with existing exponential backoff, and fails the run
with a clear message when the bound is reached. Database connection
pressure retries remain unbounded.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Remove hostRoots from this-mac desktop sandbox so shell execution stays
inside the bot computer workspace, matching container path rules.
Add resolveDesktopExecuteCwd to map virtual /home/rakazo paths onto the
local home and reject host-absolute cwd requests via containment checks.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
The respond_agent_connection builtin could flip a pending agent connection
to approved without the target owner's YES/NO DM or authenticated API
response. Treat it like other security-boundary builtins so the executor
shows an approval card before the status change runs.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
mirrorMessagingOutbound always stamped messagingMirroredAt even when
mirrorRun returned early, so the job reconciler never retried completed
messaging runs whose channel or DM mirror was skipped or not yet durable.
Gate the recovery marker on mirror disposition (complete vs retry), only
set it for completed messaging runs, and leave it null when mirrorable
bot text still exists but was not written to the outbox.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Apply the connect-invite at-most-once pattern to mirrored DMs, group
posts, channel invites, and intros. Provider send errors now keep the
outbox row claimed as sent without a handle instead of reverting to
pending and risking duplicate delivery.
Pre-send setup failures (thread resolution) still retry with backoff.
Pass outbox idempotency keys through to sendToThread for future provider
dedupe.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Group inbound webhooks often report only the sender in participants,
not the full roster. Sweeping on any non-empty list incorrectly marked
approved members as left, silently dropping them from channel fan-out.
Gate the sweep on participantsAuthoritative so adapters opt in only when
the provider supplies a complete roster.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Non-owner Space members could read provider settings (mode, baseUrl,
endpoint metadata) while connect/disconnect/setDefaultScope already
required owner role. Align the read path with write authz.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Agent secrets are owner-managed via the API but the executor loaded every
secret in the Space and injected decrypted values into shell environment
variables for any member's bot run.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Team mode shares one disk per Space. RPC and executor paths under
bots/<otherBotId>/ were reachable with any member-owned entry bot,
leaking another member's workspace files while same-user cross-bot
access stays intentional.
Add path guards, filter bot listings, regression tests.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
When a delegated bot finishes but its wake message was deleted (e.g.
thread clear), returnBotMessageOutcome used to mark botOutcomeReturnedAt
and drop the coordinator reply silently. Retry instead, and block
clearThread while completed bot_message runs still owe a return.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Drain claims outbox rows as sent before the provider acks. Late ERROR
webhooks were regressing delivered rows to failed; late DELIVERED could
upgrade exhausted failures. Gate webhook updates by allowed source status.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Cloud/public memory providers are owner-managed infrastructure. The RPC
read path is owner-gated separately; this aligns executor, history
compaction, and thread-clear purge with the same boundary so non-owner
members cannot load credentials or reach external endpoints at runtime.
Deployment-owner local/private providers remain available to all Space
members when the deployment owner configured them.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
Remove duplicate definitions from executor.ts and pi-runtime.ts that
already live in executor-*.ts and pi-model-config.ts. Import extracted
symbols with .js extensions and re-export the public executor/pi-runtime
surface for existing callers.
Export a few pi-model-config helpers required by pi-runtime (including
boundAgentToolResult and toolCallBudgetFor) and align beginToolCall queue
typing with AgentRuntimeEvent.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
- Remove pi-tool-utils.ts (too many dependencies on pi-runtime internals)
- Fix executor.test.ts to import from extracted modules
- Remove pi-tool-utils from index.ts exports
- Build verified green
