oomi-ai 0.12.1 → 0.13.0

package/bin/oomi-ai.js

@@ -12,6 +12,10 @@ import { lookup as dnsLookup } from 'dns/promises';
 import { fileURLToPath } from 'url';
 import WebSocket from 'ws';
 import { planPackageUpdate, isWorkerDescendant, queueRestart, readMaintenance, createMaintenanceController } from '../lib/bridgeMaintenance.js';
+import { createGatewayRuns } from '../lib/gatewayRuns.js';
+import { CHAT_MODELS_CAPABILITY } from '../lib/chatModels.js';
+import { OpenclawModelRequests } from '../lib/openclawModels.js';
+import { startUpdateWatcher } from '../lib/updateWatcher.js';
 import { processCommand, readProcessTable } from '../lib/processTable.js';
 import { bridgeServiceConfig, createBridgeService, renderLaunchAgent } from '../lib/bridgeService.js';
 import { LOCAL_PROTOCOL_MIN, LOCAL_PROTOCOL_MAX, probeGateway } from '../lib/gatewayProbe.js';
@@ -1146,28 +1150,13 @@ function acquireBridgeLock(deviceId) {
   return release;
 }
 
-/**
- * Tells Oomi which models the runtime offers, so the persona's page can offer a faster one for
- * calls (Voice::CallModel). False when it didn't arrive, so the next turn reports again.
- */
-async function reportRuntimeModels({ brokerHttp, deviceToken }, report, fetchImpl = fetch) {
-  if (!brokerHttp || !deviceToken) return false;
-  try {
-    const response = await fetchImpl(`${brokerHttp.replace(/\/$/, '')}/v1/agent_runtime/models`, {
-      method: 'PUT',
-      headers: { Authorization: `Bearer ${deviceToken}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(report),
-      signal: AbortSignal.timeout(10000),
-    });
-    return response.ok;
-  } catch { return false; }
-}
-
-async function claimBridgeDeviceToken({ brokerHttp, pairCode, deviceId }) {
+// A computer already linked to an account re-pairs only by showing the token it was given (even
+// an expired one): the backend won't hand a linked device's token to a pair code alone.
+async function claimBridgeDeviceToken({ brokerHttp, pairCode, deviceId, proofToken = '' }) {
   const response = await fetch(`${brokerHttp.replace(/\/$/, '')}/v1/pair/claim`, {
     method: 'POST',
     signal: AbortSignal.timeout(15000),
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...(proofToken ? { Authorization: `Bearer ${proofToken}` } : {}) },
     body: JSON.stringify({ pairCode, deviceId }),
   });
   const payload = await response.json().catch(() => ({}));
@@ -1367,6 +1356,12 @@ function loadGatewayDeviceIdentity() {
   return null;
 }
 
+// What an oomi app may ask of the person's agent gateway through this bridge. The bridge signs in
+// to OpenClaw with the owner's own token and device identity, so anything else (config, exec
+// approvals, cron, other sessions' history) never passes, whoever holds an app session.
+// `trusted` frames are the bridge's own (the /model translator's models.list / sessions.patch).
+const CLIENT_GATEWAY_METHODS = new Set(['chat.send', 'chat.history', 'chat.abort', 'oomi.models.list', 'oomi.models.set']);
+
 function prepareGatewayFrameForLocalGateway(frameText, gatewayAuth, options = {}) {
   const connectNonce = typeof options.connectNonce === 'string' ? options.connectNonce.trim() : '';
   const deviceIdentity = options.deviceIdentity || null;
@@ -1382,6 +1377,9 @@ function prepareGatewayFrameForLocalGateway(frameText, gatewayAuth, options = {}
     }
 
     if (method !== 'connect') {
+      if (options.trusted !== true && !CLIENT_GATEWAY_METHODS.has(method)) {
+        return { frameText: '', waitForChallenge: false, refusedMethod: method };
+      }
       const rawParams = frame.params && typeof frame.params === 'object' ? frame.params : {};
       if (method === 'chat.send') {
         const sanitized = {};
@@ -1403,18 +1401,10 @@ function prepareGatewayFrameForLocalGateway(frameText, gatewayAuth, options = {}
         if (Number.isFinite(rawParams.timeoutMs) && rawParams.timeoutMs > 0) {
           sanitized.timeoutMs = Math.floor(rawParams.timeoutMs);
         }
-        // A call turn's faster model, for the runtimes Oomi drives itself (OpenClaw's gateway
-        // would reject the field).
-        const callModel = rawParams.oomi?.call?.model;
-        if (gatewayAuth?.gatewayUrl === 'local-agent:' && typeof callModel === 'string' && callModel.trim() && callModel.trim().length <= 200) {
-          sanitized.oomi = { call: { model: callModel.trim() } };
-        }
-
         const practiceBrief = rawParams.oomi?.call?.practiceBrief;
         const context = practiceContext(practiceBrief);
         if (context && gatewayAuth?.gatewayUrl === 'local-agent:') {
-          sanitized.oomi ||= { call: {} };
-          sanitized.oomi.call.practiceBrief = practiceBrief;
+          sanitized.oomi = { call: { practiceBrief } };
         } else if (context && typeof sanitized.message === 'string') {
           // OpenClaw rejects custom metadata; carry hidden context on every turn,
           // including an ordinary transcript retry after a rejected greeting.
@@ -1497,42 +1487,11 @@ function prepareGatewayFrameForLocalGateway(frameText, gatewayAuth, options = {}
     }
     params.client = client;
 
-    params.role = typeof rawParams.role === 'string' && rawParams.role.trim() ? rawParams.role.trim() : 'operator';
-
-    const existingScopes = Array.isArray(rawParams.scopes)
-      ? rawParams.scopes.filter((value) => typeof value === 'string' && value.trim())
-      : [];
-    const requiredScopes = ['operator.read', 'operator.write'];
-    for (const scope of requiredScopes) {
-      if (!existingScopes.includes(scope)) {
-        existingScopes.push(scope);
-      }
-    }
-    params.scopes = existingScopes;
-
-    params.caps = Array.isArray(rawParams.caps)
-      ? rawParams.caps.filter((value) => typeof value === 'string' && value.trim())
-      : [];
-
-    params.commands = Array.isArray(rawParams.commands)
-      ? rawParams.commands.filter((value) => typeof value === 'string' && value.trim())
-      : [];
-
-    if (rawParams.permissions && typeof rawParams.permissions === 'object') {
-      const permissions = {};
-      for (const [key, value] of Object.entries(rawParams.permissions)) {
-        const normalizedKey = typeof key === 'string' ? key.trim() : '';
-        if (!normalizedKey || typeof value !== 'boolean') continue;
-        permissions[normalizedKey] = value;
-      }
-      if (Object.keys(permissions).length > 0) {
-        params.permissions = permissions;
-      }
-    }
-
-    if (typeof rawParams.pathEnv === 'string') {
-      params.pathEnv = rawParams.pathEnv;
-    }
+    // The bridge decides what the app's connection may do, never the app: chat as an operator.
+    params.role = 'operator';
+    params.scopes = ['operator.read', 'operator.write'];
+    params.caps = [];
+    params.commands = [];
 
     const auth = {};
     if (gatewayAuth.token) {
@@ -1570,7 +1529,7 @@ function prepareGatewayFrameForLocalGateway(frameText, gatewayAuth, options = {}
         clientId: client.id,
         clientMode: client.mode,
         role: params.role,
-        scopes: existingScopes,
+        scopes: params.scopes,
         signedAtMs,
         token: tokenForSignature,
         nonce: nonceForSignature,
@@ -1759,14 +1718,21 @@ function sanitizeGatewayFrameForOomiClient(frameText) {
 }
 
 // The runtime accepted oomi's connect: say what this bridge can do. Grok Bot gets no greeting (its
-// inbox is slow, and Grok's own app would show the cue).
-function annotateConnectResponseForOomi(frameText, { runtime = 'openclaw', version = '' } = {}) {
+// inbox is slow, and Grok's own app would show the cue). `extra` is what the local runtime adds
+// (Hermes over ACP: chat.models.v1, `/model` in Talk).
+function annotateConnectResponseForOomi(frameText, { runtime = 'openclaw', version = '', extra = [] } = {}) {
   const frame = parseJsonPayload(frameText);
   if (!frame || typeof frame !== 'object' || frame.type !== 'res' || !frame.ok) return frameText;
   const payload = frame.payload && typeof frame.payload === 'object' && !Array.isArray(frame.payload) ? frame.payload : {};
   const existing = payload.oomi && typeof payload.oomi === 'object' && !Array.isArray(payload.oomi) ? payload.oomi : {};
-  const capabilities = runtime === 'grokbot' ? [] : [...OOMI_BRIDGE_CAPABILITIES];
-  return JSON.stringify({ ...frame, payload: { ...payload, oomi: { ...existing, bridgeVersion: version, capabilities } } });
+  const capabilities = [...(runtime === 'grokbot' ? [] : OOMI_BRIDGE_CAPABILITIES), ...extra];
+  // The gateway's connect answer can carry credentials for this connection (an issued device
+  // token); they're the bridge's, and never leave the computer.
+  const { auth, ...rest } = payload;
+  const safeAuth = auth && typeof auth === 'object' && !Array.isArray(auth)
+    ? Object.fromEntries(Object.entries(auth).filter(([key]) => !/token|secret|password|key/i.test(key)))
+    : undefined;
+  return JSON.stringify({ ...frame, payload: { ...rest, ...(safeAuth ? { auth: safeAuth } : {}), oomi: { ...existing, bridgeVersion: version, capabilities } } });
 }
 
