@chibitek/chibi 0.1.155 → 0.1.157

package/dist-server/server/index.js

@@ -1,3 +1,7 @@
+import { hasUnboundGoalGuard, goalGuardForEvent, addGoalGuard, removeGoalGuard, runPersonalGoalTurn, updatePersonalGoalReceipt } from "./personal-goal-turn.js";
+import { PersonalGoalRuntime, receiveGoalCommand } from "./personal-goal-runtime.js";
+import { personalGoalInstructions } from "./personal-goals.js";
+import { parseGoalCommand } from "../shared/personal-goal.js";
 // OpenMausBot server — the harness host. Clients hold no transports
 // (upstream rule): the React app dispatches typed commands over HTTP and
 // folds one SSE event stream; every provider process runs here.
@@ -143,7 +147,7 @@ import { MEMORY_INDEX, MemoryStoreError, memoryCapacity, memoryOverview, openFol
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, flushMemoryJournal, journalMemoryDelete, journalMemoryWrite, readMemoryJournal, revertMemoryChange, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
 import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installSkill, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
-import { fetchSkillFromSource } from "./skill-fetch.js";
+import { resolveSkillImport, skillImportSchema } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
@@ -235,6 +239,7 @@ import { activityCsv, activityEntries, appendAdminAction, botAuditSnapshot, botC
 import { frameForMember, memberBody, memberBot, noteSeen, notFoundFor, audienceEquals, memberGroup, narrowestAudience, parseVisibility, pathSubject, roomFeeds, routineVisible, sameAudience, SEES_EVERYTHING, SEES_ALL_BUT_PRIVATE, VisibleSet, } from "./bot-visibility.js";
 import { describeBrand, loadBrand } from "./brand.js";
 import { deliverSseFrame } from "./sse-fanout.js";
+import { DeviceRouteRegistry, removeStream } from "./device-routing.js";
 import { PHONE_SECRET_PROTOCOL_VERSION, PhoneSecretBridge, PhoneSecretError, PhoneSecretSubmissionRegistry, assertPhoneSecretRequestMatches, phoneSecretOperationId, } from "./phone-secret.js";
 // Keep these two last: a route module may import any server module, and
 // loading the table after everything above leaves module start-up order as is.
@@ -248,7 +253,7 @@ import { createModelLevelsRoutes } from "./routes/model-levels.js";
 import { createMcpMarketplaceRoutes } from "./routes/mcp-marketplace.js";
 import { createLocalModelRoutes, OLLAMA_LOCAL_URL, ollamaInstalledHere } from "./routes/local-models.js";
 import { createSetupRoutes } from "./routes/setup.js";
-import { installOllamaApp, openPodmanInstaller, runTool, startPodmanMachine } from "./app-installers.js";
+import { installOllamaApp, openPodmanInstaller, startOllamaApp, runTool, startPodmanMachine } from "./app-installers.js";
 import { CliLoginRunner } from "./cli-login.js";
 import { JobFailure, SetupJobs } from "./setup-jobs.js";
 import { localHost, probeLocalInjects } from "./drivers/local-inject.js";
@@ -1820,6 +1825,7 @@ function requestedTaskBot(botId, rawThreadId) {
     return task;
 }
 async function interruptDirectThread(botId, threadId) {
+    personalGoals.steer(threadId);
     const requestOwner = directRequestOwners.get(threadId);
     if (requestOwner) {
         requestOwner.stopped = true;
@@ -3350,7 +3356,7 @@ function localModeTurn(resolution, turn) {
     return { ...resolution, local: true, choice: { ...choice, selection: placement.selection, candidate: placement.candidate } };
 }
 const payPerUsePausedLine = (until) => `Pay-per-use is paused until ${restTime(until)}, when a subscription is back, so this turn stopped.`;
-/** A model this machine serves: never a stand-in for Engineering and above. */
+/** A model this machine serves: a rung when a ladder names it, else local rules only. */
 const isLocalModel = (candidate, model) => localModel(candidate, model) || modelLevels.classOf(candidate.driverKind, model)?.local === true;
 // ── silent automatic failover (docs/chibitek/engine-tiers.md, step 2) ────
 // Resting engines are shared by every bot and survive a restart.
