@chibitek/chibi 0.1.155 → 0.1.158

package/dist-server/server/index.js

@@ -1,3 +1,7 @@
+import { hasUnboundGoalGuard, goalGuardForEvent, addGoalGuard, removeGoalGuard, runPersonalGoalTurn, updatePersonalGoalReceipt } from "./personal-goal-turn.js";
+import { PersonalGoalRuntime, receiveGoalCommand } from "./personal-goal-runtime.js";
+import { personalGoalInstructions } from "./personal-goals.js";
+import { parseGoalCommand } from "../shared/personal-goal.js";
 // OpenMausBot server — the harness host. Clients hold no transports
 // (upstream rule): the React app dispatches typed commands over HTTP and
 // folds one SSE event stream; every provider process runs here.
@@ -64,7 +68,7 @@ import { turnTimingFinish, turnTimingMark, turnTimingStart } from "./turn-timing
 import { ATOMIC_TEAM_PACKAGE_ID, BUILTIN_CHIBI_REFUSALS, builtinChibiPatchRefusal } from "./builtin-chibi.js";
 import { canAccessTeam, canContactTeamOf, canManagePeer, canReachPeer, canReachTeam, coordinatorSupervises, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, reachesEveryTeam, roomBoundaryHolds, teamStatusPrompt, PEER_ROSTER_MAX, resolveTeammate, roomPeerRosterSystemPrompt, rosterAbout, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
-import { containerComputerAction, managedImageNeedsUpgrade, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, recentContainerComputerStatus, containerRuntimeStatus, ensureContainerRuntime, localVmRecreatableOnDemand, localVmReplaceableWhenStopped, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
+import { containerComputerAction, managedImageNeedsUpgrade, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, recentContainerComputerStatus, containerRuntimeStatus, ensureContainerRuntime, containerRuntimeError, localVmRecreatableOnDemand, localVmReplaceableWhenStopped, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
 import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmAutoStartRuntime, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, userMcpEnabledFor, addonEnabled, skillAuthoringEnabled, sharedComputersEnabled, teamRoomsEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, onDeviceHelpersEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, accountBotGrantPolicy, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { GodModeSwitch } from "./god-mode.js";
@@ -143,7 +147,7 @@ import { MEMORY_INDEX, MemoryStoreError, memoryCapacity, memoryOverview, openFol
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, flushMemoryJournal, journalMemoryDelete, journalMemoryWrite, readMemoryJournal, revertMemoryChange, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
 import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installSkill, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
-import { fetchSkillFromSource } from "./skill-fetch.js";
+import { resolveSkillImport, skillImportSchema } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
@@ -235,6 +239,7 @@ import { activityCsv, activityEntries, appendAdminAction, botAuditSnapshot, botC
 import { frameForMember, memberBody, memberBot, noteSeen, notFoundFor, audienceEquals, memberGroup, narrowestAudience, parseVisibility, pathSubject, roomFeeds, routineVisible, sameAudience, SEES_EVERYTHING, SEES_ALL_BUT_PRIVATE, VisibleSet, } from "./bot-visibility.js";
 import { describeBrand, loadBrand } from "./brand.js";
 import { deliverSseFrame } from "./sse-fanout.js";
+import { DeviceRouteRegistry, removeStream } from "./device-routing.js";
 import { PHONE_SECRET_PROTOCOL_VERSION, PhoneSecretBridge, PhoneSecretError, PhoneSecretSubmissionRegistry, assertPhoneSecretRequestMatches, phoneSecretOperationId, } from "./phone-secret.js";
 // Keep these two last: a route module may import any server module, and
 // loading the table after everything above leaves module start-up order as is.
