@chibitek/chibi 0.1.169 → 0.1.171

package/dist-server/server/index.js

@@ -1,3 +1,5 @@
+import { createMessageFileRoutes } from "./routes/message-file.js";
+import { SharedDeliverables, createSharedDeliverablesRoutes, sharedDeliverableAccess } from "./shared-deliverables.js";
 import { connectionCredentialServer } from "./connection-credential.js";
 import { requestCredentialCard } from "./credential-card-request.js";
 import { invalidateBrokenCheckpoint } from "./checkpoint-recovery.js";
@@ -34,7 +36,7 @@ import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
 import { approvalModeFor, supportsApprovalMode, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { credentialResumeOutcome, credentialIsConfigured, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
+import { approvalHeldNote, approvalHeldReason, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { failedRunDetail } from "./turn-failure.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
@@ -50,7 +52,6 @@ import { ApprovalGrantStore, describeScope, matchGrant } from "./approval-grants
 import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { companyCheck, companyContext } from "./company-document-check.js";
-import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, avatarImageStatus, snapshotAvatarGenerationState } from "./avatar-image.js";
 import { generateRoutedAvatar, installAvatarSubscriptionRoute } from "./avatar-subscription.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
@@ -99,6 +100,7 @@ import { decodeGeneratedImage } from "./generated-image.js";
 import { MAX_MCP_SERVERS, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, isRemoteMcpServer, mcpReadOnlyAutoAllow, } from "./mcp-registry.js";
 import { mcpLaunchBlocker, mcpLaunchBlockerReason, mcpSecretStorage, mcpServerSecretView, moveParkedArgToEnv, receiveMcpSecretsSaveResult, setMcpSecretSender, storeMcpServerSecrets, } from "./mcp-secrets.js";
 import { probeMcpServer } from "./mcp-probe.js";
+import { createInteractiveMcpProbe } from "./mcp-interactive-probe.js";
 import { McpToolHintStore, readOnlyToolAllowed } from "./mcp-tool-hints.js";
 import { McpAuthStateStore } from "./mcp-auth-state.js";
 import { McpHealthStore } from "./mcp-health.js";
@@ -156,11 +158,12 @@ import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite,
 import { resolveSkillImport, skillImportSchema } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
-import { expandLearnTurnText, learnSource } from "./skill-learn.js";
+import { expandSkillTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
 import { buildSystemPrompt, userProfileSystemPrompt, computerPrompt, accountsPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
+import { remoteDesktopRoute } from "./remote-desktop.js";
 import { discoverExistingPerBotLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { ATOMIC_BACKUP_DIR, BROWSER_BACKUP_INTERVAL_MS, backupBrowserProfiles, localVmWorkspaces } from "./atomic-backup.js";
 import { LocalVmIdleTimer } from "./local-vm-idle.js";
@@ -251,6 +254,7 @@ import { PHONE_SECRET_PROTOCOL_VERSION, PhoneSecretBridge, PhoneSecretError, Pho
 // Keep these two last: a route module may import any server module, and
 // loading the table after everything above leaves module start-up order as is.
 import { json, onJsonBody, parsedBodyOf, readBody } from "./harness/http.js";
+import { BotWorkModes, createBotWorkModeRoutes, ownBotApprovalMode, legacyGodModeCovers, dispatchWorkMode, trustedPlanChangeForStore, invalidAllThreadScope } from "./bot-work-modes.js";
 import { ROUTES, dispatchRoutes } from "./routes/table.js";
 import { createThreadStopRoutes } from "./routes/thread-stop.js";
 import { createThreadImageRoutes } from "./routes/thread-images.js";
@@ -2662,12 +2666,13 @@ function subscriptionModel(bot, candidate, wanted) {
     const provider = subscriptionProvider(bot.subscription?.provider);
     if (!provider)
         return undefined;
+    const usable = (model) => !engineResting(candidate, model);
     const flagship = wanted !== undefined ? undefined : provider.host ? hostDefaultModel(provider, candidate) : frontierChoice(bot, candidate)?.model;
-    if (flagship)
+    if (flagship && usable(flagship))
         return flagship;
     return bestProviderModel({
         provider, candidate, wanted: wanted ?? engineTierClasses(cfg.engineTiers)[botTier(bot)],
-        classOf: (model) => modelClassOf(candidate.driverKind, model), ranked: rankedModelIds(candidate.driverKind),
+        classOf: (model) => modelClassOf(candidate.driverKind, model), ranked: rankedModelIds(candidate.driverKind), usable,
     });
 }
 /** Thrown when a subscription bot's turn has no account of its provider
@@ -4171,8 +4176,8 @@ function checkedTaskModelSwitch(current, raw, updateBotDefault, resetApprovalToA
     }
     for (const target of updateBotDefault ? [current, profile] : [current]) {
         const mode = approvalModeFor(target);
-        if (resetApprovalToAsk && mode === "custom" && !trusted) {
-            return { ok: false, status: 403, error: "Leaving Custom approval requires confirmation in the packaged desktop app" };
+        if (resetApprovalToAsk && (mode === "plan" || (mode === "custom" && !trusted))) {
