openmausbot 0.1.57 → 0.1.58

package/dist-server/index.js

@@ -5,10 +5,10 @@ var __export = (target, all2) => {
 };
 
 // server/index.ts
-import { createHash as createHash23, randomBytes as randomBytes7, randomUUID as randomUUID16, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
-import { existsSync as existsSync24, readFileSync as readFileSync37, rmSync as rmSync6, unlinkSync as unlinkSync9 } from "node:fs";
+import { createHash as createHash24, randomBytes as randomBytes8, randomUUID as randomUUID17, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { existsSync as existsSync25, readFileSync as readFileSync38, rmSync as rmSync6, unlinkSync as unlinkSync9 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { extname as extname5, join as join48 } from "node:path";
+import { extname as extname5, join as join49 } from "node:path";
 
 // node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -1624,8 +1624,8 @@ function emoji() {
 }
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
-var mac = (delimiter4) => {
-  const escapedDelim = escapeRegex(delimiter4 ?? ":");
+var mac = (delimiter5) => {
+  const escapedDelim = escapeRegex(delimiter5 ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -14878,10 +14878,10 @@ async function requestReview(reviewPermission, request, timeoutMs = AUTO_REVIEW_
   const controller = new AbortController();
   let timer;
   try {
-    const timeout2 = new Promise((resolve10) => {
+    const timeout2 = new Promise((resolve11) => {
       timer = setTimeout(() => {
         controller.abort();
-        resolve10(null);
+        resolve11(null);
       }, timeoutMs);
     });
     const answer = await Promise.race([reviewPermission(buildReviewPrompt(request), controller.signal), timeout2]);
@@ -15068,8 +15068,8 @@ function whichWin(cli) {
 function nodeExe(near) {
   const local = join(near, "node.exe");
   if (isFile(local)) return local;
-  const onPath = whichWin("node.exe");
-  if (onPath && extname(onPath).toLowerCase() === ".exe") return onPath;
+  const onPath2 = whichWin("node.exe");
+  if (onPath2 && extname(onPath2).toLowerCase() === ".exe") return onPath2;
   return process.versions.electron ? null : process.execPath;
 }
 function parseCmdShim(shim) {
@@ -15229,14 +15229,14 @@ function stderrOf(error51) {
   return typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
 }
 function run(execute, cli, args, options) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     execute(cli, args, options, (error51, stdout, stderr) => {
       if (error51) {
         if (error51.stderr === void 0 && stderr) {
           Object.assign(error51, { stderr });
         }
         reject(error51);
-      } else resolve10(stdout);
+      } else resolve11(stdout);
     });
   });
 }
@@ -15542,7 +15542,7 @@ var BrowserCleanupCoordinator = class {
     const current2 = this.#pending.get(request.requestId);
     if (!current2) return true;
     if (current2.phase !== "committed") return false;
-    const result = new Promise((resolve10) => {
+    const result = new Promise((resolve11) => {
       const prior = this.#waiters.get(request.requestId);
       if (prior) {
         clearTimeout(prior.timer);
@@ -15551,10 +15551,10 @@ var BrowserCleanupCoordinator = class {
       const timer = setTimeout(() => {
         if (this.#waiters.get(request.requestId)?.timer !== timer) return;
         this.#waiters.delete(request.requestId);
-        resolve10(false);
+        resolve11(false);
       }, this.#timeoutMs);
       timer.unref?.();
-      this.#waiters.set(request.requestId, { resolve: resolve10, timer });
+      this.#waiters.set(request.requestId, { resolve: resolve11, timer });
     });
     const sent = this.#send({
       type: current2.kind === "bot" ? "openmausbot:browser-bot-deleted" : "openmausbot:browser-profile-deleted",
@@ -16863,8 +16863,8 @@ async function withUploadLock(uploadId, operation) {
   if (!uploadId) return operation();
   const previous2 = uploadLocks.get(uploadId) ?? Promise.resolve();
   let release;
-  const current2 = new Promise((resolve10) => {
-    release = resolve10;
+  const current2 = new Promise((resolve11) => {
+    release = resolve11;
   });
   uploadLocks.set(uploadId, current2);
   await previous2;
@@ -19674,10 +19674,10 @@ function resolveAll(constructs2, events, context) {
   const called = [];
   let index2 = -1;
   while (++index2 < constructs2.length) {
-    const resolve10 = constructs2[index2].resolveAll;
-    if (resolve10 && !called.includes(resolve10)) {
-      events = resolve10(events, context);
-      called.push(resolve10);
+    const resolve11 = constructs2[index2].resolveAll;
+    if (resolve11 && !called.includes(resolve11)) {
+      events = resolve11(events, context);
+      called.push(resolve11);
     }
   }
   return events;
@@ -25360,7 +25360,7 @@ async function confirmAcceptedBoxDeletion(cfg2, boxId, acceptedBody) {
   if (operation?.status === "blocked") throw deletionBlockedError(boxId);
   if (operation) {
     for (const delayMs of BOX_DELETE_OPERATION_POLL_DELAYS_MS) {
-      if (delayMs > 0) await new Promise((resolve10) => setTimeout(resolve10, delayMs));
+      if (delayMs > 0) await new Promise((resolve11) => setTimeout(resolve11, delayMs));
       let polled;
       try {
         polled = await boxJson(cfg2, `/deletion-operations/${operation.id}`, {
@@ -25825,7 +25825,7 @@ async function requestBoxCreate(cfg2, botId, ttlSeconds) {
     if (idempotentCreateInProgress(last)) {
       const delay = BOX_CREATE_IN_PROGRESS_RETRY_DELAYS_MS[inProgressRetries++];
       if (delay !== void 0) {
-        await new Promise((resolve10) => setTimeout(resolve10, delay));
+        await new Promise((resolve11) => setTimeout(resolve11, delay));
         continue;
       }
       return { ...last, request, createdThisAttempt };
@@ -28138,13 +28138,13 @@ function computeBackoff(attempt, random = Math.random) {
 function interruptibleDelay(ms, signal) {
   let timer = null;
   let onCancel = null;
-  const promise2 = new Promise((resolve10) => {
-    timer = setTimeout(() => resolve10("elapsed"), Math.max(1, ms));
+  const promise2 = new Promise((resolve11) => {
+    timer = setTimeout(() => resolve11("elapsed"), Math.max(1, ms));
     timer.unref?.();
-    if (signal?.aborted) return resolve10("cancelled");
+    if (signal?.aborted) return resolve11("cancelled");
     onCancel = () => {
       clearTimeout(timer);
-      resolve10("cancelled");
+      resolve11("cancelled");
     };
     signal?.addEventListener("abort", onCancel, { once: true });
   });
@@ -28236,9 +28236,9 @@ function redactConfiguredValues(value, env) {
   return redacted;
 }
 function probeMcpServer(server2, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     if (signal?.aborted) {
-      resolve10({ ok: false, error: publicProbeError("cancelled") });
+      resolve11({ ok: false, error: publicProbeError("cancelled") });
       return;
     }
     let child;
@@ -28249,7 +28249,7 @@ function probeMcpServer(server2, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
         stdio: ["pipe", "pipe", "pipe"]
       });
     } catch {
-      resolve10({ ok: false, error: publicProbeError("spawn") });
+      resolve11({ ok: false, error: publicProbeError("spawn") });
       return;
     }
     let settled = false;
@@ -28263,7 +28263,7 @@ function probeMcpServer(server2, timeoutMs = DEFAULT_TIMEOUT_MS, signal) {
       if (timer) clearTimeout(timer);
       signal?.removeEventListener("abort", onAbort);
       killCliTree(child);
-      resolve10(result);
+      resolve11(result);
     };
     const write = (frame) => {
       try {
@@ -28975,7 +28975,7 @@ function createAcpDriver(support11) {
           }
           appendNative(threadId, { dir: "out", source: SOURCE, msg: nativeLogMessage(obj) });
         };
-        const request = (method, params, timeoutMs) => new Promise((resolve10, reject) => {
+        const request = (method, params, timeoutMs) => new Promise((resolve11, reject) => {
           const id = nextId++;
           let timer = null;
           if (timeoutMs) {
@@ -28985,7 +28985,7 @@ function createAcpDriver(support11) {
             }, timeoutMs);
             timer.unref?.();
           }
-          rpcPending.set(id, { resolve: resolve10, reject, timer });
+          rpcPending.set(id, { resolve: resolve11, reject, timer });
           send({ jsonrpc: "2.0", id, method, params });
         });
         const stop = () => killCliTree(child);
@@ -29421,12 +29421,12 @@ ${turn.text}` : turn.text;
       const snapshot2 = async () => {
         const env = childEnv();
         if (support11.snapshot) return support11.snapshot(env, config2, instanceId);
-        const version2 = await new Promise((resolve10) => {
+        const version2 = await new Promise((resolve11) => {
           execCli(
             config2.cli,
             ["--version"],
             { timeout: 8e3, env },
-            (err, stdout) => resolve10(err ? null : stdout.trim())
+            (err, stdout) => resolve11(err ? null : stdout.trim())
           );
         });
         if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
@@ -29526,6 +29526,21 @@ function takeLines(buffer) {
   const rest = parts.pop() ?? "";
   return { lines: parts.map((line) => line.replace(/\r$/u, "")), rest };
 }
+function startupHint(line) {
+  if (/no space left|not enough (?:space|disk)|disk (?:is )?full|winerror\s*112/iu.test(line)) {
+    return "The runtime reported insufficient disk space while starting.";
+  }
+  if (/failed to (?:extract|load (?:python|embedded python))|could not load python/iu.test(line)) {
+    return "The runtime reported a problem unpacking or loading its bundled Python runtime.";
+  }
+  if (/permission denied|access is denied|winerror\s*5\b/iu.test(line)) {
+    return "The runtime reported a file or process permission failure.";
+  }
+  if (/address family not supported|failed to create.*(?:socket|listener)|failed to bind/iu.test(line)) {
+    return "The runtime reported a local network listener failure.";
+  }
+  return void 0;
+}
 function authorizationUrlFromLine(line) {
   if (line.startsWith(ANTIGRAVITY_AUTH_PREFIX)) return line.slice(ANTIGRAVITY_AUTH_PREFIX.length).trim();
   if (!line.startsWith(BROWSER_MARKER)) return null;
@@ -29590,6 +29605,10 @@ var AntigravityAcpClient = class {
   pending = /* @__PURE__ */ new Map();
   buffer = "";
   diagnosticBuffer = "";
+  initializationComplete = false;
+  startupOutputBytes = 0;
+  startupDiagnosticBytes = 0;
+  nativeStartupHint;
   closed = false;
   onAuthorizationUrl;
   /** Settles once the runtime process is gone. On Windows a running
@@ -29608,14 +29627,19 @@ var AntigravityAcpClient = class {
     this.child.stderr.setEncoding("utf8");
     this.child.stderr.on("data", (chunk) => this.consumeDiagnostics(chunk));
     this.child.once("error", (error51) => this.failAll(error51));
-    this.exited = new Promise((resolve10) => {
-      this.child.once("close", (code) => {
-        if (!this.closed) this.failAll(new Error(`Antigravity ACP exited ${code ?? "unexpectedly"}.`));
-        resolve10();
+    this.exited = new Promise((resolve11) => {
+      this.child.once("close", (code, signal) => {
+        this.noteStartupDiagnostic(this.diagnosticBuffer);
+        this.diagnosticBuffer = "";
+        if (!this.closed) this.failAll(new Error(
+          `Antigravity ACP exited ${code ?? signal ?? "unexpectedly"}.${this.nativeStartupHint ? ` ${this.nativeStartupHint}` : ""}`
+        ));
+        resolve11();
       });
     });
   }
   consume(chunk) {
+    if (!this.initializationComplete) this.startupOutputBytes += Buffer.byteLength(chunk);
     this.buffer += chunk;
     if (Buffer.byteLength(this.buffer) > MAX_PROTOCOL_LINE_BYTES) {
       this.failAll(new Error("Antigravity sent a protocol line that is too large."));
@@ -29660,9 +29684,15 @@ var AntigravityAcpClient = class {
    * and released immediately and the tail is capped, so no authorization code
    * is ever held. Draining also keeps the pipe from stalling the server. */
   consumeDiagnostics(chunk) {
+    if (!this.initializationComplete) this.startupDiagnosticBytes += Buffer.byteLength(chunk);
     const { lines, rest } = takeLines(this.diagnosticBuffer + chunk);
     this.diagnosticBuffer = rest.length > MAX_DIAGNOSTIC_LINE_CHARS ? "" : rest;
-    for (const line of lines) this.announceAuthorizationUrl(line);
+    for (const line of lines) {
+      if (!this.announceAuthorizationUrl(line)) this.noteStartupDiagnostic(line);
+    }
+  }
+  noteStartupDiagnostic(line) {
+    if (!this.initializationComplete) this.nativeStartupHint ??= startupHint(line);
   }
   failAll(error51) {
     for (const pending of this.pending.values()) {
@@ -29677,7 +29707,12 @@ var AntigravityAcpClient = class {
     return new Promise((resolveRequest, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
-        reject(new Error(`${method} timed out.`));
+        if (method === "initialize") {
+          this.noteStartupDiagnostic(this.diagnosticBuffer);
+          reject(new Error(
+            `Antigravity initialization timed out after ${Math.ceil(timeoutMs / 1e3)} seconds (${process.platform}-${process.arch}). The executable was found, but did not finish starting. ` + (this.nativeStartupHint ? `${this.nativeStartupHint} ` : "") + `Startup output: ${this.startupOutputBytes} bytes; diagnostic output: ${this.startupDiagnosticBytes} bytes. Retry setup. If it still fails, share this error and your OpenMausBot version; do not paste Google sign-in links or tokens.`
+          ));
+        } else reject(new Error(`${method} timed out.`));
       }, timeoutMs);
       timer.unref?.();
       this.pending.set(id, { resolve: resolveRequest, reject, timer });
@@ -29686,11 +29721,14 @@ var AntigravityAcpClient = class {
     });
   }
   async initialize(timeoutMs = STARTUP_TIMEOUT_MS) {
-    return this.request("initialize", {
+    const initialized = await this.request("initialize", {
       protocolVersion: 1,
       clientInfo: { name: "openmausbot", version: "0.0.0" },
       clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false }
     }, timeoutMs);
+    this.initializationComplete = true;
+    this.nativeStartupHint = void 0;
+    return initialized;
   }
   close() {
     if (this.closed) return;
@@ -29703,8 +29741,8 @@ var AntigravityAcpClient = class {
   async closeAndWait(timeoutMs = 5e3) {
     this.close();
     let timer;
-    const timedOut = new Promise((resolve10) => {
-      timer = setTimeout(() => resolve10(false), timeoutMs);
+    const timedOut = new Promise((resolve11) => {
+      timer = setTimeout(() => resolve11(false), timeoutMs);
       timer.unref?.();
     });
     try {
@@ -29839,7 +29877,11 @@ async function validateAntigravityRuntime(runtime, expectedVersion) {
     const profile = await prepareAntigravityProfile({
       instanceId: `verify-${randomUUID7()}`,
       runtime,
-      profileDirectory
+      profileDirectory,
+      // Google's Windows one-file executable expands a large Python runtime
+      // into TEMP. Forced shutdown skips its own cleanup. Keep verification's
+      // extraction inside the profile we already remove after confirmed close.
+      baseEnv: process.platform === "win32" ? { ...process.env, TEMP: profileDirectory, TMP: profileDirectory } : void 0
     });
     client = new AntigravityAcpClient(runtime, profile, profileDirectory);
     const initialized = await client.initialize();
@@ -30036,7 +30078,7 @@ function transientWindowsFileError(error51) {
   const code = typeof error51 === "object" && error51 !== null ? Reflect.get(error51, "code") : void 0;
   return code === "EPERM" || code === "EBUSY" || code === "EACCES" || code === "ENOTEMPTY";
 }
-var wait = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
+var wait = (ms) => new Promise((resolve11) => setTimeout(resolve11, ms));
 async function retryOnWindowsFileLock(step, options = {}) {
   const attempts = options.attempts ?? 8;
   const sleep = options.sleep ?? wait;
@@ -30464,8 +30506,9 @@ var AntigravityDriver = {
   async create(input) {
     const base2 = await AcpAntigravityDriver.create(input);
     const auth = new AntigravityAuthController();
+    let installFailure;
     const runtimeAndProfile = async () => {
-      const environment = { ...process.env, ...input.environment };
+      const environment = { ...process.env, ...input.environment, PATH: augmentedPath() };
       const runtime = await resolveAntigravityRuntime(input.config.cli, environment);
       const profile = await prepareAntigravityProfile({
         instanceId: input.instanceId,
@@ -30479,9 +30522,20 @@ var AntigravityDriver = {
       get models() {
         return base2.models;
       },
+      snapshot: async () => {
+        const snapshot2 = await base2.snapshot();
+        if (snapshot2.state === "available") installFailure = void 0;
+        return snapshot2.state === "unavailable" && installFailure ? { ...snapshot2, reason: installFailure } : snapshot2;
+      },
       ...antigravityManagedInstallAvailable() ? {
         installRuntime: async () => {
