openmausbot 0.1.58 → 0.1.60

package/dist-server/server/index.js

@@ -11,7 +11,7 @@ import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 import { approvalModeFor, supportsApprovalMode, requiresNativeApproval, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldReason, approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
+import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
 import { requestReview, resolveAutoReviewMode, shouldReview } from "./auto-review.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
@@ -84,8 +84,8 @@ import { redactSecretsInText } from "./redact.js";
 import * as vps from "./vps-computer.js";
 import { RoutineManager } from "./routines.js";
 import { CalendarCallManager } from "./calendar-calls.js";
-import { BUILT_IN_BROWSER_SYSTEM_PROMPT, applyDesktopBrowserConnectionMessage, availableBrowserConnection, browserScreenshot, clearBrowserCapabilities, registerBrowserCapability, revokeBrowserCapability, } from "./browser-connection.js";
-import { agentBrowserIntegration, browserEngineEncryptionKey, browserEngineStatus, browserSessionId, describeBrowserEngine, } from "./browser-engine.js";
+import { BUILT_IN_BROWSER_SYSTEM_PROMPT } from "./browser-engine.js";
+import { agentBrowserIntegration, browserEngineEncryptionKey, clearBrowserSessionState, ensureChrome, installAgentBrowserBinary, resolveAgentBrowserBinary, browserEngineStatus, browserSessionId, describeBrowserEngine, } from "./browser-engine.js";
 import { captureOutsideHumanControl } from "./private-screen-capture.js";
 import { screenFrameHash, screenTouchingTool, settledFrameIsNews } from "./screen-frame-gate.js";
 import { RoutineRequestService } from "./routine-requests.js";
@@ -203,9 +203,40 @@ function applyDesktopMutationTokenMessage(raw) {
     }
     return true;
 }
+// Browser data of a deleted bot or profile: the engine's saved session
+// state, cleared here on every host (the desktop no longer owns a browser).
+// The coordinator keeps its durable journal and replay; this is its outbox.
 const browserCleanup = new BrowserCleanupCoordinator({
     file: join(DATA_DIR, "browser-cleanups.json"),
-    send: postDesktopPrivateMessage,
+    send: (request) => {
+        const status = browserEngineStatus();
+        // Guest sessions are throwaway and never saved, so only the bot's own
+        // session and shared profile sessions have state to clear.
+        const sessions = request.type === "openmausbot:browser-bot-deleted" && request.botId
+            ? [browserSessionId(request.botId, "")]
+            : request.partitionId
+                ? [browserSessionId("", request.partitionId)]
+                : [];
+        // Failed erasure leaves the committed intent pending for retry; it must
+        // never acknowledge that saved state was removed when it was not.
+        const work = status.kind === "ready" && sessions.length
+            ? Promise.all(sessions.map(async (session) => {
+                const ok = await clearBrowserSessionState(status.binaryPath, session, { encryptionKey: browserEngineEncryptionKey() });
+                if (!ok)
+                    console.warn(`browser cleanup: could not clear the engine's saved state for session ${session}; clear it with \`agent-browser --session ${session} state clear --all\``);
+                return ok;
+            }))
+            : Promise.resolve([true]);
+        void work.then((results) => results.every(Boolean), (error) => {
+            console.warn("browser cleanup: could not clear saved session state", error);
+            return false;
+        }).then((ok) => {
+            browserCleanup.receive({ type: "openmausbot:browser-lifecycle-result", requestId: request.requestId, ok });
+        }).catch((error) => {
+            console.warn("browser cleanup: could not acknowledge cleanup", error);
+        });
+        return true;
+    },
 });
 const phoneSecrets = new PhoneSecretBridge(postDesktopPrivateMessage);
 utilityParentPort?.on("message", (event) => {
@@ -219,8 +250,7 @@ utilityParentPort?.on("message", (event) => {
             return;
         if (phoneSecrets.receive(message))
             return;
-        if (!applyDesktopBrowserConnectionMessage(message))
-            composio.applyManagedBrokerMessage(message);
+        composio.applyManagedBrokerMessage(message);
     }
     catch (error) {
         console.error(`[desktop-sync] rejected private parent message: ${error instanceof Error ? error.message : String(error)}`);
@@ -300,10 +330,8 @@ function revokeInternalCapabilityForProviderEvent(event) {
  * length; only capabilities for currently active turns are retained. */
 function authorizedInternalCapability(header) {
     const got = Buffer.from(Array.isArray(header) ? "" : (header ?? ""));
-    const now = Date.now();
     for (const [token, capability] of internalCapabilities) {
-        if (capability.orphanExpiresAt <= now ||
-            activeInternalGenerationByThread.get(capability.threadId) !== capability.generation) {
+        if (!internalCapabilityIsActive(capability)) {
             internalCapabilities.delete(token);
             continue;
         }
@@ -314,6 +342,12 @@ function authorizedInternalCapability(header) {
     return null;
 }
 function internalCapabilityIsActive(capability) {
+    if (capability.localVmTarget) {
+        const owner = localVmLeaseFor(capability.localVmTarget).current(localVmOwnerBusy);
+        if (localVmThreadTargets.get(capability.threadId) !== capability.localVmTarget ||
+            owner?.threadId !== capability.threadId || owner.botId !== capability.botId)
+            return false;
+    }
     return (capability.orphanExpiresAt > Date.now() &&
         activeInternalGenerationByThread.get(capability.threadId) === capability.generation);
