openmausbot 0.1.56 → 0.1.58

package/dist-server/server/cli.js

@@ -28,9 +28,10 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
 import { explainTailscaleFailure, tailscaleServe, tailscaleServeOff, tailscaleStatus } from "./tailscale.js";
+import { browserEngineStatus, describeBrowserEngine, ensureChrome, installAgentBrowserBinary, resolveAgentBrowserBinary, } from "./browser-engine.js";
 import { cleanupTunnelOrigin, createTunnelAccount, createTunnelOrigin, describeTunnelAccount, describeTunnelState, ensureCloudflared, guardianEntry, startTunnel, tunnelAccess, } from "./tunnel.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
-const COMMANDS = ["serve", "pair", "sessions", "status", "login", "logout", "help", "--help", "-h"];
+const COMMANDS = ["serve", "pair", "sessions", "status", "login", "logout", "browser", "help", "--help", "-h"];
 export function parseArgs(argv, env = process.env) {
     const [command = "help", ...rest] = argv;
     if (!COMMANDS.includes(command)) {
@@ -44,6 +45,7 @@ export function parseArgs(argv, env = process.env) {
         tunnel: false,
         client: false,
         pair: true,
+        withDeps: false,
         json: false,
     };
     for (let i = 0; i < rest.length; i += 1) {
@@ -78,6 +80,10 @@ export function parseArgs(argv, env = process.env) {
                 options.email = value();
             else if (options.command === "sessions" && arg === "revoke")
                 options.revoke = value();
+            else if (options.command === "browser" && (arg === "install" || arg === "status"))
+                options.browserAction = arg;
+            else if (options.command === "browser" && arg === "--with-deps")
+                options.withDeps = true;
             else
                 return { error: `unknown argument "${arg}"` };
         }
@@ -91,6 +97,8 @@ export function parseArgs(argv, env = process.env) {
         return { error: "--public-url must start with http:// or https://" };
     if (options.tailscale && options.tunnel)
         return { error: "choose one of --tailscale (your tailnet) and --tunnel (a public address)" };
+    if (options.command === "browser" && !options.browserAction)
+        return { error: "browser needs an action: install or status" };
     return options;
 }
 export const USAGE = `openmausbot — run the server anywhere, pair devices to it
@@ -102,6 +110,7 @@ export const USAGE = `openmausbot — run the server anywhere, pair devices to i
   openmausbot status
   openmausbot login [--email you@example.com]
   openmausbot logout
+  openmausbot browser install [--with-deps] | status
 
 serve   starts the server and prints a pairing link + QR code
 pair    mints a pairing code against a running server (--client: chat only)
@@ -110,6 +119,10 @@ status  what the server says about itself
 login   signs this machine in to an OpenMausBot account (an emailed code)
         and reserves its public address for --tunnel
 logout  releases that address and signs out
+browser install: the bots' browser engine (agent-browser, pinned) and a
+        Chrome for Testing, into the data dir; --with-deps also installs
+        the Linux libraries Chrome needs (run as root once). status: what
+        this machine has.
 