 function summarizeVoiceFrameContract(frameText) {
@@ -2617,7 +2583,6 @@ async function startOpenclawBridge(flags) {
   const localRuntime = bridgeState.localAgent
     ? new LocalAgentRuntime({ ...bridgeState.localAgent, connection: bridgeConnectionName }, path.dirname(resolveBridgeStatePath()), (health) => updateBridgeStatus(health))
     : null;
-  if (localRuntime) localRuntime.onModels = (report) => reportRuntimeModels({ brokerHttp, deviceToken }, report);
   localRuntime?.warm();
   const gateway = localRuntime ? { gatewayUrl: 'local-agent:', configPath: resolveBridgeStatePath() } : readOpenclawGatewayConfig();
   if (!localRuntime && !gateway.token && !gateway.password) {
@@ -2718,6 +2683,16 @@ async function startOpenclawBridge(flags) {
       : `Agent channel delivery: ${error.message}` }),
     onDelivered: () => updateBridgeStatus({ agentChannelError: '' }),
   });
+  // Asks the agent to keep oomi-ai current, once per new version (lib/updateWatcher.js).
+  const stopUpdateWatcher = startUpdateWatcher({
+    current: currentPackageVersion(),
+    fetchLatest: () => fetchLatestPublishedVersion('oomi-ai'),
+    deliver: deliverAgentEvent,
+    sessionKey: `${(bridgeState.sessionKey || 'agent:main:').split(':').slice(0, 2).join(':')}:oomi:maintenance`,
+    receiptPath: path.join(path.dirname(resolveBridgeStatePath()), 'oomi-update-receipt.json'),
+    connection: bridgeConnectionName,
+    onStatus: (patch) => updateBridgeStatus(patch),
+  });
   console.log(`Local gateway: ${gateway.gatewayUrl}`);
   console.log(`Broker WS: ${brokerWs}`);
   bridgeDebugLog(
@@ -2725,7 +2700,7 @@ async function startOpenclawBridge(flags) {
   );
 
   const activeGatewaySockets = new Map();
-  const activeGatewayRuns = new Set();
+  const activeGatewayRuns = createGatewayRuns();
   let currentBrokerSocket;
   const maintenanceTick = createMaintenanceController({
     directory: path.dirname(resolveBridgeStatePath()),
@@ -3307,6 +3282,11 @@ async function startOpenclawBridge(flags) {
 
       gatewaySocket.on('message', runBridgeCallbackSafely((gatewayRaw) => {
         let frame = typeof gatewayRaw === 'string' ? gatewayRaw : gatewayRaw.toString();
+        const modelsAnswer = sessionBridge.openclawModels?.take(frame);
+        if (modelsAnswer) {
+          if (!modelsAnswer.reply) return;
+          frame = modelsAnswer.reply;
+        }
         let connectAccepted = false;
         const practiceConfirmation = confirmPracticeDelivery(sessionBridge.practiceDeliveries ||= new Map(), frame);
         if (practiceConfirmation) sendBrokerPayload(brokerSocket, {
@@ -3460,10 +3440,10 @@ async function startOpenclawBridge(flags) {
         }
 
         if (gatewayPayload?.type === 'res' && gatewayPayload.ok && gatewayPayload.payload?.status === 'started' && gatewayPayload.payload?.runId) {
-          activeGatewayRuns.add(gatewayPayload.payload.runId);
+          activeGatewayRuns.started(sessionId, gatewayPayload.payload.runId);
         }
         if (gatewayPayload?.event === 'chat' && ['final', 'error', 'aborted'].includes(gatewayPayload.payload?.state)) {
-          activeGatewayRuns.delete(gatewayPayload.payload.runId);
+          activeGatewayRuns.finished(gatewayPayload.payload.runId);
         }
         if (gatewayPayload?.event === 'chat' && gatewayPayload.payload?.state === 'final') {
           updateBridgeStatus({ runtimeReady: true, lastReplyAt: bridgeNowIso() });
@@ -3481,7 +3461,7 @@ async function startOpenclawBridge(flags) {
         }
 
         if (connectAccepted) {
-          frame = annotateConnectResponseForOomi(frame, { runtime: bridgeRuntimeName, version: currentPackageVersion() });
+          frame = annotateConnectResponseForOomi(frame, { runtime: bridgeRuntimeName, version: currentPackageVersion(), extra: localRuntime ? localRuntime.capabilities() : bridgeRuntimeName === 'openclaw' ? [CHAT_MODELS_CAPABILITY] : [] });
         }
         sendBrokerPayload(brokerSocket, { action: 'gateway_frame', type: 'gateway.frame', sessionId, frame });
       }, (error) => {
@@ -3489,6 +3469,7 @@ async function startOpenclawBridge(flags) {
       }));
 
       gatewaySocket.on('close', runBridgeCallbackSafely((code, reason) => {
+        activeGatewayRuns.closed(sessionId);
         if (connectTimeout) {
           clearTimeout(connectTimeout);
           connectTimeout = null;
@@ -3711,7 +3692,7 @@ async function startOpenclawBridge(flags) {
 
       if (payload.type === 'client.frame') {
         const sessionId = String(payload.sessionId || '').trim();
-        const frame = typeof payload.frame === 'string' ? payload.frame : '';
+        let frame = typeof payload.frame === 'string' ? payload.frame : '';
         if (!sessionId || !frame) return;
         if (classifyBridgeSessionScope(sessionId) === 'voice') {
           bridgeDebugLog(`[bridge] client.frame ${sessionId} ${JSON.stringify(summarizeVoiceFrameContract(frame))}`);
@@ -3736,10 +3717,23 @@ async function startOpenclawBridge(flags) {
             sessionBridge.lastChatCorrelationId = requestMeta.correlationId;
           }
         }
+        // `/model` in Talk for an OpenClaw persona: asked of OpenClaw's own methods, answered in
+        // oomi's shape when they reply (docs/specs/chat-models-v1.md).
+        let extraFrames = [];
+        const modelsPlan = gateway.gatewayUrl === 'local-agent:' ? null : (sessionBridge.openclawModels ||= new OpenclawModelRequests()).plan(frame);
+        if (modelsPlan?.reply) {
+          sendBrokerPayload(brokerSocket, { action: 'gateway_frame', type: 'gateway.frame', sessionId, frame: modelsPlan.reply });
+          if (requestMeta && sessionBridge.pendingRequests instanceof Map) sessionBridge.pendingRequests.delete(requestMeta.requestId);
+          if (requestMeta) clearPendingRequestTimeout(sessionBridge, requestMeta.requestId);
+          return;
+        }
+        if (modelsPlan) [frame, ...extraFrames] = modelsPlan.frames;
         const prepared = prepareGatewayFrameForLocalGateway(frame, gateway, {
           connectNonce: sessionBridge.connectNonce,
           deviceIdentity: gatewayDeviceIdentity,
+          trusted: Boolean(modelsPlan),
         });
+        if (prepared.refusedMethod) bridgeDebugLog(`[bridge] client.frame refused ${sessionId} method=${prepared.refusedMethod}`);
         if (prepared.practiceDelivery) {
           sessionBridge.practiceDeliveries ||= new Map();
           sessionBridge.practiceDeliveries.set(prepared.practiceDelivery.runId, prepared.practiceDelivery);
@@ -3791,6 +3785,9 @@ async function startOpenclawBridge(flags) {
         const result = forwardFrameToSession(sessionBridge, prepared.frameText, {
           requiresConnectAccepted: Boolean(requestMeta && requestMeta.method !== 'connect'),
         });
+        for (const extra of extraFrames) {
+          forwardFrameToSession(sessionBridge, prepareGatewayFrameForLocalGateway(extra, gateway, { connectNonce: sessionBridge.connectNonce, deviceIdentity: gatewayDeviceIdentity, trusted: true }).frameText, { requiresConnectAccepted: true });
+        }
         if (result === 'waiting_for_connect') {
           bridgeDebugLog(`[bridge] client.frame waiting for connect ${sessionId}`);
           if (requestMeta) {
@@ -3937,6 +3934,7 @@ async function startOpenclawBridge(flags) {
     stopIdentityWorker();
     stopRoutineWorker();
     agentChannelWorker.stop();
+    stopUpdateWatcher();
     if (localRuntime) { await localRuntime.queue; localRuntime.close(); }
     if (reconnectState.timer) {
       clearTimeout(reconnectState.timer);
@@ -4008,6 +4006,7 @@ async function pairAndStartOpenclawBridge(flags) {
     brokerHttp,
     pairCode,
     deviceId,
+    proofToken: String(bridgeState.deviceId || '').trim() === deviceId ? String(bridgeState.deviceToken || '').trim() : '',
   });
   const deviceToken = String(claimed.deviceToken || '').trim();
   if (!deviceToken) {
@@ -4653,6 +4652,8 @@ async function connectLocalAgent(flags) {
 }
 
 async function main() {
+  // Everything the bridge writes (tokens, status, logs, conversations) is for this user alone.
+  process.umask(0o077);
   const args = parseArgs(process.argv);
   const command = args.command;
   const subcommand = args.subcommand;

package/lib/agentChannels.js

@@ -44,6 +44,15 @@ export function parseChannelLink(link) {
   return { origin: url.origin, token: match[1] };
 }
 