 }
@@ -368,84 +402,6 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation) {
         },
     };
 }
-const browserCapabilitiesByThread = new Map();
-const pendingBrowserCapabilityRevocations = new Map();
-const BROWSER_REVOCATION_RETRY_MS = [250, 1_000, 3_000, 10_000, 30_000];
-async function revokeReleasedBrowserCapability(active, attempt = 0) {
-    const token = active.capability.token;
-    try {
-        await revokeBrowserCapability(active.connection, active.capability);
-        const pending = pendingBrowserCapabilityRevocations.get(token);
-        if (pending)
-            clearTimeout(pending.timer);
-        pendingBrowserCapabilityRevocations.delete(token);
-    }
-    catch (error) {
-        if (Date.now() >= active.capability.expiresAt) {
-            pendingBrowserCapabilityRevocations.delete(token);
-            return;
-        }
-        if (attempt === 0) {
-            console.error(`[browser] could not revoke turn capability; retrying until its absolute expiry: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        const delay = Math.min(BROWSER_REVOCATION_RETRY_MS[Math.min(attempt, BROWSER_REVOCATION_RETRY_MS.length - 1)], Math.max(1, active.capability.expiresAt - Date.now()));
-        const timer = setTimeout(() => {
-            const pending = pendingBrowserCapabilityRevocations.get(token);
-            if (!pending || pending.timer !== timer)
-                return;
-            void revokeReleasedBrowserCapability(active, attempt + 1);
-        }, delay);
-        timer.unref?.();
-        const previous = pendingBrowserCapabilityRevocations.get(token);
-        if (previous)
-            clearTimeout(previous.timer);
-        pendingBrowserCapabilityRevocations.set(token, { active, attempt: attempt + 1, timer });
-    }
-}
-async function releaseBrowserCapabilityForThread(threadId, expectedOwnerId) {
-    const active = browserCapabilitiesByThread.get(threadId);
-    if (!active || (expectedOwnerId !== undefined && active.ownerId !== expectedOwnerId))
-        return;
-    browserCapabilitiesByThread.delete(threadId);
-    await revokeReleasedBrowserCapability(active);
-}
-async function releaseBrowserCapabilitiesForBot(botId) {
-    const threads = [...browserCapabilitiesByThread]
-        .filter(([, active]) => active.botId === botId)
-        .map(([threadId]) => threadId);
-    await Promise.all(threads.map((threadId) => releaseBrowserCapabilityForThread(threadId)));
-}
-async function releaseAllBrowserCapabilities() {
-    const active = [...browserCapabilitiesByThread.values()];
-    browserCapabilitiesByThread.clear();
-    const connections = new Map();
-    for (const entry of active) {
-        connections.set(`${entry.connection.url}:${entry.connection.token}`, entry.connection);
-    }
-    for (const pending of pendingBrowserCapabilityRevocations.values()) {
-        connections.set(`${pending.active.connection.url}:${pending.active.connection.token}`, pending.active.connection);
-    }
-    await Promise.all([...connections.values()].map(async (connection) => {
-        try {
-            // Master clear is atomic at the host. It also invalidates a token whose
-            // earlier per-turn revoke timed out, which is essential for feature-off
-            // and graceful-shutdown boundaries.
-            await clearBrowserCapabilities(connection);
-            for (const [token, pending] of pendingBrowserCapabilityRevocations) {
-                if (pending.active.connection.url === connection.url &&
-                    pending.active.connection.token === connection.token) {
-                    clearTimeout(pending.timer);
-                    pendingBrowserCapabilityRevocations.delete(token);
-                }
-            }
-        }
-        catch {
-            await Promise.all(active
-                .filter((entry) => entry.connection.url === connection.url && entry.connection.token === connection.token)
-                .map((entry) => revokeReleasedBrowserCapability(entry)));
-        }
-    }));
-}
 class DirectTurnSetupCancelled extends Error {
 }
 const directTurnDispatchClaims = new Map();
@@ -540,55 +496,10 @@ function cancelDirectTurnDispatch(botId, expectedThreadId) {
     // start early enough for those old events to settle the replacement.
     return claim;
 }
-async function browserIntegration(botId, profile, threadId, generation, stillValid = () => true, ownerId = randomUUID()) {
-    const connection = availableBrowserConnection();
-    if (!connection)
-        return engineBrowserIntegration(botId, profile);
-    const control = controlIntegration(botId, threadId, generation);
-    // A profile that no longer exists falls back to the bot's own session.
-    // Canonical ids belong to config/bot references; Electron must receive the
-    // exact immutable partition inherited from #567 so an upgrade cannot move
-    // a bot into another account. Guest remains a throwaway partition.
-    const profileTarget = profile && profile !== "guest"
-        ? browserProfilePartitionTarget(cfg, profile)
-        : null;
-    const partitionId = profile === "guest" ? "guest" : (profileTarget?.partitionId ?? "");
-    await releaseBrowserCapabilityForThread(threadId);
-    const capability = await registerBrowserCapability(connection, botId, partitionId);
-    const active = { botId, ownerId, connection, capability };
-    // Registration crosses a process boundary. Stop/delete/config changes can
-    // land while the desktop host is minting the token; revalidate in the same
-    // event-loop turn that publishes it. If ownership was lost, no agent ever
-    // receives the bearer and the just-created token is revoked immediately.