@@ -248,7 +253,7 @@ import { createModelLevelsRoutes } from "./routes/model-levels.js";
 import { createMcpMarketplaceRoutes } from "./routes/mcp-marketplace.js";
 import { createLocalModelRoutes, OLLAMA_LOCAL_URL, ollamaInstalledHere } from "./routes/local-models.js";
 import { createSetupRoutes } from "./routes/setup.js";
-import { installOllamaApp, openPodmanInstaller, runTool, startPodmanMachine } from "./app-installers.js";
+import { installOllamaApp, openPodmanInstaller, startOllamaApp, runTool, startPodmanMachine } from "./app-installers.js";
 import { CliLoginRunner } from "./cli-login.js";
 import { JobFailure, SetupJobs } from "./setup-jobs.js";
 import { localHost, probeLocalInjects } from "./drivers/local-inject.js";
@@ -258,6 +263,7 @@ import { createProviderAccountRoutes } from "./routes/provider-accounts.js";
 import { accountStops, injectedModel, restScope } from "./injected-model-rest.js";
 import { accountProvider } from "../shared/provider-accounts.js";
 import { createAccountRoutes } from "./routes/accounts.js";
+import { installNativeVault } from "./vault/runtime.js";
 import { OAuthAccounts, takeOAuthClients } from "./oauth-accounts.js";
 import { DesktopAccountVault, FileAccountVault, UnavailableAccountVault, takeAccountsFromEnvironment } from "./oauth-account-vault.js";
 import { accountConnectorNames } from "./claude-account-connectors.js";
@@ -299,6 +305,7 @@ import { createBoardRoutes } from "./routes/board.js";
 import { readBoardFromNexus } from "./board/nexus-board.js";
 import { LocalModelInventory, localModePlacement, machineMemory } from "./local-models-mode.js";
 import { FailoverGate, MAX_ENGINES_PER_TURN, continuationNote, restingLine } from "./engine-failover.js";
+import { enterSessionFallback, onSessionFallback, ownOrFallback, sessionFallbackSpentLine, withoutSubscription } from "./session-fallback.js";
 import { TURN_ERROR_CATEGORIES } from "../shared/runtime-events.js";
 import { EngineProbes, PROBE_PROMPT, isProbeThread, probeThreadId } from "./engine-probe.js";
 // [jev-verifier] opt-in Jev answer checks after a model switch (server/jev).
@@ -1149,9 +1156,14 @@ if (!hostedModels) {
 // its add-on's capability, so it loads only while the add-on applies.
 const bundledSkills = [...loadBundledSkills(), ...loadAddonSkillLibraries()];
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
+// Electron's utility-process parent port is private to the desktop main
+// process. It carries desktop-only messages (approval and browser control,
+// phone secrets, the account vault) without putting them in the renderer.
+// Plain Node/dev launches have no parentPort.
 // SAFETY: Electron's utility-process runtime is the only environment that
 // supplies parentPort; plain Node intentionally leaves it absent.
 const utilityParentPort = process.parentPort;
+installNativeVault(DATA_DIR, utilityParentPort, () => desktopMutationToken, req => authorizedInternalCapability(req.headers.authorization) !== null);
 function postDesktopPrivateMessage(message) {
     if (!utilityParentPort)
         return false;
@@ -1820,6 +1832,7 @@ function requestedTaskBot(botId, rawThreadId) {
     return task;
 }
 async function interruptDirectThread(botId, threadId) {
+    personalGoals.steer(threadId);
     const requestOwner = directRequestOwners.get(threadId);
     if (requestOwner) {
         requestOwner.stopped = true;
@@ -3039,12 +3052,19 @@ function turnEngineChoice(botId, threadId, needs, runOn) {
     if (hostedModels || !profile || !task)
         return undefined;
     if (isSubscriptionBot(profile))
-        return subscriptionTurnEngineChoice(profile, threadId);
+        return ownOrFallback(threadId, () => subscriptionTurnEngineChoice(profile, threadId), () => sessionFallbackChoice(profile, threadId, needs, runOn), (stop) => stop instanceof SubscriptionStop, (stop) => new SubscriptionStop(sessionFallbackSpentLine(stop.message)));
     if (isPersonalBot(profile))
         return personalTurnEngineChoice(profile, threadId, needs, runOn);
     const projected = store.projectBotForTask(botId, threadId);
     return projected ? ladderTurnEngineChoice(profile, projected, threadId, needs, runOn) : undefined;
 }
+/** A company subscription bot's conversation on another provider's subscription, same class (server/session-fallback.ts). */
+function sessionFallbackChoice(profile, threadId, needs, runOn) {
+    const projected = store.projectBotForTask(profile.id, threadId);
+    const choice = isPersonalBot(profile) || !projected ? undefined
+        : ladderTurnEngineChoice(withoutSubscription(profile), withoutSubscription(projected), threadId, needs, runOn, true);
+    return choice && choice.selection.instanceId !== projected.modelSelection.instanceId ? { selection: choice.selection, persist: false } : undefined;
+}
 /** A room member's engine at turn start, by turnEngineChoice's rules for
  * the bot's own default (a room turn has no task of its own, so the bot's
  * engine mode decides): resting and signed-out engines passed over, a
@@ -3060,7 +3080,7 @@ function roomTurnEngineChoice(bot, threadId) {
         : ladderTurnEngineChoice(bot, projected, threadId);
     return choice && { selection: choice.selection, persist: false };
 }
-function ladderTurnEngineChoice(profile, projected, threadId, needs, runOn) {
+function ladderTurnEngineChoice(profile, projected, threadId, needs, runOn, subscriptionsOnly = false) {
     const candidates = engineSnapshots.current();
     if (!candidates)
         return undefined;
@@ -3069,7 +3089,7 @@ function ladderTurnEngineChoice(profile, projected, threadId, needs, runOn) {
     const { ladder } = plan;
     const computer = turnComputer(projected, threadId, runOn);
     const context = { candidates, needsDelegation: needsDelegation(tier, profile), computer, refuse: engineTierRefusal(projected), resting: engineResting,
-        keyBandPaused: payPerUse.pausedUntil() !== undefined };
+        keyBandPaused: subscriptionsOnly || payPerUse.pausedUntil() !== undefined };
     const local = (resolution) => localModeTurn(resolution, { tier, context, needs, prefer: [projected.modelSelection.instanceId] });
     const wider = (tried, modelClass) => resolveFailover({
         ladder, classLadder: (cls) => classLadder(classedModels(), cls), failed: projected.modelSelection, context, tried,
@@ -3350,7 +3370,7 @@ function localModeTurn(resolution, turn) {
     return { ...resolution, local: true, choice: { ...choice, selection: placement.selection, candidate: placement.candidate } };
 }
 const payPerUsePausedLine = (until) => `Pay-per-use is paused until ${restTime(until)}, when a subscription is back, so this turn stopped.`;
-/** A model this machine serves: never a stand-in for Engineering and above. */
+/** A model this machine serves: a rung when a ladder names it, else local rules only. */
 const isLocalModel = (candidate, model) => localModel(candidate, model) || modelLevels.classOf(candidate.driverKind, model)?.local === true;
 // ── silent automatic failover (docs/chibitek/engine-tiers.md, step 2) ────
 // Resting engines are shared by every bot and survive a restart.