+            return { ok: false, status: 403, error: "Approve the plan or change Custom permissions in the app before switching models" };
         }
         if (!resetApprovalToAsk && modelSwitchNeedsAsk(mode, registry.cliTarget(target.modelSelection.instanceId)?.driverKind, registry.cliTarget(checked.selection.instanceId)?.driverKind)) {
             return { ok: false, status: 400, error: "Confirm switching this model with Ask permissions first (resetApprovalToAsk)" };
@@ -4324,7 +4329,7 @@ const wireBot = (bot) => {
     const visible = approvalGrant && !approvalGrant.threadOnly
         ? { ...rest, approvalMode: "ask", autoApprove: false }
         : rest;
-    return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
+    return { ...visible, workMode: godModeCovers(bot) ? "full" : botWorkModes.permits(approvalModeFor(visible)) ? approvalModeFor(visible) : "ask", workModeWorkspaceOverride: godModeCovers(bot), waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
         screenLive: screenLiveForBot(bot.id), avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** The correlated private response carries the requested value so Electron
@@ -4450,7 +4455,7 @@ async function botOverview(bot) {
             autoApprove: bot.autoApprove,
             approvalMode: approvalModeForTurn(bot),
             // GOD MODE skips the peer check for every bot, whatever its engine
-            approvePeerComms: bot.approvePeerComms && !godModeActive(),
+            approvePeerComms: bot.approvePeerComms && !godModeCovers(bot),
             peers: bot.peers,
             browser: bot.browser,
             chiefOfStaff: bot.chiefOfStaff,
@@ -4489,36 +4494,15 @@ async function botOverview(bot) {
         recent,
     });
 }
-/** Defense in depth for hand-edited/corrupt durable records: elevated
- * approval semantics require an implemented provider mapping. The trusted transition enforces
- * this too, but no provider dispatch or later permission callback relies on
- * persistence having been produced exclusively by that route. Delegation
- * uses the receiving bot's grant, never the sender's (approvalModeForOrigin) —
- * with one deliberate exception: a Chief of Staff with Full access makes the
- * threads it delegates Full too (delegatedFullAccess), so the grant the
- * person gave the Chief covers the work the Chief hands out. */
+// Enforce engine permissions on every turn, including delegated work.
+const botWorkModes = new BotWorkModes(join(DATA_DIR, "bot-work-modes.json"));
+for (const id of botWorkModes.expired(id => sessions.isLive(id)))
+    store.setAllThreadApprovalMode(id, "ask", true);
 const approvalModeForTurn = (bot, peerInitiated = false) => godModeElevates(bot) ? "full" : ownApprovalModeForTurn(bot, peerInitiated);
 /** The bot's (or thread's) own level for a turn, GOD MODE aside. */
-const ownApprovalModeForTurn = (bot, peerInitiated = false) => {
-    const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
-    if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
-        return "ask";
-    }
-    return mode;
-};
-/** GOD MODE covers this bot or thread: the switch is on, this server allows
- * it, and no approval change of this bot's own is still being confirmed
- * (approvalModeFor keeps that inert as Ask, and so does GOD MODE). It is
- * decided per request and never written to a bot record, so turning it off
- * returns every bot to its own level. Every engine is covered: one that
- * implements Full runs its turns at Full (godModeElevates); on any other the
- * harness answers each tool permission request the engine sends
- * (request.opened), so no engine keeps asking under GOD MODE. */
+const ownApprovalModeForTurn = (bot, peerInitiated = false) => ownBotApprovalMode(bot, registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, peerInitiated, botWorkModes.permits(approvalModeFor(bot)));
 function godModeCovers(bot) {
-    if (!godModeActive())
-        return false;
-    const grant = bot.approvalGrant;
-    return !(grant && !(grant.threadOnly && grant.threadId !== bot.threadId));
+    return legacyGodModeCovers(bot, godModeActive() && botWorkModes.permits("full"), botWorkModes.selected(bot.id) !== undefined);
 }
 /** GOD MODE runs this bot or thread at Full, whatever its own level says:
  * it is covered (godModeCovers) and its engine implements Full. */
@@ -4563,7 +4547,7 @@ function peerReviewRequired(bot, threadId) {
 /** "Ask me before contacting other bots" is skipped with Full access on the
  * source conversation, and for every bot while GOD MODE is on. */
 function peerApprovalWaived(botId, threadId) {
-    return godModeActive() || fullAccessForSource(botId, threadId);
+    return fullAccessForSource(botId, threadId) || Boolean(store.projectBotForTask(botId, threadId) && godModeCovers(store.projectBotForTask(botId, threadId)));
 }
 /** Full access flows down a Chief of Staff's delegation. The person gave the
  * Chief Full access so its work runs without prompts; a teammate stopping
@@ -4577,7 +4561,7 @@ function peerApprovalWaived(botId, threadId) {
 function delegatedFullAccess(from, fromThreadId, target) {
     // Chibi's GOD MODE never reaches the Private Bot, and the Private Bot's
     // never reaches Chibi: each runs a linked handoff at its own level.