-    if (!stillValid()) {
-        await revokeReleasedBrowserCapability(active);
-        return null;
-    }
-    browserCapabilitiesByThread.set(threadId, active);
-    return {
-        connection,
-        capability,
-        profile: partitionId,
-        integration: {
-            command: process.execPath,
-            args: [SPAWNED_PROXIES.browser],
-            env: {
-                ...AGENTS_NODE_FLAG,
-                OMB_BROWSER_URL: connection.url,
-                OMB_BROWSER_TOKEN: capability.token,
-                OMB_BROWSER_PROFILE: partitionId,
-                OMB_BOT_ID: botId,
-                OMB_CONTROL_URL: control.url,
-                OMB_CONTROL_TOKEN: control.token,
-            },
-        },
-    };
-}
-/** No desktop surface (a server, or a Windows desktop): the bot's browser is
- * agent-browser, one isolated session per profile or per bot
- * (docs/plans/browser-engine.md). Returns null, with the reason logged once,
- * when the engine is not on this machine. */
-function engineBrowserIntegration(botId, profile) {
+/** The bot's browser for this turn: agent-browser, one isolated session per
+ * browser profile or per bot (docs/plans/browser-engine.md). Null, with the
+ * reason logged once, when the engine is not on this machine. */
+function browserIntegration(botId, profile) {
     const status = browserEngineStatus();
     if (status.kind !== "ready") {
         if (!engineUnavailableLogged) {
@@ -597,12 +508,11 @@ function engineBrowserIntegration(botId, profile) {
         }
         return null;
     }
+    // A profile that no longer exists falls back to the bot's own session.
     const profileTarget = profile && profile !== "guest" ? browserProfilePartitionTarget(cfg, profile) : null;
     const partitionId = profile === "guest" ? "guest" : (profileTarget?.partitionId ?? "");
     const session = browserSessionId(botId, partitionId);
     return {
-        connection: null,
-        capability: null,
         profile: partitionId,
         integration: agentBrowserIntegration({
             binaryPath: status.binaryPath,
@@ -613,13 +523,14 @@ function engineBrowserIntegration(botId, profile) {
     };
 }
 let engineUnavailableLogged = false;
+let browserEngineInstall = null;
+let browserEngineInstallError = null;
 export function browserEngineSummary() {
-    if (availableBrowserConnection())
-        return { kind: "desktop" };
     const status = browserEngineStatus();
+    const progress = { ...(browserEngineInstall ? { installing: true } : {}), ...(browserEngineInstallError ? { installError: browserEngineInstallError } : {}) };
     return status.kind === "ready"
-        ? { kind: "headless", version: status.version }
-        : { kind: "unavailable", reason: status.reason, installable: status.installable };
+        ? { kind: "engine", version: status.version, ...progress }
+        : { kind: "unavailable", reason: status.reason, installable: status.installable, ...progress };
 }
 function phoneIntegration() {
     const env = { ...AGENTS_NODE_FLAG };
@@ -680,7 +591,7 @@ const routineRequestEnvelopeSchema = z.discriminatedUnion("action", [
     ...["pause", "resume", "run_now", "delete"].map((action) => z.object({ ...routineRequestSourceSchema, action: z.literal(action), routineId: z.unknown() }).strict()),
 ]);
 /** The loopback endpoint a bot's computer proxy polls before acting. */
-function controlIntegration(botId, threadId, generation) {
+function controlIntegration(botId, threadId, generation, localVmTarget) {
     return {
         url: `http://127.0.0.1:${PORT}/api/internal/computer-control?botId=${encodeURIComponent(botId)}`,
         token: mintInternalCapability({
@@ -689,6 +600,7 @@ function controlIntegration(botId, threadId, generation) {
             generation,
             depth: 0,
             kind: "computer",
+            ...(localVmTarget ? { localVmTarget } : {}),
             skillAuthoring: false,
             createdBots: 0,
         }),
@@ -1959,7 +1871,9 @@ const watchdog = new TurnWatchdog({
     stallMs: TURN_STALL_MS,
     checkMs: 60_000,
     onStall: (turn) => {
-        void releaseBrowserCapabilityForThread(turn.threadId);
+        // Room targets carry an invocation identity; only those claims belong
+        // to the room grace cleanup added here.
+        const stalledVmTarget = groupSpeakers.has(turn.threadId) ? localVmThreadTargets.get(turn.threadId) : undefined;
         revokeInternalCapabilitiesForThread(turn.threadId);
         repeats.settle(turn.threadId);
         const bot = store.bot(turn.botId);
@@ -1988,6 +1902,9 @@ const watchdog = new TurnWatchdog({
                 retry.unref?.();
                 return;
             }
+            if (stalledVmTarget && localVmThreadTargets.get(turn.threadId) === stalledVmTarget) {
+                releaseLocalVmThread(turn.threadId);
+            }
             const group = store.groupByThread(turn.threadId);
             const speaker = groupSpeakers.get(turn.threadId);
             if (group && group.busyBotId === turn.botId && speaker?.botId === turn.botId) {
@@ -2083,7 +2000,6 @@ bus.subscribe((event) => {
         watchdog.setWaitingOnHuman(event.threadId, false);
     else if (event.type === "turn.completed") {
         watchdog.settle(event.threadId);
-        void releaseBrowserCapabilityForThread(event.threadId);
         revokeInternalCapabilityForProviderEvent(event);
     }
     else if (event.type === "session.exited") {
@@ -2093,7 +2009,6 @@ bus.subscribe((event) => {
         const directBotBusy = store.botByThread(event.threadId)?.busy === true;
         const roomBusy = Boolean(store.groupByThread(event.threadId)?.busyBotId);
         if (!directBotBusy && !roomBusy) {
-            void releaseBrowserCapabilityForThread(event.threadId);
         }
     }
     else
@@ -2552,18 +2467,23 @@ bus.subscribe((event) => {
             // the guards in auto-approve.ts; explicitly acknowledged Full does not.