@@ -3589,10 +3595,7 @@ const eventBase = (event) => ({
     ...(event.providerInstanceId ? { providerInstanceId: event.providerInstanceId } : {}), ...(event.turnId ? { turnId: event.turnId } : {}),
 });
 const restTime = (at) => new Date(at).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
-/** A watched turn ended failed because its engine ran out or was signed
- * out. Rest the engine, then run the same turn on the next engine at the
- * same level, silently; or, when nothing is left, stop it with one line
- * naming the resting engines. Returns what subscribers see. */
+/** Rest a refused engine and continue on an eligible engine, or show an actionable line. */
 function engineFailover(turn, completion) {
     const failure = turn.failure;
     const record = failoverTurns.get(turn.threadId);
@@ -3615,17 +3618,14 @@ function engineFailover(turn, completion) {
     const restFailed = () => engineRests.rest(turn.instanceId, failedCandidate ? engineAccount(failedCandidate) : undefined, failure.kind, { resetAt: failure.resetAt, resetText: failure.resetText, windowMs: failure.windowMs, message: redactSecretsInText(failure.message),
         ...(failure.permanent ? { permanent: true } : {}), ...(scope ? { scope } : {}), ...(ran?.model ? { model: ran.model } : {}),
         ...(failure.kind === "auth_failed" && failedCandidate ? { reportedSignedIn: failedCandidate.snapshot.state === "available" && failedCandidate.snapshot.authenticated === true } : {}) });
-    // An unrecognised failure (provider_error) is only a reason to try the
-    // next engine: the engine rests (the circuit breaker) only once the turn
-    // really moves, and with nowhere to go the turn ends with the engine's own
-    // report, exactly as before, rather than a "resting" line about it.
+    // Unknown failures rest only when the turn moves; otherwise preserve their report.
     const rest = failure.kind === "provider_error" ? undefined : restFailed();
     const label = (instanceId) => candidates.find((candidate) => candidate.instanceId === instanceId)?.displayName ?? instanceId;
     // The one plain line, never the provider's own words: which account needs
     // the person and where to fix it, or that every engine is resting.
     const stop = (line, category = "failover_exhausted") => [
         { ...eventBase(completion), type: "runtime.error", message: line, terminal: true, category, ...(failure.setup ? { setup: true } : {}) },
-        completion,
+        failure.kind === "auth_failed" ? { ...completion, stopReason: "auth_required" } : completion,
     ];
     const restingNamed = (instanceIds) => [...new Set(instanceIds)].flatMap((instanceId) => {
         const candidate = candidates.find((entry) => entry.instanceId === instanceId);
@@ -3648,13 +3648,11 @@ function engineFailover(turn, completion) {
         return stop(pick.line, pick.category);
     const { choice } = pick;
     const tried = new Set(record.tried);
-    // Move the turn. The attempt that failed is retired quietly afterwards: no
-    // chip, no notification, no incident, and nothing settled that the same
-    // turn still owns.
+    // Retire the failed attempt without settling the request that the next engine owns.
     const moved = ran ?? record.selection;
     const failedOwner = turnResourceOwners.get(turn.threadId);
     const tokens = completion.usage ?? turnUsage.get(turn.threadId);
-    const partialText = turn.partial.trim();
+    const partialText = groupGoalCoordinatorTurns.get(turn.threadId)?.size ? parseGroupGoalDecision(turn.partial).visibleText : turn.partial.trim();
     const requestOwner = directRequestOwners.get(turn.threadId);
     if (partialText) {
         // The answer it was in the middle of stays: the person saw it stream.
@@ -3666,6 +3664,12 @@ function engineFailover(turn, completion) {
     const tools = earlier.filter((message) => message.kind === "activity" && message.tool?.name).map((message) => message.tool.name);
     const note = continuationNote(said.map((message) => message.text ?? ""), tools);
     const attempt = record.attempt + 1;
+    for (const guard of groupGoalCoordinatorTurns.get(turn.threadId) ?? []) {
+        if (!guard.discard && (guard.turnId === completion.turnId || guard.turnId === turn.turnId)) {
+            guard.turnId = undefined;
+            guard.assistantItems = [];
+        }
+    }
     const rerun = startTurn(turn.botId, note ? `${record.text}\n\n${note}` : record.text, {
         ...record.opts,
         threadId: turn.threadId,
@@ -3703,6 +3707,11 @@ function engineFailover(turn, completion) {
         });
     }
     retireFailedAttempt(turn.botId, turn.threadId, turn.generation, failedOwner, completion);
+    if (failure.kind === "auth_failed")
+        reportIncident({
+            kind: "engine-fallback", bot: profile, threadId: turn.threadId, notifyChief: true,
+            detail: `${engineLabel(candidates, moved)} needs signing in again in Settings > Engines; the turn continued on ${engineLabel(candidates, choice.selection)}`,
+        });
     console.error(`[omb-failover] thread=${turn.threadId} ${failure.kind}: ${moved.instanceId} -> ${choice.selection.instanceId} (attempt ${attempt})`);
     // No turnId: the failed provider turn is retired, and its id would hide
     // this record from every window.