-    if (isPersonalBot(from) !== isPersonalBot(target))
+    if (isPersonalBot(from) !== isPersonalBot(target) || approvalModeFor(target) === "plan")
         return false;
     return delegationInheritsFullAccess({
         senderIsChief: Boolean(from.chiefOfStaff),
@@ -4681,7 +4665,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
     const grantBusy = (bot) => bot.approvalGrant?.threadOnly
         ? threadBusy(bot.id, bot.approvalGrant.threadId) : bot.busy ||
         Boolean(bot.approvalGrant?.allThreads && store.tasks(bot.id).some(task => threadBusy(bot.id, task.threadId)));
-    const grantSupported = (bot, mode) => supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode) &&
+    const grantSupported = (bot, mode) => botWorkModes.permits(mode) && supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode) &&
         (!bot.approvalGrant?.allThreads || store.tasks(bot.id).every(task => supportsApprovalMode(registry.cliTarget((task.modelSelection ?? bot.modelSelection).instanceId)?.driverKind, mode)));
     const clearGrant = (bot) => store.patchBot(bot.id, {
         ...(!bot.approvalGrant?.threadOnly ? { approvalMode: "ask", autoApprove: false } : {}),
@@ -4896,6 +4880,10 @@ function handleDesktopTrustedApprovalMessage(raw) {
         respond({ ok: false, error: "The approval mode is invalid" });
         return true;
     }
+    if (!botWorkModes.permits(mode)) {
+        respond({ ok: false, error: "This mode is disabled in Settings" });
+        return true;
+    }
     const existing = store.bot(botId);
     if (!existing) {
         respond({ ok: false, error: "No such bot" });
@@ -4903,15 +4891,16 @@ function handleDesktopTrustedApprovalMessage(raw) {
     }
     const currentMode = approvalModeFor(existing);
     const threadId = message.threadId;
-    if (message.allThreads !== undefined && (typeof message.allThreads !== "boolean" ||
-        (message.allThreads && (threadId !== undefined || message.threadOnly === true ||
-            message.modelSelection !== undefined || message.updateBotDefault !== undefined ||
-            (mode !== "full" && mode !== "ask"))))) {
+    if (!trustedPlanChangeForStore(store, botId, mode, message)) {
+        respond({ ok: false, error: "Approve the plan in the app before leaving Plan" });
+        return true;
+    }
+    if (invalidAllThreadScope(mode, message)) {
         respond({ ok: false, error: "Invalid all-threads approval scope" });
         return true;
     }
     if (message.allThreads === true && mode === "ask") {
-        const updated = store.setAllThreadApprovalMode(botId, "ask");
+        const updated = store.setAllThreadApprovalMode(botId, "ask", message.approvePlan !== true);
         void stopBotForEmergencyApprovalDowngrade(botId).then(() => respond({ ok: true, bot: wireBot(store.bot(botId) ?? updated) }), () => respond({ ok: false, error: "Approval was reset to Ask, but an active turn could not be stopped" }));
         return true;
     }
@@ -6048,6 +6037,10 @@ function closeSessionStreams(sessionId) {
 }
 sessions.onSessionRevoked((sessionId) => {
     providerAuthSessions.revokeOwner(sessionId);
+    for (const id of botWorkModes.revoke(sessionId)) {
+        store.setAllThreadApprovalMode(id, "ask", true);
+        void interruptBotWork(id);
+    }
     closeSessionStreams(sessionId);
 });
 /** Every frame is numbered, and the last few hundred are kept, so a client
@@ -10051,7 +10044,7 @@ async function startTurn(botId, text, opts) {
             // the bot's first tool call (desktop attachments are host paths).