             const asker = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id) : false;
+            const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId)) : "ask";
             const verdict = permission && asker && event.requestId
                 ? autoVerdict({
                     // the same origin the dispatch used, so a peer-started turn's
                     // residual asks are judged as Approve for me here too
-                    approvalMode: approvalModeForTurn(asker, isInternalTurn(event.threadId)),
+                    approvalMode: effectiveApprovalMode,
                     autoApprove: false,
                     alwaysAllow: asker.alwaysAllow,
                 }, event.tool, event.summary, {
                     unattended,
                     scope: event.approvalScope,
                     requiresExplicitApproval: event.requiresExplicitApproval,
-                    nativeApproval: requiresNativeApproval(event.provider, approvalModeForTurn(asker)),
+                    // Antigravity's residual asks must use a peer-started turn's
+                    // effective safe Auto mode, not its durable Full grant.
+                    // Preserve the existing policy of every other provider.
+                    nativeApproval: requiresNativeApproval(event.provider, event.provider === "antigravityAgent"
+                        ? effectiveApprovalMode : approvalModeForTurn(asker)),
                 })
                 : null;
             if (verdict?.approve && asker && event.requestId) {
@@ -2621,9 +2541,12 @@ bus.subscribe((event) => {
                                     scope: event.approvalScope,
                                     requiresExplicitApproval: event.requiresExplicitApproval,
                                 }),
-                                held: verdict.source === "full-access"
-                                    ? "Full access couldn't deliver this approval."
-                                    : "Approve for me couldn't answer this one.",
+                                held: HELD_NOTE[verdict.source === "full-access"
+                                    ? "approval.held.undeliveredFull"
+                                    : "approval.held.undelivered"],
+                                heldCode: verdict.source === "full-access"
+                                    ? "approval.held.undeliveredFull"
+                                    : "approval.held.undelivered",
                                 approvalScope: event.approvalScope,
                             },
                         });
@@ -2643,6 +2566,18 @@ bus.subscribe((event) => {
                 })();
                 break;
             }
+            // A card can outlive the bot record that raised it. Without one there is
+            // no mode to explain, but the sandbox note still applies.
+            const heldContext = {
+                source: verdict?.source,
+                permission,
+                requiresExplicitApproval: event.requiresExplicitApproval,
+                mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
+                unattended: Boolean(unattended),
+                fullAccessAvailable: asker && !isInternalTurn(event.threadId)
+                    ? supportsApprovalMode(registry.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full")
+                    : false,
+            };
             const message = pushMessage({
                 role: "bot",
                 kind: "options",
@@ -2665,18 +2600,10 @@ bus.subscribe((event) => {
                             requiresExplicitApproval: event.requiresExplicitApproval,
                         })
                         : undefined,
-                    // A card can outlive the bot record that raised it. Without one
-                    // there is no mode to explain, but the sandbox note still applies.
-                    held: approvalHeldReason({
-                        source: verdict?.source,
-                        permission,
-                        requiresExplicitApproval: event.requiresExplicitApproval,
-                        mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
-                        unattended: Boolean(unattended),
-                        fullAccessAvailable: asker && !isInternalTurn(event.threadId)
-                            ? supportsApprovalMode(registry.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full")
-                            : false,
-                    }),
+                    // The text stays for cards saved before heldCode existed, and for
+                    // clients that do not know the key yet.
+                    held: approvalHeldReason(heldContext),
+                    heldCode: approvalHeldNote(heldContext),
                     approvalScope: event.approvalScope,
                 },
             });
@@ -3949,13 +3876,7 @@ async function startTurn(botId, text, opts) {
                 liveBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true) {
                 const selectedProfile = liveBot.browserProfile;
-                browser = await browserIntegration(bot.id, selectedProfile, threadId, dispatchClaimId, () => {
-                    const current = store.bot(bot.id);
-                    return (directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId) &&
-                        builtInBrowserEnabled(cfg) &&
-                        current?.browser !== false &&
-                        current?.browserProfile === selectedProfile);
-                }, dispatchClaimId);
+                browser = browserIntegration(bot.id, selectedProfile);
                 if (browser)
                     integrations.browser = browser.integration;
             }
@@ -4040,10 +3961,6 @@ async function startTurn(botId, text, opts) {
             // after its own turn.completed would never be torn down — it would
             // keep polling the box forever, carrying dead per-turn state. busy
             // is flipped false in the fold, so it is the honest "still running".