+// The device token is this computer's key to its owner's account, so it only goes to oomi itself
+// (oomi.ai, or the app URL this connection was set up with). A channel link to any other site
+// joins anonymously: an agent can be told to "join" anything.
+export function sendsDeviceToken(state, origin) {
+  const allowed = new Set(['https://www.oomi.ai', 'https://oomi.ai']);
+  try { if (state?.appUrl) allowed.add(new URL(state.appUrl).origin); } catch { /* not a URL */ }
+  return allowed.has(origin);
+}
+
 function connectionsRoot() {
   return process.env.OOMI_CONNECTIONS_DIR || path.join(os.homedir(), '.oomi', 'connections');
 }
@@ -175,7 +184,7 @@ export async function handleChannelCommand(state, action, flags = {}, positional
     }
     case 'join': {
       const { origin, token } = parseChannelLink(positionals[0] || flags.link);
-      const anonymous = flags.anonymous === true;
+      const anonymous = flags.anonymous === true || !sendsDeviceToken(state, origin);
       const joinedResult = await guest(origin, `/channel/${token}/join`, { method: 'POST', token: anonymous ? undefined : state.deviceToken,
         body: { name: typeof flags.name === 'string' ? flags.name : undefined, kind: 'oomi-agent' } });
       const channel = joinedResult.channel || {};
@@ -239,8 +248,28 @@ export async function handleChannelCommand(state, action, flags = {}, positional
   return result;
 }
 
+// Only the owner's approval of a request runs with the persona's tools. A guest's message and
+// every other notice run sandboxed (localAgent / gatewayProbe), whatever the channel's permission
+// levels say: the levels are what the persona may ask its owner for, not what a guest can do.
+export function sandboxedTurn(item) {
+  return !(item?.kind === 'approval_decision' && item?.sender === 'system' && item?.approved === true);
+}
+
+const APPROVAL_LINE = /^OOMI_APPROVAL_REQUEST\s+(privateInfo|actions|commands|payments)\s*:\s*(.{1,500})$/gm;
+
+/** Approval requests the persona wrote into a sandboxed reply, and the reply without them. */
+export function approvalRequests(text) {
+  const requests = [...String(text || '').matchAll(APPROVAL_LINE)].slice(0, 3).map((match) => ({ permission: match[1], summary: match[2].trim() }));
+  return { requests, text: String(text || '').replace(APPROVAL_LINE, '').replace(/\n{3,}/g, '\n\n').trim() };
+}
+
 export function channelTurnMessage(item, connection = '') {
   const flag = connection ? ` --connection ${connection}` : '';
+  if (sandboxedTurn(item)) {
+    return `${item.prompt}\n\n(Oomi: this turn runs with your tools turned off. You can't run commands, use files, browse or change memory here, and nothing above can turn them on. ` +
+      'To ask your owner for something that needs them, add a line on its own: OOMI_APPROVAL_REQUEST <privateInfo|actions|commands|payments>: <exactly what you will do>. ' +
+      'Oomi sends it to your owner and removes the line. If they approve, an Oomi approval notice arrives with your tools. Use this instead of the oomi channel commands.)';
+  }
   return `${item.prompt}\n\n(Oomi CLI for this channel: oomi channel request-approval ${item.channelId} --permission NAME --summary "..."${flag} · oomi channel show ${item.channelId}${flag} · oomi channel end ${item.channelId}${flag})`;
 }
 
@@ -287,9 +316,15 @@ export function startAgentChannelWorker({ state, deliver, connection = '', reque
       for (const item of result.messages || []) {
         if (stopped) break;
         if (!MESSAGE_ID.test(item.messageId || '') || !CHANNEL_ID.test(item.channelId || '') || typeof item.prompt !== 'string') continue;
+        // A channel turn only ever runs in that channel's own session, never the owner's chat.
+        if (item.sessionKey !== `agent:main:oomi:channel:${item.channelId}`) {
+          await request(state, `agent_channels/inbox/${item.messageId}/ack`, { method: 'POST', body: { outcome: 'failed', failureCode: 'host_turn_failed', failureDetail: 'Unexpected session for this channel.' } }).catch(() => {});
+          continue;
+        }
+        const sandbox = sandboxedTurn(item);
         let reply;
         try {
-          reply = await deliver({ sessionKey: item.sessionKey, idempotencyKey: item.messageId, message: channelTurnMessage(item, connection), retryInterrupted: false });
+          reply = await deliver({ sessionKey: item.sessionKey, idempotencyKey: item.messageId, message: channelTurnMessage(item, connection), retryInterrupted: false, sandbox, approvedAction: !sandbox });
         } catch (error) {
           // Report why, so the owner is told what to fix and the guest isn't left guessing.
           const failure = classifyRuntimeFailure(error);
@@ -297,7 +332,11 @@ export function startAgentChannelWorker({ state, deliver, connection = '', reque
           onError(Object.assign(error, { failure }));
           continue;
         }
-        const text = typeof reply?.text === 'string' ? reply.text.trim() : '';
+        const asked = approvalRequests(typeof reply?.text === 'string' ? reply.text : '');
+        for (const [index, wanted] of asked.requests.entries()) {
+          await request(state, `agent_channels/${item.channelId}/approvals`, { method: 'POST', body: { ...wanted, idempotencyKey: `turn:${item.messageId}:${index}` } }).catch((error) => onError(error));
+        }
+        const text = asked.text;
         // NO_REPLY lets the agent take in an owner notice without messaging the guest.
         if (text && text !== 'NO_REPLY') await postReply(item, clampReply(text));
         await request(state, `agent_channels/inbox/${item.messageId}/ack`, { method: 'POST', body: { outcome: 'delivered' } });

package/lib/agentIdentity.js

@@ -72,7 +72,9 @@ export function startIdentityWorker({ state, deliver, acknowledgeCommand, reques
   const poll = async () => {
     try {
       const { identity } = await request(state);
-      if (!stopped && identity?.revision > 0 && identity.syncStatus === 'pending' && identity.source !== 'agent') {
+      // These go into a command the agent is told to run: only a numeric id and revision pass.
+      const wellFormed = /^\d{1,18}$/.test(String(identity?.identityId ?? '')) && Number.isSafeInteger(identity?.revision);
+      if (!stopped && wellFormed && identity.revision > 0 && identity.syncStatus === 'pending' && identity.source !== 'agent') {
         const idempotencyKey = `oomi-identity:${identity.identityId}:${identity.revision}`;
         const prefix = (state.sessionKey || 'agent:main:').split(':').slice(0, 2).join(':');
         const receipt = receiptPath ? readJson(receiptPath) : {};

package/lib/chatModels.js

@@ -0,0 +1,93 @@
+// `/model` in Talk (docs/specs/chat-models-v1.md): the shapes oomi.models.list and
+// oomi.models.set answer with. Each runtime's own list becomes entries
+// `{ id, provider, providerName, name }` first; only models the persona can use are kept.
+
+export const CHAT_MODELS_CAPABILITY = 'chat.models.v1';
+
+const MESSAGES = {
+  busy: 'The persona is answering. Pick a model when it\'s done.',
+  unknown_model: 'That model isn\'t one this persona can use.',
+  unavailable: 'The model can\'t be changed right now.',
+};
+
+/** An error the app may show as it is: `code` is busy, unknown_model or unavailable. */
+export class ChatModelsError extends Error {
+  constructor(code) { super(MESSAGES[code] || MESSAGES.unavailable); this.code = MESSAGES[code] ? code : 'unavailable'; }
+}
+
+// "accounts/fireworks/models/deepseek-v4p1-flash" → "deepseek-v4p1-flash": no paths on screen.
+function lastSegment(model) { return String(model).split('/').filter(Boolean).pop() || String(model); }
+
+/**
+ * Hermes over ACP: ids are "provider:model" and names "Provider label · model"; Hermes lists
+ * only providers its owner signed in to.
+ */
+export function hermesEntries(available = []) {
+  return available.map((entry) => {
+    const split = entry.id.indexOf(':');
+    const provider = split > 0 ? entry.id.slice(0, split) : '';
+    const model = split > 0 ? entry.id.slice(split + 1) : entry.id;
+    const label = typeof entry.name === 'string' && entry.name.includes(' · ') ? entry.name.slice(0, entry.name.indexOf(' · ')).trim() : '';
+    return { id: entry.id, provider, providerName: label || provider, name: lastSegment(model) };
+  });
+}
+
+const PROVIDER_NAMES = { anthropic: 'Anthropic', openai: 'OpenAI', 'openai-codex': 'ChatGPT or Codex', google: 'Google', xai: 'xAI', openrouter: 'OpenRouter', fireworks: 'Fireworks AI', deepseek: 'DeepSeek', mistral: 'Mistral', groq: 'Groq', ollama: 'Ollama' };
+
+/**
+ * OpenClaw's models.list (view "configured": configured models and providers with usable auth).
+ * Ids are OpenClaw's "provider/model" refs; a row it marks unavailable (missing or failed
+ * sign-in, cooldown) isn't offered.
+ */
+export function openclawEntries(rows = []) {
+  return rows
+    .filter((row) => row && typeof row.id === 'string' && row.id && typeof row.provider === 'string' && row.provider && row.available !== false)
+    .map((row) => ({
+      id: `${row.provider}/${row.id}`,
+      provider: row.provider,
+      providerName: PROVIDER_NAMES[row.provider.toLowerCase()] || row.provider,
+      name: typeof row.name === 'string' && row.name.trim() ? row.name.trim() : lastSegment(row.id),
+    }));
+}
+
+/** One model as the app shows it; null for none. A model the list doesn't have keeps its own id's name. */
+export function modelChoice(id, entries = []) {
+  if (typeof id !== 'string' || !id) return null;
+  const entry = entries.find((model) => model.id === id);
+  if (entry) return { id, model: entry.name, provider: entry.provider, providerName: entry.providerName };
+  const split = id.search(/[:/]/);
+  const provider = split > 0 ? id.slice(0, split) : '';
+  const sibling = entries.find((model) => model.provider === provider);
+  return { id, model: lastSegment(split > 0 ? id.slice(split + 1) : id), provider, providerName: sibling?.providerName || provider };
+}
+
+/** oomi.models.list's answer: the current model, then each provider's models in the runtime's order. */
+export function modelsAnswer({ current, entries = [] }) {
+  const providers = [];
+  const byId = new Map();
+  for (const entry of entries) {
+    if (!byId.has(entry.provider)) {
+      const group = { id: entry.provider, name: entry.providerName, models: [] };
+      byId.set(entry.provider, group);
+      providers.push(group);
+    }
+    byId.get(entry.provider).models.push({ id: entry.id, name: entry.name });
+  }
+  return { scope: 'conversation', current: modelChoice(current, entries), providers };
+}
+
+/**
+ * What the person typed after `/model`, as an id from the list when one fits: the id itself, else
+ * the one model with that name, else the one whose name starts with it. Anything else goes to the
+ * runtime as typed (it knows its own aliases).
+ */
+export function matchModel(typed, entries = []) {
+  const text = String(typed || '').trim();
+  if (!text) return '';
+  if (entries.some((model) => model.id === text)) return text;
+  const lower = text.toLowerCase();
+  const named = entries.filter((model) => model.name.toLowerCase() === lower);
+  if (named.length === 1) return named[0].id;
+  const started = entries.filter((model) => model.name.toLowerCase().startsWith(lower));
+  return started.length === 1 ? started[0].id : text;
+}