             const attachedText = commsDepth === 0 ? await withZipListings(providerText) : providerText;
             const setupText = agentsMounted ? expandSetupTurnText(attachedText) : attachedText;
-            const userTurnText = withAssistantProvenance(promptWithReply(skillAuthoring ? expandLearnTurnText(setupText) : setupText, opts?.replyTo, cfg.profile?.name?.trim() || "User"), userMessage.sender, cfg.profile?.name?.trim() || "the person");
+            const userTurnText = withAssistantProvenance(promptWithReply(expandSkillTurnText(setupText, skillAuthoring), opts?.replyTo, cfg.profile?.name?.trim() || "User"), userMessage.sender, cfg.profile?.name?.trim() || "the person");
             // Decided again at dispatch when setup outlasted a soul edit (config).
             const decideContext = (config) => {
                 const handedStale = Boolean(handed && (!unseen || (externalUpdate && handed.config !== config)));
@@ -10817,7 +10810,7 @@ async function startTurn(botId, text, opts) {
                 text: dispatchContext.turnText,
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: approvalModeForTurn(bot, commsDepth > 0),
+                approvalMode: dispatchWorkMode(approvalModeForTurn(bot, commsDepth > 0), registry.cliTarget(instance.instanceId)?.driverKind),
                 model,
                 effort,
                 variant,
@@ -12546,7 +12539,7 @@ failover) {
             .filter(Boolean)
             .join("\n");
         const latestUserText = usesNativeImageInput ? resolvedLatestImages.text : latestUser?.text;
-        const learnTurn = skillAuthoring && latestUserText ? expandLearnTurnText(latestUserText) : "";
+        const learnTurn = latestUserText ? expandSkillTurnText(latestUserText, skillAuthoring) : "";
         const learnBlock = learnTurn && learnTurn !== latestUserText ? `\n\n${learnTurn}` : "";
         const addressedRequest = orchestration?.roomHandoffId ? roomHandoffs.nodes.get(orchestration.roomHandoffId) : undefined;
         // The room transcript already carries recent requests and reports. Repeat
@@ -12769,7 +12762,7 @@ failover) {
                 text,
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: roomTurnApprovalMode(readyBot, orchestration),
+                approvalMode: dispatchWorkMode(roomTurnApprovalMode(readyBot, orchestration), registry.cliTarget(instance.instanceId)?.driverKind),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
                 systemVolatile: roomSystem.volatile,
@@ -13610,8 +13603,9 @@ function handoffAuthorizations(from, sourceThreadId, raw) {
         conversationBotName: from.name,
     });
 }
-/** How long "Sign in" on a bridge server waits for the person's browser sign-in. */
-const MCP_SIGN_IN_TIMEOUT_MS = 180_000;
+/** Test and Reconnect share a single browser-allowed probe per connection.
+ * Bot MCP sessions remain independent to preserve request routing. */
+const interactiveMcpProbe = createInteractiveMcpProbe();
 /** The interview's view of this computer (GET /api/bot-interview/context):
  * only tools that exist here, each with a plain status. The Personal Bot
  * sees only connections marked Personal; a company bot never sees those. */
@@ -16043,6 +16037,24 @@ ROUTES.push(createMcpMarketplaceRoutes({
     fromBot: (req) => authorizedInternalCapability(req.headers.authorization) !== null,
     sessionExpired: (auth) => auth.kind === "session" && !sessions.isLive(auth.session.id),
 }));
+ROUTES.push(createBotWorkModeRoutes({
+    modes: botWorkModes, desktopManaged: DESKTOP_MANAGED, live: id => sessions.isLive(id),
+    bot: id => {
+        const bot = store.bot(id);
+        if (!bot)
+            return undefined;
+        const targets = [bot, ...store.tasks(id).map(task => store.projectBotForTask(id, task.threadId)).filter(Boolean)];
+        return { busy: targets.some(target => threadBusy(id, target.threadId)),
+            revision: JSON.stringify(targets.map(target => [target.threadId, target.modelSelection, target.approvalMode, target.approvalGrant, store.messagesFor(target.threadId).at(-1)?.id])),
+            drivers: targets.map(target => registry.cliTarget(target.modelSelection.instanceId)?.driverKind),
+            current: targets.some(target => approvalModeFor(target) === "plan") ? "plan" : wireBot(bot).workMode ?? "ask" };
+    },
+    stop: interruptBotWork,
+    apply: (id, mode, preservePlan) => { store.setAllThreadApprovalMode(id, mode, preservePlan); },
+    affected: allowed => store.bots.filter(bot => [bot, ...store.tasks(bot.id).map(task => store.projectBotForTask(bot.id, task.threadId)).filter(Boolean)].some(target => ![...allowed, "auto", "custom", "plan"].includes(godModeCovers(target) ? "full" : approvalModeFor(target)))).map(bot => bot.id),
+    changed: id => { const bot = store.bot(id); if (bot)
+        broadcast({ kind: "bot", bot: wireBot(bot) }); },
+}));
 // Settings → AI & accounts → Local models: Ollama's models, pulls and removals.
