openmausbot 0.1.55 → 0.1.56

package/dist-server/server/bot-profile.js

@@ -2,6 +2,21 @@ import { z } from "zod";
 import { BOT_AVATAR_CROPS, botAvatarCropSchema, botAvatarUrlSchema } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 import { MASCOT_BODY_IDS, mascotBodySchema } from "../shared/mascot-bodies.js";
+/** A name or title is quoted inside prompts and cards as one line — a
+ * roster entry, a "Name: …" speaker line, the bracketed provenance note.
+ * Text that can break out of that line (a newline, a control byte, the
+ * Unicode separators) is refused at the door rather than flattened later,
+ * so what the person sees in the sidebar is what every prompt sees too.
+ * Written as a scan because a control-character class is the kind of
+ * literal the linter (rightly) refuses. */
+export function fitsOnOneLine(value) {
+    for (let i = 0; i < value.length; i += 1) {
+        const code = value.charCodeAt(i);
+        if (code < 0x20 || (code >= 0x7f && code <= 0x9f) || code === 0x2028 || code === 0x2029)
+            return false;
+    }
+    return true;
+}
 export const BOT_PROFILE_PATCH_FIELDS = [
     "name",
     "title",
@@ -18,10 +33,12 @@ const profilePatchSchema = z.object({
         .string({ error: "name must be a string" })
         .max(BOT_PROFILE_LIMITS.name, { error: "name must be at most 100 characters" })
         .refine((value) => Boolean(value.trim()), { error: "name must not be empty" })
+        .refine(fitsOnOneLine, { error: "name must fit on one line" })
         .optional(),
     title: z
         .string({ error: "title must be a string" })
         .max(BOT_PROFILE_LIMITS.title, { error: "title must be at most 200 characters" })
+        .refine(fitsOnOneLine, { error: "title must fit on one line" })
         .optional(),
     description: z
         .string({ error: "description must be a string" })

package/dist-server/server/channel-queue.js

@@ -17,6 +17,7 @@ export function queueChannelMessage(groupId, threadId, text, options = {}) {
         replyToId: options.replyToId,
         sendId: options.sendId,
         mode: options.mode ?? "chat",
+        via: options.via,
     };
     entry.items.push(item);
     queues.set(threadId, entry);

package/dist-server/server/computer-control.js

@@ -147,3 +147,18 @@ export class ComputerControl {
         return snapshot;
     }
 }
+/** Safely executes an async tool or desktop control call, catching runtime exceptions gracefully. */
+export async function executeToolSafely(toolName, fn) {
+    try {
+        const data = await fn();
+        return { success: true, data };
+    }
+    catch (err) {
+        const errorMessage = err?.message || String(err) || 'Unknown execution error';
+        console.error(`[Tool Execution Error] Name: ${toolName} | Details: ${errorMessage}`);
+        return {
+            success: false,
+            error: `Tool '${toolName}' failed to execute: ${errorMessage}`
+        };
+    }
+}

package/dist-server/server/exit.js

@@ -0,0 +1,9 @@
+// End the process with a code once stdout and stderr have flushed. On Linux a
+// pipe (CI's `| grep`, a journal) takes writes asynchronously, so
+// `process.exit` right after `console.error` can drop the very line that
+// says what went wrong. A write callback fires only once its data is out.
+export function exitAfterFlush(code) {
+    process.exitCode = code;
+    const flushed = (stream) => new Promise((done) => stream.write("", () => done()));
+    void Promise.all([flushed(process.stdout), flushed(process.stderr)]).then(() => process.exit(code));
+}

package/dist-server/server/index.js

@@ -10,7 +10,7 @@ import { botAvatarUrlFromStoredPath } from "../shared/bot-avatar.js";
 import { approvalModeFor, supportsApprovalMode, requiresNativeApproval, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
+import { approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
 import { requestReview, resolveAutoReviewMode, shouldReview } from "./auto-review.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
@@ -20,7 +20,7 @@ import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, snapshotAvatarGenerationState, } from "./avatar-image.js";
-import { parseBotProfilePatch } from "./bot-profile.js";
+import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import * as box from "./box.js";
@@ -28,7 +28,7 @@ import { boxCreateRecoverySnapshot, retireDeletedBoxCreate } from "./box-create-
 import { boxAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
-import { peerAllowed, peerRosterSystemPrompt, reachablePeers, roomPeerRosterSystemPrompt } from "./peer-roster.js";
+import { peerAllowed, peerName, peerRosterSystemPrompt, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
 import { ensureDirs, instanceConfigs, loadConfig, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, saveConfig, showToolCallsEnabled, skillRecorderEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
@@ -156,6 +156,7 @@ const DESKTOP_MANAGED = process.env.OMB_DESKTOP_PARENT === "1";
 // Empty is deliberately a deny-all bootstrap state. Only Electron's private
 // utility-process port can replace it with the per-launch owner capability.
 let desktopMutationToken = DESKTOP_MANAGED ? "" : undefined;
+let companionMutationToken = DESKTOP_MANAGED ? "" : undefined;
 // Where remote clients reach this server (a proxy's public address); pairing URLs use it.
 const PUBLIC_URL = process.env.OMB_PUBLIC_URL?.trim().replace(/\/+$/, "") || null;
 const cfg = loadConfig();
@@ -188,6 +189,9 @@ function applyDesktopMutationTokenMessage(raw) {
         throw new Error("invalid desktop mutation capability");
     }
     desktopMutationToken = message.token;
+    if (typeof message.companionToken === "string" && /^[A-Za-z0-9_-]{43}$/.test(message.companionToken)) {
+        companionMutationToken = message.companionToken;
+    }
     return true;
 }
 const browserCleanup = new BrowserCleanupCoordinator({
@@ -853,9 +857,10 @@ const wireTrustedApprovalBot = (bot) => {
 /** Defense in depth for hand-edited/corrupt durable records: elevated
  * approval semantics require an implemented provider mapping. The trusted transition enforces
  * this too, but no provider dispatch or later permission callback relies on
- * persistence having been produced exclusively by that route. */
-const approvalModeForTurn = (bot) => {
-    const mode = approvalModeFor(bot);
+ * persistence having been produced exclusively by that route. And a turn
+ * another bot started never runs as Full — see approvalModeForOrigin. */
+const approvalModeForTurn = (bot, peerInitiated = false) => {
+    const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
     if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
         return "ask";
     }
@@ -2376,7 +2381,9 @@ bus.subscribe((event) => {
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id) : false;
             const verdict = permission && asker && event.requestId
                 ? autoVerdict({
-                    approvalMode: approvalModeForTurn(asker),
+                    // the same origin the dispatch used, so a peer-started turn's
+                    // residual asks are judged as Approve for me here too
+                    approvalMode: approvalModeForTurn(asker, isInternalTurn(event.threadId)),
                     autoApprove: false,
                     alwaysAllow: asker.alwaysAllow,
                 }, event.tool, event.summary, {
@@ -3421,7 +3428,12 @@ async function startTurn(botId, text, opts) {
     directTurnDispatchClaims.set(bot.id, { id: dispatchClaimId, threadId, phase: "setup" });
     beginInternalCapabilityGeneration(threadId, dispatchClaimId);
     store.setActivity(bot.id, "working");
-    store.patchBot(bot.id, { unread: false });
+    // The badge is "this bot answered you, and you have not looked yet". A
+    // person starting a turn has looked; a teammate's hop has not — the fold
+    // never re-marks an internal turn, so clearing here would silently spend
+    // a signal the person still owes a glance to.
+    if (commsDepth === 0)
+        store.patchBot(bot.id, { unread: false });
     turnUsage.delete(threadId);
     void (async () => {
         try {
@@ -3747,7 +3759,7 @@ async function startTurn(botId, text, opts) {
                 threadId,
                 text: turnText,
                 images: turnImages,
-                approvalMode: approvalModeForTurn(liveBot ?? bot),
+                approvalMode: approvalModeForTurn(liveBot ?? bot, commsDepth > 0),
                 model,
                 effort,
                 // a rewound thread never resumes the abandoned branch's session
@@ -4339,7 +4351,12 @@ function serializeRoomContext(threadId, userName, textOverride, readerBotId) {
         .slice(-GROUP_CONTEXT_MESSAGES)
         .map((m) => {
         const rendered = textOverride?.messageId === m.id ? { ...m, text: textOverride.text } : m;
-        const speaker = m.role === "user" ? userName : (m.from?.name ?? "Bot");
+        // a bot's name is quoted on the speaker line, so it gets one line; a
+        // user line that came through the API says so, since the reader would
+        // otherwise take it for the person typing
+        const speaker = m.role === "user"
+            ? m.via === "api" ? `${userName} (sent through the local API, not typed)` : userName
+            : m.from ? peerName(m.from.name) : "Bot";
         const line = `${speaker}: ${transcriptText(rendered, messagesById, userName)}`;
         // A room reply is the room talking. A post_to_room message is another
         // bot's text carried in from somewhere else, so it says so — the
@@ -4366,7 +4383,7 @@ const ROOM_POST_MAX_CHARS = 4_000;
 // approval bus: peer-approval.ts only needs to push cards and broadcast
 // them — its pending map lives in the module so the two respond endpoints
 // can call resolvePeerComms without holding a reference back to here.
-const approvalBus = { store, broadcast };
+const approvalBus = { store, broadcast, notify };
 // Approvals live only in memory, so any peer card still open on disk is one
 // whose resolver died with the previous process. Left alone it can never be
 // answered, and the composer stays disabled behind it — settle them at boot.
@@ -4634,7 +4651,7 @@ setupRetry = 0) {
         const roster = readyGroup.memberIds
             .map((id) => store.bot(id))
             .filter((b) => Boolean(b))
-            .map((b) => `@${b.name}${b.title ? ` (${b.title})` : ""}`)
+            .map(roomRosterLine)
             .join(", ");
         // The roster above is who an @mention can reach; the section's other bots
         // are who it cannot. The 1:1 prompt has carried a peer roster since #774,
@@ -5246,6 +5263,7 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
         sendId,
         channelMode,
         queueId,
+        via: options.via,
     });
     if (!group.dm)
         store.titleGroupTaskFromFirstMessage(group.id, text, threadId);
@@ -5376,7 +5394,7 @@ function drainQueuedChannelSends() {
     drainChannelMessages((groupId) => {
         const group = store.group(groupId);
         return group ? groupIsWorking(group) : false;
-    }, ({ groupId, threadId, text, replyToId, sendId, mode, id }) => {
+    }, ({ groupId, threadId, text, replyToId, sendId, mode, id, via }) => {
         const group = store.group(groupId);
         const ownsThread = group?.dm
             ? group.threadId === threadId
@@ -5384,7 +5402,7 @@ function drainQueuedChannelSends() {
         if (!group || !ownsThread)
             return;
         try {
-            startGroupTurn(groupId, text, resolveReplyTarget(threadId, replyToId), sendId, mode, id);
+            startGroupTurn(groupId, text, resolveReplyTarget(threadId, replyToId), sendId, mode, id, { via });
         }
         catch (error) {
             store.appendMessage(threadId, {
@@ -5478,14 +5496,17 @@ function connectorThread(botId, threadId) {
  * last, and a second copy of it could only ever disagree.
  *
  * Only a person puts a user-role message in a room: the composer, or a
- * calendar call they scheduled. No bot has that ingress — post_to_room
- * appends role "bot", which is the rule this whole surface turns on — so
- * a bot cannot re-arm the ceiling it just spent. */
+ * calendar call they scheduled. No bot tool has that ingress — post_to_room
+ * appends role "bot", which is the rule this whole surface turns on. The
+ * one door a bot's shell could reach on a headless server, the HTTP API
+ * with no session behind it, stamps what it lets in (Message.via), and a
+ * line so stamped does not count here — so a bot cannot re-arm the ceiling
+ * it just spent. */
 function lastHumanRoomMessageAt(group) {
     const messages = store.messagesFor(group.threadId);
     for (let i = messages.length - 1; i >= 0; i -= 1) {
         const message = messages[i];
-        if (message.role === "user" && message.kind === "text")
+        if (message.role === "user" && message.kind === "text" && !message.via)
             return message.at;
     }
     return undefined;
@@ -6469,6 +6490,7 @@ const handleRequest = async (req, res) => {
             streamPath: "/api/events",
             url,
             loopbackMutationToken: desktopMutationToken,
+            companionMutationToken,
         });
         // Reachability probe, public: the phone races it across a server's
         // addresses before it has a session, and the tunnel verifier polls it.
@@ -7004,7 +7026,12 @@ const handleRequest = async (req, res) => {
                     currentFrom = freshFrom;
                     currentTarget = freshTarget;
                 }
-                const channel = getOrCreateChannel(store, currentFrom, currentTarget);
+                // An ask made from inside a room is mirrored into that room — the
+                // conversation the person is actually reading — the way delegate_bot
+                // already does. The pair channel is for asks made from a bot's own
+                // thread; sending a room's ask there put the whole exchange behind
+                // an unbadged "A ⇄ B" entry nobody had a reason to open.
+                const channel = getOrCreateChannel(store, currentFrom, currentTarget, connectorThread(currentFrom.id, fromThreadId)?.group);
                 mirrorExchange(commsBus, currentFrom, currentTarget, message, channel, fromThreadId);
                 const prefixed = withPeerProvenance(message, {
                     botName: currentFrom.name,
@@ -7312,6 +7339,12 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "name must be at most 80 characters" });
                 if (role.length > 120)
                     return json(res, 400, { error: "role must be at most 120 characters" });
+                // the same door the profile endpoints keep: both fields are quoted
+                // into every other room member's system prompt, one line each
+                if (!fitsOnOneLine(name))
+                    return json(res, 400, { error: "name must fit on one line" });
+                if (!fitsOnOneLine(role))
+                    return json(res, 400, { error: "role must fit on one line" });
                 if (instructions.length > 1_000) {
                     return json(res, 400, { error: "instructions must be at most 1000 characters" });
                 }
@@ -8071,7 +8104,9 @@ const handleRequest = async (req, res) => {
             const userName = cfg.profile?.name?.trim() || "User";
             const lines = [`# ${title}`, ""];
             for (const msg of messages) {
-                const who = msg.role === "user" ? userName : (msg.from?.name ?? bot?.name ?? "Bot");
+                const who = msg.role === "user"
+                    ? msg.via === "api" ? `${userName} (via the local API)` : userName
+                    : (msg.from?.name ?? bot?.name ?? "Bot");
                 if (msg.kind === "text" && msg.text)
                     lines.push(`**${who}:**`, "", msg.text, "");
                 else if (msg.kind === "activity" && msg.tool)
@@ -8774,6 +8809,19 @@ const handleRequest = async (req, res) => {
             }
             const sendId = parseSendId(body.sendId);
             const replyTo = resolveReplyTarget(threadId, body.replyToId);
+            // Who is this "user"? On a headless server loopback is the owner by
+            // design, and a bot's shell is a loopback caller too. A request with
+            // no paired session and no browser origin cannot be told from a
+            // script, so its message is stamped rather than trusted as typed —
+            // the room's readers, its posting budget and its transcript all look
+            // at that stamp — and the send is logged where the operator can see
+            // it. The desktop app never gets here: its owner capability is
+            // checked before this handler runs.
+            const browserOrigin = typeof req.headers.origin === "string" && req.headers.origin.trim() !== "";
+            const via = auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin ? "api" : undefined;
+            if (via) {
+                console.warn(`room message from ${requestSource(req)} through the local API (no session, no browser origin) into "${group.name}"`);
+            }
             const receipt = await sendSequencer.run(sendId ? `group:${group.id}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id, channelMode), async () => {
                 if (sendId) {
                     const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id, channelMode);
@@ -8806,10 +8854,11 @@ const handleRequest = async (req, res) => {
                         replyToId: replyTo?.id,
                         sendId,
                         mode: channelMode,
+                        via,
                     });
                     return { ok: true, queued: true, queueId: queued.id, threadId };
                 }
-                const message = startGroupTurn(current.id, text, replyTo, sendId, channelMode);
+                const message = startGroupTurn(current.id, text, replyTo, sendId, channelMode, undefined, { via });
                 return { ok: true, threadId, message };
             });
             return json(res, 202, receipt);
@@ -9379,6 +9428,45 @@ const handleRequest = async (req, res) => {
                 }
                 patch.alwaysAllow = [...new Set(body.alwaysAllow)].slice(0, 200);
             }
+            // What "the proof of a human" above actually rests on. In the packaged
+            // desktop it is real: every mutation here already carried the owner
+            // capability a tool call cannot forge. Outside it — `pnpm dev`, the
+            // CLI, the Docker stack — loopback is the owner by design, so the
+            // acknowledgement flag and the settings that loosen a bot's leash
+            // (a wider peer list, the peer-approval gate switched off, a section
+            // move that changes who is in reach, a standing always-allow grant)
+            // are one curl away from the bot they constrain. What such a request
+            // does NOT have is a paired session or a browser origin; and the one
+            // moment a bot's shell can send it is while a turn is running. So an
+            // originless, session-less loopback caller may loosen a bot only
+            // while every bot is idle — and is logged when it does — while the
+            // served UI (a browser, with its origin) and a paired device keep
+            // working mid-turn as before. A bar, not a wall: the wall is the
+            // desktop capability or a paired session, which is what the refusal
+            // points at.
+            const loosened = [];
+            if (body.peers !== undefined && Array.isArray(existingBot?.peers)) {
+                const nextPeers = patch.peers;
+                if (nextPeers === undefined || (Array.isArray(nextPeers) && nextPeers.some((peerId) => !existingBot.peers.includes(peerId)))) {
+                    loosened.push("peers");
+                }
+            }
+            if (body.approvePeerComms === false && existingBot?.approvePeerComms === true)
+                loosened.push("approvePeerComms");
+            if (section !== undefined && sectionKey(existingBot?.section) !== sectionKey(section))
+                loosened.push("section");
+            if (Array.isArray(patch.alwaysAllow) && patch.alwaysAllow.some((key) => !(existingBot?.alwaysAllow ?? []).includes(key))) {
+                loosened.push("alwaysAllow");
+            }
+            const browserOrigin = typeof req.headers.origin === "string" && req.headers.origin.trim() !== "";
+            if (loosened.length && auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin) {
+                if (store.bots.some((candidate) => candidate.busy)) {
+                    return json(res, 409, {
+                        error: "A bot is working right now, so this change has to come from the desktop app or a paired device. Try again once every bot is idle.",
+                    });
+                }
+                console.warn(`bot ${m[1]}: ${loosened.join(", ")} loosened by ${requestSource(req)} through the local API with no paired session`);
+            }
             if (existingBot?.computer === "local" && computerSpecified && requestedComputer !== "local") {
                 const routineThread = routines.activeBotRunForBot(existingBot.id)?.threadId;
                 const groupThread = activeGroupTurnForBot(existingBot.id)?.threadId;
@@ -9936,7 +10024,16 @@ const handleRequest = async (req, res) => {
                         if (!current.busy) {
                             throw Object.assign(new Error("the running turn ended before the steered message could be recorded"), { status: 409 });
                         }
-                        clearUnattended(current.id);
+                        // A person steering a webhook turn is present, and auto mode may
+                        // follow them again. But this route is also reachable from the
+                        // bot's own shell on a headless server (loopback is the owner
+                        // there), and "continue" typed by the turn itself must not be
+                        // the thing that lifts the block written against it — so only
+                        // a request that proves a person (a paired session, or the
+                        // desktop's owner capability, which every mutation there has
+                        // already shown) clears the mark.
+                        if (auth.kind === "session" || DESKTOP_MANAGED)
+                            clearUnattended(current.id);
                         const message = store.appendMessage(threadId, {
                             role: "user",
                             kind: "text",

package/dist-server/server/openmausbot.js

@@ -1,6 +1,7 @@
 // Entry point for the `openmausbot` command (see cli.ts).
 import { main } from "./cli.js";
-main().then((code) => process.exit(code), (error) => {
+import { exitAfterFlush } from "./exit.js";
+main().then(exitAfterFlush, (error) => {
     console.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    exitAfterFlush(1);
 });

package/dist-server/server/pair-cli.js

@@ -1,7 +1,8 @@
 // Compatibility alias: `openmausbot pair` lives in cli.ts now. Kept because
 // docs and images reference dist-server/pair-cli.js.
 import { main } from "./cli.js";
-main(["pair", ...process.argv.slice(2)]).then((code) => process.exit(code), (error) => {
+import { exitAfterFlush } from "./exit.js";
+main(["pair", ...process.argv.slice(2)]).then(exitAfterFlush, (error) => {
     console.error(error instanceof Error ? error.message : String(error));
-    process.exit(1);
+    exitAfterFlush(1);
 });

package/dist-server/server/peer-approval.js

@@ -14,6 +14,7 @@
 // the user-facing Always-allow flow already mirrors that key back into
 // `alwaysAllow`, so the two sides never disagree about what was granted.
 import { newId } from "./contracts.js";
+import { buildNotification } from "./notify.js";
 import { peerAllowKey } from "./peer-approval-key.js";
 export { peerAllowKey } from "./peer-approval-key.js";
 /** Mark the card answered so the UI stops treating it as pending. Mirrors
@@ -28,6 +29,11 @@ function settleCard(pending, behavior, source) {
     pending.bus.store.patchMessage(pending.threadId, pending.messageId, {
         card: { ...existing.card, answered: behavior, dismissed: source !== "user" },
     });
+    // answered (by whoever): the turn is working again — the same hand-back
+    // the request.resolved fold does for a provider's card
+    const waiting = pending.bus.store.bot(pending.fromBotId);
+    if (waiting?.activity === "waiting-on-you")
+        pending.bus.store.setActivity(waiting.id, "working");
 }
 /** requestId → pending ask. Lives only in memory — restarting the
  * server cancels every in-flight approval, like provider permissions do. */
@@ -62,6 +68,26 @@ function pushApprovalCard(bus, from, target, message, action, requestId, sourceT
     });
     return note;
 }
+/** This card is the one bot-to-bot event that blocks on a person — for up
+ * to fifteen minutes — so it gets exactly what a provider's card gets: the
+ * bot shows as waiting rather than working, and a "needs approval" frame
+ * goes out aimed at the thread the card is in. Without this the sidebar
+ * read "Working…" with no dot and no banner until the timer denied it, and
+ * the bot then reported it could not reach a teammate nobody knew it had
+ * asked for. A bot speaking in a room is not reachable in its own thread,
+ * so the room the card landed in is named, the way takeover does. */
+function announceCard(bus, from, card, sourceThreadId) {
+    // the bot is not working now — it is waiting on a person. A delegation
+    // drained after its turn has already settled is idle, and stays so.
+    const live = bus.store.bot(from.id);
+    if (live?.busy)
+        bus.store.setActivity(from.id, "waiting-on-you");
+    const room = bus.store.groupByThread(sourceThreadId);
+    const group = room && !room.dm ? { id: room.id, name: room.name } : undefined;
+    const title = card.card?.title ?? "";
+    const detail = card.card?.subtitle ? `${title} — ${card.card.subtitle}` : title;
+    bus.notify?.(buildNotification("approval", from, sourceThreadId, detail, { avatarUrl: from.avatarUrl, group }));
+}
 /** Ask the user (in the source task thread) whether `from` may `action` `target`.
  * Resolves with `"allow"` or `"deny"`. If `from.alwaysAllow` already
  * covers the (action, target) pair, returns `"allow"` immediately
@@ -75,6 +101,7 @@ export function requestPeerApproval(bus, from, target, message, action, sourceTh
         // the card has to exist before the entry, so a timeout or an answer can
         // always find it to settle
         const card = pushApprovalCard(bus, from, target, message, action, requestId, sourceThreadId);
+        announceCard(bus, from, card, sourceThreadId);
         const timer = setTimeout(() => {
             // 15 minutes without an answer → deny. Keeps an unattended bot from
             // stalling its own turn forever (matches the Claude broker timeout).

package/dist-server/server/peer-provenance.js

@@ -16,8 +16,11 @@
 // The note opens with "[Message from @Name" or "[Posted by @Name" because
 // the shape of the first few words is what a model actually keys on, and
 // that marker has been in the ask path since peer comms shipped.
+import { peerName } from "./peer-roster.js";
 /** The bracketed provenance line on its own. */
-export function peerProvenanceNote({ botName, delivery, unattended }) {
+export function peerProvenanceNote({ botName: rawName, delivery, unattended }) {
+    // the note is one bracketed line, and the name must not be able to end it
+    const botName = peerName(rawName);
     const opening = delivery === "ask_bot"
         ? `Message from @${botName}, another bot in this OpenMausBot workspace`
         : `Posted by @${botName}, another bot in this OpenMausBot workspace`;

package/dist-server/server/peer-roster.js

@@ -57,6 +57,21 @@ const clip = (value, max) => {
     const flat = oneLine(value);
     return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
 };
+/** A bot's name where it is about to be quoted INSIDE harness text — the
+ * bracketed provenance note, a room transcript's "Name: …" speaker line.
+ * Flattened and clipped like a roster entry, and with the brackets the
+ * provenance note is built from taken out: "Scout]" would otherwise close
+ * the note early and let whatever follows read as a speaker of its own. */
+export function peerName(value) {
+    return clip(value.replace(/[[\]]/g, " "), ROSTER_NAME_MAX);
+}
+/** One member of a room as the room prompt lists it. Same discipline as the
+ * 1:1 roster: a title carrying a newline would otherwise land in every OTHER
+ * member's system prompt as a line of its own. */
+export function roomRosterLine(member) {
+    const role = member.title ? clip(member.title, ROSTER_ROLE_MAX) : "";
+    return `@${clip(member.name, ROSTER_NAME_MAX)}${role ? ` (${role})` : ""}`;
+}
 /** Render a team as roster lines. Every knob is the caller's, not the
  * renderer's: how many names a bot needs — and how much detail — depends on
  * what it is expected to do with them. */

package/dist-server/server/request-auth.js

@@ -1,5 +1,6 @@
 import { timingSafeEqual } from "node:crypto";
 import { isIP } from "node:net";
+import { denyReason as companionDenial } from "../companion/src/routes.js";
 const LOOPBACK_SCOPES = ["admin", "client"];
 export function isLoopbackHost(host) {
     if (!host)
@@ -307,6 +308,15 @@ export function resolveRequestAuth(req, options) {
     const proxied = isProxied(req);
     const loopback = !proxied && isLoopbackHost(headerValue(req.headers.host)) && isAllowedOrigin(headerValue(req.headers.origin));
     if (loopback) {
+        const companionToken = headerValue(req.headers["x-openmausbot-companion-auth"]);
+        if (companionToken && options.loopbackMutationToken !== undefined) {
+            if (!secureTokenMatch(companionToken, options.companionMutationToken ?? "") ||
+                req.headers["x-openmausbot-companion"] !== "1" ||
+                !/^[\w-]{1,128}$/.test(headerValue(req.headers["x-openmausbot-companion-device"]) ?? "") ||
+                companionDenial({ path, method, authenticated: true }))
+                return deny(403, "forbidden: invalid companion request");
+            return { auth: { kind: "loopback", scopes: LOOPBACK_SCOPES }, status: 401, error: "" };
+        }
         if (options.loopbackMutationToken !== undefined &&
             mutatingPublicRoute(method, path) &&
             !secureTokenMatch(headerValue(req.headers[DESKTOP_OWNER_HEADER]), options.loopbackMutationToken)) {

package/dist-server/server/tunnel.js

@@ -126,7 +126,7 @@ export function guardianEntry(here = HERE) {
     const bundled = join(here, "tunnel-guardian.js");
     if (existsSync(bundled))
         return bundled;
-    const source = resolve(here, "..", "electron", "managed-companion-guardian.mjs");
+    const source = resolve(here, "..", "electron", "managed-companion-guardian-main.mjs");
     return existsSync(source) ? source : null;
 }
 export async function ensureCloudflared(options) {

package/dist-server/tunnel-guardian.js

@@ -1,7 +1,6 @@
 // electron/managed-companion-guardian.mjs
 import { spawn } from "node:child_process";
 import path2 from "node:path";
-import { fileURLToPath } from "node:url";
 
 // electron/companion-origin-gateway.mjs
 import http from "node:http";
@@ -236,12 +235,6 @@ function minimalCloudflaredEnvironment(environment = process.env, platform = pro
   }
   return minimal;
 }
-function minimalGuardianEnvironment(environment = process.env, platform = process.platform) {
-  return {
-    ...minimalCloudflaredEnvironment(environment, platform),
-    ELECTRON_RUN_AS_NODE: "1"
-  };
-}
 function processIsAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -376,15 +369,9 @@ function guardianArguments(argv) {
   }
   return { cloudflaredBinary, tokenFile, target, originPort };
 }
-var isDirectExecution = process.argv[1] && path2.resolve(process.argv[1]) === path2.resolve(fileURLToPath(import.meta.url));
-if (isDirectExecution) {
-  runManagedCompanionGuardian(guardianArguments(process.argv.slice(2))).then(
-    (code) => process.exit(code),
-    () => process.exit(1)
-  );
-}
-export {
-  minimalCloudflaredEnvironment,
-  minimalGuardianEnvironment,
-  runManagedCompanionGuardian
-};
+
+// electron/managed-companion-guardian-main.mjs
+runManagedCompanionGuardian(guardianArguments(process.argv.slice(2))).then(
+  (code) => process.exit(code),
+  () => process.exit(1)
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.55",
+  "version": "0.1.56",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",