 --tailscale  serve over your tailnet: Tailscale terminates HTTPS and the
              link uses this machine's MagicDNS name (needs Tailscale signed in
@@ -329,6 +342,44 @@ export async function runLogout(options, io = defaultIo()) {
     io.log(`Signed out ${before.email}${before.address ? `; ${before.address} is released` : ""}.`);
     return 0;
 }
+export async function runBrowser(options, io = defaultIo()) {
+    const status = browserEngineStatus({ dataDir: options.dataDir });
+    if (options.browserAction === "status") {
+        io.log(describeBrowserEngine(status));
+        if (status.kind !== "ready" && status.installable)
+            io.log("install it with:  openmausbot browser install");
+        return status.kind === "ready" ? 0 : 1;
+    }
+    let binary = resolveAgentBrowserBinary({ dataDir: options.dataDir });
+    if (binary) {
+        io.log(`agent-browser is already here: ${binary}`);
+    }
+    else {
+        if (status.kind !== "ready" && !status.installable) {
+            io.error(status.reason);
+            return 1;
+        }
+        try {
+            binary = await installAgentBrowserBinary({ dataDir: options.dataDir, log: io.log });
+        }
+        catch (error) {
+            io.error(`could not install agent-browser: ${message(error)}`);
+            return 1;
+        }
+        io.log(`installed ${binary}`);
+    }
+    try {
+        await ensureChrome(binary, { withDeps: options.withDeps === true, log: io.log });
+    }
+    catch (error) {
+        io.error(`Chrome is not ready: ${message(error)}`);
+        if (process.platform === "linux" && !options.withDeps)
+            io.error("on Linux, Chrome needs system libraries: run `sudo openmausbot browser install --with-deps` once");
+        return 1;
+    }
+    io.log("bots on this server can use a browser now: turn it on under Settings → Experimental, then per bot");
+    return 0;
+}
 /** Where the server bundle lives relative to this file: next to it in the
  * npm package and the image (dist-server/), or the TypeScript source in a
  * checkout. */
@@ -485,6 +536,7 @@ export async function runServe(options, log = console.log) {
     log("");
     log(`OpenMausBot is running on http://127.0.0.1:${options.port}${publicUrl ? `, reachable at ${publicUrl}` : ""}`);
     log(`data: ${options.dataDir}`);
+    log(describeBrowserEngine(browserEngineStatus({ dataDir: options.dataDir })));
     if (options.pair) {
         log("");
         log(await mintPairing(options.port, { label: options.label ? `${options.label} owner` : undefined, publicUrl: publicUrl ?? undefined }));
@@ -517,6 +569,8 @@ export async function main(argv = process.argv.slice(2)) {
             return runLogin(options);
         case "logout":
             return runLogout(options);
+        case "browser":
+            return runBrowser(options);
         default:
             console.log(USAGE);
             return 0;

package/dist-server/server/connector-proxy.js

@@ -118,22 +118,42 @@ function connectorAdds(args) {
     const toolkits = args.toolkits;
     if (!Array.isArray(toolkits))
         return [];
-    return [...new Set(toolkits.flatMap((item) => {
-            if (typeof item === "string")
-                return [item.toLowerCase()];
-            if (!item || typeof item !== "object" || Array.isArray(item))
-                return [];
-            const row = item;
-            const slug = typeof row.toolkit === "string" ? row.toolkit : row.name;
-            const action = String(row.action ?? "add").toLowerCase();
-            return typeof slug === "string" && ["add", "connect", "initiate"].includes(action) ? [slug.toLowerCase()] : [];
-        }))];
+    const seen = new Set();
+    const requests = [];
+    for (const item of toolkits) {
+        if (typeof item === "string") {
+            const slug = item.trim().toLowerCase();
+            const key = JSON.stringify([slug, ""]);
+            if (!seen.has(key)) {
+                seen.add(key);
+                requests.push({ slug });
+            }
+            continue;
+        }
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            continue;
+        const row = item;
+        const action = String(row.action ?? "add").toLowerCase();
+        if (!["add", "connect", "initiate"].includes(action))
+            continue;
+        const slug = typeof row.toolkit === "string" ? row.toolkit : row.name;
+        if (typeof slug !== "string")
+            continue;
+        const normalized = slug.trim().toLowerCase();
+        const alias = (typeof row.alias === "string" ? row.alias : typeof row.account === "string" ? row.account : "").trim();
+        const key = JSON.stringify([normalized, alias.toLowerCase()]);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        requests.push({ slug: normalized, ...(alias ? { alias } : {}) });
+    }
+    return requests;
 }
-async function showConnectorCards(slugs) {
+async function showConnectorCards(items) {
     const response = await fetch(`${HARNESS}/api/internal/connectors/request`, {
         method: "POST",
         headers: { "content-type": "application/json", authorization: `Bearer ${TOKEN}` },
-        body: JSON.stringify({ botId: BOT_ID, threadId: THREAD_ID, slugs, resumeKey: randomUUID() }),
+        body: JSON.stringify({ botId: BOT_ID, threadId: THREAD_ID, items, resumeKey: randomUUID() }),
         signal: AbortSignal.timeout(30_000),
     });
     if (!response.ok) {
@@ -176,10 +196,11 @@ async function handle(message) {
     if (method === "tools/call") {
         const params = (message.params ?? {});
         const name = String(params.name ?? "");
-        const slugs = /MANAGE_CONNECTIONS$/i.test(name) ? connectorAdds(params.arguments) : [];
-        if (slugs.length) {
-            await showConnectorCards(slugs);
-            send(textResult(id, `OpenMausBot showed the user a secure connection card for ${slugs.join(", ")}. End this turn now. The app will continue the task automatically after the connection finishes.`));
+        const requests = /MANAGE_CONNECTIONS$/i.test(name) ? connectorAdds(params.arguments) : [];
+        if (requests.length) {
+            await showConnectorCards(requests);
+            const labels = requests.map((r) => (r.alias ? `${r.slug} (${r.alias})` : r.slug)).join(", ");
+            send(textResult(id, `OpenMausBot showed the user a secure connection card for ${labels}. End this turn now. The app will continue the task automatically after the connection finishes.`));
             return;
         }
         if (/WAIT_FOR_CONNECTIONS$/i.test(name)) {