-            if (!previewCapture && browser?.connection && browser.capability) {
-                const { connection, capability } = browser;
-                previewCapture = () => browserScreenshot(connection, capability, fetch);
-            }
             if (previewCapture && store.bot(bot.id)?.busy) {
                 startScreenPoller(bot.id, previewCapture, { screenIsTheWork: instance.driverKind === "boxAgent" });
             }
@@ -4058,7 +3975,6 @@ async function startTurn(botId, text, opts) {
             clearCancelledProviderHandshake(threadId, `direct:${dispatchClaimId}`);
             clearDirectTurnDispatch(bot.id, dispatchClaimId);
             revokeInternalCapabilityGeneration(threadId, dispatchClaimId);
-            await releaseBrowserCapabilityForThread(threadId, dispatchClaimId);
             const ownsLatestGeneration = directTurnGenerationByBot.get(bot.id) === dispatchClaimId;
             if (ownsLatestGeneration) {
                 releaseLocalVmThread(threadId);
@@ -4222,7 +4138,6 @@ async function interruptRoutineGroupGoal(groupId, threadId, outcome) {
     const bot = speaker ? store.bot(speaker.botId) : undefined;
     cancelGroupTurnOperations(groupId, threadId, outcome);
     revokeInternalCapabilitiesForThread(threadId);
-    await releaseBrowserCapabilityForThread(threadId);
     await (bot ? registry.get(bot.modelSelection.instanceId) : undefined)
         ?.adapter.interruptTurn(threadId)
         .catch(() => { });
@@ -4251,7 +4166,6 @@ async function stopBotForEmergencyApprovalDowngrade(botId) {
         revokeInternalCapabilitiesForThread(groupTurn.threadId);
         cancelGroupTurnOperations(groupTurn.group.id, groupTurn.threadId);
         const results = await Promise.allSettled([
-            releaseBrowserCapabilityForThread(groupTurn.threadId),
             registry.get(bot.modelSelection.instanceId)?.adapter.interruptTurn(groupTurn.threadId),
         ]);
         closeOpenApprovals(groupTurn.threadId);
@@ -4264,7 +4178,6 @@ async function stopBotForEmergencyApprovalDowngrade(botId) {
     const threadId = directClaim?.threadId ?? bot.threadId;
     revokeInternalCapabilitiesForThread(threadId);
     const results = await Promise.allSettled([
-        releaseBrowserCapabilityForThread(threadId),
         registry.get(bot.modelSelection.instanceId)?.adapter.interruptTurn(threadId),
     ]);
     closeOpenApprovals(threadId);
@@ -4318,7 +4231,6 @@ routines = new RoutineManager({
                 ? registry.get(bot.modelSelection.instanceId)
                 : null;
         try {
-            await releaseBrowserCapabilityForThread(threadId);
             await instance?.adapter.interruptTurn(threadId);
         }
         finally {
@@ -4730,6 +4642,15 @@ setupRetry = 0) {
         return true;
     }
     const internalGeneration = beginInternalCapabilityGeneration(threadId);
+    let roomVmTarget = null;
+    let retainRoomVmLease = false;
+    let roomSpeaker;
+    let providerDispatched = false;
+    const releaseRoomVmLease = () => {
+        if (roomVmTarget && localVmThreadTargets.get(threadId) === roomVmTarget)
+            releaseLocalVmThread(threadId);
+        roomVmTarget = null;
+    };
     try {
         const integrations = {};
         const skillAuthoring = skillRecorderEnabled(cfg) &&
@@ -4879,19 +4800,7 @@ setupRetry = 0) {
             readyBot.browser !== false &&
             instance.adapter.capabilities.browserMcp === true) {
             const selectedProfile = readyBot.browserProfile;
-            const browser = await browserIntegration(readyBot.id, selectedProfile, threadId, internalGeneration, () => {
-                const currentBot = store.bot(readyBot.id);
-                const currentGroup = store.group(readyGroup.id);
-                const stillOwnsThread = currentGroup?.dm
-                    ? currentGroup.threadId === threadId
-                    : Boolean(currentGroup && store.groupTaskByThread(currentGroup.id, threadId));
-                return (!isCancelled?.() &&
-                    stillOwnsThread &&
-                    currentBot?.busy === true &&
-                    builtInBrowserEnabled(cfg) &&
-                    currentBot.browser !== false &&
-                    currentBot.browserProfile === selectedProfile);
-            });
+            const browser = browserIntegration(readyBot.id, selectedProfile);
             if (browser)
                 integrations.browser = browser.integration;
         }
@@ -4900,7 +4809,6 @@ setupRetry = 0) {
         // room's setup claim so no provider turn starts after Stop returned.
         const browserReadyBot = store.bot(readyBot.id);
         if (isCancelled?.() || !browserReadyBot || !browserReadyBot.busy) {
-            await releaseBrowserCapabilityForThread(threadId);
             if (browserReadyBot?.busy) {
                 store.setActivity(browserReadyBot.id, "idle");
                 retryDelegationsWaitingOn(browserReadyBot.id);
@@ -4908,7 +4816,44 @@ setupRetry = 0) {
             return false;
         }
         store.patchGroup(readyGroup.id, { busyBotId: bot.id }); // the store's change stream carries the frame
-        groupSpeakers.set(threadId, { botId: bot.id, name: bot.name, color: bot.color });
+        roomSpeaker = { botId: bot.id, name: bot.name, color: bot.color };
+        groupSpeakers.set(threadId, roomSpeaker);
+        // Room and Goal turns use the speaker's desktop, never the coordinator's.
+        // Claim the same lease as direct turns before asynchronous VM setup.
+        if (readyBot.computer === "vm") {
+            if (instance.adapter.capabilities.computerMcp !== true || instance.driverKind === "boxAgent") {
+                throw new Error("this model engine cannot use the Local VM");
+            }
+            // A distinct identity fences cleanup even in shared mode on the same room thread.