@@ -5013,67 +5022,21 @@ const publicBotQueuedMessages = () => queuedSteerSnapshot((botId, threadId) => B
 const groupTurnOperations = new Map();
 const groupGoalCoordinatorTurns = new Map();
 const GROUP_GOAL_COORDINATOR_GUARD_MS = 5 * 60_000;
-function addGroupGoalCoordinatorTurn(threadId, turn) {
-    const turns = groupGoalCoordinatorTurns.get(threadId) ?? new Set();
-    turns.add(turn);
-    groupGoalCoordinatorTurns.set(threadId, turns);
-}
-function removeGroupGoalCoordinatorTurn(threadId, turn) {
-    if (turn.cleanupTimer)
-        clearTimeout(turn.cleanupTimer);
-    const turns = groupGoalCoordinatorTurns.get(threadId);
-    turns?.delete(turn);
-    if (turns?.size === 0)
-        groupGoalCoordinatorTurns.delete(threadId);
-}
-function hasUnboundDiscardedGroupGoalTurn(threadId) {
-    return [...(groupGoalCoordinatorTurns.get(threadId) ?? [])]
-        .some((turn) => turn.discard && !turn.turnId);
-}
-/** Match private coordinator output to one provider turn, never merely to a
- * reusable room thread. Most adapters emit turn.started before sendTurn
- * resolves, so the first stable event may bind an otherwise pending guard. */
-function groupGoalCoordinatorTurnForEvent(event) {
-    const turns = groupGoalCoordinatorTurns.get(event.threadId);
-    if (!turns?.size)
-        return undefined;
-    const candidates = [...turns];
-    if (event.turnId) {
-        const exact = candidates.find((turn) => turn.turnId === event.turnId);
-        if (exact)
-            return exact;
-        // Until an interrupted handshake returns its own id, no new id can be
-        // attributed safely. The stall fallback keeps this thread unavailable in
-        // that narrow window; private text is suppressed below until sendTurn's
-        // result binds the old guard or its bounded expiry releases ownership.
-        const unboundDiscarded = candidates.filter((turn) => turn.discard && !turn.turnId);
-        if (unboundDiscarded.length > 0) {
-            // The ownership fallback below keeps a lone abandoned handshake's
-            // thread closed, so its first eventual id can safely bind here. More
-            // than one unbound candidate is genuinely ambiguous and stays gated.
-            if (candidates.length === 1) {
-                unboundDiscarded[0].turnId = event.turnId;
-                // This event is the first stable identity for an already-abandoned
-                // provider turn. Tombstone it immediately so this event and every
-                // later completion/request cannot settle a replacement on the same
-                // room thread.
-                retireProviderTurn(event.turnId);
-                return unboundDiscarded[0];
-            }
-            return undefined;
-        }
-        const pending = candidates.findLast((turn) => !turn.turnId && !turn.discard);
-        if (pending && !pending.turnId) {
-            pending.turnId = event.turnId;
-            return pending;
-        }
-        return undefined;
-    }
-    // Turn-scoped events normally carry an id. If an adapter omits it, fail
-    // closed for private text; with multiple overlapping guards there is no
-    // safe way to attribute a completion, so leave cleanup to the bounded timer.