@@ -3589,10 +3609,7 @@ const eventBase = (event) => ({
     ...(event.providerInstanceId ? { providerInstanceId: event.providerInstanceId } : {}), ...(event.turnId ? { turnId: event.turnId } : {}),
 });
 const restTime = (at) => new Date(at).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
-/** A watched turn ended failed because its engine ran out or was signed
- * out. Rest the engine, then run the same turn on the next engine at the
- * same level, silently; or, when nothing is left, stop it with one line
- * naming the resting engines. Returns what subscribers see. */
+/** Rest a refused engine and continue on an eligible engine, or show an actionable line. */
 function engineFailover(turn, completion) {
     const failure = turn.failure;
     const record = failoverTurns.get(turn.threadId);
@@ -3615,17 +3632,14 @@ function engineFailover(turn, completion) {
     const restFailed = () => engineRests.rest(turn.instanceId, failedCandidate ? engineAccount(failedCandidate) : undefined, failure.kind, { resetAt: failure.resetAt, resetText: failure.resetText, windowMs: failure.windowMs, message: redactSecretsInText(failure.message),
         ...(failure.permanent ? { permanent: true } : {}), ...(scope ? { scope } : {}), ...(ran?.model ? { model: ran.model } : {}),
         ...(failure.kind === "auth_failed" && failedCandidate ? { reportedSignedIn: failedCandidate.snapshot.state === "available" && failedCandidate.snapshot.authenticated === true } : {}) });
-    // An unrecognised failure (provider_error) is only a reason to try the
-    // next engine: the engine rests (the circuit breaker) only once the turn
-    // really moves, and with nowhere to go the turn ends with the engine's own
-    // report, exactly as before, rather than a "resting" line about it.
+    // Unknown failures rest only when the turn moves; otherwise preserve their report.
     const rest = failure.kind === "provider_error" ? undefined : restFailed();
     const label = (instanceId) => candidates.find((candidate) => candidate.instanceId === instanceId)?.displayName ?? instanceId;
     // The one plain line, never the provider's own words: which account needs
     // the person and where to fix it, or that every engine is resting.
     const stop = (line, category = "failover_exhausted") => [
         { ...eventBase(completion), type: "runtime.error", message: line, terminal: true, category, ...(failure.setup ? { setup: true } : {}) },
-        completion,
+        failure.kind === "auth_failed" ? { ...completion, stopReason: "auth_required" } : completion,
     ];
     const restingNamed = (instanceIds) => [...new Set(instanceIds)].flatMap((instanceId) => {
         const candidate = candidates.find((entry) => entry.instanceId === instanceId);
@@ -3648,13 +3662,11 @@ function engineFailover(turn, completion) {
         return stop(pick.line, pick.category);
     const { choice } = pick;
     const tried = new Set(record.tried);
-    // Move the turn. The attempt that failed is retired quietly afterwards: no
-    // chip, no notification, no incident, and nothing settled that the same
-    // turn still owns.
+    // Retire the failed attempt without settling the request that the next engine owns.
     const moved = ran ?? record.selection;
     const failedOwner = turnResourceOwners.get(turn.threadId);
     const tokens = completion.usage ?? turnUsage.get(turn.threadId);
-    const partialText = turn.partial.trim();
+    const partialText = groupGoalCoordinatorTurns.get(turn.threadId)?.size ? parseGroupGoalDecision(turn.partial).visibleText : turn.partial.trim();
     const requestOwner = directRequestOwners.get(turn.threadId);
     if (partialText) {
         // The answer it was in the middle of stays: the person saw it stream.