-          await installAntigravityRuntime({ validate: validateAntigravityRuntime });
+          installFailure = void 0;
+          try {
+            await installAntigravityRuntime({ validate: validateAntigravityRuntime });
+          } catch (error51) {
+            installFailure = error51 instanceof Error ? error51.message : String(error51);
+            throw error51;
+          }
         }
       } : {},
       startAuthentication: async () => {
@@ -30721,15 +30775,15 @@ import { createServer as createNetServer } from "node:net";
 import { homedir as homedir8, tmpdir as tmpdir3 } from "node:os";
 import { join as join16, dirname as dirname7 } from "node:path";
 function claudeSignedIn(cli, env, run3 = execCli) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     run3(cli, ["auth", "status", "--json"], { timeout: 8e3, env }, (_error, stdout) => {
       try {
         const status = JSON.parse(stdout);
-        resolve10(
+        resolve11(
           typeof status === "object" && status !== null && "loggedIn" in status && status.loggedIn === true
         );
       } catch {
-        resolve10(false);
+        resolve11(false);
       }
     });
   });
@@ -30920,9 +30974,9 @@ async function createPermissionBroker(opts) {
       unlinkSync5(candidate);
     } catch {
     }
-    let outcome = await new Promise((resolve10) => {
-      attempt.once("listening", () => resolve10("listening"));
-      attempt.once("error", (error51) => resolve10(error51));
+    let outcome = await new Promise((resolve11) => {
+      attempt.once("listening", () => resolve11("listening"));
+      attempt.once("error", (error51) => resolve11(error51));
       attempt.listen(candidate);
     });
     if (outcome === "listening" && process.platform !== "win32") {
@@ -31127,19 +31181,19 @@ var ClaudeDriver = {
     };
     const writeUser = (s, threadId, promptMsg) => {
       if (!s.child.stdin.writable || s.child.stdin.destroyed) return Promise.resolve(false);
-      return new Promise((resolve10) => {
+      return new Promise((resolve11) => {
         try {
           s.child.stdin.write(JSON.stringify(promptMsg) + "\n", (error51) => {
-            if (error51) return resolve10(false);
+            if (error51) return resolve11(false);
             appendNative(threadId, {
               dir: "out",
               source: "claude.sdk.message",
               msg: diagnosticClaudeUserMessage(promptMsg)
             });
-            resolve10(true);
+            resolve11(true);
           });
         } catch {
-          resolve10(false);
+          resolve11(false);
         }
       });
     };
@@ -31620,19 +31674,19 @@ var ClaudeDriver = {
     };
     const snapshot2 = async () => {
       const env = claudeEnvironment(void 0, { ...process.env, ...input.environment });
-      const version2 = await new Promise((resolve10) => {
+      const version2 = await new Promise((resolve11) => {
         execCli(
           config2.cli,
           ["--version"],
           { timeout: 8e3, env },
-          (err, stdout) => resolve10(err ? null : stdout.trim())
+          (err, stdout) => resolve11(err ? null : stdout.trim())
         );
       });
       if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
       const authenticated = await claudeSignedIn(config2.cli, env);
       return { state: "available", version: version2, authenticated, billing: "subscription" };
     };
-    const generateReview = (prompt, signal) => new Promise((resolve10, reject) => {
+    const generateReview = (prompt, signal) => new Promise((resolve11, reject) => {
       const child = spawnCli(
         config2.cli,
         ["-p", "--model", "claude-haiku-4-5", "--output-format", "text"],
@@ -31650,7 +31704,7 @@ var ClaudeDriver = {
         clearTimeout(timer);
         signal?.removeEventListener("abort", onAbort);
         if (error51) reject(error51);
-        else resolve10(stdout.trim());
+        else resolve11(stdout.trim());
       };
       const onAbort = () => {
         killCliTree(child);
@@ -31779,7 +31833,7 @@ function decodeCodexSelection(id) {
   return { model: id, modelProvider: MODEL_ID2.test(id) ? OFFICIAL_CODEX_PROVIDER : null };
 }
 function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8e3) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const child = spawnCli(cli, ["app-server"], {
       cwd: homedir9(),
       env,
@@ -31796,7 +31850,7 @@ function readCodexAppServerModelCatalog(cli, env, timeoutMs = 8e3) {
       settled = true;
       clearTimeout(timer);
       killCliTree(child);
-      resolve10(catalog);
+      resolve11(catalog);
     };
     const request = (method, params, kind) => {
       const id = nextId++;
@@ -32481,7 +32535,7 @@ var CodexDriver = {
             msg: codexNativeLogMessage(obj)
           });
         };
-        const request = (method, params, timeoutMs = 6e4) => new Promise((resolve10, reject) => {
+        const request = (method, params, timeoutMs = 6e4) => new Promise((resolve11, reject) => {
           const id = nextId++;
           if (method === "config/read") sensitiveResponseIds.add(id);
           const timer = setTimeout(() => {
@@ -32491,7 +32545,7 @@ var CodexDriver = {
           rpcPending.set(id, {
             resolve: (v) => {
               clearTimeout(timer);
-              resolve10(v);
+              resolve11(v);
             },
             reject: (e) => {
               clearTimeout(timer);
@@ -32852,8 +32906,8 @@ ${turn.text}` : turn.text;
             });
             abandoned = true;
             killCliTree(child);
-            await new Promise((resolve10) => {
-              const timer = setTimeout(resolve10, Math.max(1, Math.round(delayMs * retryScale)));
+            await new Promise((resolve11) => {
+              const timer = setTimeout(resolve11, Math.max(1, Math.round(delayMs * retryScale)));
               timer.unref?.();
             });
             if (!stopRequested) {
@@ -32881,21 +32935,21 @@ ${turn.text}` : turn.text;
     };
     const snapshot2 = async () => {
       const env = childEnv();
-      const version2 = await new Promise((resolve10) => {
+      const version2 = await new Promise((resolve11) => {
         execCli(
           config2.cli,
           ["--version"],
           { timeout: 8e3, env },
-          (err, stdout) => resolve10(err ? null : stdout.trim())
+          (err, stdout) => resolve11(err ? null : stdout.trim())
         );
       });
       if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
-      const authenticated = await new Promise((resolve10) => {
+      const authenticated = await new Promise((resolve11) => {
         execCli(
           config2.cli,
           ["login", "status"],
           { timeout: 8e3, env },
-          (err, stdout, stderr) => resolve10(!err && /^logged in\b/im.test(`${stdout}
+          (err, stdout, stderr) => resolve11(!err && /^logged in\b/im.test(`${stdout}
 ${stderr ?? ""}`))
         );
       });
@@ -34309,10 +34363,10 @@ function decodeCursorAuthText(text6) {
   return null;
 }
 function execText(run3, cli, args, env) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     run3(cli, args, { timeout: EXEC_TIMEOUT_MS, env }, (err, stdout) => {
-      if (err) return resolve10(null);
-      resolve10(String(stdout ?? ""));
+      if (err) return resolve11(null);
+      resolve11(String(stdout ?? ""));
     });
   });
 }
@@ -34498,7 +34552,7 @@ function parseOpenCodeModelsOutput(stdout) {
   return { default: (preferred ?? options[0]).id, options };
 }
 function runOpenCodeModels(cli, environment, verbose) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     execCli(
       cli,
       ["models", ...verbose ? ["--verbose"] : []],
@@ -34508,7 +34562,7 @@ function runOpenCodeModels(cli, environment, verbose) {
           reject(new Error(stderr?.trim() || error51.message, { cause: error51 }));
           return;
         }
-        resolve10(stdout);
+        resolve11(stdout);
       }
     );
   });
@@ -41256,12 +41310,12 @@ function hermesConfiguredModel(env = process.env) {
   };
 }
 async function fetchHermesAcpModels(cli, env) {
-  return await new Promise((resolve10) => {
+  return await new Promise((resolve11) => {
     let child;
     try {
       child = spawn2(cli, ["acp"], { stdio: ["pipe", "pipe", "ignore"], env });
     } catch {
-      return resolve10([]);
+      return resolve11([]);
     }
     let settled = false;
     let timer;
@@ -41282,7 +41336,7 @@ async function fetchHermesAcpModels(cli, env) {
         }
       } catch {
       }
-      resolve10(out);
+      resolve11(out);
     };
     timer = setTimeout(() => done([]), 5e3);
     child.once("error", () => done([]));
@@ -41718,7 +41772,7 @@ function readPiDefaultModel(env) {
 }
 async function fetchPiModels(cli, env) {
   const child = spawnCli(cli, PI_ARGS, { stdio: ["pipe", "pipe", "pipe"], env });
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let buf = "";
     let done = false;
     const fallbackDefault = readPiDefaultModel(env);
@@ -41729,7 +41783,7 @@ async function fetchPiModels(cli, env) {
         killCliTree(child);
       } catch {
       }
-      resolve10(catalog);
+      resolve11(catalog);
     };
     const timer = setTimeout(() => finish({ default: "", options: [] }), 15e3);
     timer.unref?.();
@@ -41884,13 +41938,13 @@ var PiDriver = {
         }
         responseWaiters.clear();
       };
-      const awaitResponse = (command, timeoutMs = 2e4) => new Promise((resolve10, reject) => {
+      const awaitResponse = (command, timeoutMs = 2e4) => new Promise((resolve11, reject) => {
         const timer = setTimeout(() => {
           responseWaiters.delete(command);
           reject(new Error(`pi ${command} timed out`));
         }, timeoutMs);
         timer.unref?.();
-        responseWaiters.set(command, { resolve: resolve10, reject, timer });
+        responseWaiters.set(command, { resolve: resolve11, reject, timer });
       });
       child.stdin.on("error", () => rejectWaiters(new Error("pi stdin closed")));
       const send = (obj) => {
@@ -42098,7 +42152,7 @@ ${turn.text}` : turn.text;
       return { turnId };
     };
     const snapshot2 = async () => {
-      const version2 = await new Promise((resolve10) => {
+      const version2 = await new Promise((resolve11) => {
         const child = spawnCli(config2.cli, ["--version"], {
           stdio: ["ignore", "pipe", "pipe"],
           env: piEnvironment({ ...process.env, ...input.environment })
@@ -42111,16 +42165,16 @@ ${turn.text}` : turn.text;
             killCliTree(child);
           } catch {
           }
-          resolve10(null);
+          resolve11(null);
         }, 8e3);
         timer.unref?.();
         child.on("error", () => {
           clearTimeout(timer);
-          resolve10(null);
+          resolve11(null);
         });
         child.on("close", () => {
           clearTimeout(timer);
-          resolve10(out.trim() || null);
+          resolve11(out.trim() || null);
         });
       });
       if (!version2) return { state: "unavailable", reason: `\`${config2.cli}\` CLI not found` };
@@ -43267,7 +43321,7 @@ var Store = class {
   /** A process restart cannot preserve an in-flight room orchestrator. Close
    * every durable working receipt before clients load it, including manual
    * goals that do not have a RoutineRun record to reconcile separately. */
-  reconcileInterruptedGroupGoals(resolve10, fallbackDetail = "OpenMausBot restarted before this goal finished.", fallbackFinishedAt = Date.now()) {
+  reconcileInterruptedGroupGoals(resolve11, fallbackDetail = "OpenMausBot restarted before this goal finished.", fallbackFinishedAt = Date.now()) {
     const ownedThreadIds = /* @__PURE__ */ new Set();
     for (const group of this.groups) {
       ownedThreadIds.add(group.threadId);
@@ -43276,7 +43330,7 @@ var Store = class {
     let recovered = 0;
     for (const hit of workingGoalRunMessages()) {
       if (!ownedThreadIds.has(hit.threadId) || !hit.message.goalRun) continue;
-      const resolution = resolve10?.(hit.message.goalRun.runId, hit.threadId) ?? {
+      const resolution = resolve11?.(hit.message.goalRun.runId, hit.threadId) ?? {
         status: "failed",
         detail: fallbackDetail,
         finishedAt: fallbackFinishedAt
@@ -44059,7 +44113,7 @@ function requestPeerApproval(bus2, from, target, message3, action, sourceThreadI
   if (allowKeyAllowed(from, peerAllowKey(action, target.id))) {
     return Promise.resolve("allow");
   }
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const requestId = newId();
     const card = pushApprovalCard(bus2, from, target, message3, action, requestId, sourceThreadId);
     announceCard(bus2, from, card, sourceThreadId);
@@ -44068,11 +44122,11 @@ function requestPeerApproval(bus2, from, target, message3, action, sourceThreadI
       if (!pending) return;
       pendingComms.delete(requestId);
       settleCard(pending, "deny", "system");
-      resolve10("deny");
+      resolve11("deny");
     }, APPROVAL_TIMEOUT_MS);
     timer.unref?.();
     pendingComms.set(requestId, {
-      resolve: resolve10,
+      resolve: resolve11,
       timer,
       fromBotId: from.id,
       toBotId: target.id,
@@ -47332,28 +47386,28 @@ function vpsSshTunnelArgs(alias, localPort, privateIp) {
   ];
 }
 function unusedLoopbackPort() {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const probe = createServer();
     probe.once("error", reject);
     probe.listen(0, "127.0.0.1", () => {
       const port = probe.address().port;
       probe.close((error51) => {
         if (error51) reject(error51);
-        else if (port >= 1024) resolve10(port);
+        else if (port >= 1024) resolve11(port);
         else reject(new Error("could not reserve a VPS viewer port"));
       });
     });
   });
 }
 function loopbackAnswers(port) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     const socket = createConnection({ host: "127.0.0.1", port });
     let settled = false;
     const finish = (answer) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve10(answer);
+      resolve11(answer);
     };
     socket.once("connect", () => finish(true));
     socket.once("error", () => finish(false));
@@ -47395,7 +47449,7 @@ function tailCollector() {
   };
 }
 function defaultRunner(args, options = {}) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     const command = resolveCliSpawn("docker", args);
     const child = spawn3(command.command, command.args, {
       shell: false,
@@ -47448,7 +47502,7 @@ function defaultRunner(args, options = {}) {
         return;
       }
       settle(() => {
-        if (code === 0) return resolve10({ stdout: stdout.text(), stderr: stderr.text() });
+        if (code === 0) return resolve11({ stdout: stdout.text(), stderr: stderr.text() });
         const detail = stderr.text().trim().slice(-1e3);
         reject(new Error(detail || `Docker-over-SSH exited ${code ?? signal ?? "without a status"}`));
       });
@@ -47833,8 +47887,8 @@ async function waitForVpsReady(cfg2, botId, runner, budgetMs = 6e4) {
     if (!status.daemonUp || !status.image || !status.imageMatches || !status.managed || status.container !== "running" || status.network !== "private" || status.mounts !== "none" || status.security !== "hardened") {
       return status;
     }
-    await new Promise((resolve10) => {
-      const sleep = setTimeout(resolve10, Math.min(delayMs, Math.max(0, deadline - Date.now())));
+    await new Promise((resolve11) => {
+      const sleep = setTimeout(resolve11, Math.min(delayMs, Math.max(0, deadline - Date.now())));
       sleep.unref?.();
     });
     delayMs = Math.min(delayMs * 2, 4e3);
@@ -47854,16 +47908,16 @@ async function waitForVpsReady(cfg2, botId, runner, budgetMs = 6e4) {
 async function withVpsLifecycleLock(key3, operation) {
   const previous2 = lifecycleLocks.get(key3);
   let release;
-  const current2 = new Promise((resolve10) => {
-    release = resolve10;
+  const current2 = new Promise((resolve11) => {
+    release = resolve11;
   });
   lifecycleLocks.set(key3, current2);
   if (previous2) {
     let acquireTimer;
     const acquired = await Promise.race([
       previous2.then(() => true),
-      new Promise((resolve10) => {
-        acquireTimer = setTimeout(() => resolve10(false), LOCK_ACQUIRE_TIMEOUT_MS);
+      new Promise((resolve11) => {
+        acquireTimer = setTimeout(() => resolve11(false), LOCK_ACQUIRE_TIMEOUT_MS);
         acquireTimer.unref?.();
       })
     ]);
@@ -48035,7 +48089,7 @@ async function vpsComputerJoin(cfg2, botId, runner = defaultRunner) {
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline && !failure) {
     if (await loopbackAnswers(localPort)) break;
-    await new Promise((resolve10) => setTimeout(resolve10, 100));
+    await new Promise((resolve11) => setTimeout(resolve11, 100));
   }
   if (failure || !await loopbackAnswers(localPort)) {
     if (child.exitCode === null && !child.killed) child.kill("SIGTERM");
@@ -49541,6 +49595,124 @@ async function browserScreenshot(connection, capability, fetchImpl = fetch) {
   return { png: body.png, format: body.format ?? "jpeg" };
 }
 