-    return candidates.length === 1 ? candidates[0] : undefined;
-}
+const personalGoals = new PersonalGoalRuntime(join(DATA_DIR, "personal-goals.json"), {
+    busy: (botId, threadId) => threadBusy(botId, threadId) || Boolean(activeGroupTurnForBot(botId)),
+    interrupt: async (botId, threadId, goalId) => {
+        const owns = [...(groupGoalCoordinatorTurns.get(threadId) ?? [])].some(guard => guard.personalGoalId === goalId && !guard.discard && (!guard.turnId || guard.turnId === liveTurnByThread.get(threadId)));
+        if (owns)
+            await interruptDirectThread(botId, threadId);
+    },
+    changed: (goal) => updatePersonalGoalReceipt(goal, store),
+    run: (goal) => runPersonalGoalTurn(goal, { store, addGuard: addGroupGoalCoordinatorTurn, removeGuard: removeGroupGoalCoordinatorTurn,
+        subscribe: (listener) => bus.subscribe(listener), ignore: shouldIgnoreProviderEvent, busy: threadBusy, start: startTurn }),
+});
+const addGroupGoalCoordinatorTurn = (threadId, turn) => addGoalGuard(groupGoalCoordinatorTurns, threadId, turn);
+const removeGroupGoalCoordinatorTurn = (threadId, turn) => removeGoalGuard(groupGoalCoordinatorTurns, threadId, turn);
+const hasUnboundDiscardedGroupGoalTurn = (threadId) => hasUnboundGoalGuard(groupGoalCoordinatorTurns, threadId);
+const groupGoalCoordinatorTurnForEvent = (event) => goalGuardForEvent(groupGoalCoordinatorTurns, retireProviderTurn, event);
 function groupIsWorking(group) {
     return Boolean(group.busyBotId) || Boolean(groupTurnOperations.get(group.id)?.size);
 }
@@ -6024,6 +5987,9 @@ function messageWindow(threadId, messageId, limit) {
     return { messages: all.slice(start, stop).map(slimMessage), hasMore: start > 0 };
 }
 const sseClients = new Set();
+// Approval device routing: docs/specs/remote-approval/spec.md.
+const deviceRoutes = new DeviceRouteRegistry();
+const removeSseClient = (client) => removeStream(sseClients, deviceRoutes, client);
 /** The frame at which a bot's audience last changed (see the SSE route). */
 let audienceChangedAt = 0;
 /** A bot's audience changed: end every member stream. Each reconnects at
@@ -6035,27 +6001,15 @@ function audienceChanged() {
     for (const client of sseClients) {
         if (client.viewer.kind !== "member")
             continue;
-        sseClients.delete(client);
-        try {
-            client.res.end();
-        }
-        catch {
-            /* already gone */
-        }
+        removeSseClient(client);
     }
 }
 function closeSessionStreams(sessionId) {
     browserLive.closeForOwner(sessionId);
-    for (const client of sseClients) {
+    for (const client of Array.from(sseClients)) {
         if (client.sessionId !== sessionId)
             continue;
-        sseClients.delete(client);
-        try {
-            client.res.end();
-        }
-        catch {
-            /* already gone */
-        }
+        removeSseClient(client);
     }
 }
 sessions.onSessionRevoked((sessionId) => {
@@ -6253,7 +6207,7 @@ function broadcast(payload, options = {}) {
         // Screen frames are replaceable and durable events are not: see
         // ./sse-fanout.ts for the backpressure/bound decision this makes.
         if (deliverSseFrame(client, kind, out) === "disconnected") {
-            sseClients.delete(client);
+            removeSseClient(client);
         }
     }
 }
@@ -8271,7 +8225,7 @@ bus.subscribe((event) => {
             if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !routines?.runForThread(event.threadId)) {
                 const broken = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
                 if (broken)
-                    reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: failedRunDetail(event.stopReason, turnError) });
+                    reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: failedRunDetail(event.stopReason, turnError), notifyChief: event.stopReason === "auth_required" });
             }
             const lastReported = turnUsage.get(event.threadId);
             turnUsage.delete(event.threadId);
@@ -8637,7 +8591,7 @@ function reportIncident(input) {
     const task = store.taskByThread(bot.id, threadId);
     // A thread another bot opened and is watching is that bot's to handle:
     // the delegator is woken with the failure already (wakeDelegationSource).