@@ -3666,6 +3678,12 @@ function engineFailover(turn, completion) {
     const tools = earlier.filter((message) => message.kind === "activity" && message.tool?.name).map((message) => message.tool.name);
     const note = continuationNote(said.map((message) => message.text ?? ""), tools);
     const attempt = record.attempt + 1;
+    for (const guard of groupGoalCoordinatorTurns.get(turn.threadId) ?? []) {
+        if (!guard.discard && (guard.turnId === completion.turnId || guard.turnId === turn.turnId)) {
+            guard.turnId = undefined;
+            guard.assistantItems = [];
+        }
+    }
     const rerun = startTurn(turn.botId, note ? `${record.text}\n\n${note}` : record.text, {
         ...record.opts,
         threadId: turn.threadId,
@@ -3703,6 +3721,11 @@ function engineFailover(turn, completion) {
         });
     }
     retireFailedAttempt(turn.botId, turn.threadId, turn.generation, failedOwner, completion);
+    if (failure.kind === "auth_failed")
+        reportIncident({
+            kind: "engine-fallback", bot: profile, threadId: turn.threadId, notifyChief: true,
+            detail: `${engineLabel(candidates, moved)} needs signing in again in Settings > Engines; the turn continued on ${engineLabel(candidates, choice.selection)}`,
+        });
     console.error(`[omb-failover] thread=${turn.threadId} ${failure.kind}: ${moved.instanceId} -> ${choice.selection.instanceId} (attempt ${attempt})`);
     // No turnId: the failed provider turn is retired, and its id would hide
     // this record from every window.
@@ -3803,14 +3826,19 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
     const computer = projected ? turnComputer(projected, turn.threadId, attempt.runOn) : undefined;
     // A subscription bot fails over only to another account of its own
     // provider on its side of the personal line; with none left it stops with
-    // its one line (and the client offers Chibi). Never another provider.
+    // its one line, or a company bot's own conversation takes its session fallback (server/session-fallback.ts).
     const subscriptionMove = isSubscriptionBot(profile)
         ? tried.size >= MAX_ENGINES_PER_TURN || !projected
             ? { line: subscriptionLine(profile, candidates) }
             : subscriptionPlacement({ profile, projected, candidates, tried: new Set([...tried, turn.instanceId]), auto: attempt.persist, modelClass: neededClass })
         : undefined;
-    if (subscriptionMove && !subscriptionMove.choice)
+    const fallback = subscriptionMove && !subscriptionMove.choice && projected && !isPersonalBot(profile) && tried.size < MAX_ENGINES_PER_TURN && store.taskByThread(profile.id, turn.threadId);
+    if (fallback && !enterSessionFallback(turn.threadId, false))
+        return { line: sessionFallbackSpentLine(subscriptionMove.line) };
+    if (subscriptionMove && !subscriptionMove.choice && !fallback)
         return { line: subscriptionMove.line };
+    if (fallback)
+        [profile, projected] = [withoutSubscription(profile), withoutSubscription(projected)];
     const personalTurn = isPersonalBot(profile) && !subscriptionMove;
     // The Private Bot prefers personal engines and opted-in local compute,
     // then company compute. startTurn rechecks company cost on every attempt.
@@ -3830,7 +3858,7 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
         classLadder: (modelClass) => classLadder(classedModels(), modelClass),
         failed: attempt.selection,
         context: { candidates, needsDelegation: needsDelegation(tier, profile), computer, refuse: engineTierRefusal(projected), resting: engineResting,
-            keyBandPaused: keyBandPausedFor(turn.threadId) },
+            keyBandPaused: Boolean(fallback) || keyBandPausedFor(turn.threadId) },
         tried,
         modelClass: neededClass,
         mayDrop: true,
@@ -3846,6 +3874,8 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
             context: { candidates, needsDelegation: needsDelegation(tier, profile), computer, refuse: engineTierRefusal(projected), resting: engineResting } })
             : { ...resolution, local: false };
     const choice = placed.choice && placed.local ? { ...placed.choice, modelClass: "Añejo" } : placed.choice;
+    if (!choice && fallback)
+        return { line: subscriptionMove.line };
     if (!choice && turn.failure?.kind === "provider_error")