package/dist-server/server/container-computer.js

@@ -728,7 +728,10 @@ export function wholeScreenshot(bytes) {
         mime: "image/jpeg",
     };
 }
-export async function containerComputerScreenshot(runner = sh, platform = process.platform, target = SHARED_LOCAL_VM_TARGET) {
+/** The raw frame, in the shape the live screen poller broadcasts to every
+ * client (server/index.ts). The web panel wants a data URL instead, so
+ * containerComputerScreenshot below wraps this one. */
+export async function containerComputerFrame(runner = sh, platform = process.platform, target = SHARED_LOCAL_VM_TARGET) {
     const cacheable = runner === sh && platform === process.platform;
     const now = Date.now();
     const cached = screenshotStatusCache.get(target.key);
@@ -759,7 +762,7 @@ export async function containerComputerScreenshot(runner = sh, platform = proces
         if (!checked.ok) {
             throw Object.assign(new Error("Cua Driver returned an incomplete screenshot"), { status: 502 });
         }
-        return `data:${checked.mime};base64,${data}`;
+        return { png: data, format: checked.mime === "image/jpeg" ? "jpeg" : "png" };
     }
     catch (error) {
         if (cacheable)
@@ -767,6 +770,10 @@ export async function containerComputerScreenshot(runner = sh, platform = proces
         throw error;
     }
 }
+export async function containerComputerScreenshot(runner = sh, platform = process.platform, target = SHARED_LOCAL_VM_TARGET) {
+    const { png, format } = await containerComputerFrame(runner, platform, target);
+    return `data:image/${format};base64,${png}`;
+}
 const screenshotStatusCache = new Map();
 const containerMcpPath = SPAWNED_PROXIES.containerMcp;
 export function containerComputerMcp(runtime, control, target = SHARED_LOCAL_VM_TARGET) {