+// server/browser-engine.ts
+import { createHash as createHash15, randomBytes as randomBytes5, randomUUID as randomUUID12 } from "node:crypto";
+import { chmodSync as chmodSync5, existsSync as existsSync18, mkdirSync as mkdirSync19, readFileSync as readFileSync31, renameSync as renameSync5, statSync as statSync8, writeFileSync as writeFileSync15 } from "node:fs";
+import { delimiter as delimiter4, join as join40, resolve as resolve10 } from "node:path";
+
+// server/browser-engine-release.ts
+var AGENT_BROWSER_VERSION = "0.36.0";
+var RELEASES2 = /* @__PURE__ */ new Map([
+  [
+    "darwin-arm64",
+    { target: "darwin-arm64", asset: "agent-browser-darwin-arm64", sha256: "b2106ab39db0838e7b1772f7f26f760518de56d09053150c56f9dddf15af997d", bytes: 12363200 }
+  ],
+  [
+    "darwin-x64",
+    { target: "darwin-x64", asset: "agent-browser-darwin-x64", sha256: "45d9ac061a7d72e61eaff905326e2e19365f4dadb12142ea2f2d76d84689c708", bytes: 13510280 }
+  ],
+  [
+    "linux-arm64",
+    { target: "linux-arm64", asset: "agent-browser-linux-arm64", sha256: "aeb556addca3903601a433de1acad3ace1c9c61d170084bf58d875884599a990", bytes: 12442720 }
+  ],
+  [
+    "linux-musl-arm64",
+    { target: "linux-musl-arm64", asset: "agent-browser-linux-musl-arm64", sha256: "1ca7e003c9cb185f174fc81e51a609db27c77e3bfe00a0edff60688f8cd14f88", bytes: 12297e3 }
+  ],
+  [
+    "linux-musl-x64",
+    { target: "linux-musl-x64", asset: "agent-browser-linux-musl-x64", sha256: "a20cc2a5202a48f5820372803dedbcd5f556dff7a89421f1b0f2612962b10718", bytes: 13995728 }
+  ],
+  [
+    "linux-x64",
+    { target: "linux-x64", asset: "agent-browser-linux-x64", sha256: "56d15181e51e00213f907fcf39707cfc76bfa804ff20f5a9373661c73f96de5e", bytes: 14156776 }
+  ],
+  [
+    "win32-x64",
+    { target: "win32-x64", asset: "agent-browser-win32-x64.exe", sha256: "412ff72737a109e93f5304b0ff76c988fb6f1f451d0fc7e010577922bcc20ff3", bytes: 13837312 }
+  ]
+]);
+function resolveAgentBrowserReleaseAsset(platform = process.platform, arch = process.arch, musl = false) {
+  const key3 = platform === "linux" && musl ? `linux-musl-${arch}` : `${platform}-${arch}`;
+  return RELEASES2.get(key3) ?? null;
+}
+
+// server/browser-engine.ts
+var ENGINE_DIR = "tools/agent-browser";
+var KEY_FILE = "browser-engine-key";
+var DOWNLOAD_TIMEOUT_MS2 = 10 * 6e4;
+function executableName(platform = process.platform) {
+  return platform === "win32" ? "agent-browser.exe" : "agent-browser";
+}
+function isMusl(platform = process.platform, exists = existsSync18) {
+  return platform === "linux" && (exists("/lib/ld-musl-x86_64.so.1") || exists("/lib/ld-musl-aarch64.so.1"));
+}
+function pinnedBinaryPath(dataDir = DATA_DIR, platform = process.platform) {
+  return join40(dataDir, ENGINE_DIR, AGENT_BROWSER_VERSION, executableName(platform));
+}
+function onPath(env, platform, exists) {
+  const pathValue = platform === "win32" ? Object.entries(env).findLast(([key3]) => key3.toUpperCase() === "PATH")?.[1] : env.PATH;
+  for (const part of (pathValue ?? "").split(delimiter4)) {
+    const dir = part.trim().replace(/^"|"$/gu, "");
+    if (!dir) continue;
+    const candidate = resolve10(dir, executableName(platform));
+    if (exists(candidate)) return candidate;
+  }
+  return null;
+}
+function resolveAgentBrowserBinary(options = {}) {
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const exists = options.exists ?? existsSync18;
+  const override = env.OMB_AGENT_BROWSER_PATH?.trim();
+  if (override) return resolve10(override) && exists(resolve10(override)) ? resolve10(override) : null;
+  const pinned = pinnedBinaryPath(options.dataDir, platform);
+  if (exists(pinned)) return pinned;
+  return onPath(env, platform, exists);
+}
+function browserEngineEncryptionKey(dataDir = DATA_DIR) {
+  const file2 = join40(dataDir, KEY_FILE);
+  try {
+    const existing = readFileSync31(file2, "utf8").trim();
+    if (/^[0-9a-f]{64}$/u.test(existing)) return existing;
+  } catch {
+  }
+  const key3 = randomBytes5(32).toString("hex");
+  mkdirSync19(dataDir, { recursive: true });
+  writeFileAtomic(file2, `${key3}
+`, { mode: 384 });
+  return key3;
+}
+function browserEngineStatus(options = {}) {
+  const binaryPath = resolveAgentBrowserBinary(options);
+  if (binaryPath) return { kind: "ready", binaryPath, version: AGENT_BROWSER_VERSION };
+  const platform = options.platform ?? process.platform;
+  const asset = resolveAgentBrowserReleaseAsset(platform, process.arch, isMusl(platform));
+  return asset ? { kind: "unavailable", reason: "agent-browser is not installed on this machine yet", installable: true } : { kind: "unavailable", reason: `agent-browser publishes no build for ${platform}-${process.arch}`, installable: false };
+}
+function agentBrowserIntegration(input) {
+  const env = {
+    AGENT_BROWSER_SESSION: input.session,
+    // This is a restore *name*, not a boolean. "1" would give every bot
+    // the same saved cookies despite using different daemon sessions.
+    AGENT_BROWSER_RESTORE: input.session,
+    AGENT_BROWSER_RESTORE_SAVE: input.persistent === false ? "never" : "auto",
+    AGENT_BROWSER_ENCRYPTION_KEY: input.encryptionKey
+  };
+  if (input.headless !== false) env.AGENT_BROWSER_HEADLESS = "1";
+  const path = (input.env ?? process.env).PATH;
+  if (path) env.PATH = path;
+  return { command: input.binaryPath, args: ["mcp", "--tools", "core", "--no-webmcp"], env };
+}
+function browserSessionId(botId, partitionId) {
+  if (partitionId === "guest") return `guest-${randomUUID12()}`;
+  const raw = partitionId || `bot-${botId}`;
+  return raw.replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 96);
+}
+function describeBrowserEngine(status) {
+  return status.kind === "ready" ? `browser engine: agent-browser ${status.version} at ${status.binaryPath}` : `browser engine: unavailable (${status.reason})`;
+}
+
 // server/private-screen-capture.ts
 async function captureOutsideHumanControl(control, capture) {
   const before = control();
@@ -49552,7 +49724,7 @@ async function captureOutsideHumanControl(control, capture) {
 }
 