+            const target = { ...localVmTargetForBot(readyBot.id) };
+            if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
+                throw new Error("this Local VM is being started, stopped, or replaced");
+            }
+            if (!localVmLeaseFor(target).claim(threadId, readyBot.id, localVmOwnerBusy)) {
+                throw new Error("this Local VM is already being used by another turn");
+            }
+            roomVmTarget = target;
+            localVmThreadTargets.set(threadId, target);
+            localVmActiveThreads.set(target.key, threadId);
+            localVmIdleFor(target).touch();
+            const setupIsCurrent = () => !isCancelled?.() &&
+                groupSpeakers.get(threadId) === roomSpeaker &&
+                activeInternalGenerationByThread.get(threadId) === internalGeneration &&
+                store.group(readyGroup.id)?.memberIds.includes(readyBot.id) === true &&
+                store.bot(readyBot.id)?.busy === true &&
+                store.group(readyGroup.id)?.busyBotId === readyBot.id;
+            const vm = await readyLocalVmForTurn(readyBot.id, target, setupIsCurrent);
+            if (!setupIsCurrent()) {
+                return false;
+            }
+            if (!vm.ready || !vm.runtime)
+                throw new Error(vm.problem ?? "the Local VM is not ready");
+            const owner = localVmLeaseFor(target).current(localVmOwnerBusy);
+            if (owner?.threadId !== threadId || owner.botId !== readyBot.id) {
+                throw new Error("the Local VM lease expired while preparing the turn");
+            }
+            integrations.localComputer = containerComputerMcp(vm.runtime, controlIntegration(readyBot.id, threadId, internalGeneration, target), target);
+        }
         const roster = readyGroup.memberIds
             .map((id) => store.bot(id))
             .filter((b) => Boolean(b))
@@ -4959,6 +4904,7 @@ setupRetry = 0) {
                 store.patchBot(bot.id, { soulDrift: drift.drift });
         }
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
+            { id: "computer", label: "Computer", text: computerPrompt(roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
@@ -4984,7 +4930,6 @@ setupRetry = 0) {
         if (isCancelled?.() ||
             store.group(group.id)?.busyBotId !== bot.id ||
             store.bot(bot.id)?.busy !== true) {
-            await releaseBrowserCapabilityForThread(threadId);
             if (store.group(group.id)?.busyBotId === bot.id) {
                 groupSpeakers.delete(threadId);
                 store.patchGroup(group.id, { busyBotId: null, unread: true });
@@ -5016,7 +4961,6 @@ setupRetry = 0) {
             let unregisterStall = () => { };
             const deadline = new RoomTurnDeadline(timeoutMinutes, () => {
                 abandonProviderTurn();
-                void releaseBrowserCapabilityForThread(threadId);
                 void instance.adapter.interruptTurn(threadId).catch(() => { });
                 store.appendMessage(threadId, {
                     role: "bot",
@@ -5068,6 +5012,7 @@ setupRetry = 0) {
             });
             watchdog.watch(threadId, bot.id);
             onProviderHandshakeStarted?.();
+            providerDispatched = true;
             guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
                 text,
@@ -5081,7 +5026,6 @@ setupRetry = 0) {
                 // Stop may have landed while the adapter was authenticating, before
                 // it had an active process for the first interrupt to reach. Now that
                 // sendTurn completed setup, revoke again and interrupt the real turn.
-                await releaseBrowserCapabilityForThread(threadId);
                 await instance.adapter.interruptTurn(threadId).catch(() => { });
             })
                 .then((dispatch) => {
@@ -5121,6 +5065,9 @@ setupRetry = 0) {
         // work so a retained proxy from this member cannot act during the next
         // member's generation.
         revokeInternalCapabilityGeneration(threadId, internalGeneration);
+        retainRoomVmLease = outcome === "timed_out" || outcome === "stalled";
+        if (!retainRoomVmLease)
+            releaseRoomVmLease();
         if (orchestration) {
             orchestration.result.replyText = replyText.trim();
             orchestration.result.outcome = outcome;
@@ -5160,6 +5107,7 @@ setupRetry = 0) {
                     retry.unref?.();
                     return;
                 }
+                releaseRoomVmLease();
                 const currentGroup = store.group(group.id);
                 const speaker = groupSpeakers.get(threadId);
                 if (currentGroup?.busyBotId === bot.id && speaker?.botId === bot.id) {
@@ -5195,7 +5143,6 @@ setupRetry = 0) {
         if (outcome === "dispatch_failed") {
             if (skillAuthoring)
                 skillAuthoringClaim.claimed = false;
-            await releaseBrowserCapabilityForThread(threadId);
             // No turn.completed follows a rejected room dispatch. Anything that was
             // queued while this bot briefly owned the room must be retried now.
             drainQueuedSends();
@@ -5255,10 +5202,38 @@ setupRetry = 0) {
         }
         return true;
     }
+    catch (error) {
+        if (providerDispatched || !roomSpeaker)
+            throw error;
+        const message = error instanceof Error ? error.message : "Local VM setup failed";
+        store.appendMessage(threadId, {
+            role: "bot", kind: "activity",
+            from: { botId: bot.id, name: bot.name, color: bot.color },
+            tool: { name: `error: ${message}`, ok: false },
+        });
+        onDispatchError?.(message);
+        if (orchestration)
+            orchestration.result.outcome = "dispatch_failed";
+        return false;
+    }
     finally {
         // Covers connector/setup failures, cancellation before dispatch, and all
         // other early returns that never produce a provider terminal event.
         revokeInternalCapabilityGeneration(threadId, internalGeneration);
+        if (!retainRoomVmLease)
+            releaseRoomVmLease();
+        if (!providerDispatched && roomSpeaker && groupSpeakers.get(threadId) === roomSpeaker) {
+            groupSpeakers.delete(threadId);
+            if (store.group(group.id)?.busyBotId === bot.id)
+                store.patchGroup(group.id, { busyBotId: null });
+            if (store.bot(bot.id)?.busy) {
+                store.setActivity(bot.id, "idle");
+                retryDelegationsWaitingOn(bot.id);
+            }
+            drainQueuedSends();
+            drainConnectorResumes();
+            drainSecretResumes();
+        }
     }
 }
 async function runGroupGoalStep(args) {
@@ -6493,13 +6468,15 @@ async function localVmPayload(target) {
  * instance cap; creating past it would quietly do what the lifecycle route
  * refuses.