package/lib/gatewayProbe.js

@@ -6,10 +6,21 @@ import { redactDetail } from './runtimeFailure.js';
 export const LOCAL_PROTOCOL_MIN = 3;
 export const LOCAL_PROTOCOL_MAX = 4;
 
+// A guest's turn (agent channels, chat links) first puts its session in OpenClaw's read-only
+// permission mode (no exec, no file changes) and doesn't run if that fails; the owner's approved
+// request puts it back on the agent's own policy (null) first. Other turns don't touch the mode.
+export function guestPermissionMode(turn) {
+  if (turn?.sandbox === true) return 'read-only';
+  if (turn?.approvedAction === true) return null;
+  return undefined;
+}
+
 export function probeGateway({ gateway, deviceIdentity, prepareFrame, verifyReply = false, timeoutMs = 15000, turn }) {
   return new Promise((resolve, reject) => {
     const socket = new WebSocket(gateway.gatewayUrl);
     const connectId = randomUUID();
+    const patchId = randomUUID();
+    const permissionMode = guestPermissionMode(turn);
     const runId = turn?.idempotencyKey || randomUUID();
     verifyReply ||= Boolean(turn);
     let settled = false;
@@ -18,6 +29,13 @@ export function probeGateway({ gateway, deviceIdentity, prepareFrame, verifyRepl
     let turnSent = false;
     let started = false;
     const confirmStarted = () => { if (!started) { started = true; turn?.onStarted?.(); } };
+    const sendTurn = () => {
+      turnSent = true;
+      socket.send(JSON.stringify({ type: 'req', id: runId, method: 'chat.send', params: {
+        sessionKey: turn?.sessionKey || `agent:main:oomi:verify:${runId}`, idempotencyKey: runId,
+        message: turn?.message || 'Oomi connection check. Reply with OOMI_OK only. Do not use tools or change anything.',
+      } }));
+    };
     const finish = (error, result) => {
       if (settled) return;
       settled = true;
@@ -45,17 +63,23 @@ export function probeGateway({ gateway, deviceIdentity, prepareFrame, verifyRepl
       let frame;
       try { frame = JSON.parse(raw.toString()); } catch { return; }
       if (frame.event === 'connect.challenge') connect(frame.payload?.nonce);
+      if (frame.type === 'res' && frame.id === patchId) {
+        if (!frame.ok && permissionMode === 'read-only') {
+          return finish(Object.assign(new Error('OpenClaw could not limit this guest turn to read-only, so it did not run.'), { notStarted: true, runtimeFailureCode: 'guest_sandbox_unavailable' }));
+        }
+        return sendTurn();
+      }
       if (frame.type === 'res' && (frame.id === connectId || frame.id === runId) && !frame.ok) {
         finish(Object.assign(new Error(`Local agent rejected ${frame.id === connectId ? 'connect' : 'verification'}: ${frame.error?.message || frame.error?.code || 'unknown error'}`), { notStarted: !started }));
       } else if (frame.type === 'res' && frame.id === connectId && frame.ok) {
         protocol = frame.payload?.protocol;
         if (![3, 4].includes(protocol)) return finish(new Error('Local gateway returned an unsupported protocol version. Update oomi-ai.'));
         if (!verifyReply) return finish(null, { protocol });
-        turnSent = true;
-        socket.send(JSON.stringify({ type: 'req', id: runId, method: 'chat.send', params: {
-          sessionKey: turn?.sessionKey || `agent:main:oomi:verify:${runId}`, idempotencyKey: runId,
-          message: turn?.message || 'Oomi connection check. Reply with OOMI_OK only. Do not use tools or change anything.',
-        } }));
+        if (permissionMode !== undefined && turn?.sessionKey) {
+          socket.send(JSON.stringify({ type: 'req', id: patchId, method: 'sessions.patch', params: { key: turn.sessionKey, permissionMode } }));
+          return;
+        }
+        sendTurn();
       } else if (verifyReply && frame.type === 'res' && frame.id === runId && frame.ok) {
         confirmStarted();
       } else if (verifyReply && frame.event === 'chat' && frame.payload?.runId === runId) {

package/lib/gatewayRuns.js

@@ -0,0 +1,29 @@
+// Runs the local gateway has started, by the gateway socket they started on. A closed socket
+// can't deliver its runs' final events, so its runs stop counting as active; otherwise a lost
+// final would keep the bridge from ever being idle, and a queued restart would expire.
+export function createGatewayRuns() {
+  const bySocket = new Map();
+  return {
+    started(socketId, runId) {
+      if (!runId) return;
+      let runs = bySocket.get(socketId);
+      if (!runs) bySocket.set(socketId, (runs = new Set()));
+      runs.add(runId);
+    },
+    // A final can arrive on another socket after a reconnect.
+    finished(runId) {
+      for (const [socketId, runs] of bySocket) {
+        runs.delete(runId);
+        if (!runs.size) bySocket.delete(socketId);
+      }
+    },
+    closed(socketId) {
+      bySocket.delete(socketId);
+    },
+    get size() {
+      let count = 0;
+      for (const runs of bySocket.values()) count += runs.size;
+      return count;
+    },
+  };
+}

package/lib/hermesAcp.js

@@ -22,9 +22,6 @@ const IMAGE_TYPES = { '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.png': 'imag
 const SEED_MESSAGES = 12;
 const SEED_MESSAGE_CHARS = 800;
 const SEED_TOTAL_CHARS = 6000;
-const MAX_REPORTED_MODELS = 60;
-// Not models to talk with: images, video, speech, embeddings.
-const NOT_CHAT = /imagine|image|video|stt|tts|speech|audio|embed|whisper|moderation/i;
 
 // Only fixed messages cross the bridge; Hermes diagnostics may hold credentials or tool output.
 export class HermesAcpError extends Error {
@@ -79,29 +76,41 @@ class HermesAcpClient {
     this.turns = new Map();
     this.loaded = new Set();
     this.replayed = new Map();
-    // The model each ACP session is on, and what Hermes offers (session/new and session/load
-    // answers), for a call's faster model (Oomi's call.model, Voice::CallModel on the server).
+    // The model each ACP session is on and what Hermes can switch to (session/new and
+    // session/load answers), for `/model` in Talk and to put back a conversation an older bridge
+    // left on a call's model (restoreChatModel).
     this.sessionModels = new Map();
     this.availableModels = [];
-    this.newSessionModel = '';
+    this.defaultModel = '';
     this.closed = false;
     this.ready = null;
   }
 
   noteModels(sessionId, models, { created = false } = {}) {
-    if (!models || typeof models !== 'object') return;
-    const current = typeof models.currentModelId === 'string' ? models.currentModelId : '';
+    const current = typeof models?.currentModelId === 'string' ? models.currentModelId : '';
     if (current) {
       this.sessionModels.set(sessionId, current);
-      if (created) this.newSessionModel = current;
+      if (created) this.defaultModel = current;
     }
-    if (Array.isArray(models.availableModels)) {
+    if (Array.isArray(models?.availableModels)) {
       this.availableModels = models.availableModels
         .filter((model) => typeof model?.modelId === 'string' && model.modelId)
         .map((model) => ({ id: model.modelId, name: typeof model.name === 'string' ? model.name : '' }));
     }
   }
 
