@chibitek/chibi 0.1.157 → 0.1.160

package/dist-server/server/drivers/openai-chat.js

@@ -42,7 +42,7 @@ export function createOpenAIChatRuntime(options) {
         turnId,
         createdAt: new Date().toISOString(),
     });
-    const complete = async (messages, model, stream, signal, onDelta, tools = []) => {
+    const complete = async (messages, model, stream, signal, onDelta, tools = [], onIdentity) => {
         // Idle timer that is renewed on every received chunk during streaming
         const timeoutController = new AbortController();
         let idleTimer = null;
@@ -77,6 +77,7 @@ export function createOpenAIChatRuntime(options) {
                 const bodyError = providerError(json);
                 if (bodyError)
                     throw new ChatProtocolError(`provider returned a completion error: ${bodyError.slice(0, 200)}`);
+                onIdentity?.(typeof json.model === "string" ? json.model : null, typeof json.id === "string" ? json.id : undefined);
                 const message = json.choices?.[0]?.message;
                 if (!message || !object(message) || !["content", "reasoning_content", "reasoning", "reasoning_details", "tool_calls", "function_call"].some((key) => key in message)) {
                     throw new ChatProtocolError("provider returned no completion message");
@@ -141,6 +142,7 @@ export function createOpenAIChatRuntime(options) {
                 const chunkError = providerError(chunk);
                 if (chunkError)
                     throw new ChatProtocolError(`provider returned a streaming completion error: ${chunkError.slice(0, 200)}`);
+                onIdentity?.(typeof chunk.model === "string" ? chunk.model : null, typeof chunk.id === "string" ? chunk.id : undefined);
                 const choice = chunk.choices?.find((row) => row.index === undefined || row.index === 0);
                 const delta = choice?.delta;
                 if (object(delta))
@@ -329,10 +331,19 @@ export function createOpenAIChatRuntime(options) {
                                 emit({ ...base(turn.threadId, turnId), type: "content.delta", streamKind, delta: visible });
                         };
                         try {
+                            const callId = newId();
+                            emit({ ...base(turn.threadId, turnId), type: "model.call", callId });
+                            let previousIdentity = "";
                             completion = await complete(messages, model, true, abort.signal, (text, streamKind) => {
                                 streamed = true;
                                 delta(text, streamKind);
-                            }, tools.definitions);
+                            }, tools.definitions, (reportedModel, responseId) => {
+                                const identity = JSON.stringify([reportedModel, responseId]);
+                                if (identity === previousIdentity)
+                                    return;
+                                previousIdentity = identity;
+                                emit({ ...base(turn.threadId, turnId), type: "model.evidence", callId, model: reportedModel, responseId, level: reportedModel ? "response-reported" : "unknown" });
+                            });
                             delta("", "assistant_text", true);
                             delta("", "reasoning_text", true);
                             break;

package/dist-server/server/engine-failover.js

@@ -1,16 +1,53 @@
+// Silent automatic failover (docs/chibitek/engine-tiers.md, step 2).
+//
+// A turn whose engine runs out of its usage allowance, turns out to be
+// signed out, goes fully silent, or fails in any other way, is not failed:
+// the engine rests and the same turn runs on the next engine of the bot's
+// ladder at the same level, at most two tries per turn. No chat message is
+// added; the client shows a small banner that fades (src/lib/engine-switch.ts).
+//
+// Modelled on OpenRouter's routing (docs/chibitek/engine-tiers.md): any
+// error is a reason to try the next candidate, not only the ones we have
+// learned to recognise. Recognised failures (a usage limit, a failed or
+// dead sign-in, a stall, a rate limit, a reasonless 400) rest the engine
+// for as long as that cause lasts; anything else is `provider_error`, which
+// rests it briefly (a circuit breaker) so it is not hammered. Every error an
+// engine reports while its turn is watched is held, so the person never sees
+// a provider's raw words for a failure the next engine recovers from.
+// This module is the part that watches a turn's events:
+//
+//   - While a turn is tracked, the engine's own report of the limit (a
+//     runtime.error, or the text a CLI prints in place of a reply, which the
+//     drivers mark `synthetic`) is held back instead of delivered. So is a
+//     reply that starts the way an agent's billing error does (Hermes answers
+//     "Billing or credits exhausted: HTTP 402: ..." as ordinary text and ends
+//     the turn as a success): it waits until the reply is complete, and if it
+//     is that error, with no tool run, the turn counts as failed.
+//   - When the turn completes failed with a held (or recognisable) limit,
+//     `onFailure` decides: it either moves the turn to another engine, and
+//     returns the one record that says so (turn.engine_failover), or it stops
+//     the turn with one plain line naming the resting engines.