package/dist-server/server/drivers/agents-proxy.js

@@ -19,6 +19,7 @@
 //   list_routines()                       → inspect this bot's scheduled work
 //   propose_routine(...)                  → show a confirmation card for a new routine
 //   propose_routine_action(...)           → show a confirmation card for a routine change
+//   propose_profile(...)                  → show a confirmation card for a profile change
 //
 // Speaks raw JSON-RPC 2.0 over stdio (no MCP SDK — house style, matches
 // computer-proxy / permission-proxy). All state comes from env, injected by
@@ -212,6 +213,10 @@ const ROUTINE_FIELDS_SCHEMA = {
         type: "boolean",
         description: "Only for updates: set true to remove an existing safety limit. Do not combine with timeout_minutes.",
     },
+    continuity: {
+        type: "boolean",
+        description: "Opt in to using the latest completed run's bounded report as historical context. Defaults to false; set false in an update to start fresh again. Shown on the confirmation card.",
+    },
 };
 const TOOLS = [
     {
@@ -390,6 +395,31 @@ const TOOLS = [
             required: ["routine_id", "action"],
         },
     },
+    {
+        name: "propose_profile",
+        description: "Propose changes to your own name, title, description, standing instructions (SOUL.md), or working folder (cwd). This only creates a confirmation card; nothing changes until the user approves it. After calling it, end the turn and do not claim the change is applied. Keep SOUL.md short — who you are and the rules you never break; put step-by-step procedure into a skill instead. A Chief of Staff may pass for_bot_id (from list_bots) to propose a change for another bot in its section.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                name: { type: "string", maxLength: 100, description: "New display name." },
+                title: { type: "string", maxLength: 200, description: "New role or title." },
+                description: { type: "string", maxLength: 4000, description: "New one-line blurb shown in rosters." },
+                soul: { type: "string", description: "Full replacement text for SOUL.md, at most 24000 bytes." },
+                cwd: {
+                    type: "string",
+                    maxLength: 1024,
+                    description: "Absolute path of the folder your tools read and write in (for example /Users/me/Projects/site). It must already exist. An empty string means your private workspace.",
+                },
+                reason: { type: "string", minLength: 1, maxLength: 500, description: "One sentence the user will see explaining why." },
+                for_bot_id: {
+                    type: "string",
+                    description: "Chief of Staff only: the id of another bot in your section whose profile this changes. Omit to change your own.",
+                },
+            },
+            required: ["reason"],
+        },
+    },
     {
         name: "skills_list",
         description: "List this bot's imported skills (enabled and disabled) and any staged skill writes waiting for the user to confirm. Use this before skill_manage to avoid duplicate names. Listing does not enable anything.",
@@ -475,12 +505,14 @@ function routineFields(args) {
         fields.timeoutMinutes = null;
     else if (typeof args.timeout_minutes === "number")
         fields.timeoutMinutes = args.timeout_minutes;
+    if (typeof args.continuity === "boolean")
+        fields.continuity = args.continuity;
     return { fields };
 }
-function confirmationResult(r, fallback) {
+function confirmationResult(r, fallback, noun = "routine") {
     const summary = typeof r.summary === "string" && r.summary.trim() ? `\n\n${r.summary.trim()}` : "";
     return {
-        text: `A confirmation card is now visible to the user for ${fallback}.${summary}\n\nThis change has not been applied yet. End this turn and wait for the user to confirm or deny the card; do not claim the routine was created or changed before confirmation.`,
+        text: `A confirmation card is now visible to the user for ${fallback}.${summary}\n\nThis change has not been applied yet. End this turn and wait for the user to confirm or deny the card; do not claim the ${noun} was created or changed before confirmation.`,
     };
 }
 /** Who said a recalled line, as the header of a hit or a read. A user-role
@@ -770,6 +802,35 @@ async function callTool(name, args) {
         });
         return confirmationResult(r, `${action.replace("_", " ")} on routine ${routineId}`);
     }
+    if (name === "propose_profile") {
+        const changes = {};
+        if (typeof args.name === "string")
+            changes.name = args.name.trim();
+        if (typeof args.title === "string")
+            changes.title = args.title.trim();
+        if (typeof args.description === "string")
+            changes.description = args.description.trim();
+        if (typeof args.soul === "string")
+            changes.soul = args.soul;
+        if (typeof args.cwd === "string")
+            changes.cwd = args.cwd.trim();
+        if (!Object.keys(changes).length) {
+            return { text: "propose_profile needs at least one of name, title, description, soul, or cwd.", isError: true };
+        }
+        const forBotId = String(args.for_bot_id ?? "").trim();
+        const r = await api("/api/internal/profile-requests", {
+            method: "POST",
+            body: JSON.stringify({
+                fromBotId: BOT_ID,
+                fromThreadId: THREAD_ID,
+                changes,
+                reason: args.reason,
+                // JSON.stringify drops the key entirely when no target was named
+                forBotId: forBotId || undefined,
+            }),
+        });
+        return confirmationResult(r, "the profile change", "profile");
+    }
     if (name === "session_search") {
         const q = String(args.query ?? "").trim();
         if (!q)