  */
-async function readyLocalVmForTurn(botId, target) {
+async function readyLocalVmForTurn(botId, target, isCurrent = () => true) {
     let status = await containerComputerStatus(undefined, undefined, target);
+    if (!isCurrent())
+        return status;
     if (status.ready || !localVmRecreatableOnDemand(status))
         return status;
     if (target.key !== SHARED_LOCAL_VM_TARGET.key) {
         const count = await existingPerBotLocalVmCount(status.runtime);
-        if (count >= localVmMaxInstances(cfg))
+        if (!isCurrent() || count >= localVmMaxInstances(cfg))
             return status;
     }
     broadcast({ kind: "computer", botId, state: "provisioning" });
@@ -6522,8 +6499,10 @@ async function readyLocalVmForTurn(botId, target) {
     // the turn is the whole point: a person who has been away eight hours should
     // not have to send their message twice.
     const deadline = Date.now() + LOCAL_VM_DESKTOP_WAIT_MS;
-    while (!status.ready && status.container === "running" && Date.now() < deadline) {
+    while (isCurrent() && !status.ready && status.container === "running" && Date.now() < deadline) {
         await new Promise((resolve) => setTimeout(resolve, 2_000));
+        if (!isCurrent())
+            break;
         status = await containerComputerStatus(undefined, undefined, target);
     }
     return status;
@@ -6599,7 +6578,6 @@ async function reloadProviders() {
     // one synchronous step before the first teardown await, including room/task
     // threads that are not a bot's default DM.
     revokeAllInternalCapabilities();
-    await releaseAllBrowserCapabilities();
     bus.detachAll();
     await registry.disposeAll();
     await registry.load(instanceConfigs(cfg));
@@ -9257,7 +9235,6 @@ const handleRequest = async (req, res) => {
                 cancelGroupTurnOperations(group.id, threadId);
             for (const { threadId, instance } of interruptTargets) {
                 revokeInternalCapabilitiesForThread(threadId);
-                await releaseBrowserCapabilityForThread(threadId);
                 await instance?.adapter.interruptTurn(threadId).catch(() => { });
                 closeOpenApprovals(threadId);
             }
@@ -9430,7 +9407,7 @@ const handleRequest = async (req, res) => {
                 (!supportsApprovalMode(registry.cliTarget(checked.selection.instanceId)?.driverKind, existingApprovalMode) ||
                     registry.cliTarget(checked.selection.instanceId)?.driverKind !== registry.cliTarget(existing.modelSelection.instanceId)?.driverKind)) {
                 return json(res, 400, {
-                    error: "Changing providers with elevated permissions requires choosing Ask or Auto first",
+                    error: "Changing providers with elevated permissions requires choosing Ask first",
                 });
             }
             // patchBot persists first and emits the canonical bot change, which the
@@ -9682,7 +9659,7 @@ const handleRequest = async (req, res) => {
                 (!targetSelection || !supportsApprovalMode(registry.cliTarget(targetSelection.instanceId)?.driverKind, requestedApprovalMode) ||
                     (existingBot && normalizedSelection && registry.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry.cliTarget(existingBot.modelSelection.instanceId)?.driverKind))) {
                 return json(res, 400, {
-                    error: "This provider does not support the selected approval level, or changing providers requires choosing Ask or Auto first",
+                    error: "This provider does not support the selected approval level, or changing providers requires choosing Ask first",
                 });
             }
             const requiresPrivateApprovalTransition = ((requestedApprovalMode === "full" || requestedApprovalMode === "custom") &&
@@ -9855,7 +9832,6 @@ const handleRequest = async (req, res) => {
                     cancelDirectTurnDispatch(bot.id, routineRun.threadId);
                     if (routineRun.threadId) {
                         revokeInternalCapabilitiesForThread(routineRun.threadId);
-                        await releaseBrowserCapabilityForThread(routineRun.threadId);
                     }
                     await routines.cancelRun(routineRun.id);
                     return;
@@ -9865,7 +9841,6 @@ const handleRequest = async (req, res) => {
                 if (groupTurn) {
                     cancelGroupTurnOperations(groupTurn.group.id, groupTurn.threadId);
                     revokeInternalCapabilitiesForThread(groupTurn.threadId);
-                    await releaseBrowserCapabilityForThread(groupTurn.threadId);
                     await instance?.adapter.interruptTurn(groupTurn.threadId).catch(() => { });
                     closeOpenApprovals(groupTurn.threadId);
                     return;
@@ -9873,7 +9848,6 @@ const handleRequest = async (req, res) => {
                 const directClaim = cancelDirectTurnDispatch(bot.id);
                 const threadId = directClaim?.threadId ?? bot.threadId;
                 revokeInternalCapabilitiesForThread(threadId);
-                await releaseBrowserCapabilityForThread(threadId);
                 await instance?.adapter.interruptTurn(threadId).catch(() => { });
                 closeOpenApprovals(threadId);
             }));
@@ -10000,7 +9974,7 @@ const handleRequest = async (req, res) => {
                 // or unreadable journal therefore rejects the delete with the bot and
                 // all of its live work untouched. The intent is aborted if a later
                 // pre-delete side effect fails, and committed only after Store deletion.