 ROUTES.push(createLocalModelRoutes({
     ollamaUrl: process.env.OMB_OLLAMA_URL || undefined,
@@ -16158,6 +16170,14 @@ ROUTES.push(createThreadStopRoutes({
         routines?.activeBotRunForBot(botId)?.threadId === threadId,
     stop: stopBotThread,
 }));
+const sharedDeliverables = new SharedDeliverables(DATA_DIR);
+const deliverableAccess = (senderId, auth) => sharedDeliverableAccess(sharedDeliverables, {
+    dataDir: DATA_DIR, pawRoot: paw.root, store, senderId,
+    canSeeBot: auth ? (id) => visibleTo(viewerFor(auth)).bot(id) : () => true,
+    canSeeGroup: auth ? (id) => visibleTo(viewerFor(auth)).group(id) : () => true,
+});
+ROUTES.push(createSharedDeliverablesRoutes(sharedDeliverables, () => deliverableAccess(undefined).sharedBlockedRoots ?? []));
+ROUTES.push(createMessageFileRoutes({ store, attachments: ATTACHMENTS_DIR, workspaceDir, access: deliverableAccess }));
 ROUTES.push(createPinOrderRoutes({ store, visible: (auth) => visibleTo(viewerFor(auth)), personalHidden: personalBotHidden, fromBot: (req) => authorizedInternalCapability(req.headers.authorization) !== null }));
 // Linked repos: Settings > Repos, per-thread links and worktrees. See
 // server/routes/repos.ts for the routes and docs/chibitek/README.md.
@@ -19204,118 +19224,6 @@ const handleRequest = async (req, res) => {
             });
             return res.end(bytes);
         }
-        // Download one local file only when this exact stored message grants it:
-        // a bot must render a Markdown link or carry a generated-image attachment,
-        // while a user message must carry the standalone composer tag. The bot
-        // branch derives conversation/workspace roots; the user branch is limited
-        // to OpenMausBot's private attachment directory. This is deliberately not
-        // a general path reader.
-        m = path.match(/^\/api\/threads\/([\w-]+)\/messages\/([\w-]+)\/file$/);
-        const streamsMessageImage = Boolean(m && method === "GET" && url.searchParams.get("preview") === "1");
-        if (m && (method === "POST" || streamsMessageImage)) {
-            if (method === "POST" && !String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
-                return json(res, 415, { error: "content-type must be application/json" });
-            }
-            const threadId = m[1];
-            const directBot = store.botByThread(threadId);
-            const group = directBot ? undefined : store.groupByThread(threadId);
-            if (!directBot && !group)
-                return json(res, 404, { error: "no such conversation" });
-            const message = store.messagesFor(threadId).find((candidate) => candidate.id === m[2]);
-            if (!message)
-                return json(res, 404, { error: "no such message" });
-            if (message.kind !== "text") {
-                return json(res, 403, { error: "that message does not share this file" });
-            }
-            const body = method === "POST" ? await readBody(req) : null;
-            const rawReference = streamsMessageImage ? url.searchParams.get("ref") : null;
-            if (streamsMessageImage && (!rawReference || !/^\d+$/.test(rawReference))) {
-                return json(res, 400, { error: "ref must identify a rendered image" });
-            }
-            const href = method === "POST"
-                ? (typeof body.path === "string" ? body.path : "")
-                : messageImageTargetAt(message.text ?? "", Number(rawReference));
-            if (!href)
-                return json(res, 400, { error: "path is required" });
-            // Generated image paths are durable capabilities on this exact message.
-            // They do not grant access to arbitrary workspace files or Markdown refs.
-            const generatedImage = method === "POST" && message.role === "bot" &&
-                message.attachments?.some((attachment) => attachment.kind === "image" && attachment.path === href) === true;
-            let roots;
-            let downloadName;
-            if (generatedImage) {
-                roots = [ATTACHMENTS_DIR];
-            }
-            else if (message.role === "user") {
-                downloadName = messageAttachmentName(message.text ?? "", href) ?? undefined;
-                if (!downloadName) {
-                    return json(res, 403, { error: "that message does not share this file" });
-                }
-                roots = [ATTACHMENTS_DIR];
-            }
-            else {
-                if (!messageReferencesFile(message.text ?? "", href)) {
-                    return json(res, 403, { error: "that bot message does not link to this file" });
-                }
-                const senderId = directBot?.id ?? message.from?.botId;
-                // The persisted bot-role message is the author record. Membership is
-                // intentionally not consulted: removing a bot must not break files it
-                // already shared in channel history.