+//   - A turn that ends any other way gets everything it held, in order.
+//
+// The server wires `onFailure` to the ladder, the resting store and
+// startTurn (server/index.ts); everything here is pure bookkeeping.
+import { newEventId } from "./contracts.js";
 import { classifyEngineFailure, isCredentialDead, mayBeReplyFailure, replyEngineFailure, statedReset } from "./engine-failure.js";
-/** At most this many engines take part in one turn: the first and five
- * switches. Each engine is tried once per turn anyway; this only bounds a
- * long run of failures, which then stops rather than loops. */
-export const MAX_ENGINES_PER_TURN = 6;
-/** OpenRouter's rule for an error no pattern recognises: fail over while
- * nothing has reached the person yet (no text, no tool run), as a
- * provider_error. Once part of the answer or an action is out, the turn ends
- * as it did. */
+/** The two-try cap: at most this many engines take part in one turn, the
+ * first and one switch. Every failed attempt counts toward it, whatever the
+ * failure was (a usage limit, a sign-in, a stall, or an error no pattern
+ * recognises). When the second engine fails too, the turn stops with its
+ * one plain line rather than walking the rest of the ladder. */
+export const MAX_ENGINES_PER_TURN = 2;
+/** What the engine said when it ended a turn failed without any words. */
+export const NO_ANSWER_FAILURE = "The engine ended the turn without an answer.";
+/** Any failure counts: a failed end that no pattern recognises is a
+ * provider_error, whether or not part of the answer or a tool run already
+ * reached the person (the next engine continues from there, told what was
+ * said and which actions ran, as for a usage limit) and whether or not the
+ * engine said why. */
 function unrecognisedFailure(turn) {
-    if (turn.said || turn.tools || turn.partial || !turn.lastError)
-        return undefined;
-    return { kind: "provider_error", message: turn.lastError };
+    return { kind: "provider_error", message: turn.lastError ?? NO_ANSWER_FAILURE };
 }
 /** Ways a turn ends failed that are not the engine's fault: the person (or
  * the harness on their behalf) stopped it. Every other failed end moves the
@@ -196,7 +233,7 @@ export const ACCOUNTS_HINT = "Fix it in Settings > AI & accounts.";
  * engines passed over because they cannot work on the turn's "Works on"
  * place (`place`, "this computer"). When an account needs the person (a
  * sign-in, an expired key), the line says where to fix it. */
-export function restingLine(engines, formatTime, computer) {
+export function restingLine(engines, formatTime, computer, options = {}) {
     const seen = new Set();
     const listed = engines.filter((engine) => !seen.has(engine.label) && seen.add(engine.label));
     const parts = listed.map((engine) => (engine.keyExpired ? `${engine.label}'s API key has expired`
@@ -208,9 +245,22 @@ export function restingLine(engines, formatTime, computer) {
         .map((label) => `${label} can't control ${computer.place}`);
     if (cannot.length)
         return `No engine that can work on ${computer.place} is free, so this turn stopped: ${[...parts, ...cannot].join("; ")}.${hint}`;
+    // The two-try cap, not an empty ladder: say so, with what each engine hit.
+    if (options.capped) {
+        const count = MAX_ENGINES_PER_TURN === 2 ? "two" : String(MAX_ENGINES_PER_TURN);
+        return parts.length
+            ? `This turn stopped after ${count} engines failed: ${parts.join(", ")}.${hint}`
+            : `This turn stopped after ${count} engines failed.`;
+    }
     if (parts.length === 0)
         return "No engine is available for this turn, so it stopped.";
     if (parts.length === 1)
         return `${parts[0]}, and no other engine at the same level is free, so this turn stopped.${hint}`;
     return `Every engine this bot can use is resting, so this turn stopped: ${parts.join(", ")}.${hint}`;
 }
+/** A new harness event about the same provider turn as `event`. */
+export const eventBase = (event) => ({
+    eventId: newEventId(), provider: event.provider, threadId: event.threadId, createdAt: new Date().toISOString(),
+    ...(event.providerInstanceId ? { providerInstanceId: event.providerInstanceId } : {}), ...(event.turnId ? { turnId: event.turnId } : {}),
+});
+export const restTime = (at) => new Date(at).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });

package/dist-server/server/engine-failure.js

@@ -160,9 +160,9 @@ export function classifyEngineFailure(text, now = Date.now()) {
     return null;
 }
 // Hermes returns billing and expired-login refusals as successful reply text.