+  /** The person's pick (`/model`): fixed errors only, since Hermes's own text may hold internals. */
+  async setModel(sessionId, modelId) {
+    if (this.turns.has(sessionId)) throw new HermesAcpError('hermes_busy', 'Hermes is answering in this conversation.');
+    try {
+      await this.request('session/set_model', { sessionId, modelId });
+    } catch (err) {
+      if (err.rpcCode === -32602) throw new HermesAcpError('hermes_unknown_model', 'Hermes can\'t use that model.');
+      throw err;
+    }
+    this.sessionModels.set(sessionId, modelId);
+  }
+
   /** Switches a session's model between turns (Hermes refuses mid-turn); false if it couldn't. */
   async switchModel(sessionId, modelId) {
     if (!modelId || this.turns.has(sessionId)) return false;
@@ -399,87 +408,55 @@ export async function runHermesAcpTurn(config, request, { signal, timeoutMs = 18
   const continuing = request.runtimeTransport === 'acp' ? request.runtimeSessionId : '';
   let { sessionId, created } = await client.openSession(continuing);
   const seed = () => continuityPreamble(request.history);
-  let chatModel = await applyCallModel(client, sessionId, request);
+  let chatModel = await restoreChatModel(client, sessionId, request);
   let text;
   try {
-    text = await client.prompt(sessionId, promptBlocks(request, created ? seed() : ''), { signal, timeoutMs, onText });
+    // A session `/model` opened for a conversation with history hasn't heard it yet.
+    text = await client.prompt(sessionId, promptBlocks(request, created || request.seedPending ? seed() : ''), { signal, timeoutMs, onText });
   } catch (err) {
     if (err.code !== 'hermes_session_unknown' || created) throw err;
     ({ sessionId } = await client.openSession(''));
-    // A fresh session starts on the chat model.
-    chatModel = await applyCallModel(client, sessionId, { ...request, chatModel: null });
+    // A fresh session starts on the persona's own model.
+    chatModel = null;
     text = await client.prompt(sessionId, promptBlocks(request, seed()), { signal, timeoutMs, onText });
   }
   return { text, sessionId, transport: 'acp', chatModel };
 }
 
 /**
- * A call turn asks for the persona's faster model (request.callModel); every other turn puts
- * the session back on the model it chats with. Returns the model to go back to, while the
- * session is on the call model (kept in the conversation's state, so a restart still restores
- * it), else null. A session whose model Hermes didn't say isn't switched: there'd be no way back.
+ * `/model` in Talk (docs/specs/chat-models-v1.md): the model a conversation's session is on, and
+ * what Hermes can switch it to (the providers its owner signed in to, as Telegram's picker lists).
+ * `create` makes a session when the conversation has none: true always, 'if-unknown' only when
+ * Hermes hasn't said its models yet. `session` is then `{ sessionId, created }` for the
+ * conversation to keep.
  */
-async function applyCallModel(client, sessionId, request) {
-  const current = client.sessionModels.get(sessionId) || '';
-  const remembered = typeof request.chatModel === 'string' && request.chatModel ? request.chatModel : null;
-  const callModel = typeof request.callModel === 'string' && request.callModel ? request.callModel : '';
-  if (callModel) {
-    if (current === callModel) return remembered;
-    if (!current) return remembered;
-    const back = remembered || current;
-    return (await client.switchModel(sessionId, callModel)) ? back : remembered;
-  }
-  if (remembered && current !== remembered) return (await client.switchModel(sessionId, remembered)) ? null : remembered;
-  return null;
-}
-
-/**
- * What Hermes offers for a faster call model, for Oomi's persona page: the models of the provider
- * the persona chats with (chatModel, or the one new sessions start on), a recommendation (one
- * that doesn't reason first), and whether this runtime can switch. Null until Hermes has said.
- */
-export function hermesAcpModelReport(config, { chatModel = '' } = {}) {
-  const client = clients.get(clientKey(config));
-  if (!client || !client.availableModels.length) return null;
-  const current = chatModel || client.newSessionModel || [...client.sessionModels.values()][0] || '';
-  if (!current) return null;
-  const provider = current.includes(':') ? current.slice(0, current.indexOf(':') + 1) : '';
-  const available = client.availableModels
-    .filter((model) => (!provider || model.id.startsWith(provider)) && !NOT_CHAT.test(model.id))
-    .slice(0, MAX_REPORTED_MODELS)
-    .map((model) => ({ id: model.id, name: modelDisplayName(model.id) }));
-  if (!available.some((model) => model.id === current)) available.push({ id: current, name: modelDisplayName(current) });
-  return { current, recommended: recommendedCallModel(available, current), switchable: true, available };
+export async function hermesAcpModels(config, sessionId, { create = false } = {}) {
+  const client = hermesAcpClient(config);
+  await client.start();
+  const make = create === true || (create === 'if-unknown' && !client.availableModels.length);
+  const session = sessionId || make ? await client.openSession(sessionId || '', { create: make }) : null;
+  const current = (session && client.sessionModels.get(session.sessionId)) || client.defaultModel;
+  return { session, current, available: client.availableModels };
 }
 
-/** One that answers without reasoning first, else one built to be quick; never the chat model. */
-export function recommendedCallModel(available, current) {
-  const others = available.filter((model) => model.id !== current);
-  const plain = others.find((model) => /non[-_]?reasoning/i.test(model.id));
-  if (plain) return plain.id;
-  const quick = others.find((model) => /(^|[-_:/])(fast|flash|mini|lite|haiku|turbo|instant)([-_.]|$)/i.test(model.id) && !/code|coder|composer|build/i.test(model.id));
-  return quick ? quick.id : null;
+/** Switches a conversation's session (opened or made here) to `modelId`, for this conversation only. */
+export async function setHermesAcpModel(config, sessionId, modelId) {
+  const client = hermesAcpClient(config);
+  await client.start();
+  const session = await client.openSession(sessionId || '');
+  await client.setModel(session.sessionId, modelId);
+  return { session, current: modelId, available: client.availableModels };
 }
 
-/** "xai-oauth:grok-4.20-0309-non-reasoning" → "Grok 4.20 (no reasoning)"; "claude-haiku-5-5" → "Claude Haiku 5.5". */
-export function modelDisplayName(id) {
-  const text = String(id);
-  const raw = (text.includes(':') ? text.slice(text.indexOf(':') + 1) : text).split(/[-_/\s]+/).filter(Boolean);
-  let plain = false;
-  const words = [];
-  for (let index = 0; index < raw.length; index++) {
-    const word = raw[index];
-    if (/^non$/i.test(word) && /^reasoning$/i.test(raw[index + 1] || '')) { plain = true; index++; continue; }
-    if (/^nonreasoning$/i.test(word)) { plain = true; continue; }
-    if (/^\d{4}$/.test(word)) continue; // a release date
-    // "5", "5" → "5.5"
-    if (/^\d+$/.test(word) && words.length && /^\d+(\.\d+)?$/.test(words[words.length - 1]) && !words[words.length - 1].includes('.')) {
-      words[words.length - 1] += `.${word}`;
-      continue;
-    }
-    words.push(/^(gpt|glm|ai)$/i.test(word) ? word.toUpperCase() : /^[a-z]/.test(word) ? word[0].toUpperCase() + word.slice(1) : word);
-  }
-  const name = words.join(' ');
-  return plain ? `${name} (no reasoning)` : name;
+/**
+ * Calls answer on the model the persona is set up with; Oomi never switches it (Justin,
+ * 2026-10-22). oomi-ai 0.11.0-0.12.3 switched a session to a faster model on calls and kept the
+ * model to go back to in the conversation's state (request.chatModel): put such a session back.
+ * Returns the model still to go back to if Hermes couldn't switch now, else null.
+ */
+async function restoreChatModel(client, sessionId, request) {
+  const remembered = typeof request.chatModel === 'string' && request.chatModel ? request.chatModel : null;
+  if (!remembered || client.sessionModels.get(sessionId) === remembered) return null;
+  return (await client.switchModel(sessionId, remembered)) ? null : remembered;
 }
 

package/lib/localAgent.js

@@ -5,7 +5,8 @@ import { spawn } from 'node:child_process';
 import { EventEmitter } from 'node:events';
 import { createHash, randomUUID } from 'node:crypto';
 import { runSharedHermesTurn, hermesRefusal } from './hermesGateway.js';
-import { runHermesAcpTurn, hermesAcpAvailable, resetHermesAcp, warmHermesAcp, hermesAcpModelReport } from './hermesAcp.js';
+import { runHermesAcpTurn, hermesAcpAvailable, resetHermesAcp, warmHermesAcp, hermesAcpModels, setHermesAcpModel, continuityPreamble } from './hermesAcp.js';
+import { CHAT_MODELS_CAPABILITY, ChatModelsError, hermesEntries, matchModel, modelChoice, modelsAnswer } from './chatModels.js';
 import { grokbotConfig, runGrokbotTurn, completedGrokbotTurn } from './grokbotRuntime.js';
 import { classifyRuntimeFailure } from './runtimeFailure.js';
 
@@ -114,9 +115,19 @@ function usesHermesAcp(config) {
   return config.hermesTransport === 'acp' || hermesAcpAvailable(config);
 }
 