-                if (!senderId) {
-                    return json(res, 403, { error: "the file's bot author could not be verified" });
-                }
-                let pinnedCwd;
-                let configuredCwd;
-                if (directBot) {
-                    pinnedCwd = store.taskByThread(directBot.id, threadId)?.cwd;
-                    configuredCwd = directBot.cwd;
-                }
-                else if (group) {
-                    const task = store.groupTaskByThread(group.id, threadId);
-                    pinnedCwd = task ? task.pinnedCwd : group.threadId === threadId ? group.pinnedCwd : undefined;
-                    configuredCwd = group.cwd;
-                }
-                roots = messageFileRoots({
-                    senderWorkspace: workspaceDir(senderId),
-                    attachments: ATTACHMENTS_DIR,
-                    pinnedCwd,
-                    configuredCwd,
-                });
-            }
-            const file = await openMessageFile(href, roots);
-            if ((streamsMessageImage || generatedImage) && !file.mime.startsWith("image/")) {
-                await file.handle.close();
-                return json(res, 415, { error: "only images can be previewed here" });
-            }
-            res.writeHead(200, {
-                "content-type": file.mime,
-                "content-length": String(file.bytes),
-                ...(streamsMessageImage
-                    ? { "content-disposition": "inline" }
-                    : { "content-disposition": messageFileDisposition(messageFileDownloadName(downloadName, file.name)) }),
-                "cache-control": streamsMessageImage ? "private, max-age=3600" : "private, no-store",
-                "cdn-cache-control": "no-store",
-                "cloudflare-cdn-cache-control": "no-store",
-                pragma: "no-cache",
-                vary: "Authorization",
-                "x-content-type-options": "nosniff",
-                ...(streamsMessageImage
-                    ? {
-                        "cross-origin-resource-policy": "same-origin",
-                        "referrer-policy": "no-referrer",
-                    }
-                    : {}),
-            });
-            if (file.bytes === 0) {
-                await file.handle.close();
-                return res.end();
-            }
-            const stream = file.handle.createReadStream({ start: 0, end: file.bytes - 1, autoClose: true });
-            stream.on("error", () => res.destroy());
-            res.on("close", () => stream.destroy());
-            stream.pipe(res);
-            return;
-        }
         // ── image attachments ────────────────────────────────────────────────
         // Pasted/dropped images are stored as files and referenced by path in
         // the prompt (<attached-image path="…"/>); this pair of routes is the
@@ -21283,8 +21191,12 @@ const handleRequest = async (req, res) => {
             else {
                 requestedApprovalMode = approvalModeFor(existingBot ?? {});
             }
+            if (!botWorkModes.permits(requestedApprovalMode))
+                return json(res, 403, { error: "This mode is disabled in Settings" });
             const currentApprovalMode = approvalModeFor(existingBot ?? {});
             const approvalChangeRequested = body.approvalMode !== undefined || body.autoApprove !== undefined;
+            if (currentApprovalMode === "plan" && requestedApprovalMode !== "plan")
+                return json(res, 403, { error: "Approve the plan in the app before leaving Plan" });
             if (existingBot?.busy && approvalChangeRequested && requestedApprovalMode !== currentApprovalMode) {
                 return json(res, 409, {
                     error: "stop this bot's turn before changing its approval level",
@@ -21299,13 +21211,13 @@ const handleRequest = async (req, res) => {
             const targetSelection = normalizedSelection ?? existingBot?.modelSelection;
             if (normalizedSelection && selectedTask) {
                 const mode = approvalModeFor(selectedTask);
-                if ((mode === "full" || mode === "custom") &&
+                if ((mode === "full" || mode === "custom" || mode === "plan") &&
                     (!supportsApprovalMode(registry.cliTarget(normalizedSelection.instanceId)?.driverKind, mode) ||
                         registry.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry.cliTarget(selectedTask.modelSelection.instanceId)?.driverKind)) {
                     return json(res, 400, { error: "Choose Ask for the selected thread before changing providers with elevated permissions" });
                 }
             }
-            if ((requestedApprovalMode === "full" || requestedApprovalMode === "custom") &&
+            if ((requestedApprovalMode === "full" || requestedApprovalMode === "custom" || requestedApprovalMode === "plan") &&
                 (body.approvalMode !== undefined || normalizedSelection !== undefined) &&
                 (!targetSelection || !supportsApprovalMode(registry.cliTarget(targetSelection.instanceId)?.driverKind, requestedApprovalMode) ||
                     (existingBot && normalizedSelection && registry.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry.cliTarget(existingBot.modelSelection.instanceId)?.driverKind))) {
@@ -23009,14 +22921,19 @@ const handleRequest = async (req, res) => {
                 if (!checked.ok)
                     return json(res, checked.status, { error: checked.error });
                 patch.modelSelection = checked.selection;
+                if (approvalModeFor(current) === "plan" && !supportsApprovalMode(registry.cliTarget(checked.selection.instanceId)?.driverKind, "plan"))
+                    return json(res, 400, { error: "Choose Ask before switching from Plan to this engine" });
             }
             if (body.approvalMode !== undefined || body.autoApprove !== undefined) {
                 if (body.autoApprove !== undefined && typeof body.autoApprove !== "boolean")
                     return json(res, 400, { error: "autoApprove must be a boolean" });
                 const mode = body.approvalMode ?? (body.autoApprove ? "auto" : "ask");
-                // Elevated modes still require the trusted desktop transition. A
-                // thread settings PATCH cannot manufacture that grant.