-const REPLY_FAILURE_HEADS = ["login expired", "error: nonretriableerror:", "billing or credits exhausted", "http 402:", "error: http 402:", "api error: http 402:"];
+const REPLY_FAILURE_HEADS = ["login expired", "error: nonretriableerror:", "billing or credits exhausted", "http 402:", "error: http 402:", "api error: http 402:", "usage limit reached"];
 const REPLY_FAILURE = [
-    /^billing or credits exhausted\b/i,
+    /^billing or credits exhausted\b|^usage limit reached\b[\s\S]*\b(?:quota|limit will reset|resets? (?:in|at|on))\b/i, // the second: a quota page as the reply (2026-10-26)
     // A bare "HTTP 402:" at the head counts only with the provider's own
     // billing words after it.
     /^(?:(?:api )?error:\s*)?http 402:[\s\S]*\b(?:positive balance|insufficient (?:balance|credits?|funds)|add (?:credits|balance|funds)|top-?up|credits? (?:exhausted|depleted))\b/i,

package/dist-server/server/harness-import/history.js

@@ -11,7 +11,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { pathToFileURL } from "node:url";
-import { attachmentBytesUsed, ATTACHMENTS_DIR, ATTACHMENTS_MAX_BYTES, deleteAttachment, extensionForFileMime, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, saveFile, saveImage, } from "../attachments.js";
+import { attachmentBytesAvailable, ATTACHMENTS_DIR, deleteAttachment, extensionForFileMime, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, saveFile, saveImage, } from "../attachments.js";
 import { redactSecretsInText } from "../redact.js";
 import { existingBots, importIdentity, mergedBotOf, sourceRefFor } from "./apply.js";
 import { GROKBOT_HISTORY_ALLOWLIST } from "./grokbot.js";
@@ -31,7 +31,7 @@ const MAX_STORE_BYTES = 2 * 1024 * 1024 * 1024;
 /** The real attachment directory, through the same save calls uploads use. */
 export function historyAttachmentStore() {
     return {
-        usedBytes: attachmentBytesUsed,
+        availableBytes: attachmentBytesAvailable,
         has(uploadId, extension) {
             try {
                 return statSync(join(ATTACHMENTS_DIR, `${uploadId}${extension}`)).isFile();
@@ -421,7 +421,7 @@ export function planBotHistory(sourceId, entries, ctx) {
         hidden: cleaner.hidden(),
     };
 }
-export const defaultHistoryBudget = (usedBytes) => Math.max(0, ATTACHMENTS_MAX_BYTES - usedBytes - HISTORY_QUOTA_MARGIN_BYTES);
+export const defaultHistoryBudget = (availableBytes) => Math.max(0, availableBytes - HISTORY_QUOTA_MARGIN_BYTES);
 /** Which files to copy: images first, then documents, newest first, until
  * the budget is spent. A file already in Atomic costs nothing. */
 export function allocateFiles(input, budget, stored) {
@@ -608,7 +608,7 @@ const storedCheck = (store) => (file) => {
 export function previewHistory(root, result, deps, options) {
     const source = options.source ?? GROKBOT_HISTORY;
     const targets = historyTargets(result, deps.bots());
-    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.usedBytes());
+    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.availableBytes());
     const empty = { threads: 0, messages: 0, files: { copied: 0, copiedBytes: 0, skipped: 0, skippedBytes: 0 } };
     if (!options.requested) {
         return { requested: false, available: targets.filter((target) => source.available(root, target.sourceId, options.fs)).length, bots: [], totals: empty, budgetBytes: budget };
@@ -698,7 +698,7 @@ export async function applyHistory(root, result, deps, options = {}) {
             out.hiddenMessages += plan.hidden;
         }
     }
-    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.usedBytes());
+    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.availableBytes());
     const stored = storedCheck(deps.attachments);
     const allocation = allocateFiles(work.flatMap((item) => item.threads.flatMap(({ thread }) => thread.messages.flatMap((message) => message.files))), budget, stored);
     out.files.tooLarge = allocation.tooLarge.size;

package/dist-server/server/harness-import/test-fixtures.js

@@ -276,7 +276,7 @@ export function fakeHistoryDeps(options = {}) {
         },
         deleteThread: (_botId, threadId) => state.threads.delete(threadId),
         attachments: {
-            usedBytes: () => state.used,
+            availableBytes: () => 512 * 1024 * 1024 - state.used,
             has: (uploadId, extension) => state.files.has(`/attachments/${uploadId}${extension}`),
             saveImage: (bytes, mime, uploadId) => {
                 const path = pathFor(uploadId, mime);

package/dist-server/server/index.js

@@ -1,3 +1,5 @@
+import { createModelExpectation, ModelEvidenceLedger } from "./model-evidence-context.js";
+import { reactToMessage } from "./message-reactions.js";
 import { hasUnboundGoalGuard, goalGuardForEvent, addGoalGuard, removeGoalGuard, runPersonalGoalTurn, updatePersonalGoalReceipt } from "./personal-goal-turn.js";