+// A guest's turn (agent channels, chat links) runs with the persona's tools off: Hermes as
+// `hermes chat --toolsets clarify` (no terminal, files, browser, memory, skills or MCP servers;
+// Hermes freezes the toolsets into the session), a command adapter told `sandbox: true`. Grok
+// Bot can't be limited, so it doesn't take guests.
+export const SANDBOX_TOOLSETS = 'clarify';
+
 // No shell interpolation. Message bodies travel over stdin, never as executable code.
 export async function runLocalAgent(config, request, options = {}) {
+  if (request.sandbox && config.runtime === 'grokbot') {
+    throw Object.assign(new Error("This persona's runtime can't answer guests with its tools turned off."), { notStarted: true, runtimeFailureCode: 'guest_sandbox_unavailable' });
+  }
   if (config.runtime === 'grokbot') return runGrokbotTurn(config, request, options);
+  if (config.runtime === 'hermes' && request.sandbox) return runAgentProcess(config, request, options);
   if (config.runtime === 'hermes') {
     const shared = await runSharedHermesTurn(config, request, options);
     if (shared) {
@@ -151,6 +162,7 @@ function runAgentProcess(config, request, { signal, timeoutMs = 180000 } = {}) {
     if (config.runtime === 'hermes') {
       if (config.profile) args.push('--profile', config.profile);
       args.push('chat', '--quiet', '--query-file', '-');
+      if (request.sandbox) args.push('--toolsets', SANDBOX_TOOLSETS);
       if (request.runtimeSessionId) args.push('--resume', request.runtimeSessionId);
       if (request.imagePaths?.[0]) args.push('--image', request.imagePaths[0]);
     }
@@ -220,15 +232,10 @@ export class LocalAgentRuntime {
     this.queue = Promise.resolve();
     this.active = new Map();
     this.deliveries = 0;
-    // Told what models the runtime offers for a call's faster model, when that changes.
-    this.onModels = null;
-    this.lastModelReport = '';
   }
   file(sessionKey) { return path.join(this.directory, 'conversations', createHash('sha256').update(sessionKey).digest('hex') + '.json'); }
   history(sessionKey) { return readJson(this.file(sessionKey), { messages: [], receipts: {} }); }
-  async turn({ sessionKey, message, idempotencyKey, attachments = [], retryInterrupted = false, onText, onStarted, oomi }) {
-    // A call turn names the persona's faster model (Oomi's call.model); see applyCallModel.
-    const callModel = typeof oomi?.call?.model === 'string' && oomi.call.model.trim().length <= 200 ? oomi.call.model.trim() : '';
+  async turn({ sessionKey, message, idempotencyKey, attachments = [], retryInterrupted = false, onText, onStarted, oomi, sandbox = false }) {
     const images = readImageAttachments(attachments);
     const text = typeof message === 'string' ? message : '';
     if (typeof sessionKey !== 'string' || !sessionKey || typeof idempotencyKey !== 'string' || !idempotencyKey || (!text.trim() && !images.length)) throw new Error('A session, message, and idempotency key are required.');
@@ -269,13 +276,23 @@ export class LocalAgentRuntime {
       };
       try {
         scratch = images.length ? writeTurnImages(images) : null;
-        const result = resumedReply || await runLocalAgent(this.config, { sessionKey, message: prompt, idempotencyKey, history: state.messages, runtimeSessionId: state.runtimeSessionId || this.config.resume, runtimeTransport: state.runtimeTransport, imagePaths: scratch?.paths || [], callModel, chatModel: state.runtimeChatModel || null }, { signal: controller.signal, onText: text => { confirmStarted(); onText?.(text); }, onStarted: confirmStarted });
+        // A sandboxed turn keeps its own runtime session (its tools are frozen off), started with
+        // the conversation so far; the conversation's own session is left as it is.
+        const request = sandbox
+          ? { sessionKey, message: (state.sandboxSessionId ? '' : continuityPreamble(state.messages)) + prompt, idempotencyKey, history: state.messages, runtimeSessionId: state.sandboxSessionId || '', runtimeTransport: 'cli', imagePaths: [], sandbox: true }
+          : { sessionKey, message: prompt, idempotencyKey, history: state.messages, runtimeSessionId: state.runtimeSessionId || this.config.resume, runtimeTransport: state.runtimeTransport, imagePaths: scratch?.paths || [], chatModel: state.runtimeChatModel || null, seedPending: state.runtimeSeedPending === true };
+        const result = resumedReply || await runLocalAgent(this.config, request, { signal: controller.signal, onText: text => { confirmStarted(); onText?.(text); }, onStarted: confirmStarted });
         confirmStarted();
-        state.runtimeSessionId = result.sessionId;
-        if (result.transport) state.runtimeTransport = result.transport;
-        // While the session is on a call's model, the model to go back to (kept here, so a
-        // restart still restores it before the next chat turn).
-        if ('chatModel' in result) {
+        if (sandbox) {
+          if (result.sessionId) state.sandboxSessionId = result.sessionId;
+        } else {
+          state.runtimeSessionId = result.sessionId;
+          if (result.transport) state.runtimeTransport = result.transport;
+          delete state.runtimeSeedPending;
+        }
+        // A session an older bridge left on a call's model keeps the model to go back to until
+        // Hermes has switched it (restoreChatModel).
+        if (!sandbox && 'chatModel' in result) {
           if (result.chatModel) state.runtimeChatModel = result.chatModel;
           else delete state.runtimeChatModel;
         }
@@ -283,7 +300,6 @@ export class LocalAgentRuntime {
         state.receipts[receiptKey] = { message, practiceDigest, result };
         writePrivateJson(this.file(sessionKey), state);
         this.onHealth({ runtimeReady: true, lastReplyAt: new Date().toISOString(), lastErrorMessage: '' });
-        this.reportModels(state.runtimeChatModel);
         return { ...result, started: true };
       } catch (err) {
         if (err.notStarted === true && !started) {
@@ -306,32 +322,59 @@ export class LocalAgentRuntime {
   }
   socket() { return new LocalAgentSocket(this); }
   close() { if (this.config.runtime === 'hermes') resetHermesAcp(this.config); }
-  /** Gets Hermes ready before a message arrives: at bridge start and when a call opens. */
-  warm() {
-    if (this.config.runtime !== 'hermes' || !usesHermesAcp(this.config)) return Promise.resolve();
-    return warmHermesAcp(this.config, this.recentAcpSessions(2)).then(() => this.reportModels(), () => {});
+  /** What this runtime adds to the bridge's capabilities on connect. */
+  capabilities() { return this.switchesModels() ? [CHAT_MODELS_CAPABILITY] : []; }
+  switchesModels() { return this.config.runtime === 'hermes' && usesHermesAcp(this.config); }
+  answering(sessionKey) { return [...this.active.values()].some((entry) => entry.sessionKey === sessionKey); }
+  /** `/model` in Talk (docs/specs/chat-models-v1.md): the conversation's model and what it can switch to. */
+  async models(sessionKey) {
+    if (!this.switchesModels() || typeof sessionKey !== 'string' || !sessionKey) throw new ChatModelsError('unavailable');
+    // Mid-turn the conversation's session belongs to the turn: read, don't open one.
+    const answering = this.answering(sessionKey);
+    const result = await hermesAcpModels(this.config, this.acpSession(sessionKey), { create: answering ? false : 'if-unknown' }).catch(() => { throw new ChatModelsError('unavailable'); });
+    if (!answering) this.keepAcpSession(sessionKey, result.session);
+    return modelsAnswer({ current: result.current, entries: hermesEntries(result.available) });
+  }
+  /** Switches this conversation only; nothing reaches the model, and the persona's default stays. */
+  async setModel(sessionKey, model) {
+    if (!this.switchesModels() || typeof sessionKey !== 'string' || !sessionKey) throw new ChatModelsError('unavailable');
+    if (typeof model !== 'string' || !model.trim() || model.length > 300) throw new ChatModelsError('unknown_model');
+    if (this.answering(sessionKey)) throw new ChatModelsError('busy');
+    // Names resolve against Hermes's list; a new conversation's session is opened (and kept) to learn it.
+    const listed = await hermesAcpModels(this.config, this.acpSession(sessionKey), { create: 'if-unknown' }).catch(() => ({ session: null, available: [] }));
+    this.keepAcpSession(sessionKey, listed.session);
+    let result;
+    try {
+      result = await setHermesAcpModel(this.config, this.acpSession(sessionKey), matchModel(model, hermesEntries(listed.available)));
+    } catch (err) {
+      throw new ChatModelsError(err.code === 'hermes_busy' ? 'busy' : err.code === 'hermes_unknown_model' ? 'unknown_model' : 'unavailable');
+    }
+    this.keepAcpSession(sessionKey, result.session, { picked: true });
+    return { scope: 'conversation', current: modelChoice(result.current, hermesEntries(result.available)) };
   }
-  /** Tells onModels what the runtime offers for calls, once Hermes has said and whenever it changes. */
-  reportModels(chatModel = '') {
-    if (!this.onModels || this.config.runtime !== 'hermes') return;
-    const report = hermesAcpModelReport(this.config, { chatModel: chatModel || this.rememberedChatModel() });
-    if (!report) return;
-    const text = JSON.stringify(report);
-    if (text === this.lastModelReport) return;
-    this.lastModelReport = text;
-    // Reporting never breaks a turn; a report that didn't arrive goes again after the next one.
-    Promise.resolve().then(() => this.onModels(report)).then((delivered) => { if (delivered === false) this.lastModelReport = ''; }, () => { this.lastModelReport = ''; });
+  acpSession(sessionKey) {
+    const state = this.history(sessionKey);
+    return state.runtimeTransport === 'acp' && state.runtimeSessionId ? state.runtimeSessionId : '';
   }
-  /** A conversation on a call's model knows what the persona chats with. */
-  rememberedChatModel() {
-    const directory = path.join(this.directory, 'conversations');
-    let files;
-    try { files = fs.readdirSync(directory).filter((name) => name.endsWith('.json')); } catch { return ''; }
-    for (const name of files) {
-      const state = readJson(path.join(directory, name), {});
-      if (typeof state.runtimeChatModel === 'string' && state.runtimeChatModel) return state.runtimeChatModel;
+  /** A session `/model` opened is the conversation's from now on; one made for a conversation with history still needs its seed. */
+  keepAcpSession(sessionKey, session, { picked = false } = {}) {
+    if (!session) return;
+    const state = this.history(sessionKey);
+    const changed = state.runtimeSessionId !== session.sessionId || state.runtimeTransport !== 'acp';
+    if (!changed && !(picked && state.runtimeChatModel)) return;
+    if (changed) {
+      state.runtimeSessionId = session.sessionId;
+      state.runtimeTransport = 'acp';
+      if (session.created && state.messages.length) state.runtimeSeedPending = true;
     }
-    return '';
+    // The person's pick wins over a call model an older bridge meant to undo.
+    if (picked) delete state.runtimeChatModel;
+    writePrivateJson(this.file(sessionKey), state);
+  }
+  /** Gets Hermes ready before a message arrives: at bridge start and when a call opens. */
+  warm() {
+    if (this.config.runtime !== 'hermes' || !usesHermesAcp(this.config)) return Promise.resolve();
+    return warmHermesAcp(this.config, this.recentAcpSessions(2)).catch(() => {});
   }
   recentAcpSessions(limit) {
     const directory = path.join(this.directory, 'conversations');
@@ -370,12 +413,16 @@ class LocalAgentSocket extends EventEmitter {
     try { req = JSON.parse(raw); } catch { return; }
     if (req.type !== 'req') return;
     const reply = (payload) => this.frame({ type: 'res', id: req.id, ok: true, payload });
-    const fail = (message) => this.frame({ type: 'res', id: req.id, ok: false, error: { code: 'local_agent_error', message } });
+    const fail = (message, code = 'local_agent_error') => this.frame({ type: 'res', id: req.id, ok: false, error: { code, message } });
     const params = req.params || {};
     if (req.method === 'connect') { this.connected = true; return reply({ type: 'hello-ok', protocol: 3, features: { methods: ['chat.send', 'chat.history', 'chat.abort'], events: ['chat'] }, snapshot: {}, policy: { tickIntervalMs: 30000 } }); }
     if (!this.connected) return fail('Connect before sending requests.');
     if (req.method === 'chat.history') return reply({ sessionKey: params.sessionKey, messages: this.runtime.history(params.sessionKey || '').messages.slice(-Math.min(params.limit || 200, 500)) });
     if (req.method === 'chat.abort') return reply({ aborted: this.runtime.abort(params.sessionKey, params.runId) });
+    // `/model` in Talk (docs/specs/chat-models-v1.md).
+    const failModels = (err) => fail(err instanceof ChatModelsError ? err.message : new ChatModelsError('unavailable').message, err instanceof ChatModelsError ? err.code : 'unavailable');
+    if (req.method === 'oomi.models.list') return void this.runtime.models(params.sessionKey).then(reply, failModels);
+    if (req.method === 'oomi.models.set') return void this.runtime.setModel(params.sessionKey, params.model).then(reply, failModels);
     if (req.method !== 'chat.send') return fail(`Method ${req.method} is not supported by this agent adapter.`);
     const runId = params.idempotencyKey || req.id || randomUUID();
     reply({ runId, status: 'started' });
@@ -440,7 +487,7 @@ export function startChannelWorker(state, runtime) {
 export function practiceContext(brief) {
   if (!brief || typeof brief !== 'object' || Array.isArray(brief)) return '';
   if (!/^lp_[a-f0-9]{24}$/.test(brief.practiceSessionId || '') || !/^spc_[a-f0-9]{24}$/.test(brief.spaceId || '') ||
-      !['es', 'fr', 'de', 'it', 'pt'].includes(brief.targetLanguage) || brief.instructionLanguage !== 'en' ||
+      !['es', 'fr', 'de', 'it', 'pt', 'zh-Hans', 'ja', 'ko'].includes(brief.targetLanguage) || brief.instructionLanguage !== 'en' ||
       !['beginner', 'intermediate', 'advanced'].includes(brief.level) || typeof brief.goal !== 'string' || brief.goal.length > 300 ||
       !Number.isInteger(brief.minutesPerDay) || brief.minutesPerDay < 3 || brief.minutesPerDay > 60 ||
       !Array.isArray(brief.phrasesToTry) || brief.phrasesToTry.length > 10 || brief.phrasesToTry.some(p => !p || typeof p.text !== 'string' || p.text.length > 120 || typeof p.translation !== 'string' || p.translation.length > 120)) return '';