 // server/screen-frame-gate.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 var SCREEN_TOUCHING_TOOLS = /* @__PURE__ */ new Set([
   // cloud box / remote computer
   "screenshot",
@@ -49590,14 +49762,14 @@ function screenTouchingTool(toolName) {
   return SCREEN_TOUCHING_TOOLS.has(bare) || SCREEN_TOUCHING_TOOLS.has(bare.replace(/^(?:computer|browser)_/, ""));
 }
 function screenFrameHash(png) {
-  return createHash15("sha256").update(png).digest("hex");
+  return createHash16("sha256").update(png).digest("hex");
 }
 function settledFrameIsNews(shownFrameHash, png) {
   return shownFrameHash === void 0 || screenFrameHash(png) !== shownFrameHash;
 }
 
 // server/routine-requests.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 var WEEKDAY_NUMBER = {
   sunday: 0,
   monday: 1,
@@ -50032,7 +50204,7 @@ function routineRequestFingerprint(payload, messageId) {
     threadId: payload.threadId,
     operation: payload.operation
   }));
-  return createHash16("sha256").update(JSON.stringify(canonicalValue2(document3))).digest("hex");
+  return createHash17("sha256").update(JSON.stringify(canonicalValue2(document3))).digest("hex");
 }
 function verifyManageSnapshot(operation, manager, botId) {
   const current2 = ownedRoutine(manager, operation.routineId, botId);
@@ -50590,25 +50762,25 @@ function lineDiff(before, after) {
 var PROFILE_REQUEST_FIELDS = ["name", "title", "description", "soul", "cwd"];
 
 // server/profile-revision.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function profileSnapshot(bot) {
   return { name: bot.name, title: bot.title, description: bot.description, soul: bot.soul ?? "", cwd: bot.cwd ?? "" };
 }
 function profileRevision(bot) {
-  return createHash17("sha256").update(JSON.stringify({ ...profileSnapshot(bot), lastProfileRequestId: bot.lastProfileRequestId ?? "" }), "utf8").digest("hex");
+  return createHash18("sha256").update(JSON.stringify({ ...profileSnapshot(bot), lastProfileRequestId: bot.lastProfileRequestId ?? "" }), "utf8").digest("hex");
 }
 
 // server/profile-versions.ts
 import { appendFile as appendFile2 } from "node:fs/promises";
-import { createHash as createHash18, randomUUID as randomUUID12 } from "node:crypto";
-import { closeSync as closeSync8, existsSync as existsSync18, fstatSync as fstatSync3, mkdirSync as mkdirSync19, openSync as openSync8, readSync as readSync3 } from "node:fs";
-import { join as join40 } from "node:path";
+import { createHash as createHash19, randomUUID as randomUUID13 } from "node:crypto";
+import { closeSync as closeSync8, existsSync as existsSync19, fstatSync as fstatSync3, mkdirSync as mkdirSync20, openSync as openSync8, readSync as readSync3 } from "node:fs";
+import { join as join41 } from "node:path";
 var FILE_NAME2 = "history.ndjson";
 var ONE_LINER = 200;
 var MAX_HISTORY_READ_BYTES = 8 * 1024 * 1024;
 var writeQueues2 = /* @__PURE__ */ new Map();
 function historyFile(botId) {
-  return join40(botFolder(botId), FILE_NAME2);
+  return join41(botFolder(botId), FILE_NAME2);
 }
 function oneLiner(value) {
   return value.replace(/\s+/g, " ").trim().slice(0, ONE_LINER);
@@ -50617,11 +50789,11 @@ function rowFor(field, at, actor, via, before, after) {
   if (field === "soul") {
     const b2 = Buffer.byteLength(before, "utf8");
     const a2 = Buffer.byteLength(after, "utf8");
-    return { id: randomUUID12(), at, actor, via, field, summary: `soul: ${b2} \u2192 ${a2} bytes`, before, after };
+    return { id: randomUUID13(), at, actor, via, field, summary: `soul: ${b2} \u2192 ${a2} bytes`, before, after };
   }
   const b = oneLiner(before);
   const a = oneLiner(after);
-  return { id: randomUUID12(), at, actor, via, field, summary: `${field}: ${JSON.stringify(b)} \u2192 ${JSON.stringify(a)}`, before: b, after: a };
+  return { id: randomUUID13(), at, actor, via, field, summary: `${field}: ${JSON.stringify(b)} \u2192 ${JSON.stringify(a)}`, before: b, after: a };
 }
 function withRestoreEligibility(row) {
   const redacted = redactSecrets(row);
@@ -50633,9 +50805,9 @@ function withRestoreEligibility(row) {
   };
 }
 async function writeRows(botId, rows) {
-  if (!existsSync18(botFolder(botId))) return;
+  if (!existsSync19(botFolder(botId))) return;
   const file2 = historyFile(botId);
-  mkdirSync19(botFolder(botId), { recursive: true, mode: 448 });
+  mkdirSync20(botFolder(botId), { recursive: true, mode: 448 });
   const text6 = rows.map((row) => JSON.stringify(withRestoreEligibility(row))).join("\n") + "\n";
   await appendFile2(file2, text6, { mode: 384 });
 }
@@ -50697,7 +50869,7 @@ function readHistory(botId, limit = 100) {
     try {
       const value = JSON.parse(line);
       if (isRow(value)) {
-        const id = typeof value.id === "string" && value.id ? value.id : `legacy-${createHash18("sha256").update(`${end}:${line}`).digest("hex")}`;
+        const id = typeof value.id === "string" && value.id ? value.id : `legacy-${createHash19("sha256").update(`${end}:${line}`).digest("hex")}`;
         rows.push(withRestoreEligibility({ ...value, id }));
       }
     } catch {
@@ -51107,8 +51279,8 @@ function matchDirectoryBots(profile, bots, limit = 5) {
 }
 
 // server/project-scout.ts
-import { readFileSync as readFileSync31, readdirSync as readdirSync6, statSync as statSync8 } from "node:fs";
-import { basename as basename5, join as join41 } from "node:path";
+import { readFileSync as readFileSync32, readdirSync as readdirSync6, statSync as statSync9 } from "node:fs";
+import { basename as basename5, join as join42 } from "node:path";
 
 // shared/import-name.ts
 function takeImportName(value, taken, maxLength = 100) {
@@ -51291,8 +51463,8 @@ var MAX_FILE_BYTES2 = 256e3;
 var MAX_DIR_ENTRIES = 400;
 function readText2(path) {
   try {
-    if (statSync8(path).size > MAX_FILE_BYTES2) return null;
-    return readFileSync31(path, "utf8");
+    if (statSync9(path).size > MAX_FILE_BYTES2) return null;
+    return readFileSync32(path, "utf8");
   } catch {
     return null;
   }
@@ -51306,13 +51478,13 @@ function listNames(dir) {
 }
 function isDir(path) {
   try {
-    return statSync8(path).isDirectory();
+    return statSync9(path).isDirectory();
   } catch {
     return false;
   }
 }
 function packageJson(cwd) {
-  const raw = readText2(join41(cwd, "package.json"));
+  const raw = readText2(join42(cwd, "package.json"));
   if (!raw) return { deps: /* @__PURE__ */ new Set() };
   try {
     const parsed = JSON.parse(raw);
@@ -51335,7 +51507,7 @@ function packageJson(cwd) {
   }
 }
 function readme(cwd) {
-  const raw = readText2(join41(cwd, "README.md")) ?? readText2(join41(cwd, "readme.md")) ?? readText2(join41(cwd, "README"));
+  const raw = readText2(join42(cwd, "README.md")) ?? readText2(join42(cwd, "readme.md")) ?? readText2(join42(cwd, "README"));
   if (!raw) return {};
   let title;
   let summary;
@@ -51409,12 +51581,12 @@ function scoutProject(cwd) {
   const pkg = packageJson(cwd);
   const md = readme(cwd);
   const entries = new Set(listNames(cwd));
-  const pythonDeps = `${readText2(join41(cwd, "requirements.txt")) ?? ""}
-${readText2(join41(cwd, "pyproject.toml")) ?? ""}`.toLowerCase();
+  const pythonDeps = `${readText2(join42(cwd, "requirements.txt")) ?? ""}
+${readText2(join42(cwd, "pyproject.toml")) ?? ""}`.toLowerCase();
   const hasDep = (dep) => pkg.deps.has(dep) || pythonDeps.length > 1 && pythonDeps.includes(dep);
   const pathEvidence = (path) => {
-    if (path.includes("/")) return isDir(join41(cwd, path)) && listNames(join41(cwd, path)).length > 0 ? `${path}/` : null;
-    if (entries.has(path)) return isDir(join41(cwd, path)) ? `${path}/` : path;
+    if (path.includes("/")) return isDir(join42(cwd, path)) && listNames(join42(cwd, path)).length > 0 ? `${path}/` : null;
+    if (entries.has(path)) return isDir(join42(cwd, path)) ? `${path}/` : path;
     return null;
   };
   const signals = [];
@@ -51427,7 +51599,7 @@ ${readText2(join41(cwd, "pyproject.toml")) ?? ""}`.toLowerCase();
     }
     if (detector.role === "docs" && evidence.length > 0) {
       const hasMkdocs = evidence.includes("mkdocs.yml");
-      const hasMarkdown = listNames(join41(cwd, "docs")).some((name2) => name2.endsWith(".md"));
+      const hasMarkdown = listNames(join42(cwd, "docs")).some((name2) => name2.endsWith(".md"));
       if (!hasMkdocs && !hasMarkdown) continue;
     }
     if (evidence.length > 0) signals.push({ role: detector.role, evidence: evidence.slice(0, 6) });
@@ -52017,7 +52189,7 @@ async function fetchGithubTeam(input, fetcher = fetch) {
 