 import { PersonalGoalRuntime, receiveGoalCommand } from "./personal-goal-runtime.js";
 import { personalGoalInstructions } from "./personal-goals.js";
@@ -46,7 +48,8 @@ import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { companyCheck, companyContext } from "./company-document-check.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
-import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, avatarImageStatus, snapshotAvatarGenerationState, } from "./avatar-image.js";
+import { avatarGenerationRequestSchema, avatarGenerationStateMatches, avatarImageStatus, snapshotAvatarGenerationState } from "./avatar-image.js";
+import { generateRoutedAvatar, installAvatarSubscriptionRoute } from "./avatar-subscription.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RepoRegistry } from "./repos.js";
@@ -68,7 +71,7 @@ import { turnTimingFinish, turnTimingMark, turnTimingStart } from "./turn-timing
 import { ATOMIC_TEAM_PACKAGE_ID, BUILTIN_CHIBI_REFUSALS, builtinChibiPatchRefusal } from "./builtin-chibi.js";
 import { canAccessTeam, canContactTeamOf, canManagePeer, canReachPeer, canReachTeam, coordinatorSupervises, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, reachesEveryTeam, roomBoundaryHolds, teamStatusPrompt, PEER_ROSTER_MAX, resolveTeammate, roomPeerRosterSystemPrompt, rosterAbout, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
-import { containerComputerAction, managedImageNeedsUpgrade, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, recentContainerComputerStatus, containerRuntimeStatus, ensureContainerRuntime, localVmRecreatableOnDemand, localVmReplaceableWhenStopped, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
+import { containerComputerAction, managedImageNeedsUpgrade, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, recentContainerComputerStatus, containerRuntimeStatus, ensureContainerRuntime, containerRuntimeError, localVmRecreatableOnDemand, localVmReplaceableWhenStopped, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
 import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmAutoStartRuntime, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, userMcpEnabledFor, addonEnabled, skillAuthoringEnabled, sharedComputersEnabled, teamRoomsEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, onDeviceHelpersEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, accountBotGrantPolicy, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { GodModeSwitch } from "./god-mode.js";
@@ -263,6 +266,7 @@ import { createProviderAccountRoutes } from "./routes/provider-accounts.js";
 import { accountStops, injectedModel, restScope } from "./injected-model-rest.js";
 import { accountProvider } from "../shared/provider-accounts.js";
 import { createAccountRoutes } from "./routes/accounts.js";
+import { installNativeVault } from "./vault/runtime.js";
 import { OAuthAccounts, takeOAuthClients } from "./oauth-accounts.js";
 import { DesktopAccountVault, FileAccountVault, UnavailableAccountVault, takeAccountsFromEnvironment } from "./oauth-account-vault.js";
 import { accountConnectorNames } from "./claude-account-connectors.js";
@@ -303,7 +307,8 @@ import { createNexusMemoryRoutes } from "./routes/nexus-memory.js";
 import { createBoardRoutes } from "./routes/board.js";
 import { readBoardFromNexus } from "./board/nexus-board.js";
 import { LocalModelInventory, localModePlacement, machineMemory } from "./local-models-mode.js";
-import { FailoverGate, MAX_ENGINES_PER_TURN, continuationNote, restingLine } from "./engine-failover.js";
+import { eventBase, restTime, FailoverGate, MAX_ENGINES_PER_TURN, continuationNote, restingLine } from "./engine-failover.js";
+import { enterSessionFallback, onSessionFallback, ownOrFallback, sessionFallbackSpentLine, withoutSubscription } from "./session-fallback.js";
 import { TURN_ERROR_CATEGORIES } from "../shared/runtime-events.js";
 import { EngineProbes, PROBE_PROMPT, isProbeThread, probeThreadId } from "./engine-probe.js";
 // [jev-verifier] opt-in Jev answer checks after a model switch (server/jev).
@@ -485,6 +490,7 @@ function customDomainStatus() {
     };
 }
 const registry = new ProviderRegistry(BUILT_IN_DRIVERS);
+installAvatarSubscriptionRoute(() => registry.instances());
 // Engines installed from Settings live under the data directory and win over
 // any other copy on PATH.
 registerEnginesBinDir();
@@ -1154,9 +1160,14 @@ if (!hostedModels) {
 // its add-on's capability, so it loads only while the add-on applies.
 const bundledSkills = [...loadBundledSkills(), ...loadAddonSkillLibraries()];
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
+// Electron's utility-process parent port is private to the desktop main
+// process. It carries desktop-only messages (approval and browser control,
+// phone secrets, the account vault) without putting them in the renderer.