         return { passthrough: true };
     if (!choice) {
@@ -3855,11 +3885,11 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
         const resting = resolution.skipped.filter((skip) => skip.reason === "resting" || skip.reason === "tried").map((skip) => skip.instanceId);
         const named = restingNamed([turn.instanceId, ...attempt.tried, ...resting]);
         return {
-            line: restingLine(named, restTime, cannotDriveNamed(candidates, resolution.skipped.map((skip) => skip.instanceId), computer)),
+            line: restingLine(named, restTime, cannotDriveNamed(candidates, resolution.skipped.map((skip) => skip.instanceId), computer), { capped: tried.size >= MAX_ENGINES_PER_TURN }),
             category: named.some((engine) => engine.needsSignIn || engine.keyExpired) ? "account" : "failover_exhausted",
         };
     }
-    if (subscriptionMove) { /* subscriptions only: no pay-per-use episode */ }
+    if (subscriptionMove || fallback) { /* subscriptions only: no pay-per-use episode */ }
     else if (personalMove)
         notePersonalPayPerUse(personalMove);
     else
@@ -5013,67 +5043,21 @@ const publicBotQueuedMessages = () => queuedSteerSnapshot((botId, threadId) => B
 const groupTurnOperations = new Map();
 const groupGoalCoordinatorTurns = new Map();
 const GROUP_GOAL_COORDINATOR_GUARD_MS = 5 * 60_000;
-function addGroupGoalCoordinatorTurn(threadId, turn) {
-    const turns = groupGoalCoordinatorTurns.get(threadId) ?? new Set();
-    turns.add(turn);
-    groupGoalCoordinatorTurns.set(threadId, turns);
-}
-function removeGroupGoalCoordinatorTurn(threadId, turn) {
-    if (turn.cleanupTimer)
-        clearTimeout(turn.cleanupTimer);
-    const turns = groupGoalCoordinatorTurns.get(threadId);
-    turns?.delete(turn);
-    if (turns?.size === 0)
-        groupGoalCoordinatorTurns.delete(threadId);
-}
-function hasUnboundDiscardedGroupGoalTurn(threadId) {
-    return [...(groupGoalCoordinatorTurns.get(threadId) ?? [])]
-        .some((turn) => turn.discard && !turn.turnId);
-}
-/** Match private coordinator output to one provider turn, never merely to a
- * reusable room thread. Most adapters emit turn.started before sendTurn
- * resolves, so the first stable event may bind an otherwise pending guard. */
-function groupGoalCoordinatorTurnForEvent(event) {
-    const turns = groupGoalCoordinatorTurns.get(event.threadId);
-    if (!turns?.size)
-        return undefined;
-    const candidates = [...turns];
-    if (event.turnId) {
-        const exact = candidates.find((turn) => turn.turnId === event.turnId);
-        if (exact)
-            return exact;
-        // Until an interrupted handshake returns its own id, no new id can be
-        // attributed safely. The stall fallback keeps this thread unavailable in
-        // that narrow window; private text is suppressed below until sendTurn's
-        // result binds the old guard or its bounded expiry releases ownership.
-        const unboundDiscarded = candidates.filter((turn) => turn.discard && !turn.turnId);
-        if (unboundDiscarded.length > 0) {
-            // The ownership fallback below keeps a lone abandoned handshake's
-            // thread closed, so its first eventual id can safely bind here. More
-            // than one unbound candidate is genuinely ambiguous and stays gated.
-            if (candidates.length === 1) {
-                unboundDiscarded[0].turnId = event.turnId;
-                // This event is the first stable identity for an already-abandoned
-                // provider turn. Tombstone it immediately so this event and every
-                // later completion/request cannot settle a replacement on the same
-                // room thread.
-                retireProviderTurn(event.turnId);
-                return unboundDiscarded[0];
-            }
-            return undefined;
-        }
-        const pending = candidates.findLast((turn) => !turn.turnId && !turn.discard);
-        if (pending && !pending.turnId) {
-            pending.turnId = event.turnId;
-            return pending;
-        }
-        return undefined;
-    }
-    // Turn-scoped events normally carry an id. If an adapter omits it, fail
-    // closed for private text; with multiple overlapping guards there is no
-    // safe way to attribute a completion, so leave cleanup to the bounded timer.