 // server/thread-events.ts
 import { closeSync as closeSync9, fstatSync as fstatSync4, openSync as openSync9, readSync as readSync4 } from "node:fs";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 var DEFAULT_LIMIT = 300;
 var MAX_LIMIT = 2e3;
 var READ_CHUNK = 64 * 1024;
@@ -52151,8 +52323,8 @@ function readThreadEvents(input) {
   assertThreadId(threadId);
   const requested = input.limit ?? DEFAULT_LIMIT;
   const limit = Number.isFinite(requested) ? Math.max(1, Math.min(Math.trunc(requested), MAX_LIMIT)) : DEFAULT_LIMIT;
-  const runtime = readRecentLines(join42(eventsDir, `${threadId}.ndjson`), limit, isRuntimeEvent);
-  const native = readRecentLines(join42(nativeDir, `${threadId}.ndjson`), limit, isNativeRecord);
+  const runtime = readRecentLines(join43(eventsDir, `${threadId}.ndjson`), limit, isRuntimeEvent);
+  const native = readRecentLines(join43(nativeDir, `${threadId}.ndjson`), limit, isNativeRecord);
   const merged = [
     ...runtime.lines.map((data) => ({ kind: "runtime", at: data.createdAt, data })),
     ...native.lines.map((data) => ({ kind: "native", at: data.at, data }))
@@ -52289,12 +52461,12 @@ async function listenWebhookIngress(manager, options) {
   const host = options.host ?? "127.0.0.1";
   const advertised = options.publicBaseUrl === void 0 ? void 0 : advertisedWebhookBase(options.publicBaseUrl);
   const server2 = createServer2(createWebhookIngressHandler(manager));
-  await new Promise((resolve10, reject) => {
+  await new Promise((resolve11, reject) => {
     const onError = (error51) => reject(error51);
     server2.once("error", onError);
     server2.listen(options.port, host, () => {
       server2.off("error", onError);
-      resolve10();
+      resolve11();
     });
   });
   const address = serverAddressSchema.safeParse(server2.address());
@@ -52327,9 +52499,9 @@ function memberTurnSelection(selection) {
 }
 
 // server/webhooks.ts
-import { createHash as createHash19, randomBytes as randomBytes5, randomUUID as randomUUID13, timingSafeEqual } from "node:crypto";
-import { mkdirSync as mkdirSync20, readFileSync as readFileSync32 } from "node:fs";
-import { dirname as dirname13, join as join43 } from "node:path";
+import { createHash as createHash20, randomBytes as randomBytes6, randomUUID as randomUUID14, timingSafeEqual } from "node:crypto";
+import { mkdirSync as mkdirSync21, readFileSync as readFileSync33 } from "node:fs";
+import { dirname as dirname13, join as join44 } from "node:path";
 var MAX_DELIVERIES = 2e3;
 var MAX_ATTEMPTS = 2e3;
 var MAX_EVENT_CHARS = 48e3;
@@ -52405,7 +52577,7 @@ function invalidInput(error51) {
   fail(400, schemaIssue(error51, "Invalid webhook settings"));
 }
 function hashSecret(secret) {
-  return createHash19("sha256").update(secret).digest("hex");
+  return createHash20("sha256").update(secret).digest("hex");
 }
 function secretMatches(secret, expectedHex) {
   if (!secret) return false;
@@ -52414,10 +52586,10 @@ function secretMatches(secret, expectedHex) {
   return actual.length === expected.length && timingSafeEqual(actual, expected);
 }
 function newEndpointId() {
-  return `wh_${randomBytes5(12).toString("base64url")}`;
+  return `wh_${randomBytes6(12).toString("base64url")}`;
 }
 function newSecret() {
-  return `whsec_${randomBytes5(32).toString("base64url")}`;
+  return `whsec_${randomBytes6(32).toString("base64url")}`;
 }
 function cleanInput2(input) {
   const name2 = input.name.trim().slice(0, 80);
@@ -52516,10 +52688,10 @@ var WebhookManager = class {
   rate = /* @__PURE__ */ new Map();
   constructor(options) {
     this.options = options;
-    this.file = options.file ?? join43(DATA_DIR, "webhooks.json");
+    this.file = options.file ?? join44(DATA_DIR, "webhooks.json");
     this.now = options.now ?? Date.now;
     try {
-      const parsed = webhookFileSchema.safeParse(parseJson(readFileSync32(this.file, "utf8")));
+      const parsed = webhookFileSchema.safeParse(parseJson(readFileSync33(this.file, "utf8")));
       if (!parsed.success) throw parsed.error;
       this.webhooks = parsed.data.webhooks;
       this.deliveries = parsed.data.deliveries.slice(-MAX_DELIVERIES);
@@ -52542,7 +52714,7 @@ var WebhookManager = class {
     const now = this.now();
     const secret = newSecret();
     const trigger = {
-      id: randomUUID13(),
+      id: randomUUID14(),
       endpointId: newEndpointId(),
       ...clean2,
       secretHash: hashSecret(secret),
@@ -52638,7 +52810,7 @@ var WebhookManager = class {
       contentType: "application/json",
       eventName: eventName2,
       userAgent: "OpenMausBot webhook tester",
-      deliveryId: `test-${randomUUID13()}`
+      deliveryId: `test-${randomUUID14()}`
     });
   }
   recordRejected(endpointId, statusCode, reason, event = {}) {
@@ -52651,7 +52823,7 @@ var WebhookManager = class {
     if (this.options.botState(trigger.botId) === "missing") fail(410, "The assigned MAUS no longer exists");
     const allowed = trigger.eventTypes ?? [];
     if (allowed.length > 0 && (!event.eventName || !allowed.includes(event.eventName))) {
-      const deliveryId3 = String(event.deliveryId ?? "").trim().slice(0, 200) || randomUUID13();
+      const deliveryId3 = String(event.deliveryId ?? "").trim().slice(0, 200) || randomUUID14();
       this.appendAttempt(trigger, event, {
         outcome: "ignored",
         statusCode: 202,
@@ -52685,7 +52857,7 @@ var WebhookManager = class {
     if (recent.length >= RATE_LIMIT) fail(429, "Webhook rate limit exceeded");
     recent.push(now);
     this.rate.set(trigger.endpointId, recent);
-    const deliveryId2 = requestedDeliveryId || randomUUID13();
+    const deliveryId2 = requestedDeliveryId || randomUUID14();
     const run3 = this.options.enqueue({
       webhookId: trigger.id,
       webhookName: trigger.name,
@@ -52715,7 +52887,7 @@ var WebhookManager = class {
   }
   captureVerification(trigger, event) {
     const receivedAt = this.now();
-    const deliveryId2 = String(event.deliveryId ?? "").trim().slice(0, 200) || randomUUID13();
+    const deliveryId2 = String(event.deliveryId ?? "").trim().slice(0, 200) || randomUUID14();
     trigger.verificationPending = false;
     trigger.verifiedAt = receivedAt;
     trigger.lastReceivedAt = receivedAt;
@@ -52749,7 +52921,7 @@ var WebhookManager = class {
   }
   appendAttempt(trigger, event, details) {
     const attempt = {
-      id: randomUUID13(),
+      id: randomUUID14(),
       webhookId: trigger.id,
       receivedAt: this.now(),
       outcome: details.outcome,
@@ -52769,7 +52941,7 @@ var WebhookManager = class {
     this.options.emit?.({ kind: "webhook", webhook: publicTrigger(trigger) });
   }
   save() {
-    mkdirSync20(dirname13(this.file), { recursive: true });
+    mkdirSync21(dirname13(this.file), { recursive: true });
     writeFileAtomic(
       this.file,
       JSON.stringify({ version: 1, webhooks: this.webhooks, deliveries: this.deliveries, attempts: this.attempts }, null, 2),
@@ -52779,8 +52951,8 @@ var WebhookManager = class {
 };
 
 // server/skill-library.ts
-import { existsSync as existsSync19, readFileSync as readFileSync33, readdirSync as readdirSync7 } from "node:fs";
-import { basename as basename6, join as join44 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync34, readdirSync as readdirSync7 } from "node:fs";
+import { basename as basename6, join as join45 } from "node:path";
 var SAFE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 function strings(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string" && item.trim()) ? value.map((item) => item.trim()) : null;
@@ -52809,26 +52981,26 @@ function parseSkillManifest(value, directory) {
   };
 }
 function loadSkillDirectory(directory) {
-  const manifestPath2 = join44(directory, "manifest.json");
-  const skillPath = join44(directory, "SKILL.md");
-  if (!existsSync19(manifestPath2) || !existsSync19(skillPath)) return null;
-  const manifest = parseSkillManifest(JSON.parse(readFileSync33(manifestPath2, "utf8")), directory);
-  const instructions = readFileSync33(skillPath, "utf8").trim();
+  const manifestPath2 = join45(directory, "manifest.json");
+  const skillPath = join45(directory, "SKILL.md");
+  if (!existsSync20(manifestPath2) || !existsSync20(skillPath)) return null;
+  const manifest = parseSkillManifest(JSON.parse(readFileSync34(manifestPath2, "utf8")), directory);
+  const instructions = readFileSync34(skillPath, "utf8").trim();
   if (!instructions.startsWith("---")) throw new Error(`${skillPath} has no skill frontmatter`);
   return { manifest, instructions, directory };
 }
-function loadBundledSkills(root = process.env.OMB_SKILLS_DIR || join44(process.cwd(), "skills")) {
-  if (!existsSync19(root)) return [];
+function loadBundledSkills(root = process.env.OMB_SKILLS_DIR || join45(process.cwd(), "skills")) {
+  if (!existsSync20(root)) return [];
   const skills = [];
   for (const name2 of readdirSync7(root).sort()) {
-    const directory = join44(root, name2);
+    const directory = join45(root, name2);
     const skill = loadSkillDirectory(directory);
     if (skill) skills.push(skill);
   }
   return skills;
 }
 function loadUserSkills(root) {
-  if (!existsSync19(root)) return [];
+  if (!existsSync20(root)) return [];
   let names;
   try {
     names = readdirSync7(root).sort();
@@ -52838,7 +53010,7 @@ function loadUserSkills(root) {
   const skills = [];
   for (const name2 of names) {
     try {
-      const skill = loadSkillDirectory(join44(root, name2));
+      const skill = loadSkillDirectory(join45(root, name2));
       if (skill) skills.push(skill);
     } catch {
     }
@@ -53484,7 +53656,7 @@ var PendingTurnCancellations = class {
     this.#ownersByThread.delete(threadId);
     const waiters = this.#clearWaitersByThread.get(threadId);
     this.#clearWaitersByThread.delete(threadId);
-    for (const resolve10 of waiters ?? []) resolve10();
+    for (const resolve11 of waiters ?? []) resolve11();
   }
   /** Do not overlap a replacement dispatch with the ambiguous pre-id window.
    * Re-check after every wake: a cancellation can be renewed in the same
@@ -53492,14 +53664,14 @@ var PendingTurnCancellations = class {
    * expiry, so a broken adapter cannot strand this await forever. */
   async waitForClear(threadId) {
     while (this.has(threadId)) {
-      await new Promise((resolve10) => {
+      await new Promise((resolve11) => {
         const waiters = this.#clearWaitersByThread.get(threadId) ?? /* @__PURE__ */ new Set();
-        waiters.add(resolve10);
+        waiters.add(resolve11);
         this.#clearWaitersByThread.set(threadId, waiters);
         if (!this.has(threadId)) {
-          waiters.delete(resolve10);
+          waiters.delete(resolve11);
           if (waiters.size === 0) this.#clearWaitersByThread.delete(threadId);
-          resolve10();
+          resolve11();
         }
       });
     }
@@ -53526,8 +53698,8 @@ function createGracefulShutdown({
     if (started) return;
     started = true;
     let timer;
-    const deadline = new Promise((resolve10) => {
-      timer = setTimeout(resolve10, timeoutMs);
+    const deadline = new Promise((resolve11) => {
+      timer = setTimeout(resolve11, timeoutMs);
       timer.unref?.();
     });
     const settled = Promise.allSettled(cleanup.map((job) => Promise.resolve().then(job))).then(() => void 0);
@@ -53539,10 +53711,10 @@ function createGracefulShutdown({
 }
 