+// Plain Node/dev launches have no parentPort.
 // SAFETY: Electron's utility-process runtime is the only environment that
 // supplies parentPort; plain Node intentionally leaves it absent.
 const utilityParentPort = process.parentPort;
+installNativeVault(DATA_DIR, utilityParentPort, () => desktopMutationToken, req => authorizedInternalCapability(req.headers.authorization) !== null);
 function postDesktopPrivateMessage(message) {
     if (!utilityParentPort)
         return false;
@@ -3045,12 +3056,19 @@ function turnEngineChoice(botId, threadId, needs, runOn) {
     if (hostedModels || !profile || !task)
         return undefined;
     if (isSubscriptionBot(profile))
-        return subscriptionTurnEngineChoice(profile, threadId);
+        return ownOrFallback(threadId, () => subscriptionTurnEngineChoice(profile, threadId), () => sessionFallbackChoice(profile, threadId, needs, runOn), (stop) => stop instanceof SubscriptionStop, (stop) => new SubscriptionStop(sessionFallbackSpentLine(stop.message)));
     if (isPersonalBot(profile))
         return personalTurnEngineChoice(profile, threadId, needs, runOn);
     const projected = store.projectBotForTask(botId, threadId);
     return projected ? ladderTurnEngineChoice(profile, projected, threadId, needs, runOn) : undefined;
 }
+/** A company subscription bot's conversation on another provider's subscription, same class (server/session-fallback.ts). */
+function sessionFallbackChoice(profile, threadId, needs, runOn) {
+    const projected = store.projectBotForTask(profile.id, threadId);
+    const choice = isPersonalBot(profile) || !projected ? undefined
+        : ladderTurnEngineChoice(withoutSubscription(profile), withoutSubscription(projected), threadId, needs, runOn, true);
+    return choice && choice.selection.instanceId !== projected.modelSelection.instanceId ? { selection: choice.selection, persist: false } : undefined;
+}
 /** A room member's engine at turn start, by turnEngineChoice's rules for
  * the bot's own default (a room turn has no task of its own, so the bot's
  * engine mode decides): resting and signed-out engines passed over, a
@@ -3066,7 +3084,7 @@ function roomTurnEngineChoice(bot, threadId) {
         : ladderTurnEngineChoice(bot, projected, threadId);
     return choice && { selection: choice.selection, persist: false };
 }
-function ladderTurnEngineChoice(profile, projected, threadId, needs, runOn) {
+function ladderTurnEngineChoice(profile, projected, threadId, needs, runOn, subscriptionsOnly = false) {
     const candidates = engineSnapshots.current();
     if (!candidates)
         return undefined;
@@ -3075,7 +3093,7 @@ function ladderTurnEngineChoice(profile, projected, threadId, needs, runOn) {
     const { ladder } = plan;
     const computer = turnComputer(projected, threadId, runOn);
     const context = { candidates, needsDelegation: needsDelegation(tier, profile), computer, refuse: engineTierRefusal(projected), resting: engineResting,
-        keyBandPaused: payPerUse.pausedUntil() !== undefined };
+        keyBandPaused: subscriptionsOnly || payPerUse.pausedUntil() !== undefined };
     const local = (resolution) => localModeTurn(resolution, { tier, context, needs, prefer: [projected.modelSelection.instanceId] });
     const wider = (tried, modelClass) => resolveFailover({
         ladder, classLadder: (cls) => classLadder(classedModels(), cls), failed: projected.modelSelection, context, tried,
@@ -3550,6 +3568,9 @@ const roomFailoverTurns = new Map();
  * default (a resting engine's stand-in, a failover): the ledger books it. */
 const roomTurnSelections = new Map();
 const turnEngineOverrides = new Map();
+const modelEvidence = new ModelEvidenceLedger(DATA_DIR);
+const modelExpectation = createModelExpectation({ get store() { return store; }, get registry() { return registry; }, turnEngineOverrides, roomTurnSelections,
+    speakerBot: threadId => groupSpeakers.get(threadId)?.botId, enginePlan, botClassChoices });
 const failoverGate = new FailoverGate((turn, completion) => engineFailover(turn, completion));
 /** An approval shows a shell command as the model meant it: the RTK add-on's
  * launcher, which engines that take RTK as instructions put in front of
@@ -3568,9 +3589,16 @@ bus.setGate((published) => {
         return [];
     }
     const event = withoutRtkInSummary(published);
+    if (!shouldIgnoreProviderEvent(event))
+        modelEvidence.observe(event, () => modelExpectation(event.threadId, event.providerInstanceId, event.provider));
     // [jev-verifier] note a failover turn that finished, before the gate forgets it.
     const jevCandidate = jevAnswerCheckCandidate(event);
     const delivered = failoverGate.filter(event);
+    // Gate-generated switches never re-enter publish; preserve their evidence too.