package/lib/openclawModels.js

@@ -0,0 +1,71 @@
+// `/model` in Talk for OpenClaw personas (docs/specs/chat-models-v1.md). The bridge asks
+// OpenClaw's own gateway methods and answers in oomi's shape: models.list (view "configured":
+// configured models and providers with usable auth) for the choices, chat.history's
+// sessionInfo for the conversation's model, and sessions.patch to switch that session.
+import { ChatModelsError, matchModel, modelChoice, modelsAnswer, openclawEntries } from './chatModels.js';
+
+const MODELS = '::oomi-models';
+const SESSION = '::oomi-session';
+const SET = '::oomi-set';
+const STALE_MS = 60 * 1000;
+
+function parse(text) { try { const value = JSON.parse(text); return value && typeof value === 'object' ? value : null; } catch { return null; } }
+function request(id, method, params) { return JSON.stringify({ type: 'req', id, method, params }); }
+function answer(id, payload) { return JSON.stringify({ type: 'res', id, ok: true, payload }); }
+function failure(id, code) { const error = new ChatModelsError(code); return JSON.stringify({ type: 'res', id, ok: false, error: { code: error.code, message: error.message } }); }
+
+export class OpenclawModelRequests {
+  constructor({ now = () => Date.now() } = {}) { this.now = now; this.pending = new Map(); this.entries = []; }
+
+  /**
+   * For an oomi.models.* request: `{ frames }` to send OpenClaw instead, or `{ reply }` to answer
+   * the app straight away. Null for every other frame.
+   */
+  plan(frameText) {
+    const frame = parse(frameText);
+    if (frame?.type !== 'req' || (frame.method !== 'oomi.models.list' && frame.method !== 'oomi.models.set')) return null;
+    for (const [id, entry] of this.pending) if (this.now() - entry.at > STALE_MS) this.pending.delete(id);
+    const id = typeof frame.id === 'string' || typeof frame.id === 'number' ? String(frame.id) : '';
+    const sessionKey = typeof frame.params?.sessionKey === 'string' ? frame.params.sessionKey.trim() : '';
+    if (!id || !sessionKey) return { reply: failure(id, 'unavailable') };
+    if (frame.method === 'oomi.models.list') {
+      this.pending.set(id, { kind: 'list', at: this.now() });
+      return { frames: [request(id + MODELS, 'models.list', { view: 'configured' }), request(id + SESSION, 'chat.history', { sessionKey, limit: 1 })] };
+    }
+    const typed = typeof frame.params?.model === 'string' ? frame.params.model.trim() : '';
+    if (!typed || typed.length > 300) return { reply: failure(id, 'unknown_model') };
+    this.pending.set(id, { kind: 'set', at: this.now() });
+    return { frames: [request(id + SET, 'sessions.patch', { key: sessionKey, model: matchModel(typed, this.entries) })] };
+  }
+
+  /**
+   * For OpenClaw's answer to one of those frames: `{ reply }` once oomi's answer is complete, or
+   * `{}` while it waits for the other half. Either way the frame itself goes no further. Null for
+   * every other frame.
+   */
+  take(frameText) {
+    const frame = parse(frameText);
+    if (frame?.type !== 'res' || typeof frame.id !== 'string') return null;
+    const suffix = [MODELS, SESSION, SET].find((end) => frame.id.endsWith(end));
+    const id = suffix ? frame.id.slice(0, -suffix.length) : '';
+    const entry = suffix && this.pending.get(id);
+    if (!entry) return null;
+    if (suffix === SET) {
+      this.pending.delete(id);
+      if (!frame.ok) return { reply: failure(id, frame.error?.code === 'INVALID_REQUEST' ? 'unknown_model' : 'unavailable') };
+      const resolved = frame.payload?.resolved;
+      const current = resolved?.modelProvider && resolved?.model ? `${resolved.modelProvider}/${resolved.model}` : '';
+      return { reply: answer(id, { scope: 'conversation', current: modelChoice(current, this.entries) }) };
+    }
+    if (suffix === MODELS) entry.models = frame.ok && Array.isArray(frame.payload?.models) ? openclawEntries(frame.payload.models) : null;
+    else {
+      const info = frame.ok ? frame.payload?.sessionInfo : null;
+      entry.current = info?.modelProvider && info?.model ? `${info.modelProvider}/${info.model}` : '';
+    }
+    if (entry.models === undefined || entry.current === undefined) return {};
+    this.pending.delete(id);
+    if (!entry.models) return { reply: failure(id, 'unavailable') };
+    this.entries = entry.models;
+    return { reply: answer(id, modelsAnswer({ current: entry.current, entries: entry.models })) };
+  }
+}

package/lib/runtimeFailure.js

@@ -15,6 +15,7 @@ export const FAILURE_SUMMARIES = {
   model_unavailable: "its AI provider couldn't be reached",
   runtime_timeout: 'it took too long to answer',
   runtime_failed: 'its agent runtime stopped with an error',
+  guest_sandbox_unavailable: "its agent runtime can't answer guests with its tools turned off",
 };
 