-                if (mode !== "ask" && mode !== "auto" && mode !== "edits")
+                if (!botWorkModes.permits(mode))
+                    return json(res, 403, { error: "This mode is disabled in Settings" });
+                if (approvalModeFor(current) === "plan" && mode !== "plan")
+                    return json(res, 403, { error: "Approve the plan in the app before leaving Plan" });
+                // A settings PATCH cannot manufacture an elevated grant.
+                if (mode !== "ask" && mode !== "auto" && mode !== "edits" && mode !== "plan")
                     return json(res, 403, { error: "Full and Custom access require trusted desktop confirmation" });
                 if (approvalModeFor(current) === "custom")
                     return json(res, 403, { error: "Leaving Custom approval requires confirmation in the packaged desktop app" });
@@ -23995,7 +23912,7 @@ const handleRequest = async (req, res) => {
             const testBlocked = mcpLaunchBlocker(parsed.server);
             if (testBlocked)
                 return json(res, 409, { error: `${mcpTest[1]} cannot start yet: ${mcpLaunchBlockerReason(testBlocked)}`, code: testBlocked });
-            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES) {
+            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES && !interactiveMcpProbe.has(bridgedMcpServer(parsed.server, true))) {
                 return json(res, 429, { error: "Two MCP connection tests are already running." });
             }
             const controller = new AbortController();
@@ -24006,11 +23923,9 @@ const handleRequest = async (req, res) => {
             res.once("close", disconnect);
             mcpProbesInFlight += 1;
             try {
-                // `?connect=1`: the person's own sign-in through a bridge's browser
-                // page (Mochii, Nexus). It waits for them, not for a machine.
-                const connecting = url.searchParams.get("connect") === "1";
-                // A person's click: the one start besides Reconnect that may open a browser.
-                const probed = await probeMcpServer(bridgedMcpServer(parsed.server, true), connecting ? MCP_SIGN_IN_TIMEOUT_MS : undefined, controller.signal);
+                // Test may open a browser even without ?connect=1. Keep its callback
+                // listener alive for the same MFA window as Reconnect.
+                const probed = await interactiveMcpProbe(bridgedMcpServer(parsed.server, true), controller.signal);
                 if (probed.ok) {
                     mcpAuthState.noteOk(mcpTest[1]);
                     mcpHealth.noteOk(mcpTest[1]);
@@ -24049,7 +23964,7 @@ const handleRequest = async (req, res) => {
             const reconnectBlocked = mcpLaunchBlocker(parsed.server);
             if (reconnectBlocked)
                 return json(res, 409, { error: `${name} cannot start yet: ${mcpLaunchBlockerReason(reconnectBlocked)}`, code: reconnectBlocked });
-            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES) {
+            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES && !interactiveMcpProbe.has(bridgedMcpServer(parsed.server, true))) {
                 return json(res, 429, { error: "Two MCP connection tests are already running." });
             }
             const controller = new AbortController();
@@ -24060,7 +23975,7 @@ const handleRequest = async (req, res) => {
             res.once("close", disconnect);
             mcpProbesInFlight += 1;
             try {
-                const probed = await probeMcpServer(bridgedMcpServer(parsed.server, true), MCP_SIGN_IN_TIMEOUT_MS, controller.signal);
+                const probed = await interactiveMcpProbe(bridgedMcpServer(parsed.server, true), controller.signal);
                 if (probed.ok) {
                     mcpAuthState.noteOk(name);
                     mcpHealth.noteOk(name);
@@ -25120,6 +25035,8 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 405, { error: "method not allowed" });
         }
+        if (await remoteDesktopRoute(path, method, req, res, { store, surface: computerPreviewSurface, controlHeld: (id) => botComputerControlSnapshot(id).held }))
+            return;
         m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/viewer-close$/);
         if (m && method === "POST") {
             const bot = computerPreviewBot(m[1], url);

package/dist-server/server/mcp-interactive-probe.js

@@ -0,0 +1,60 @@
+// One browser-allowed probe per resolved connection. Bot MCP sessions remain
+// independent: sharing those would misroute server-initiated requests.