-    return candidates.length === 1 ? candidates[0] : undefined;
-}
+const personalGoals = new PersonalGoalRuntime(join(DATA_DIR, "personal-goals.json"), {
+    busy: (botId, threadId) => threadBusy(botId, threadId) || Boolean(activeGroupTurnForBot(botId)),
+    interrupt: async (botId, threadId, goalId) => {
+        const owns = [...(groupGoalCoordinatorTurns.get(threadId) ?? [])].some(guard => guard.personalGoalId === goalId && !guard.discard && (!guard.turnId || guard.turnId === liveTurnByThread.get(threadId)));
+        if (owns)
+            await interruptDirectThread(botId, threadId);
+    },
+    changed: (goal) => updatePersonalGoalReceipt(goal, store),
+    run: (goal) => runPersonalGoalTurn(goal, { store, addGuard: addGroupGoalCoordinatorTurn, removeGuard: removeGroupGoalCoordinatorTurn,
+        subscribe: (listener) => bus.subscribe(listener), ignore: shouldIgnoreProviderEvent, busy: threadBusy, start: startTurn }),
+});
+const addGroupGoalCoordinatorTurn = (threadId, turn) => addGoalGuard(groupGoalCoordinatorTurns, threadId, turn);
+const removeGroupGoalCoordinatorTurn = (threadId, turn) => removeGoalGuard(groupGoalCoordinatorTurns, threadId, turn);
+const hasUnboundDiscardedGroupGoalTurn = (threadId) => hasUnboundGoalGuard(groupGoalCoordinatorTurns, threadId);
+const groupGoalCoordinatorTurnForEvent = (event) => goalGuardForEvent(groupGoalCoordinatorTurns, retireProviderTurn, event);
 function groupIsWorking(group) {
     return Boolean(group.busyBotId) || Boolean(groupTurnOperations.get(group.id)?.size);
 }
@@ -6024,6 +6008,9 @@ function messageWindow(threadId, messageId, limit) {
     return { messages: all.slice(start, stop).map(slimMessage), hasMore: start > 0 };
 }
 const sseClients = new Set();
+// Approval device routing: docs/specs/remote-approval/spec.md.
+const deviceRoutes = new DeviceRouteRegistry();
+const removeSseClient = (client) => removeStream(sseClients, deviceRoutes, client);
 /** The frame at which a bot's audience last changed (see the SSE route). */
 let audienceChangedAt = 0;
 /** A bot's audience changed: end every member stream. Each reconnects at
@@ -6035,27 +6022,15 @@ function audienceChanged() {
     for (const client of sseClients) {
         if (client.viewer.kind !== "member")
             continue;
-        sseClients.delete(client);
-        try {
-            client.res.end();
-        }
-        catch {
-            /* already gone */
-        }
+        removeSseClient(client);
     }
 }
 function closeSessionStreams(sessionId) {
     browserLive.closeForOwner(sessionId);
-    for (const client of sseClients) {
+    for (const client of Array.from(sseClients)) {
         if (client.sessionId !== sessionId)
             continue;
-        sseClients.delete(client);
-        try {
-            client.res.end();
-        }
-        catch {
-            /* already gone */
-        }
+        removeSseClient(client);
     }
 }
 sessions.onSessionRevoked((sessionId) => {
@@ -6253,7 +6228,7 @@ function broadcast(payload, options = {}) {
         // Screen frames are replaceable and durable events are not: see
         // ./sse-fanout.ts for the backpressure/bound decision this makes.
         if (deliverSseFrame(client, kind, out) === "disconnected") {
-            sseClients.delete(client);
+            removeSseClient(client);
         }
     }
 }
@@ -7019,15 +6994,15 @@ function localVmSetUp() {
 }
 /** The one gate for starting the container engine (App Settings →
  * Computers): the person's switch, the organisation's policy, and a Local VM
- * actually set up here. Returns what it started ("Colima", "Docker
- * Desktop") once the engine answers, or null. */
+ * actually set up here. Returns what it started (Colima, the only engine
+ * Atomic starts; never Docker Desktop) once it answers, or null. */
 async function startLocalVmRuntime() {
     if (!localVmAutoStartRuntime(cfg) || !managedPolicy.computerAllowed("localVm") || !localVmSetUp())
         return null;
     try {
-        const { status, started } = await ensureContainerRuntime();
-        if (started)
-            console.log(`[local-vm] started ${started}: ${status.daemonUp ? "ready" : "still not answering"}`);
+        const { status, started, error } = await ensureContainerRuntime();
+        if (started || error)
+            console[error ? "error" : "log"](`[local-vm] ${started ? `started ${started}: ${status.daemonUp ? "ready" : "still not answering"}` : "not started"}${error ? `. ${error}` : ""}`);
         return started && status.daemonUp ? started : null;
     }
     catch (error) {
@@ -7539,7 +7514,7 @@ async function unusableAutoPin(bot, threadId, plan, runOn) {
     if (pinned === "vm" && !choice.available && !choice.starting && await startLocalVmRuntime()) {
         choice = await computerChoice(bot, pinned);
     }
-    return choice.available || choice.starting ? null : choice.reason ?? `${surfaceLabel(pinned)} is unavailable`;
+    return choice.available || choice.starting ? null : (pinned === "vm" ? containerRuntimeError() : null) ?? choice.reason ?? `${surfaceLabel(pinned)} is unavailable`;
 }
 function continueComputerSelection(threadId, generation, succeeded) {
     const selection = computerSelectionTurns.get(threadId);
@@ -8271,7 +8246,7 @@ bus.subscribe((event) => {
             if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !routines?.runForThread(event.threadId)) {
                 const broken = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
                 if (broken)
-                    reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: failedRunDetail(event.stopReason, turnError) });
+                    reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: failedRunDetail(event.stopReason, turnError), notifyChief: event.stopReason === "auth_required" });
             }
             const lastReported = turnUsage.get(event.threadId);
             turnUsage.delete(event.threadId);
@@ -8637,7 +8612,7 @@ function reportIncident(input) {
     const task = store.taskByThread(bot.id, threadId);
     // A thread another bot opened and is watching is that bot's to handle:
     // the delegator is woken with the failure already (wakeDelegationSource).