-                const browserCleanupRequest = utilityParentPort ? browserCleanup.prepare("bot", bot.id) : null;
+                const browserCleanupRequest = browserCleanup.prepare("bot", bot.id);
                 try {
                     // a running turn dies with its bot
                     const directClaim = cancelDirectTurnDispatch(bot.id);
@@ -10010,7 +9984,6 @@ const handleRequest = async (req, res) => {
                     // check is revalidated after its body arrives and must fail closed.
                     revokeInternalCapabilitiesForThread(directThreadId);
                     directTurnGenerationByBot.delete(bot.id);
-                    await releaseBrowserCapabilitiesForBot(bot.id);
                     await registry.get(bot.modelSelection.instanceId)?.adapter.interruptTurn(directThreadId).catch(() => { });
                     closeOpenApprovals(directThreadId);
                     // Deletion removes the thread before a late turn.completed can fold
@@ -10771,7 +10744,6 @@ const handleRequest = async (req, res) => {
                 cancelDirectTurnDispatch(bot.id, routineRun.threadId ?? expectedThreadId);
                 if (routineRun.threadId) {
                     revokeInternalCapabilitiesForThread(routineRun.threadId);
-                    await releaseBrowserCapabilityForThread(routineRun.threadId);
                 }
                 await routines.cancelRun(routineRun.id);
                 return json(res, 200, { ok: true });
@@ -10786,7 +10758,6 @@ const handleRequest = async (req, res) => {
                 }
                 cancelGroupTurnOperations(busyGroup.group.id, busyGroup.threadId);
                 revokeInternalCapabilitiesForThread(busyGroup.threadId);
-                await releaseBrowserCapabilityForThread(busyGroup.threadId);
                 await instance?.adapter.interruptTurn(busyGroup.threadId).catch(() => { });
                 closeOpenApprovals(busyGroup.threadId);
                 return json(res, 200, { ok: true });
@@ -10800,7 +10771,6 @@ const handleRequest = async (req, res) => {
             const cancelledDirect = cancelDirectTurnDispatch(bot.id, expectedThreadId);
             const directThreadId = cancelledDirect?.threadId ?? bot.threadId;
             revokeInternalCapabilitiesForThread(directThreadId);
-            await releaseBrowserCapabilityForThread(directThreadId);
             await instance?.adapter.interruptTurn(directThreadId).catch(() => { });
             closeOpenApprovals(directThreadId);
             return json(res, 200, { ok: true });
@@ -11088,6 +11058,26 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && path === "/api/health") {
             return json(res, 200, { app: "openmausbot", pid: process.pid, static: Boolean(STATIC_DIR) });
         }
+        // The bots' browser engine: install it on this machine (agent-browser +
+        // a Chrome for Testing, a one-time download), or ask how that is going.
+        // One install at a time; the config frame's browserEngine tells the rest.
+        if (method === "POST" && path === "/api/browser-engine/install") {
+            if (!browserEngineInstall) {
+                const status = browserEngineStatus();
+                if (status.kind === "unavailable" && !status.installable)
+                    return json(res, 409, { error: status.reason });
+                browserEngineInstallError = null;
+                browserEngineInstall = (async () => {
+                    const binary = resolveAgentBrowserBinary() ?? await installAgentBrowserBinary({ log: (line) => console.log(line) });
+                    await ensureChrome(binary, { log: (line) => console.log(line) });
+                })().then(() => { browserEngineInstallError = null; }, (error) => { browserEngineInstallError = error instanceof Error ? error.message : String(error); }).finally(() => {
+                    browserEngineInstall = null;
+                    broadcast({ kind: "config", ...configStatus() });
+                });
+                broadcast({ kind: "config", ...configStatus() });
+            }
+            return json(res, 202, { installing: true });
+        }
         // Which edition this server runs and why (see server/enterprise.ts). Read-only.
         if (method === "GET" && path === "/api/edition") {
             return json(res, 200, editionStatus());
@@ -11649,13 +11639,11 @@ const handleRequest = async (req, res) => {
                 }
                 const browserCleanupRequests = [];
                 try {
-                    if (utilityParentPort) {
-                        for (const profileId of removedBrowserProfileIds) {
-                            const target = browserProfilePartitionTarget(cfg, profileId);
-                            if (!target)
-                                throw new Error(`browser profile cleanup target “${profileId}” is unavailable`);
-                            browserCleanupRequests.push(browserCleanup.prepare("profile", target.profileId, target.partitionId));
-                        }
+                    for (const profileId of removedBrowserProfileIds) {
+                        const target = browserProfilePartitionTarget(cfg, profileId);
+                        if (!target)
+                            throw new Error(`browser profile cleanup target “${profileId}” is unavailable`);
+                        browserCleanupRequests.push(browserCleanup.prepare("profile", target.profileId, target.partitionId));
                     }
                 }
                 catch (error) {
@@ -11763,7 +11751,6 @@ const handleRequest = async (req, res) => {
                         let mandatoryError = null;
                         if (disablingBuiltInBrowser) {
                             try {
-                                await releaseAllBrowserCapabilities();
                             }
                             catch (error) {
                                 mandatoryError = error;
@@ -12241,7 +12228,6 @@ const gracefulShutdown = createGracefulShutdown({
             webhookIngress?.server.close();
             tunnelListener?.close();
         },
-        () => releaseAllBrowserCapabilities(),
         () => registry.disposeAll(),
         () => flushAllProfileHistory(),
     ],