-    if (task?.openedBy?.delegationId || delegationWatch.has(threadId) || roomHandoffs.activeDirect(threadId))
+    if (!input.notifyChief && (task?.openedBy?.delegationId || delegationWatch.has(threadId) || roomHandoffs.activeDirect(threadId)))
         return;
     const group = store.groupByThread(threadId);
     const incident = {
@@ -10760,6 +10714,7 @@ async function startTurn(botId, text, opts) {
                 ? await nexusMemory.readBack({ bot: liveBot ?? bot, threadId, query: providerText })
                 : "";
             const prompt = buildSystemPrompt(persona, liveBot?.soul ?? bot.soul ?? "", roomPromptSections(roomTurn, [
+                { id: "personal-goal", label: "Active goal", text: personalGoals.goals.get(threadId)?.status === "working" ? personalGoalInstructions(personalGoals.goals.get(threadId)) : "" },
                 { id: "user-profile", label: "About the user", text: userProfileSystemPrompt(cfg.profile) },
                 // the ICM folder is on this machine; a cloud run cannot reach it
                 // first after the soul: the block names agent tools, so it only goes
@@ -16129,7 +16084,7 @@ ROUTES.push(createSetupRoutes({
         }
     },
     startOllama: async (context) => {
-        await runTool("/usr/bin/open", ["-a", "Ollama"]);
+        startOllamaApp();
         for (let attempt = 0; attempt < 30 && !context.signal.aborted; attempt++) {
             if ((await setupOllamaState()) === "running")
                 return;
@@ -19062,6 +19017,7 @@ const handleRequest = async (req, res) => {
                 admin: auth.scopes.includes("admin"),
                 screens: url.searchParams.get("screens") !== "off",
                 backpressured: false,
+                authKind: auth.kind,
                 viewer,
                 // What this person's hydration (GET /api/bots, narrowed the same way) showed them.
                 seen: viewer.kind === "all" && viewer.privateOwner ? { bots: new Set(), groups: new Set() } : {
@@ -19105,6 +19061,7 @@ const handleRequest = async (req, res) => {
                 // A client that offered no cursor gets false too, which is exactly
                 // what a cold start should do.
                 resumed,
+                approvalTarget: deviceRoutes.route(),
             })}\n\n`);
             if (resumed) {
                 for (const buffered of replayBuffer) {
@@ -19120,6 +19077,7 @@ const handleRequest = async (req, res) => {
                 }
             }
             sseClients.add(client);
+            deviceRoutes.streamOpened(client.authKind);
             // Keep this long-lived response out of socket idle-timeout handling
             // without weakening timeouts for every other API request.
             req.socket.setTimeout(0);
@@ -19139,7 +19097,7 @@ const handleRequest = async (req, res) => {
             }, SSE_HEARTBEAT_MS);
             req.on("close", () => {
                 clearInterval(keepalive);
-                sseClients.delete(client);
+                removeSseClient(client);
             });
             return;
         }
@@ -20584,11 +20542,11 @@ const handleRequest = async (req, res) => {
             });
         }
         if (method === "POST" && path === "/api/bot-defaults/skills/preview") {
-            const checked = z.object({ source: z.string().min(1).max(2000) }).strict().safeParse(await readBody(req));
+            // Drafts accept the same uploaded bytes as existing bots, without installing them.
+            const checked = skillImportSchema.safeParse(await readBody(req));
             if (!checked.success)
                 return json(res, 400, { error: checked.error.message });
-            const input = checked.data;
-            const fetched = await fetchSkillFromSource(input.source);
+            const fetched = await resolveSkillImport(checked.data);
             if ("error" in fetched)
                 return json(res, 422, { error: fetched.error });
             const skills = [];
@@ -21701,10 +21659,10 @@ const handleRequest = async (req, res) => {
         if (m && method === "POST") {
             if (!store.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
-            const parsed = z.object({ source: z.string().min(1).max(2000) }).safeParse(await readBody(req));
+            const parsed = skillImportSchema.safeParse(await readBody(req));
             if (!parsed.success)
-                return json(res, 400, { error: "source must be a GitHub URL or owner/repo" });
-            const fetched = await fetchSkillFromSource(parsed.data.source);
+                return json(res, 400, { error: "Choose a Markdown skill file or enter a GitHub source (maximum 256 KiB per file)." });
+            const fetched = await resolveSkillImport(parsed.data);
             if ("error" in fetched)
                 return json(res, 422, { error: fetched.error });
             const results = fetched.skills.map((skill) => installSkill(m[1], skill.source, skill.files));
@@ -22233,10 +22191,20 @@ const handleRequest = async (req, res) => {
                 userAgent: typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : undefined,
                 relayed: Boolean(onBehalfOf),
             }));
+            let goalCommand;
+            try {
+                goalCommand = parseGoalCommand(text);
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : "Invalid goal command" });
+            }
+            if (guarded && goalCommand)
+                return json(res, 400, { error: "Goal commands require the conversation command interface." });
             // The send is acknowledged before the turn starts, so a workspace at its
             // spend limit is refused here, where the person can see it.
             try {
-                assertWithinBudget(cfg, DATA_DIR);
+                if (!goalCommand || goalCommand.action === "start" || goalCommand.action === "resume")
+                    assertWithinBudget(cfg, DATA_DIR);
             }
             catch (error) {
                 return json(res, 409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
@@ -22305,6 +22273,12 @@ const handleRequest = async (req, res) => {
                     const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth), trigger });
                     return { ok: true, threadId, message };
                 }
+                if (goalCommand) {
+                    if (auth.kind === "assistant")
+                        throw Object.assign(new Error("Only the person controls goals."), { status: 403 });
+                    return receiveGoalCommand(personalGoals, store, bot.id, threadId, goalCommand, text, sendId, messageSender(auth), trigger);
+                }
+                personalGoals.steer(threadId);
                 // Claude can accept the message inside its live turn. If the write
                 // loses a race with turn settlement, or the engine cannot steer, the
                 // existing server-side queue records it atomically for the next turn.
@@ -23733,6 +23707,8 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && authStatus) {
             res.setHeader("cache-control", "no-store");
             const state = await providerAuthSessions.status(authStatus[1], auth.kind === "session" ? auth.session.id : "loopback", url.searchParams.get("flowId") ?? "");
+            if (state.phase === "succeeded")
+                engineRests.clear(authStatus[1], "signed-in");
             return json(res, 200, { auth: state });
         }
         const instanceAction = /^\/api\/instances\/([\w.-]+)\/(refresh-models|install|auth\/start|auth\/complete|auth\/cancel|auth\/sign-out)$/.exec(path);
@@ -23774,6 +23750,8 @@ const handleRequest = async (req, res) => {
                         providerAuthSessions.revokeOwner(owner);
                         return json(res, 401, { error: "Your session ended. Start a new sign-in." });
                     }
+                    if (started.phase === "succeeded")
+                        engineRests.clear(instanceId, "signed-in");
                     return json(res, 200, { auth: started });
                 }
                 if (action === "auth/sign-out") {
@@ -23791,6 +23769,8 @@ const handleRequest = async (req, res) => {
                     if (!flowId || !callbackUrl)
                         return json(res, 400, { error: "flowId and a code or callbackUrl are required" });
                     await providerAuthSessions.complete(instanceId, owner, flowId, callbackUrl);
+                    engineRests.clear(instanceId, "signed-in");
+                    await describeEngines();
                     return json(res, 200, { ok: true });
                 }
                 const body = await readBody(req, 4096);

package/dist-server/server/personal-goal-runtime.js

@@ -0,0 +1,86 @@
+import { GOAL_HELP } from "../shared/personal-goal.js";
+import { PersonalGoals } from "./personal-goals.js";
+/** Serial continuation per goal; every provider turn still passes normal admission. */
+export class PersonalGoalRuntime {
+    goals;
+    running = new Set();
+    scheduled = new Map();
+    host;
+    constructor(path, host) {
+        this.host = host;
+        this.goals = new PersonalGoals(path, (goal) => host.changed(goal));
+    }
+    async command(botId, threadId, command, trigger) {
+        if (command.action === "help")
+            return GOAL_HELP;
+        if (this.goals.loadError)
+            return this.goals.loadError;
+        let goal = this.goals.get(threadId);
+        if (command.action === "status")
+            return goal ? this.describe(goal) : "This conversation has no goal. " + GOAL_HELP;
+        if (command.action === "start" || command.action === "resume") {
+            if (this.host.busy(botId, threadId) || (goal && this.running.has(goal.id)))
+                throw new Error("This conversation is still working. Wait for its turn to settle.");
+            goal = command.action === "start" ? this.goals.start(botId, threadId, { ...command, ...(trigger?.kind === "user" || trigger?.kind === "owner" ? { trigger } : {}) }) : this.goals.resume(threadId, command);
+            // Persist the human command before provider setup reads the conversation.