 // electron/data-dir-lease.mjs
-import { createHash as createHash20, randomUUID as randomUUID14 } from "node:crypto";
-import { existsSync as existsSync20, linkSync as linkSync4, mkdirSync as mkdirSync21, readFileSync as readFileSync34, renameSync as renameSync5, unlinkSync as unlinkSync8, writeFileSync as writeFileSync15 } from "node:fs";
+import { createHash as createHash21, randomUUID as randomUUID15 } from "node:crypto";
+import { existsSync as existsSync21, linkSync as linkSync4, mkdirSync as mkdirSync22, readFileSync as readFileSync35, renameSync as renameSync6, unlinkSync as unlinkSync8, writeFileSync as writeFileSync16 } from "node:fs";
 import { hostname as hostname4 } from "node:os";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 var LEASE_NAME = "openmausbot-server.lease";
 var DELEGATED_CHILD_DIR = ".openmausbot-server-child";
 var CHILD_LEASE_ENV = "OPENMAUSBOT_INTERNAL_DATA_DIR_LEASE";
@@ -53568,7 +53740,7 @@ function isReaperOwner(value, targetToken) {
 function parseRecord(path, invalidMessage, validate) {
   let raw;
   try {
-    raw = readFileSync34(path, "utf8");
+    raw = readFileSync35(path, "utf8");
   } catch (error51) {
     if (error51?.code === "ENOENT") return null;
     throw leaseError("OpenMausBot cannot read the data-directory lease; refusing to start to protect its state.", error51);
@@ -53616,7 +53788,7 @@ function unlinkExact(path, message3) {
 function publishRecord(path, record2, prepareMessage, acquireMessage) {
   const candidatePath = `${path}.candidate-${record2.pid}-${record2.token}`;
   try {
-    writeFileSync15(candidatePath, `${JSON.stringify(record2)}
+    writeFileSync16(candidatePath, `${JSON.stringify(record2)}
 `, { flag: "wx", mode: 384, flush: true });
   } catch (error51) {
     throw leaseError(prepareMessage, error51);
@@ -53634,7 +53806,7 @@ function publishRecord(path, record2, prepareMessage, acquireMessage) {
   }
 }
 function successorReaperPath2(leasePath, targetToken, reaperToken) {
-  const digest = createHash20("sha256").update(reaperToken).digest("hex").slice(0, 32);
+  const digest = createHash21("sha256").update(reaperToken).digest("hex").slice(0, 32);
   return `${leasePath}.reap-${targetToken}-${digest}`;
 }
 function claimReaperAuthority2(leasePath, expected) {
@@ -53644,7 +53816,7 @@ function claimReaperAuthority2(leasePath, expected) {
       version: 1,
       pid: process.pid,
       host: hostname4(),
-      token: randomUUID14(),
+      token: randomUUID15(),
       createdAt: Date.now(),
       targetToken: expected.token
     };
@@ -53689,22 +53861,22 @@ function prepareDataDir(dataDir, legacyDataDir) {
   validateDataDir(dataDir);
   if (legacyDataDir !== void 0) {
     validateDataDir(legacyDataDir);
-    if (!existsSync20(dataDir) && existsSync20(legacyDataDir)) {
+    if (!existsSync21(dataDir) && existsSync21(legacyDataDir)) {
       try {
-        renameSync5(legacyDataDir, dataDir);
+        renameSync6(legacyDataDir, dataDir);
       } catch {
       }
     }
   }
   try {
-    mkdirSync21(dataDir, { recursive: true, mode: 448 });
+    mkdirSync22(dataDir, { recursive: true, mode: 448 });
   } catch (error51) {
     throw leaseError("OpenMausBot cannot create its data directory.", error51);
   }
-  return join45(dataDir, LEASE_NAME);
+  return join46(dataDir, LEASE_NAME);
 }
 function assertNoLiveDelegatedChild(dataDir) {
-  const childLeasePath = join45(dataDir, DELEGATED_CHILD_DIR, LEASE_NAME);
+  const childLeasePath = join46(dataDir, DELEGATED_CHILD_DIR, LEASE_NAME);
   const child = readOwner(childLeasePath);
   if (!child) return;
   if (child.host !== hostname4()) {
@@ -53746,13 +53918,13 @@ function validateChildDelegation(dataDir, encoded) {
   const capability = parseCapability(encoded);
   const invalid = () => leaseError("The OpenMausBot desktop lease delegation is invalid; refusing to start to protect its state.");
   if (!capability) throw invalid();
-  const parentLeasePath = join45(dataDir, LEASE_NAME);
+  const parentLeasePath = join46(dataDir, LEASE_NAME);
   const matchesLiveParent = (owner2) => Boolean(owner2 && owner2.pid === capability.pid && owner2.token === capability.token && owner2.host === hostname4() && processIsAlive2(owner2.pid));
   if (!matchesLiveParent(readOwner(parentLeasePath))) {
     throw invalid();
   }
   const childLease = acquireDataDirLeaseInternal(
-    join45(dataDir, DELEGATED_CHILD_DIR),
+    join46(dataDir, DELEGATED_CHILD_DIR),
     { guardDelegatedChild: false }
   );
   if (!matchesLiveParent(readOwner(parentLeasePath))) {
@@ -53774,12 +53946,12 @@ function acquireDataDirLeaseInternal(dataDir, options = {}) {
     version: 1,
     pid: process.pid,
     host: hostname4(),
-    token: randomUUID14(),
+    token: randomUUID15(),
     createdAt: Date.now()
   };
   const candidatePath = `${leasePath}.candidate-${owner2.pid}-${owner2.token}`;
   try {
-    writeFileSync15(candidatePath, `${JSON.stringify(owner2)}
+    writeFileSync16(candidatePath, `${JSON.stringify(owner2)}
 `, { flag: "wx", mode: 384, flush: true });
   } catch (error51) {
     throw leaseError("OpenMausBot cannot prepare its data-directory lease.", error51);
@@ -53850,15 +54022,15 @@ function acquireDataDirLeaseForProcess(dataDir, environment = process.env) {
 }
 
 // server/enterprise.ts
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join47 } from "node:path";
 import { pathToFileURL } from "node:url";
 var layerSchema = external_exports.object({
   customer: external_exports.string().min(1),
   features: external_exports.array(external_exports.string().min(1)),
   expiresAt: external_exports.string().nullable()
 });
-var DEFAULT_DIR = join46(SERVER_ROOT, "..", "enterprise");
+var DEFAULT_DIR = join47(SERVER_ROOT, "..", "enterprise");
 var current = { edition: "oss", features: [] };
 function oss(notice) {
   current = notice ? { edition: "oss", features: [], notice } : { edition: "oss", features: [] };
@@ -53867,7 +54039,7 @@ function oss(notice) {
 async function loadEnterpriseLayer(options = {}) {
   const dir = options.dir ?? process.env.OMB_ENTERPRISE_DIR ?? DEFAULT_DIR;
   const licenseKey = options.licenseKey ?? process.env.OMB_LICENSE_KEY;
-  const entry = [join46(dir, "server", "index.ts"), join46(dir, "server", "index.js")].find((candidate) => existsSync21(candidate));
+  const entry = [join47(dir, "server", "index.ts"), join47(dir, "server", "index.js")].find((candidate) => existsSync22(candidate));
   if (!entry) {
     return oss(
       licenseKey ? `OMB_LICENSE_KEY is set but no enterprise layer exists at ${dir}` : void 0
@@ -54327,8 +54499,8 @@ function resolveRequestAuth(req, options) {
 }
 
 // server/sessions.ts
-import { createHash as createHash21, randomBytes as randomBytes6, randomUUID as randomUUID15, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync35, renameSync as renameSync6, writeFileSync as writeFileSync16 } from "node:fs";
+import { createHash as createHash22, randomBytes as randomBytes7, randomUUID as randomUUID16, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { chmodSync as chmodSync6, existsSync as existsSync23, mkdirSync as mkdirSync23, readFileSync as readFileSync36, renameSync as renameSync7, writeFileSync as writeFileSync17 } from "node:fs";
 import { dirname as dirname14 } from "node:path";
 var SCOPES = ["admin", "client"];
 var PAIRING_CODE_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
@@ -54351,7 +54523,7 @@ var sessionSchema = external_exports.object({
   expiresAt: external_exports.number()
 });
 var fileSchema2 = external_exports.object({ version: external_exports.literal(1), sessions: external_exports.array(sessionSchema) });
-var sha2562 = (value) => createHash21("sha256").update(value).digest("hex");
+var sha2562 = (value) => createHash22("sha256").update(value).digest("hex");
 function sameDigest(a, b) {
   const left = Buffer.from(a, "hex");
   const right = Buffer.from(b, "hex");
@@ -54361,7 +54533,7 @@ function generatePairingCode() {
   const limit = Math.floor(256 / PAIRING_CODE_ALPHABET.length) * PAIRING_CODE_ALPHABET.length;
   let code = "";
   while (code.length < PAIRING_CODE_LENGTH) {
-    for (const byte of randomBytes6(PAIRING_CODE_LENGTH)) {
+    for (const byte of randomBytes7(PAIRING_CODE_LENGTH)) {
       if (byte >= limit) continue;
       code += PAIRING_CODE_ALPHABET[byte % PAIRING_CODE_ALPHABET.length];
       if (code.length === PAIRING_CODE_LENGTH) break;
@@ -54403,10 +54575,10 @@ var SessionRegistry = class {
     this.load();
   }
   load() {
-    if (!existsSync22(this.options.file)) return;
+    if (!existsSync23(this.options.file)) return;
     let raw;
     try {
-      raw = JSON.parse(readFileSync35(this.options.file, "utf8"));
+      raw = JSON.parse(readFileSync36(this.options.file, "utf8"));
     } catch {
       return;
     }
@@ -54416,11 +54588,11 @@ var SessionRegistry = class {
   /** Atomic write, owner-only, directory owner-only. */
   persist() {
     const dir = dirname14(this.options.file);
-    mkdirSync22(dir, { recursive: true, mode: 448 });
+    mkdirSync23(dir, { recursive: true, mode: 448 });
     const tmp = `${this.options.file}.${process.pid}.tmp`;
-    writeFileSync16(tmp, JSON.stringify({ version: 1, sessions: this.sessions }, null, 2) + "\n", { mode: 384 });
-    chmodSync5(tmp, 384);
-    renameSync6(tmp, this.options.file);
+    writeFileSync17(tmp, JSON.stringify({ version: 1, sessions: this.sessions }, null, 2) + "\n", { mode: 384 });
+    chmodSync6(tmp, 384);
+    renameSync7(tmp, this.options.file);
   }
   prune() {
     const now = this.now();
@@ -54455,7 +54627,7 @@ var SessionRegistry = class {
     const code = generatePairingCode();
     const scopes = input.scopes?.length ? [...new Set(input.scopes)] : [...SCOPES];
     const pairing = {
-      id: randomUUID15(),
+      id: randomUUID16(),
       codeHash: sha2562(code),
       scopes,
       label: (input.label ?? "").trim().slice(0, 80),
@@ -54525,9 +54697,9 @@ var SessionRegistry = class {
     }
     const [pairing] = this.pairings.splice(index2, 1);
     this.failures.delete(input.source);
-    const token = `omb_sess_${randomBytes6(32).toString("base64url")}`;
+    const token = `omb_sess_${randomBytes7(32).toString("base64url")}`;
     const record2 = {
-      id: randomUUID15(),
+      id: randomUUID16(),
       tokenHash: sha2562(token),
       label: (input.label.trim() || pairing.label || input.fallbackLabel?.trim() || "Unnamed device").slice(0, 80),
       scopes: [...pairing.scopes],
@@ -54579,7 +54751,7 @@ var SessionRegistry = class {
     this.prune();
     const mine = [...this.tickets].filter(([, t]) => t.sessionId === sessionId).sort((a, b) => a[1].expiresAt - b[1].expiresAt);
     for (const [hash2] of mine.slice(0, Math.max(0, mine.length - (MAX_STREAM_TICKETS_PER_SESSION - 1)))) this.tickets.delete(hash2);
-    const ticket = `omb_tick_${randomBytes6(24).toString("base64url")}`;
+    const ticket = `omb_tick_${randomBytes7(24).toString("base64url")}`;
     const expiresAt = this.now() + STREAM_TICKET_TTL_MS;
     this.tickets.set(sha2562(ticket), { sessionId, expiresAt });
     return { ticket, expiresAt };
@@ -54598,8 +54770,8 @@ var SessionRegistry = class {
 };
 