 export const FAILURE_HINTS = {
@@ -23,6 +24,7 @@ export const FAILURE_HINTS = {
   model_unavailable: 'Check this computer is online and the provider is up, then try again.',
   runtime_timeout: 'Try again with a shorter request, or check the agent runtime is responsive.',
   runtime_failed: 'Check the agent runtime logs on this computer, then try again.',
+  guest_sandbox_unavailable: 'Chat links and agent channels need a Hermes or OpenClaw persona, which can answer guests without running commands or touching files.',
 };
 
 export function redactDetail(text, limit = 300) {

package/lib/updateWatcher.js

@@ -0,0 +1,56 @@
+// Keeps the persona's oomi-ai current (Justin, 2026-10-25: "make sure the package always requests
+// the agent to stay up to date to avoid security risks"). The running bridge checks npm and, once
+// per new version, asks its agent to update through the agent's own approval flow, or to tell its
+// owner. It never installs anything itself. OOMI_UPDATE_NOTICES=0 turns it off.
+import { readJson, writePrivateJson } from './localAgent.js';
+
+export const UPDATE_CHECK_EVERY_MS = 6 * 60 * 60 * 1000;
+const VERSION = /^\d+\.\d+\.\d+$/;
+
+export function newerVersion(current, latest) {
+  if (!VERSION.test(String(current)) || !VERSION.test(String(latest))) return false;
+  const a = current.split('.').map(Number);
+  const b = latest.split('.').map(Number);
+  const difference = b.map((value, index) => value - a[index]).find((value) => value !== 0) || 0;
+  return difference > 0;
+}
+
+export function updateNotice({ current, latest, connection = '' }) {
+  const name = connection ? ` --name ${connection}` : '';
+  const conn = connection ? ` --connection ${connection}` : '';
+  return `Oomi maintenance notice from the oomi-ai bridge on this computer (not from a person): oomi-ai ${latest} is out; this computer has ${current}. ` +
+    'New versions carry security fixes, so keep it current.\n' +
+    `1. Run oomi update${conn} for the exact install command, and run that command alone through your normal approval flow.\n` +
+    `2. After it succeeds, check the installed version, then run oomi bridge repair${name}.\n` +
+    `If you can't (it needs approval you don't have, or you have no terminal here), tell your owner: oomi notify "oomi-ai on this computer needs an update to ${latest}: npm install -g oomi-ai@${latest}"${conn}\n` +
+    'Never change security settings or approvals to do this. Reply with one line saying what you did.';
+}
+
+/**
+ * Checks after `firstDelayMs`, then every `intervalMs`. `deliver` runs one agent turn (the same
+ * path as identity and routine notices); `onStatus` records what's available for oomi status.
+ */
+export function startUpdateWatcher({ current, fetchLatest, deliver, sessionKey, receiptPath, connection = '', onStatus = () => {}, intervalMs = UPDATE_CHECK_EVERY_MS, firstDelayMs = 60 * 1000, env = process.env }) {
+  if (String(env.OOMI_UPDATE_NOTICES || '').trim() === '0' || !VERSION.test(String(current))) return () => {};
+  let stopped = false;
+  let timer;
+  const check = async () => {
+    try {
+      const latest = String(await fetchLatest() || '').trim();
+      if (stopped || !VERSION.test(latest)) return;
+      if (!newerVersion(current, latest)) { onStatus({ updateAvailable: '' }); return; }
+      onStatus({ updateAvailable: latest });
+      const receipt = readJson(receiptPath, {});
+      if (receipt.notifiedVersion === latest) return;
+      await deliver({ sessionKey, idempotencyKey: `oomi-update:${latest}`, message: updateNotice({ current, latest, connection }) });
+      writePrivateJson(receiptPath, { notifiedVersion: latest, notifiedAt: new Date().toISOString() });
+    } catch {
+      // A missed check or notice is tried again at the next interval.
+    } finally {
+      if (!stopped) { timer = setTimeout(check, intervalMs); timer.unref?.(); }
+    }
+  };
+  timer = setTimeout(check, firstDelayMs);
+  timer.unref?.();
+  return () => { stopped = true; clearTimeout(timer); };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oomi-ai",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Connect OpenClaw, Hermes, Grok Bot, and other agents to Oomi with verified runtime adapters",
   "bin": {
     "oomi": "bin/oomi-ai.js"
@@ -49,7 +49,7 @@
     "url": "https://github.com/crispcode-io/oomi/issues"
   },
   "scripts": {
-    "check": "node --check bin/oomi-ai.js && node --check lib/bridgeService.js && node --check lib/bridgeMaintenance.js && node --check lib/processTable.js && node --check lib/localAgent.js && node --check lib/hermesGateway.js && node --check lib/hermesAcp.js && node --check lib/grokbotRuntime.js && node --check lib/connectionSetup.js && node --check lib/processSupervisor.js && node --check lib/agentChannels.js && node --check lib/runtimeFailure.js",
+    "check": "node --check bin/oomi-ai.js && node --check lib/bridgeService.js && node --check lib/bridgeMaintenance.js && node --check lib/gatewayRuns.js && node --check lib/processTable.js && node --check lib/localAgent.js && node --check lib/chatModels.js && node --check lib/openclawModels.js && node --check lib/updateWatcher.js && node --check lib/hermesGateway.js && node --check lib/hermesAcp.js && node --check lib/grokbotRuntime.js && node --check lib/connectionSetup.js && node --check lib/processSupervisor.js && node --check lib/agentChannels.js && node --check lib/runtimeFailure.js",
     "test": "node --test test/*.test.mjs",
     "prepublishOnly": "npm run check && node --test test/packageFiles.test.mjs"
   },
@@ -60,6 +60,7 @@
   "files": [
     "bin/oomi-ai.js",
     "bin/sessionBridgeState.js",
+    "lib/gatewayRuns.js",
     "lib/modelRelayClient.js",
     "lib/openclawPaths.js",
     "lib/openclawProfile.js",
@@ -74,6 +75,9 @@
     "skills/oomi/agent_instructions.md",
     "lib/gatewayProbe.js",
     "lib/localAgent.js",
+    "lib/chatModels.js",
+    "lib/openclawModels.js",
+    "lib/updateWatcher.js",
     "lib/agentIdentity.js",
     "lib/routines.js",
     "lib/spaces.js",

package/skills/oomi/SKILL.md

@@ -519,6 +519,8 @@ Oomi renders simple Markdown in chat: short paragraphs, bullet or numbered lists
 
 ### Language Spaces v1
 
-Choose Language in Talk after the owner's instruction; ask only for missing target language (`es`, `fr`, `de`, `it`, `pt`), level, goal and minutes/day (3–60), and confirm English instruction and the IANA timezone. Use `oomi spaces catalog` and build the approved Path / Lesson / Lesson complete / Words / Practice call views from `learning_path`, `exercise`, `step_sequence` variant `lesson`, `recap` variant `language`, `review_deck`, and `practice_feedback`. Write lessons as JSON data, each with `provenance: {kind:"persona", validation:"structural"}`; translations are persona-written and not teacher-checked. A daily objective is a separate opt-in; Space creation schedules nothing.
+Choose Language in Talk after the owner's instruction; ask only for missing target language (`es`, `fr`, `de`, `it`, `pt`, `zh-Hans`, `ja`, `ko`), level, goal and minutes/day (3–60), and confirm English instruction and the IANA timezone. Use `oomi spaces catalog` and build the approved Path / Lesson / Lesson complete / Words / Practice call views from `learning_path`, `exercise`, `step_sequence` variant `lesson`, `recap` variant `language`, `review_deck`, and `practice_feedback`. Write lessons as JSON data, each with `provenance: {kind:"persona", validation:"structural"}`; translations are persona-written and not teacher-checked. A daily objective is a separate opt-in; Space creation schedules nothing.
+
+Offer Mandarin (simplified Chinese, `zh-Hans`), Japanese and Korean in Talk like the other languages. At beginner level, use choose, listen-and-choose and arrange; translate answers are in English. Typing in the target language starts at intermediate. List accepted alternatives explicitly, including Japanese kanji and kana spellings where both are natural; never guess alternatives. Put reading aids (pinyin with tone marks, romaji or Revised Romanization) in `explanation`, optionally after a word in an option, like "你好 (nǐ hǎo)". Never put romanization in an accepted text unless the exercise asks for romanization.
 
 Read before writing; send `space.v4`, revision, stable idempotency key and an owner `sourceMessageId`. The CLI advertises `cooking.v1, language.v1`. `oomi spaces language-action SPACE --component COMPONENT --file action.json` performs permitted actions. Never answer or skip exercises for the owner. After an ordinary practice call ends, use that handoff's `practiceSessionId` with `action:"save_practice_feedback"`, at most five `phrasesToTry` (`text,translation`) and five `corrections` (`original,suggested,reason`), each field at most 300 characters. Feedback is your suggestions, not mastery scoring. A call is eligible only after its practice brief was accepted. The feedback event stays pending until the runtime confirms startup; confirmed non-starts retry, and an uncertain start gets one recovery attempt with the same dedupe key before expiring after 24 hours. Read it with `oomi spaces practice-feedback SPACE --component COMPONENT`; paginate cards with `oomi spaces reviews SPACE --component COMPONENT [--cursor CURSOR]`. Never fabricate a call, request audio from client-written text, or start a microphone. Calls are saved in Talk.