-    if (task?.openedBy?.delegationId || delegationWatch.has(threadId) || roomHandoffs.activeDirect(threadId))
+    if (!input.notifyChief && (task?.openedBy?.delegationId || delegationWatch.has(threadId) || roomHandoffs.activeDirect(threadId)))
         return;
     const group = store.groupByThread(threadId);
     const incident = {
@@ -9678,7 +9653,8 @@ async function startTurn(botId, text, opts) {
             : threadBusy(botId, threadId) ? undefined : turnEngineChoice(botId, threadId, { tools: true, vision: turnHasImages(opts?.userMessage) }, opts?.runOn);
     const tierSelection = engineChoice?.persist ? engineChoice.selection : undefined;
     const projectedBot = store.projectBotForTask(botId, threadId);
-    const bot = projectedBot && engineChoice ? { ...projectedBot, modelSelection: engineChoice.selection } : projectedBot;
+    const fallbackBot = projectedBot && !opts?.engine && onSessionFallback(threadId) ? withoutSubscription(projectedBot) : projectedBot;
+    const bot = fallbackBot && engineChoice ? { ...fallbackBot, modelSelection: engineChoice.selection } : fallbackBot;
     if (!bot)
         throw Object.assign(new Error("no such task"), { status: 404 });
     // Routines and legacy peer delivery already have their own completion
@@ -10760,6 +10736,7 @@ async function startTurn(botId, text, opts) {
                 ? await nexusMemory.readBack({ bot: liveBot ?? bot, threadId, query: providerText })
                 : "";
             const prompt = buildSystemPrompt(persona, liveBot?.soul ?? bot.soul ?? "", roomPromptSections(roomTurn, [
+                { id: "personal-goal", label: "Active goal", text: personalGoals.goals.get(threadId)?.status === "working" ? personalGoalInstructions(personalGoals.goals.get(threadId)) : "" },
                 { id: "user-profile", label: "About the user", text: userProfileSystemPrompt(cfg.profile) },
                 // the ICM folder is on this machine; a cloud run cannot reach it
                 // first after the soul: the block names agent tools, so it only goes
@@ -14356,6 +14333,8 @@ async function readyLocalVmForTurn(botId, target, isCurrent = () => true, onNote
                 onNote?.(`Started ${started} for the Local VM`);
                 status = await containerComputerStatus(undefined, undefined, target);
             }
+            else if (containerRuntimeError() && isCurrent())
+                onNote?.(containerRuntimeError());
         }
         noteLocalVmSeen(target, status);
         if (!isCurrent())
@@ -16129,7 +16108,7 @@ ROUTES.push(createSetupRoutes({
         }
     },
     startOllama: async (context) => {
-        await runTool("/usr/bin/open", ["-a", "Ollama"]);
+        startOllamaApp();
         for (let attempt = 0; attempt < 30 && !context.signal.aborted; attempt++) {
             if ((await setupOllamaState()) === "running")
                 return;
@@ -19062,6 +19041,7 @@ const handleRequest = async (req, res) => {
                 admin: auth.scopes.includes("admin"),
                 screens: url.searchParams.get("screens") !== "off",
                 backpressured: false,
+                authKind: auth.kind,
                 viewer,
                 // What this person's hydration (GET /api/bots, narrowed the same way) showed them.
                 seen: viewer.kind === "all" && viewer.privateOwner ? { bots: new Set(), groups: new Set() } : {
@@ -19105,6 +19085,7 @@ const handleRequest = async (req, res) => {
                 // A client that offered no cursor gets false too, which is exactly
                 // what a cold start should do.
                 resumed,
+                approvalTarget: deviceRoutes.route(),
             })}\n\n`);
             if (resumed) {
                 for (const buffered of replayBuffer) {
@@ -19120,6 +19101,7 @@ const handleRequest = async (req, res) => {
                 }
             }
             sseClients.add(client);
+            deviceRoutes.streamOpened(client.authKind);
             // Keep this long-lived response out of socket idle-timeout handling
             // without weakening timeouts for every other API request.
             req.socket.setTimeout(0);
@@ -19139,7 +19121,7 @@ const handleRequest = async (req, res) => {
             }, SSE_HEARTBEAT_MS);
             req.on("close", () => {
                 clearInterval(keepalive);
-                sseClients.delete(client);
+                removeSseClient(client);
             });
             return;
         }
@@ -20584,11 +20566,11 @@ const handleRequest = async (req, res) => {
             });
         }
         if (method === "POST" && path === "/api/bot-defaults/skills/preview") {
-            const checked = z.object({ source: z.string().min(1).max(2000) }).strict().safeParse(await readBody(req));
+            // Drafts accept the same uploaded bytes as existing bots, without installing them.