 // server/brand.ts
-import { existsSync as existsSync23, readFileSync as readFileSync36 } from "node:fs";
-import { join as join47 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync37 } from "node:fs";
+import { join as join48 } from "node:path";
 var HEX_COLOUR = /^#[0-9a-fA-F]{6}$/;
 var MAX_LOGO_CHARS = 3e5;
 var brandSchema = external_exports.object({
@@ -54616,16 +54788,16 @@ var brandSchema = external_exports.object({
 }).strict();
 var DEFAULT_BRAND = { name: "OpenMausBot" };
 function brandFile() {
-  return process.env.OMB_BRAND_FILE || join47(DATA_DIR, "brand.json");
+  return process.env.OMB_BRAND_FILE || join48(DATA_DIR, "brand.json");
 }
 function loadBrand(options = {}) {
   const file2 = options.file ?? brandFile();
   const isEntitled = options.isEntitled ?? entitled;
   const fallback = (notice) => notice ? { brand: DEFAULT_BRAND, source: "default", file: file2, notice } : { brand: DEFAULT_BRAND, source: "default", file: file2 };
-  if (!existsSync23(file2)) return fallback();
+  if (!existsSync24(file2)) return fallback();
   let raw;
   try {
-    raw = JSON.parse(readFileSync36(file2, "utf8"));
+    raw = JSON.parse(readFileSync37(file2, "utf8"));
   } catch (error51) {
     return fallback(`${file2} is not valid JSON (${error51 instanceof Error ? error51.message : String(error51)}); using the default brand`);
   }
@@ -54646,7 +54818,7 @@ function describeBrand(status) {
 }
 
 // server/phone-secret.ts
-import { createECDH, createHash as createHash22 } from "node:crypto";
+import { createECDH, createHash as createHash23 } from "node:crypto";
 