package/dist-server/server/drivers/antigravity-acp.js

@@ -48,6 +48,24 @@ function takeLines(buffer) {
     const rest = parts.pop() ?? "";
     return { lines: parts.map((line) => line.replace(/\r$/u, "")), rest };
 }
+/** Only fixed, allowlisted startup hints leave stderr. Native output can
+ * contain OAuth codes and credentials in arbitrary formats, so generic
+ * text redaction is not enough to safely echo a diagnostic tail. */
+function startupHint(line) {
+    if (/no space left|not enough (?:space|disk)|disk (?:is )?full|winerror\s*112/iu.test(line)) {
+        return "The runtime reported insufficient disk space while starting.";
+    }
+    if (/failed to (?:extract|load (?:python|embedded python))|could not load python/iu.test(line)) {
+        return "The runtime reported a problem unpacking or loading its bundled Python runtime.";
+    }
+    if (/permission denied|access is denied|winerror\s*5\b/iu.test(line)) {
+        return "The runtime reported a file or process permission failure.";
+    }
+    if (/address family not supported|failed to create.*(?:socket|listener)|failed to bind/iu.test(line)) {
+        return "The runtime reported a local network listener failure.";
+    }
+    return undefined;
+}
 /** The sign-in link in a server output line, or null for anything else.
  * Google announces it two ways and both land on stderr: it hands the link to
  * $BROWSER — our helper re-emits it JSON-encoded behind a private marker — and
@@ -125,25 +143,41 @@ export class AntigravityAcpClient {
     pending = new Map();
     buffer = "";
     diagnosticBuffer = "";
+    initializationComplete = false;
+    startupOutputBytes = 0;
+    startupDiagnosticBytes = 0;
+    nativeStartupHint;
     closed = false;
     onAuthorizationUrl;
+    /** Settles once the runtime process is gone. On Windows a running
+     * executable pins its file and its directory, so an installer must not
+     * rename or delete either until this settles. */
+    exited;
     constructor(runtime, profile, cwd, onAuthorizationUrl) {
         this.onAuthorizationUrl = onAuthorizationUrl;
         this.child = spawnCli(runtime.executablePath, process.platform === "linux" ? ["--uid="] : [], { cwd, env: profile.environment, stdio: ["pipe", "pipe", "pipe"] });
         this.child.stdout.setEncoding("utf8");
         this.child.stdout.on("data", (chunk) => this.consume(chunk));
-        // Google announces the sign-in link on stderr, not stdout. Scan for that
-        // one line and drop every other byte: stderr also carries authorization
-        // codes, so nothing else is retained or surfaced.
+        // Keep only sign-in announcements and fixed startup failure categories;
+        // never surface raw stderr, which can contain authorization codes.
         this.child.stderr.setEncoding("utf8");
         this.child.stderr.on("data", (chunk) => this.consumeDiagnostics(chunk));
         this.child.once("error", (error) => this.failAll(error));
-        this.child.once("close", (code) => {
-            if (!this.closed)
-                this.failAll(new Error(`Antigravity ACP exited ${code ?? "unexpectedly"}.`));
+        this.exited = new Promise((resolve) => {
+            this.child.once("close", (code, signal) => {
+                this.noteStartupDiagnostic(this.diagnosticBuffer);
+                this.diagnosticBuffer = "";
+                if (!this.closed)
+                    this.failAll(new Error(`Antigravity ACP exited ${code ?? signal ?? "unexpectedly"}.${this.nativeStartupHint ? ` ${this.nativeStartupHint}` : ""}`));
+                resolve();
+            });
+            // Failed spawns also emit `close`. An `error` alone can instead mean
+            // a failed kill, and is not evidence that the runtime stopped.
         });
     }
     consume(chunk) {
+        if (!this.initializationComplete)
+            this.startupOutputBytes += Buffer.byteLength(chunk);
         this.buffer += chunk;
         if (Buffer.byteLength(this.buffer) > MAX_PROTOCOL_LINE_BYTES) {
             this.failAll(new Error("Antigravity sent a protocol line that is too large."));
@@ -197,11 +231,19 @@ export class AntigravityAcpClient {
      * and released immediately and the tail is capped, so no authorization code
      * is ever held. Draining also keeps the pipe from stalling the server. */
     consumeDiagnostics(chunk) {
+        if (!this.initializationComplete)
+            this.startupDiagnosticBytes += Buffer.byteLength(chunk);
         const { lines, rest } = takeLines(this.diagnosticBuffer + chunk);
         // A partial line already longer than any legal link cannot become one.
         this.diagnosticBuffer = rest.length > MAX_DIAGNOSTIC_LINE_CHARS ? "" : rest;
-        for (const line of lines)
-            this.announceAuthorizationUrl(line);
+        for (const line of lines) {
+            if (!this.announceAuthorizationUrl(line))
+                this.noteStartupDiagnostic(line);
+        }
+    }
+    noteStartupDiagnostic(line) {
+        if (!this.initializationComplete)
+            this.nativeStartupHint ??= startupHint(line);
     }
     failAll(error) {
         for (const pending of this.pending.values()) {
@@ -218,7 +260,16 @@ export class AntigravityAcpClient {
         return new Promise((resolveRequest, reject) => {
             const timer = setTimeout(() => {
                 this.pending.delete(id);