+            const checked = skillImportSchema.safeParse(await readBody(req));
             if (!checked.success)
                 return json(res, 400, { error: checked.error.message });
-            const input = checked.data;
-            const fetched = await fetchSkillFromSource(input.source);
+            const fetched = await resolveSkillImport(checked.data);
             if ("error" in fetched)
                 return json(res, 422, { error: fetched.error });
             const skills = [];
@@ -21701,10 +21683,10 @@ const handleRequest = async (req, res) => {
         if (m && method === "POST") {
             if (!store.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
-            const parsed = z.object({ source: z.string().min(1).max(2000) }).safeParse(await readBody(req));
+            const parsed = skillImportSchema.safeParse(await readBody(req));
             if (!parsed.success)
-                return json(res, 400, { error: "source must be a GitHub URL or owner/repo" });
-            const fetched = await fetchSkillFromSource(parsed.data.source);
+                return json(res, 400, { error: "Choose a Markdown skill file or enter a GitHub source (maximum 256 KiB per file)." });
+            const fetched = await resolveSkillImport(parsed.data);
             if ("error" in fetched)
                 return json(res, 422, { error: fetched.error });
             const results = fetched.skills.map((skill) => installSkill(m[1], skill.source, skill.files));
@@ -22233,10 +22215,20 @@ const handleRequest = async (req, res) => {
                 userAgent: typeof req.headers["user-agent"] === "string" ? req.headers["user-agent"] : undefined,
                 relayed: Boolean(onBehalfOf),
             }));
+            let goalCommand;
+            try {
+                goalCommand = parseGoalCommand(text);
+            }
+            catch (error) {
+                return json(res, 400, { error: error instanceof Error ? error.message : "Invalid goal command" });
+            }
+            if (guarded && goalCommand)
+                return json(res, 400, { error: "Goal commands require the conversation command interface." });
             // The send is acknowledged before the turn starts, so a workspace at its
             // spend limit is refused here, where the person can see it.
             try {
-                assertWithinBudget(cfg, DATA_DIR);
+                if (!goalCommand || goalCommand.action === "start" || goalCommand.action === "resume")
+                    assertWithinBudget(cfg, DATA_DIR);
             }
             catch (error) {
                 return json(res, 409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
@@ -22305,6 +22297,12 @@ const handleRequest = async (req, res) => {
                     const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth), trigger });
                     return { ok: true, threadId, message };
                 }
+                if (goalCommand) {
+                    if (auth.kind === "assistant")
+                        throw Object.assign(new Error("Only the person controls goals."), { status: 403 });
+                    return receiveGoalCommand(personalGoals, store, bot.id, threadId, goalCommand, text, sendId, messageSender(auth), trigger);
+                }
+                personalGoals.steer(threadId);
                 // Claude can accept the message inside its live turn. If the write
                 // loses a race with turn settlement, or the engine cannot steer, the
                 // existing server-side queue records it atomically for the next turn.
@@ -23733,6 +23731,8 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && authStatus) {
             res.setHeader("cache-control", "no-store");
             const state = await providerAuthSessions.status(authStatus[1], auth.kind === "session" ? auth.session.id : "loopback", url.searchParams.get("flowId") ?? "");
+            if (state.phase === "succeeded")
+                engineRests.clear(authStatus[1], "signed-in");
             return json(res, 200, { auth: state });
         }
         const instanceAction = /^\/api\/instances\/([\w.-]+)\/(refresh-models|install|auth\/start|auth\/complete|auth\/cancel|auth\/sign-out)$/.exec(path);
@@ -23774,6 +23774,8 @@ const handleRequest = async (req, res) => {
                         providerAuthSessions.revokeOwner(owner);
                         return json(res, 401, { error: "Your session ended. Start a new sign-in." });
                     }
+                    if (started.phase === "succeeded")
+                        engineRests.clear(instanceId, "signed-in");
                     return json(res, 200, { auth: started });
                 }
                 if (action === "auth/sign-out") {
@@ -23791,6 +23793,8 @@ const handleRequest = async (req, res) => {
                     if (!flowId || !callbackUrl)
                         return json(res, 400, { error: "flowId and a code or callbackUrl are required" });
                     await providerAuthSessions.complete(instanceId, owner, flowId, callbackUrl);
+                    engineRests.clear(instanceId, "signed-in");
+                    await describeEngines();
                     return json(res, 200, { ok: true });
                 }
                 const body = await readBody(req, 4096);