+            this.running.add(goal.id);
+            this.scheduled.set(goal.id, setImmediate(() => { this.scheduled.delete(goal.id); void this.run(goal); }));
+        }
+        else {
+            goal = this.goals.control(threadId, command.action);
+            const pending = this.scheduled.get(goal.id);
+            if (pending) {
+                clearImmediate(pending);
+                this.scheduled.delete(goal.id);
+                this.running.delete(goal.id);
+            }
+            if (this.running.has(goal.id))
+                await this.host.interrupt(botId, threadId, goal.id);
+        }
+        return this.describe(goal);
+    }
+    describe(goal) {
+        return `${goal.status}: ${goal.objective}\n${goal.detail}\nTurns: ${goal.turnCount}/${goal.maxTurns}. Tokens: ${goal.tokensUsed}${goal.tokenBudget === undefined ? "" : `/${goal.tokenBudget}`}.`;
+    }
+    steer(threadId) {
+        const goal = this.goals.get(threadId);
+        if (goal?.status === "working") {
+            goal.status = "paused";
+            goal.detail = "You sent a message. Use /goal resume when ready to continue.";
+            this.goals.touch(goal);
+        }
+    }
+    async run(goal) {
+        this.running.add(goal.id);
+        try {
+            while (this.goals.begin(goal.id)) {
+                const result = await this.host.run(goal);
+                this.goals.settle(goal.id, result);
+                // Give queued human input priority before reserving another turn.
+                await new Promise((resolve) => setTimeout(resolve, 0));
+            }
+        }
+        catch {
+            if (goal.status === "working") {
+                goal.status = "paused";
+                goal.detail = "The next turn could not start. Check the conversation and use /goal resume.";
+                this.goals.touch(goal);
+            }
+        }
+        finally {
+            this.running.delete(goal.id);
+        }
+    }
+}
+export async function receiveGoalCommand(runtime, store, botId, threadId, command, text, sendId, sender, trigger) {
+    let result;
+    try {
+        result = await runtime.command(botId, threadId, command, trigger);
+    }
+    catch (error) {
+        throw Object.assign(error instanceof Error ? error : new Error(String(error)), { status: 409 });
+    }
+    const message = store.appendMessage(threadId, { role: "user", kind: "text", text, sendId, sender });
+    store.appendMessage(threadId, { role: "bot", kind: "text", text: result });
+    return { ok: true, threadId, message, goalSummary: result };
+}

package/dist-server/server/personal-goal-turn.js

@@ -0,0 +1,125 @@
+export function updatePersonalGoalReceipt(goal, store) {
+    if (!store.taskByThread(goal.botId, goal.threadId))
+        return;
+    const goalRun = { runId: goal.id, goal: goal.objective, status: goal.status,
+        coordinatorBotId: goal.botId, coordinatorName: store.bot(goal.botId)?.name ?? "Bot",
+        turnCount: goal.turnCount, maxTurns: goal.maxTurns, detail: `${goal.detail} Tokens: ${goal.tokensUsed}${goal.tokenBudget === undefined ? "" : `/${goal.tokenBudget}`}.`, startedAt: goal.createdAt };
+    if (goal.receiptMessageId)
+        store.patchMessage(goal.threadId, goal.receiptMessageId, { goalRun });
+    else
+        goal.receiptMessageId = store.appendMessage(goal.threadId, { role: "bot", kind: "goal.run", goalRun }).id;
+}
+export async function runPersonalGoalTurn(goal, host) {
+    const guard = { token: Symbol("personal-goal"), personalGoalId: goal.id, assistantItems: [], discard: false };
+    let ok = false, tools = 0, measured = false, completed = false;
+    let tokens;
+    const before = host.store.taskByThread(goal.botId, goal.threadId)?.usage;
+    const beforeTokens = (before?.input ?? 0) + (before?.output ?? 0);
+    host.addGuard(goal.threadId, guard);
+    const unsub = host.subscribe((event) => {
+        if (event.threadId !== goal.threadId || host.ignore(event))
+            return;
+        if (guard.turnId && event.turnId && guard.turnId !== event.turnId)
+            return;
+        if (event.type === "item.completed" && event.itemType === "tool")
+            tools++;
+        if (event.type === "thread.token-usage.updated")
+            measured = true;
+        if (event.type === "turn.completed") {
+            completed = true;
+            ok = event.ok;
+            measured ||= event.usage !== undefined;
+            const usage = host.store.taskByThread(goal.botId, goal.threadId)?.usage;
+            if (measured)
+                tokens = Math.max(0, (usage?.input ?? 0) + (usage?.output ?? 0) - beforeTokens);
+        }
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            void host.start(goal.botId, goal.turnCount === 1 ? goal.objective : "Continue the active goal.", {
+                threadId: goal.threadId, cardContinuation: true, trigger: goal.trigger,
+                onTurnSettled: () => setImmediate(resolve), onDispatchError: reject,
+            }).catch(reject);
+        });
+        // The terminal event precedes digest/screen resource release. Never overlap those claims.