-                reject(new Error(`${method} timed out.`));
+                if (method === "initialize") {
+                    this.noteStartupDiagnostic(this.diagnosticBuffer);
+                    reject(new Error(`Antigravity initialization timed out after ${Math.ceil(timeoutMs / 1_000)} seconds (${process.platform}-${process.arch}). ` +
+                        "The executable was found, but did not finish starting. " +
+                        (this.nativeStartupHint ? `${this.nativeStartupHint} ` : "") +
+                        `Startup output: ${this.startupOutputBytes} bytes; diagnostic output: ${this.startupDiagnosticBytes} bytes. ` +
+                        "Retry setup. If it still fails, share this error and your OpenMausBot version; do not paste Google sign-in links or tokens."));
+                }
+                else
+                    reject(new Error(`${method} timed out.`));
             }, timeoutMs);
             timer.unref?.();
             this.pending.set(id, { resolve: resolveRequest, reject, timer });
@@ -226,11 +277,14 @@ export class AntigravityAcpClient {
         });
     }
     async initialize(timeoutMs = STARTUP_TIMEOUT_MS) {
-        return this.request("initialize", {
+        const initialized = await this.request("initialize", {
             protocolVersion: 1,
             clientInfo: { name: "openmausbot", version: "0.0.0" },
             clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
         }, timeoutMs);
+        this.initializationComplete = true;
+        this.nativeStartupHint = undefined;
+        return initialized;
     }
     close() {
         if (this.closed)
@@ -239,6 +293,22 @@ export class AntigravityAcpClient {
         this.failAll(new Error("Antigravity ACP was closed."));
         killCliTree(this.child);
     }
+    /** Close, then wait (bounded) for the process to be gone. `killCliTree`
+     * on Windows asks taskkill and returns at once; the exit lands later. */
+    async closeAndWait(timeoutMs = 5_000) {
+        this.close();
+        let timer;
+        const timedOut = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(false), timeoutMs);
+            timer.unref?.();
+        });
+        try {
+            return await Promise.race([this.exited.then(() => true), timedOut]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
 }
 export function parseAntigravityAuthorizationUrl(authorizationUrl) {
     if (authorizationUrl.length > 16_384 || /\s/u.test(authorizationUrl)) {
@@ -407,26 +477,55 @@ export function isValidAntigravityInitializeResult(initialized, expectedVersion)
  */
 export async function validateAntigravityRuntime(runtime, expectedVersion) {
     const profileDirectory = await mkdtemp(join(tmpdir(), "openmaus-antigravity-verify-"));
+    let client;
+    let failed = false;
+    let failure;
     try {
         const profile = await prepareAntigravityProfile({
             instanceId: `verify-${randomUUID()}`,
             runtime,
             profileDirectory,
+            // Google's Windows one-file executable expands a large Python runtime
+            // into TEMP. Forced shutdown skips its own cleanup. Keep verification's
+            // extraction inside the profile we already remove after confirmed close.
+            baseEnv: process.platform === "win32"
+                ? { ...process.env, TEMP: profileDirectory, TMP: profileDirectory }
+                : undefined,
         });
-        const client = new AntigravityAcpClient(runtime, profile, profileDirectory);
-        try {
-            const initialized = await client.initialize();
-            if (!isValidAntigravityInitializeResult(initialized, expectedVersion)) {
-                throw new Error("The download did not identify as the expected Google Antigravity ACP release.");
-            }
+        client = new AntigravityAcpClient(runtime, profile, profileDirectory);
+        const initialized = await client.initialize();
+        if (!isValidAntigravityInitializeResult(initialized, expectedVersion)) {
+            throw new Error("The download did not identify as the expected Google Antigravity ACP release.");
         }
-        finally {
-            client.close();
+    }
+    catch (error) {
+        failed = true;
+        failure = error;
+    }
+    // The caller is about to rename the directory this executable runs from.
+    // Neither it nor the profile is safe to touch before confirmed close.
+    let stopped = !client;
+    try {
+        if (client) {
+            stopped = await client.closeAndWait();
+            if (!stopped)
+                throw new Error("Antigravity did not shut down after runtime verification.");
         }
     }
-    finally {
-        await rm(profileDirectory, { recursive: true, force: true });
+    catch (error) {
+        if (!failed) {
+            failed = true;
+            failure = error;
+        }
+    }
+    if (stopped) {
+        await rm(profileDirectory, { recursive: true, force: true, maxRetries: 4, retryDelay: 250 })
+            .catch((error) => {
+            console.warn(`antigravity: could not remove verification profile ${profileDirectory}: ${error instanceof Error ? error.message : String(error)}`);
+        });
     }
+    if (failed)
+        throw failure;
 }
 /** One in-flight personal Google login per provider instance. */
 export class AntigravityAuthController {