+import { createHash } from "node:crypto";
+import { probeMcpServer } from "./mcp-probe.js";
+import { MCP_SIGN_IN_TIMEOUT_MS } from "./mcp-remote-bridge.js";
+const cancelled = () => ({ ok: false, error: "Connection test was cancelled." });
+function connectionKey(spec) {
+    // Include every resolved argument and credential value, never just the
+    // display name/URL. Only a digest is retained as the map key, never logged.
+    return createHash("sha256").update(JSON.stringify(spec, (_key, value) => {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+        }
+        return value;
+    })).digest("hex");
+}
+export function createInteractiveMcpProbe(probe = probeMcpServer) {
+    const pending = new Map();
+    const run = (spec, signal) => {
+        if (signal?.aborted)
+            return Promise.resolve(cancelled());
+        const key = connectionKey(spec);
+        let entry = pending.get(key);
+        if (!entry) {
+            const controller = new AbortController();
+            entry = { controller, result: Promise.resolve().then(() => probe(spec, MCP_SIGN_IN_TIMEOUT_MS, controller.signal)), callers: 0 };
+            pending.set(key, entry);
+            const current = entry;
+            const clear = () => { if (pending.get(key) === current)
+                pending.delete(key); };
+            void current.result.then(clear, clear);
+        }
+        const current = entry;
+        current.callers += 1;
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const release = () => {
+                if (settled)
+                    return false;
+                settled = true;
+                signal?.removeEventListener("abort", abort);
+                current.callers -= 1;
+                if (!current.callers && pending.get(key) === current) {
+                    pending.delete(key);
+                    current.controller.abort();
+                }
+                return true;
+            };
+            const abort = () => { if (release())
+                resolve(cancelled()); };
+            signal?.addEventListener("abort", abort, { once: true });
+            void current.result.then((result) => { if (release())
+                resolve(result); }, (error) => { if (release())
+                reject(error); });
+            if (signal?.aborted)
+                abort();
+        });
+    };
+    return Object.assign(run, { has: (spec) => pending.has(connectionKey(spec)) });
+}

package/dist-server/server/mcp-remote-bridge.js

@@ -19,6 +19,7 @@ import { basename, dirname } from "node:path";
 /** The bundled bridge's exit code when it needed a browser sign-in and was
  * told not to open one (EX_NOPERM). */
 export const MCP_SIGN_IN_REQUIRED_EXIT = 77;
+export const MCP_SIGN_IN_TIMEOUT_MS = 300_000;
 /** Set on a bridge's environment: never open a browser, exit instead. */
 export const MCP_NO_BROWSER_ENV = "ATOMIC_MCP_NO_BROWSER";
 /** The line the bundled bridge writes to stderr before that exit. */
@@ -63,6 +64,13 @@ export function bridgeMcpRemote(spec, options) {
     const target = mcpRemoteTarget(spec);
     if (!target)
         return spec;
+    // A stable redirect host prevents saved OAuth clients becoming invalid when
+    // an upstream/platform default changes. Preserve an explicitly configured host.
+    const extraArgs = target.extraArgs.includes("--host")
+        ? [...target.extraArgs]
+        : [...target.extraArgs, "--host", "localhost"];
+    if (!extraArgs.includes("--auth-timeout"))
+        extraArgs.push("--auth-timeout", String(MCP_SIGN_IN_TIMEOUT_MS / 1_000));
     const noBrowser = options.allowBrowser ? {} : { [MCP_NO_BROWSER_ENV]: "1" };
     const env = { ...spec.env };
     // A stale flag from an older start must not outlive a person's click.
@@ -71,16 +79,15 @@ export function bridgeMcpRemote(spec, options) {
     // A bundled entry keeps its own script: the desktop app already repoints
     // it at the current Resources copy on launch (electron/chibitek-defaults.mjs).
     if (target.bundled)
-        return { ...spec, env: { ...env, ...noBrowser } };
-    // Without a built bridge the npx form stays as configured: it may still
-    // open a browser, which is what this release did before. Never silently
-    // drop a server the person added.
+        return { ...spec, args: [spec.args[0], target.url, ...extraArgs], env: { ...env, ...noBrowser } };
+    // Keep the redirect stable even in a dev checkout without a built bridge.
+    // The unbundled command retains its existing browser behavior.
     if (!options.bridge)
-        return spec;
+        return { ...spec, args: [...spec.args.slice(0, spec.args.length - target.extraArgs.length), ...extraArgs] };
     return {
         ...spec,
         command: options.execPath,
-        args: [options.bridge, target.url, ...target.extraArgs],
+        args: [options.bridge, target.url, ...extraArgs],
         env: { ...env, ELECTRON_RUN_AS_NODE: "1", ...noBrowser },
     };
 }