+    for (const out of delivered)
+        if (out.type === "turn.engine_failover" && out !== event) {
+            modelEvidence.observe(out, () => modelExpectation(out.threadId, out.providerInstanceId, out.provider));
+        }
     if (jevCandidate)
         setImmediate(() => void jevAnswerCheck(jevCandidate));
     for (const out of delivered)
@@ -3589,12 +3617,6 @@ function noteEngineBack(event) {
     const model = selection?.instanceId === instanceId ? selection.model : undefined;
     engineRests.noteBack(instanceId, candidate ? engineAccount(candidate) : undefined, candidate ? restScope(candidate, model) : undefined);
 }
-/** A new harness event about the same provider turn as `event`. */
-const eventBase = (event) => ({
-    eventId: newEventId(), provider: event.provider, threadId: event.threadId, createdAt: new Date().toISOString(),
-    ...(event.providerInstanceId ? { providerInstanceId: event.providerInstanceId } : {}), ...(event.turnId ? { turnId: event.turnId } : {}),
-});
-const restTime = (at) => new Date(at).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
 /** Rest a refused engine and continue on an eligible engine, or show an actionable line. */
 function engineFailover(turn, completion) {
     const failure = turn.failure;
@@ -3812,14 +3834,19 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
     const computer = projected ? turnComputer(projected, turn.threadId, attempt.runOn) : undefined;
     // A subscription bot fails over only to another account of its own
     // provider on its side of the personal line; with none left it stops with
-    // its one line (and the client offers Chibi). Never another provider.
+    // its one line, or a company bot's own conversation takes its session fallback (server/session-fallback.ts).
     const subscriptionMove = isSubscriptionBot(profile)
         ? tried.size >= MAX_ENGINES_PER_TURN || !projected
             ? { line: subscriptionLine(profile, candidates) }
             : subscriptionPlacement({ profile, projected, candidates, tried: new Set([...tried, turn.instanceId]), auto: attempt.persist, modelClass: neededClass })
         : undefined;
-    if (subscriptionMove && !subscriptionMove.choice)
+    const fallback = subscriptionMove && !subscriptionMove.choice && projected && !isPersonalBot(profile) && tried.size < MAX_ENGINES_PER_TURN && store.taskByThread(profile.id, turn.threadId);
+    if (fallback && !enterSessionFallback(turn.threadId, false))
+        return { line: sessionFallbackSpentLine(subscriptionMove.line) };
+    if (subscriptionMove && !subscriptionMove.choice && !fallback)
         return { line: subscriptionMove.line };
+    if (fallback)
+        [profile, projected] = [withoutSubscription(profile), withoutSubscription(projected)];
     const personalTurn = isPersonalBot(profile) && !subscriptionMove;
     // The Private Bot prefers personal engines and opted-in local compute,
     // then company compute. startTurn rechecks company cost on every attempt.
@@ -3839,7 +3866,7 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
         classLadder: (modelClass) => classLadder(classedModels(), modelClass),
         failed: attempt.selection,
         context: { candidates, needsDelegation: needsDelegation(tier, profile), computer, refuse: engineTierRefusal(projected), resting: engineResting,
-            keyBandPaused: keyBandPausedFor(turn.threadId) },
+            keyBandPaused: Boolean(fallback) || keyBandPausedFor(turn.threadId) },
         tried,
         modelClass: neededClass,
         mayDrop: true,
@@ -3855,6 +3882,8 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
             context: { candidates, needsDelegation: needsDelegation(tier, profile), computer, refuse: engineTierRefusal(projected), resting: engineResting } })
             : { ...resolution, local: false };
     const choice = placed.choice && placed.local ? { ...placed.choice, modelClass: "Añejo" } : placed.choice;
+    if (!choice && fallback)
+        return { line: subscriptionMove.line };
     if (!choice && turn.failure?.kind === "provider_error")
         return { passthrough: true };
     if (!choice) {
@@ -3864,11 +3893,11 @@ function failoverPick(turn, profile, projected, candidates, failedCandidate, res
         const resting = resolution.skipped.filter((skip) => skip.reason === "resting" || skip.reason === "tried").map((skip) => skip.instanceId);
         const named = restingNamed([turn.instanceId, ...attempt.tried, ...resting]);
         return {
-            line: restingLine(named, restTime, cannotDriveNamed(candidates, resolution.skipped.map((skip) => skip.instanceId), computer)),
+            line: restingLine(named, restTime, cannotDriveNamed(candidates, resolution.skipped.map((skip) => skip.instanceId), computer), { capped: tried.size >= MAX_ENGINES_PER_TURN }),
             category: named.some((engine) => engine.needsSignIn || engine.keyExpired) ? "account" : "failover_exhausted",
         };
     }
-    if (subscriptionMove) { /* subscriptions only: no pay-per-use episode */ }
+    if (subscriptionMove || fallback) { /* subscriptions only: no pay-per-use episode */ }
     else if (personalMove)
         notePersonalPayPerUse(personalMove);
     else
@@ -6973,15 +7002,15 @@ function localVmSetUp() {
 }
 /** The one gate for starting the container engine (App Settings →
  * Computers): the person's switch, the organisation's policy, and a Local VM
- * actually set up here. Returns what it started ("Colima", "Docker
- * Desktop") once the engine answers, or null. */
+ * actually set up here. Returns what it started (Colima, the only engine
+ * Atomic starts; never Docker Desktop) once it answers, or null. */
 async function startLocalVmRuntime() {
     if (!localVmAutoStartRuntime(cfg) || !managedPolicy.computerAllowed("localVm") || !localVmSetUp())
         return null;
     try {
-        const { status, started } = await ensureContainerRuntime();
-        if (started)
-            console.log(`[local-vm] started ${started}: ${status.daemonUp ? "ready" : "still not answering"}`);
+        const { status, started, error } = await ensureContainerRuntime();
+        if (started || error)
+            console[error ? "error" : "log"](`[local-vm] ${started ? `started ${started}: ${status.daemonUp ? "ready" : "still not answering"}` : "not started"}${error ? `. ${error}` : ""}`);
         return started && status.daemonUp ? started : null;
     }
     catch (error) {
@@ -7493,7 +7522,7 @@ async function unusableAutoPin(bot, threadId, plan, runOn) {
     if (pinned === "vm" && !choice.available && !choice.starting && await startLocalVmRuntime()) {
         choice = await computerChoice(bot, pinned);
     }
-    return choice.available || choice.starting ? null : choice.reason ?? `${surfaceLabel(pinned)} is unavailable`;
+    return choice.available || choice.starting ? null : (pinned === "vm" ? containerRuntimeError() : null) ?? choice.reason ?? `${surfaceLabel(pinned)} is unavailable`;
 }
 function continueComputerSelection(threadId, generation, succeeded) {
     const selection = computerSelectionTurns.get(threadId);
@@ -9632,7 +9661,8 @@ async function startTurn(botId, text, opts) {
             : threadBusy(botId, threadId) ? undefined : turnEngineChoice(botId, threadId, { tools: true, vision: turnHasImages(opts?.userMessage) }, opts?.runOn);
     const tierSelection = engineChoice?.persist ? engineChoice.selection : undefined;
     const projectedBot = store.projectBotForTask(botId, threadId);
-    const bot = projectedBot && engineChoice ? { ...projectedBot, modelSelection: engineChoice.selection } : projectedBot;
+    const fallbackBot = projectedBot && !opts?.engine && onSessionFallback(threadId) ? withoutSubscription(projectedBot) : projectedBot;
+    const bot = fallbackBot && engineChoice ? { ...fallbackBot, modelSelection: engineChoice.selection } : fallbackBot;
     if (!bot)
         throw Object.assign(new Error("no such task"), { status: 404 });
     // Routines and legacy peer delivery already have their own completion
@@ -9803,6 +9833,7 @@ async function startTurn(botId, text, opts) {
     // thread, so this is the one moment the ledger's "who asked" may change.
     if (opts?.trigger)
         turnTriggers.set(threadId, opts.trigger);
+    const expectedModel = modelExpectation(threadId);
     // The engine the ladder chose becomes the thread's model, as a person's
     // switch would; the thread stays tier-managed for its next turn.
     if (tierSelection && JSON.stringify(tierSelection) !== JSON.stringify(task.modelSelection)) {
@@ -9827,6 +9858,8 @@ async function startTurn(botId, text, opts) {
     // busy flips immediately so the composer locks; the dispatch itself runs
     // in the background — box provisioning can take ~90s and must never
     // hang the HTTP request
+    const evidenceAttemptId = expectedModel ? modelEvidence.begin({ ...expectedModel, requestedModel: model,
+        instanceId: instance.instanceId, provider: instance.driverKind }, Boolean(failover)) : undefined;
     const dispatchClaimId = randomUUID();
     const resourceOwner = { threadId, generation: dispatchClaimId };
     turnResourceOwners.set(threadId, resourceOwner);
@@ -10867,6 +10900,8 @@ async function startTurn(botId, text, opts) {
             }
         }
         catch (e) {
+            if (evidenceAttemptId)
+                modelEvidence.finishDispatch(threadId, evidenceAttemptId);
             handoffs.abandon(threadId, dispatchClaimId);
             failoverGate.untrack(threadId, dispatchClaimId);
             if (failoverTurns.get(threadId)?.generation === dispatchClaimId)
@@ -14311,6 +14346,8 @@ async function readyLocalVmForTurn(botId, target, isCurrent = () => true, onNote
                 onNote?.(`Started ${started} for the Local VM`);
                 status = await containerComputerStatus(undefined, undefined, target);
             }
+            else if (containerRuntimeError() && isCurrent())
+                onNote?.(containerRuntimeError());
         }
         noteLocalVmSeen(target, status);
         if (!isCurrent())
@@ -20454,14 +20491,7 @@ const handleRequest = async (req, res) => {
         // emoji reactions — works on any thread (1:1 or room)
         m = path.match(/^\/api\/threads\/([\w-]+)\/messages\/([\w-]+)\/reactions$/);
         if (m && method === "POST") {
-            const body = await readBody(req);
-            const emoji = String(body.emoji ?? "").slice(0, 8);
-            if (!emoji)
-                return json(res, 400, { error: "emoji required" });
-            const patched = store.toggleReaction(m[1], m[2], emoji, typeof body.by === "string" ? body.by : "user");
-            if (!patched)
-                return json(res, 404, { error: "no such message" });
-            return json(res, 200, { message: patched });
+            return reactToMessage(store, req, res, m[1], m[2]);
         }
         if (path === "/api/sidebar-sections" && method === "GET") {
             return json(res, 200, { sections: store.sections });
@@ -20574,13 +20604,13 @@ const handleRequest = async (req, res) => {
             const profile = parseBotProfilePatch(body.profile, true);
             if (!profile.ok)
                 return json(res, 400, { error: profile.error });
-            const checked = avatarGenerationRequestSchema.safeParse({ prompt: body.prompt });
+            const checked = avatarGenerationRequestSchema.safeParse({ prompt: body.prompt, source: body.source });
             if (!checked.success)
                 return json(res, 400, { error: checked.error.message });
             const { prompt } = checked.data;
-            const generated = await generateAvatarImage(cfg, {
+            const generated = await generateRoutedAvatar(cfg, registry.instances(), {
                 name: profile.patch.name ?? "", title: profile.patch.title ?? "", description: profile.patch.description ?? "",
-            }, prompt);
+            }, prompt, checked.data.source);
             // A preview belongs to the draft. Upload it through the existing image
             // endpoint only when the user commits the new bot or its defaults.
             return json(res, 200, { dataUrl: `data:${generated.mime};base64,${generated.bytes.toString("base64")}` });
@@ -20831,7 +20861,7 @@ const handleRequest = async (req, res) => {
             if (!parsed.success) {
                 return json(res, 400, { error: `prompt must be at most 400 characters` });
             }
-            const generated = await generateAvatarImage(cfg, existing, parsed.data.prompt);
+            const generated = await generateRoutedAvatar(cfg, registry.instances(), existing, parsed.data.prompt, parsed.data.source);
             const current = store.bot(existing.id);
             if (!current)
                 return json(res, 404, { error: "no such bot" });
@@ -21812,6 +21842,15 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such bot" });
             return json(res, 200, previewSystemPrompt(bot, { privateOwner: privateOwnerFor(auth) }));
         }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/model-evidence$/);
+        if (m && method === "GET") {
+            const thread = requestedTaskBot(m[1], url.searchParams.get("threadId") ?? undefined);
+            const range = parseUsageRange(url.searchParams.get("from"), url.searchParams.get("to"));
+            if (!range)
+                return json(res, 400, { error: "Provide a date range of at most one year" });
+            res.setHeader("cache-control", "no-store");
+            return json(res, 200, modelEvidence.query(m[1], thread.threadId, range.from, range.to));
+        }
         m = path.match(/^\/api\/bots\/([\w-]+)\/model-classes$/);
         if (m && method === "GET") {
             const thread = requestedTaskBot(m[1], url.searchParams.get("threadId") ?? undefined);