package/dist-server/server/drivers/antigravity-runtime.js

@@ -11,6 +11,33 @@ import { augmentedPath } from "../env-path.js";
 import { resolveAntigravityReleaseAsset, } from "./antigravity-release.js";
 const FREE_SPACE_MARGIN = 256 * 1024 * 1024;
 const DOWNLOAD_TIMEOUT_MS = 45 * 60_000;
+const STAGING_PREFIX = ".install-";
+/** Windows refuses to rename or delete a file something still holds open,
+ * with EPERM/EBUSY/EACCES rather than a clear "in use": the runtime the
+ * validator just stopped (taskkill is asynchronous) or an antivirus scan of
+ * a brand-new executable. Retry briefly; persistent refusals still fail. */
+export function transientWindowsFileError(error) {
+    const code = typeof error === "object" && error !== null ? Reflect.get(error, "code") : undefined;
+    return code === "EPERM" || code === "EBUSY" || code === "EACCES" || code === "ENOTEMPTY";
+}
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Retry a filesystem step on the transient Windows refusals above, with
+ * growing delays (default: 8 tries, 0.25 s → 2 s, about 10 s in total).
+ * Anything else, and the final failure, surface unchanged. */
+export async function retryOnWindowsFileLock(step, options = {}) {
+    const attempts = options.attempts ?? 8;
+    const sleep = options.sleep ?? wait;
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            return await step();
+        }
+        catch (error) {
+            if (attempt >= attempts || !transientWindowsFileError(error))
+                throw error;
+            await sleep(Math.min(2_000, (options.delayMs ?? 250) * 2 ** (attempt - 1)));
+        }
+    }
+}
 const INSTALL_RECORD = ".install-complete.json";
 export class AntigravitySetupError extends Error {
     status = 409;
@@ -293,7 +320,10 @@ async function installOnce(options) {
         // statfs is unavailable on a few filesystems. The bounded download and
         // extraction checks still fail safely if the disk fills.
     }
-    const staging = await mkdtemp(join(versions, `.install-${randomUUID()}-`));
+    // Another app/server process may be installing into this versions folder.
+    // The in-memory coalescing map cannot protect its staging directory.
+    const staging = await mkdtemp(join(versions, `${STAGING_PREFIX}${randomUUID()}-`));
+    let failed = false;
     try {
         const archivePath = join(staging, "download.zip");
         const runtimeDirectory = join(staging, "runtime");
@@ -364,7 +394,7 @@ async function installOnce(options) {
         };
         await writeFile(join(runtimeDirectory, INSTALL_RECORD), `${JSON.stringify(record)}\n`, { flag: "wx", mode: 0o600 });
         try {
-            await rename(runtimeDirectory, destination);
+            await retryOnWindowsFileLock(() => rename(runtimeDirectory, destination));
         }
         catch (error) {
             const winner = await completedRelease(destination, asset);
@@ -376,8 +406,22 @@ async function installOnce(options) {
             throw new Error("The installed Antigravity runtime is incomplete.");
         return installed;
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
-        await rm(staging, { recursive: true, force: true });
+        // Cleanup must never replace the real error with its own: a user who
+        // saw "EPERM: unlink agy_acp_server.exe" was looking at this line, not
+        // at why the install failed. Only clean up this attempt's directory;
+        // if it stays locked, log and leave it without touching other attempts.
+        try {
+            await retryOnWindowsFileLock(() => rm(staging, { recursive: true, force: true }));
+        }
+        catch (cleanupError) {
+            const detail = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+            console.warn(`antigravity: could not remove the install folder ${staging} (${detail})${failed ? "" : "; the install itself succeeded"}`);
+        }
     }
 }
 /** Coalesce concurrent clicks so only one large Google artifact is fetched. */