+        const deadline = Date.now() + 30_000;
+        while (host.busy(goal.botId, goal.threadId) && Date.now() < deadline)
+            await new Promise(resolve => setTimeout(resolve, 25));
+        if (host.busy(goal.botId, goal.threadId))
+            throw new Error("Turn is still settling");
+        return { ok, text: guard.assistantItems.join("\n"), tools, tokens };
+    }
+    finally {
+        unsub();
+        // Before a provider id exists, direct-turn admission owns late setup events.
+        // Keeping an unbound guard here would swallow an unrelated later turn.
+        if (completed || !guard.turnId)
+            host.removeGuard(goal.threadId, guard);
+        else {
+            guard.discard = true;
+            guard.cleanupTimer = setTimeout(() => host.removeGuard(goal.threadId, guard), 5 * 60_000);
+            guard.cleanupTimer.unref();
+        }
+    }
+}
+export function addGoalGuard(groupGoalCoordinatorTurns, threadId, turn) {
+    const turns = groupGoalCoordinatorTurns.get(threadId) ?? new Set();
+    turns.add(turn);
+    groupGoalCoordinatorTurns.set(threadId, turns);
+}
+export function removeGoalGuard(groupGoalCoordinatorTurns, threadId, turn) {
+    if (turn.cleanupTimer)
+        clearTimeout(turn.cleanupTimer);
+    const turns = groupGoalCoordinatorTurns.get(threadId);
+    turns?.delete(turn);
+    if (turns?.size === 0)
+        groupGoalCoordinatorTurns.delete(threadId);
+}
+export function hasUnboundGoalGuard(groupGoalCoordinatorTurns, threadId) {
+    return [...(groupGoalCoordinatorTurns.get(threadId) ?? [])]
+        .some((turn) => turn.discard && !turn.turnId);
+}
+/** Match private coordinator output to one provider turn, never merely to a
+ * reusable room thread. Most adapters emit turn.started before sendTurn
+ * resolves, so the first stable event may bind an otherwise pending guard. */
+export function goalGuardForEvent(groupGoalCoordinatorTurns, retireProviderTurn, event) {
+    const turns = groupGoalCoordinatorTurns.get(event.threadId);
+    if (!turns?.size)
+        return undefined;
+    const candidates = [...turns];
+    if (event.turnId) {
+        const exact = candidates.find((turn) => turn.turnId === event.turnId);
+        if (exact)
+            return exact;
+        // Until an interrupted handshake returns its own id, no new id can be
+        // attributed safely. The stall fallback keeps this thread unavailable in
+        // that narrow window; private text is suppressed below until sendTurn's
+        // result binds the old guard or its bounded expiry releases ownership.
+        const unboundDiscarded = candidates.filter((turn) => turn.discard && !turn.turnId);
+        if (unboundDiscarded.length > 0) {
+            // The ownership fallback below keeps a lone abandoned handshake's
+            // thread closed, so its first eventual id can safely bind here. More
+            // than one unbound candidate is genuinely ambiguous and stays gated.
+            if (candidates.length === 1) {
+                unboundDiscarded[0].turnId = event.turnId;
+                // This event is the first stable identity for an already-abandoned
+                // provider turn. Tombstone it immediately so this event and every
+                // later completion/request cannot settle a replacement on the same
+                // room thread.
+                retireProviderTurn(event.turnId);
+                return unboundDiscarded[0];
+            }
+            return undefined;
+        }
+        const pending = candidates.findLast((turn) => !turn.turnId && !turn.discard);
+        if (pending && !pending.turnId) {
+            pending.turnId = event.turnId;
+            return pending;
+        }
+        return undefined;
+    }
+    // Turn-scoped events normally carry an id. If an adapter omits it, fail
+    // closed for private text; with multiple overlapping guards there is no
+    // safe way to attribute a completion, so leave cleanup to the bounded timer.
+    return candidates.length === 1 ? candidates[0] : undefined;
+}