 // node_modules/.pnpm/@hpke+common@1.10.1/node_modules/@hpke/common/esm/src/errors.js
 var HpkeError = class extends Error {
@@ -56345,8 +56517,8 @@ var Mutex = class {
   }
   async lock() {
     let releaseLock;
-    const nextLock = new Promise((resolve10) => {
-      releaseLock = resolve10;
+    const nextLock = new Promise((resolve11) => {
+      releaseLock = resolve11;
     });
     const previousLock = __classPrivateFieldGet(this, _Mutex_locked, "f");
     __classPrivateFieldSet(this, _Mutex_locked, nextLock, "f");
@@ -56830,7 +57002,7 @@ function phoneSecretKeyIdFromJwk(jwk) {
   const x = decodeBase64URL(jwk.x, 32);
   const y = decodeBase64URL(jwk.y, 32);
   if (!x || !y) return null;
-  return createHash22("sha256").update(Buffer.concat([Buffer.from([4]), x, y])).digest().subarray(0, 16).toString("base64url");
+  return createHash23("sha256").update(Buffer.concat([Buffer.from([4]), x, y])).digest().subarray(0, 16).toString("base64url");
 }
 function phoneSecretAAD(context) {
   const fields = [
@@ -56850,7 +57022,7 @@ function phoneSecretAAD(context) {
 }
 function phoneSecretOperationId(context) {
   const aad = phoneSecretAAD(context);
-  return createHash22("sha256").update(aad).update("\0").update(String(context.version)).update("\n").update(context.encapsulatedKey).update("\n").update(context.ciphertext).digest("base64url");
+  return createHash23("sha256").update(aad).update("\0").update(String(context.version)).update("\n").update(context.encapsulatedKey).update("\n").update(context.ciphertext).digest("base64url");
 }
 function assertPhoneSecretRequestMatches(context, authenticatedDeviceId, expected) {
   if (context.deviceId !== authenticatedDeviceId || context.target !== expected.target || context.requestKey !== expected.requestKey) {
@@ -57062,13 +57234,13 @@ var PhoneSecretBridge = class {
       throw new PhoneSecretError("The credential must be between 1 and 4096 bytes");
     }
     const requestId = phoneSecretOperationId(context);
-    await new Promise((resolve10, reject) => {
+    await new Promise((resolve11, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(requestId);
         reject(new PhoneSecretError("The operating-system credential store did not respond. Try again.", 504));
       }, this.timeoutMs);
       timer.unref?.();
-      this.pending.set(requestId, { resolve: resolve10, reject, timer });
+      this.pending.set(requestId, { resolve: resolve11, reject, timer });
       if (this.send({
         type: "openmausbot:phone-secret-save",
         requestId,
@@ -57112,7 +57284,7 @@ function releaseDataDirLeaseAtExit() {
 }
 process.once("exit", releaseDataDirLeaseAtExit);
 var ENVIRONMENT_ID = loadEnvironmentId(DATA_DIR);
-var sessions = new SessionRegistry({ file: join48(DATA_DIR, "sessions.json") });
+var sessions = new SessionRegistry({ file: join49(DATA_DIR, "sessions.json") });
 var SESSION_COOKIE = sessionCookieName(PORT, ENVIRONMENT_ID);
 var DESKTOP_MANAGED = process.env.OMB_DESKTOP_PARENT === "1";
 var desktopMutationToken = DESKTOP_MANAGED ? "" : void 0;
@@ -57122,7 +57294,7 @@ var cfg = loadConfig();
 var registry2 = new ProviderRegistry(BUILT_IN_DRIVERS);
 await registry2.load(instanceConfigs(cfg));
 var bundledSkills = loadBundledSkills();
-var availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join48(DATA_DIR, "skills")));
+var availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join49(DATA_DIR, "skills")));
 var utilityParentPort = process.parentPort;
 function postDesktopPrivateMessage(message3) {
   if (!utilityParentPort) return false;
@@ -57148,7 +57320,7 @@ function applyDesktopMutationTokenMessage(raw) {
   return true;
 }
 var browserCleanup = new BrowserCleanupCoordinator({
-  file: join48(DATA_DIR, "browser-cleanups.json"),
+  file: join49(DATA_DIR, "browser-cleanups.json"),
   send: postDesktopPrivateMessage
 });
 var phoneSecrets = new PhoneSecretBridge(postDesktopPrivateMessage);
@@ -57170,7 +57342,7 @@ var INTERNAL_CAPABILITY_ORPHAN_MS = 30 * 24 * 60 * 6e4;
 var internalCapabilities = /* @__PURE__ */ new Map();
 var activeInternalGenerationByThread = /* @__PURE__ */ new Map();
 var internalGenerationByProviderTurn = new ProviderTurnGenerationRegistry();
-function beginInternalCapabilityGeneration(threadId, generation = randomUUID16()) {
+function beginInternalCapabilityGeneration(threadId, generation = randomUUID17()) {
   const previous2 = activeInternalGenerationByThread.get(threadId);
   if (previous2) revokeInternalCapabilityGeneration(threadId, previous2);
   activeInternalGenerationByThread.set(threadId, generation);
@@ -57180,7 +57352,7 @@ function mintInternalCapability(capability) {
   if (activeInternalGenerationByThread.get(capability.threadId) !== capability.generation) {
     throw new Error("cannot mint an integration capability for an inactive turn");
   }
-  const token = randomBytes7(24).toString("hex");
+  const token = randomBytes8(24).toString("hex");
   internalCapabilities.set(token, {
     ...capability,
     orphanExpiresAt: Date.now() + INTERNAL_CAPABILITY_ORPHAN_MS
@@ -57422,9 +57594,9 @@ function cancelDirectTurnDispatch(botId, expectedThreadId) {
   }
   return claim;
 }
-async function browserIntegration(botId, profile, threadId, generation, stillValid = () => true, ownerId = randomUUID16()) {
+async function browserIntegration(botId, profile, threadId, generation, stillValid = () => true, ownerId = randomUUID17()) {
   const connection = availableBrowserConnection();
-  if (!connection) return null;
+  if (!connection) return engineBrowserIntegration(botId, profile);
   const control = controlIntegration(botId, threadId, generation);
   const profileTarget = profile && profile !== "guest" ? browserProfilePartitionTarget(cfg, profile) : null;
   const partitionId = profile === "guest" ? "guest" : profileTarget?.partitionId ?? "";
@@ -57455,6 +57627,36 @@ async function browserIntegration(botId, profile, threadId, generation, stillVal
     }
   };
 }
+function engineBrowserIntegration(botId, profile) {
+  const status = browserEngineStatus();
+  if (status.kind !== "ready") {
+    if (!engineUnavailableLogged) {
+      engineUnavailableLogged = true;
+      console.warn(`${describeBrowserEngine(status)}; bots get no browser tools until it is installed`);
+    }
+    return null;
+  }
+  const profileTarget = profile && profile !== "guest" ? browserProfilePartitionTarget(cfg, profile) : null;
+  const partitionId = profile === "guest" ? "guest" : profileTarget?.partitionId ?? "";
+  const session = browserSessionId(botId, partitionId);
+  return {
+    connection: null,
+    capability: null,
+    profile: partitionId,
+    integration: agentBrowserIntegration({
+      binaryPath: status.binaryPath,
+      session,
+      encryptionKey: browserEngineEncryptionKey(),
+      persistent: profile !== "guest"
+    })
+  };
+}
+var engineUnavailableLogged = false;
+function browserEngineSummary() {
+  if (availableBrowserConnection()) return { kind: "desktop" };
+  const status = browserEngineStatus();
+  return status.kind === "ready" ? { kind: "headless", version: status.version } : { kind: "unavailable", reason: status.reason, installable: status.installable };
+}
 function phoneIntegration() {
   const env = { ...AGENTS_NODE_FLAG };
   if (process.env.OMB_ADB_PATH) env.OMB_ADB_PATH = process.env.OMB_ADB_PATH;
@@ -57522,7 +57724,7 @@ function askBotAndWait(targetBotId, message3, depth, fromBotId) {
   const target = store.bot(targetBotId);
   if (!target) return Promise.resolve({ status: "error", text: "(no such bot)" });
   const threadId = target.threadId;
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     let text6 = "";
     let done = false;
     const finish = (out) => {
@@ -57530,7 +57732,7 @@ function askBotAndWait(targetBotId, message3, depth, fromBotId) {
       done = true;
       clearTimeout(timer);
       unsub();
-      resolve10(out);
+      resolve11(out);
     };
     const unsub = bus.subscribe((e) => {
       if (shouldIgnoreProviderEvent(e)) return;
@@ -58007,7 +58209,7 @@ function publicGroupState(group) {
 }
 function beginGroupTurnOperation(groupId, threadId, botIds = []) {
   const operation = {
-    id: randomUUID16(),
+    id: randomUUID17(),
     threadId,
     botIds: new Set(botIds),
     cancelled: false,
@@ -58117,7 +58319,7 @@ async function waitForGroupMemberBot(bot, operation, onWaiting) {
   const initial = groupMemberBotAvailability(bot.id, operation);
   if (initial !== "busy") return initial;
   onWaiting(`${bot.name} is finishing another conversation.`);
-  return await new Promise((resolve10) => {
+  return await new Promise((resolve11) => {
     let settled = false;
     let unsubscribe = () => {
     };
@@ -58127,7 +58329,7 @@ async function waitForGroupMemberBot(bot, operation, onWaiting) {
       clearTimeout(waitCap);
       unsubscribe();
       operation.cancellation.signal.removeEventListener("abort", onAbort);
-      resolve10(availability);
+      resolve11(availability);
     };
     const waitCap = setTimeout(() => finish("timed_out"), GROUP_GOAL_WAIT_MAX_MS);
     waitCap.unref?.();
@@ -58307,7 +58509,7 @@ sessions.onSessionRevoked((sessionId) => {
     }
   }
 });
-var STREAM_ID = randomUUID16().slice(0, 8);
+var STREAM_ID = randomUUID17().slice(0, 8);
 var REPLAY_MAX = 500;
 var configuredSseHeartbeatMs = Number(process.env.OMB_SSE_HEARTBEAT_MS);
 var SSE_HEARTBEAT_MS = Number.isFinite(configuredSseHeartbeatMs) && configuredSseHeartbeatMs > 0 ? configuredSseHeartbeatMs : 15e3;
@@ -59172,7 +59374,7 @@ function markTaskContextExternallyUpdated(bot, threadId) {
   const task2 = store.taskByThread(bot.id, threadId);
   if (!task2) return;
   task2.resumeCursors = {};
-  task2.lastInstanceId = `${EXTERNAL_CONTEXT_MARKER_PREFIX}${randomUUID16()}`;
+  task2.lastInstanceId = `${EXTERNAL_CONTEXT_MARKER_PREFIX}${randomUUID17()}`;
   const patch = { unread: true };
   if (bot.threadId === threadId) patch.resumeCursors = {};
   store.patchBot(bot.id, patch);
@@ -59512,7 +59714,7 @@ async function startTurn(botId, text6, opts) {
   }
   let userMessage = opts?.userMessage;
   if (!userMessage) {
-    userMessage = opts?.cardContinuation ? { id: `card-${randomUUID16()}`, at: Date.now(), role: "user", kind: "text", text: text6 } : store.appendMessage(threadId, {
+    userMessage = opts?.cardContinuation ? { id: `card-${randomUUID17()}`, at: Date.now(), role: "user", kind: "text", text: text6 } : store.appendMessage(threadId, {
       role: "user",
       kind: "text",
       text: text6,
@@ -59563,7 +59765,7 @@ async function startTurn(botId, text6, opts) {
     const drift = checkSoulDrift(bot.id, bot.soul ?? "", bot.soulHash ?? "");
     if (drift.drift !== Boolean(bot.soulDrift)) store.patchBot(bot.id, { soulDrift: drift.drift });
   }
-  const dispatchClaimId = randomUUID16();
+  const dispatchClaimId = randomUUID17();
   directTurnGenerationByBot.set(bot.id, dispatchClaimId);
   directTurnDispatchClaims.set(bot.id, { id: dispatchClaimId, threadId, phase: "setup" });
   beginInternalCapabilityGeneration(threadId, dispatchClaimId);
@@ -59852,9 +60054,9 @@ async function startTurn(botId, text6, opts) {
       if (!isExternalContextMarker(task2.lastInstanceId) || task2.lastInstanceId === externalContextMarker) {
         store.markTaskDispatched(bot.id, threadId, instanceId);
       }
-      if (!previewCapture && browser) {
-        const { connection } = browser;
-        previewCapture = () => browserScreenshot(connection, browser.capability, fetch);
+      if (!previewCapture && browser?.connection && browser.capability) {
+        const { connection, capability } = browser;
+        previewCapture = () => browserScreenshot(connection, capability, fetch);
       }
       if (previewCapture && store.bot(bot.id)?.busy) {
         startScreenPoller(bot.id, previewCapture, { screenIsTheWork: instance.driverKind === "boxAgent" });
@@ -60599,7 +60801,7 @@ ${memorySystemPrompt(bot.id).trim()}` : "" },
     let replyText = "";
     let providerTurnId;
     let abandoned = false;
-    const retirementOwner = `room-abandoned:${randomUUID16()}`;
+    const retirementOwner = `room-abandoned:${randomUUID17()}`;
     const abandonProviderTurn = () => {
       if (abandoned) return;
       abandoned = true;
@@ -60608,7 +60810,7 @@ ${memorySystemPrompt(bot.id).trim()}` : "" },
       else markCancelledProviderHandshake(threadId, retirementOwner);
     };
     const timeoutMinutes = roomTurnTimeoutMinutes(cfg);
-    const outcome = await new Promise((resolve10) => {
+    const outcome = await new Promise((resolve11) => {
       let done = false;
       let unsub = () => {
       };
@@ -60633,7 +60835,7 @@ ${memorySystemPrompt(bot.id).trim()}` : "" },
         deadline.stop();
         unsub();
         unregisterStall();
-        resolve10(value);
+        resolve11(value);
       };
       unsub = bus.subscribe((e) => {
         if (shouldIgnoreProviderEvent(e)) return;
@@ -61146,7 +61348,7 @@ function startGroupTurn(groupId, text6, replyTo, sendId, channelMode = "chat", q
     goalCoordinator ? [] : responders.map((responder) => responder.id)
   );
   if (goalCoordinator) {
-    const runId = options.goalRunId?.trim() || `goal-${Date.now().toString(36)}-${randomUUID16()}`;
+    const runId = options.goalRunId?.trim() || `goal-${Date.now().toString(36)}-${randomUUID17()}`;
     const startedAt = Date.now();
     const detail = `${goalCoordinator.name} is coordinating this goal.`;
     const card = store.appendMessage(threadId, {
@@ -61400,7 +61602,7 @@ Adds one line to the prompt index; the body is read only when used.${warnings}`,
   };
 }
 function appendSkillRequestCard(args) {
-  const requestId = randomUUID16();
+  const requestId = randomUUID17();
   const copy = skillCardCopy(args.staged);
   const payload = {
     version: 1,
@@ -61506,7 +61708,7 @@ function resolveSkillRequest(args) {
       error: "reviewedSha256 must match the skill shown on the approval card"
     };
   }
-  const previewSha256 = createHash23("sha256").update(request.preview).digest("hex");
+  const previewSha256 = createHash24("sha256").update(request.preview).digest("hex");
   if (previewSha256 !== request.sha256) {
     return { claimed: true, status: 422, error: "the skill preview changed after review \u2014 deny and recreate it" };
   }
@@ -61884,7 +62086,7 @@ bus.subscribe((event) => {
   }
 });
 async function testCliBinary(cli, driver) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve11) => {
     execCli(
       cli,
       ["--version"],
@@ -61903,10 +62105,10 @@ async function testCliBinary(cli, driver) {
           const exceededBuffer = e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
           const isSpawnError = typeof e.code === "string" && !exceededBuffer;
           const message3 = exceededBuffer ? "CLI test produced more than 64 KiB of output" : isSpawnError ? describeSpawnFailure(e, cli).message : e.killed ? "CLI test timed out after 10s" : `CLI exited with error ${String(e.code)}: ${(stderrOf2(err) || "").slice(0, 200) || err.message.split("\n")[0]}`;
-          resolve10({ ok: false, message: message3, ...driver?.install && isSpawnError ? { install: driver.install } : {} });
+          resolve11({ ok: false, message: message3, ...driver?.install && isSpawnError ? { install: driver.install } : {} });
           return;
         }
-        resolve10({ ok: true, version: stdout.trim().split("\n")[0] });
+        resolve11({ ok: true, version: stdout.trim().split("\n")[0] });
       }
     );
   });
@@ -61963,7 +62165,7 @@ async function readyLocalVmForTurn(botId, target) {
   localVmIdleFor(target).touch();
   const deadline = Date.now() + LOCAL_VM_DESKTOP_WAIT_MS;
   while (!status.ready && status.container === "running" && Date.now() < deadline) {
-    await new Promise((resolve10) => setTimeout(resolve10, 2e3));
+    await new Promise((resolve11) => setTimeout(resolve11, 2e3));
     status = await containerComputerStatus(void 0, void 0, target);
   }
   return status;
@@ -61979,7 +62181,7 @@ async function perBotLocalVmCountForModeChange() {
   if (targets.length === 0) return 0;
   const runtime = await containerRuntimeStatus();
   if (!runtime.runtime || !runtime.daemonUp) {
-    return targets.some((target) => existsSync24(target.workspaceDir)) ? null : 0;
+    return targets.some((target) => existsSync25(target.workspaceDir)) ? null : 0;
   }
   return existingPerBotLocalVmCount(runtime.runtime);
 }
@@ -62011,6 +62213,9 @@ function configStatus() {
       showToolCalls: showToolCallsEnabled(cfg),
       browser: builtInBrowserEnabled(cfg)
     },
+    // Which browser this server can give bots: the desktop app's surface,
+    // the agent-browser engine, or nothing yet (with the reason).
+    browserEngine: browserEngineSummary(),
     // partitionId is non-secret routing metadata. The renderer needs it to
     // show the same durable session as an agent, but config PATCH validation
     // keeps it read-only and rejects callers that try to choose it.
@@ -62064,15 +62269,15 @@ var claudeUpdatesInFlight = /* @__PURE__ */ new Set();
 function serveStatic(res, path) {
   if (!STATIC_DIR) return false;
   const safe = path === "/" ? "/index.html" : path.replace(/\.\./g, "");
-  const file2 = join48(STATIC_DIR, safe);
+  const file2 = join49(STATIC_DIR, safe);
   try {
-    const data = readFileSync37(file2);
+    const data = readFileSync38(file2);
     res.writeHead(200, { "content-type": MIME[extname5(file2)] ?? "application/octet-stream" });
     res.end(data);
     return true;
   } catch {
     try {
-      const data = readFileSync37(join48(STATIC_DIR, "index.html"));
+      const data = readFileSync38(join49(STATIC_DIR, "index.html"));
       res.writeHead(200, { "content-type": "text/html" });
       res.end(data);
       return true;
@@ -62087,7 +62292,7 @@ function json3(res, status, body) {
   res.end(data);
 }
 function readBody(req, limit = 1e6) {
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     let data = "";
     let bytes = 0;
     let done = false;
@@ -62114,7 +62319,7 @@ function readBody(req, limit = 1e6) {
         return fail2(400, "invalid JSON body");
       }
       done = true;
-      resolve10(body);
+      resolve11(body);
     });
     req.on("error", (e) => fail2(400, e instanceof Error ? e.message : String(e)));
   });
@@ -62917,7 +63122,7 @@ var handleRequest = async (req, res) => {
             description: `${reason ? `${target.description} ${reason}` : target.description} ${from.name} can use it but never read it back.`,
             placeholder: target.placeholder,
             helpUrl: target.helpUrl,
-            requestKey: randomUUID16()
+            requestKey: randomUUID17()
           }
         });
         return json3(res, 201, { messageId: message3.id, label: target.label });
@@ -63365,7 +63570,7 @@ data: ${JSON.stringify({ kind: "ping" })}
         req.resume();
         return json3(res, 413, { error: `image exceeds ${IMAGE_MAX_BYTES2} bytes` });
       }
-      const saved = await new Promise((resolve10, reject) => {
+      const saved = await new Promise((resolve11, reject) => {
         const chunks = [];
         let received = 0;
         let settled = false;
@@ -63384,7 +63589,7 @@ data: ${JSON.stringify({ kind: "ping" })}
           if (settled) return;
           settled = true;
           try {
-            resolve10(await saveImageUpload(Buffer.concat(chunks), mime, uploadId));
+            resolve11(await saveImageUpload(Buffer.concat(chunks), mime, uploadId));
           } catch (e) {
             reject(e instanceof Error ? e : new Error(String(e)));
           }
@@ -64020,7 +64225,7 @@ data: ${JSON.stringify({ kind: "ping" })}
       for (const threadId of threadIds) {
         for (const dir of [EVENTS_DIR, NATIVE_DIR]) {
           try {
-            unlinkSync9(join48(dir, `${threadId}.ndjson`));
+            unlinkSync9(join49(dir, `${threadId}.ndjson`));
           } catch {
           }
         }
@@ -64661,7 +64866,7 @@ data: ${JSON.stringify({ kind: "ping" })}
             return json3(res, 409, { error: "stop this bot's Local VM turn or setup action before deleting the bot" });
           }
           const vm = await containerComputerStatus(void 0, void 0, target);
-          if (!vm.daemonUp && existsSync24(target.workspaceDir)) {
+          if (!vm.daemonUp && existsSync25(target.workspaceDir)) {
             return json3(res, 409, {
               error: "start the container runtime and delete this bot's Local VM before deleting the bot"
             });
@@ -64747,7 +64952,7 @@ data: ${JSON.stringify({ kind: "ping" })}
         }
         for (const dir of [EVENTS_DIR, NATIVE_DIR]) {
           try {
-            unlinkSync9(join48(dir, `${bot.threadId}.ndjson`));
+            unlinkSync9(join49(dir, `${bot.threadId}.ndjson`));
           } catch {
           }
         }
@@ -66520,6 +66725,9 @@ var gracefulShutdown = createGracefulShutdown({
 for (const signal of ["SIGINT", "SIGTERM"]) {
   process.on(signal, gracefulShutdown);
 }
+export {
+  browserEngineSummary
+};
 /*! Bundled license information:
 
 @hpke/common/esm/src/curve/modular.js: