openmausbot 0.1.65 → 0.1.66

package/dist-server/server/index.js

@@ -14,11 +14,12 @@ import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, is
 import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
 import { requestReview, resolveAutoReviewMode, shouldReview } from "./auto-review.js";
 import { updateClaudeCli } from "./claude-update.js";
+import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
 import * as checkpoints from "./checkpoints.js";
 import { appendDecision, readDecisions } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
-import { ATTACHMENTS_DIR, attachmentExists, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
+import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, snapshotAvatarGenerationState, } from "./avatar-image.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
@@ -32,7 +33,7 @@ import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { peerAllowed, peerName, peerRosterSystemPrompt, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, saveConfig, showToolCallsEnabled, skillRecorderEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, saveConfig, showToolCallsEnabled, skillRecorderEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
 import { ComputerControl } from "./computer-control.js";
 import { MAX_REMOTE_COMMAND_LENGTH } from "./remote-computer.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -87,7 +88,9 @@ import * as vps from "./vps-computer.js";
 import { RoutineManager } from "./routines.js";
 import { CalendarCallManager } from "./calendar-calls.js";
 import { BUILT_IN_BROWSER_SYSTEM_PROMPT } from "./browser-engine.js";
-import { agentBrowserFrame, agentBrowserIntegration, browserEngineEncryptionKey, clearBrowserSessionState, ensureChrome, installAgentBrowserBinary, resolveAgentBrowserBinary, browserEngineStatus, browserSessionId, describeBrowserEngine, } from "./browser-engine.js";
+import { BrowserRuntime } from "./browser-runtime.js";
+import { BrowserLive } from "./browser-live.js";
+import { agentBrowserFrame, agentBrowserIntegration, browserEngineEncryptionKey, prepareBrowserSessionState, clearBrowserSessionState, ensureChrome, installAgentBrowserBinary, resolveAgentBrowserBinary, browserEngineStatus, browserSessionId, describeBrowserEngine, } from "./browser-engine.js";
 import { createScreenFrameSource } from "./screen-frame-source.js";
 import { screenFrameHash, screenSurfaceForTool, screenTouchingTool, settledFrameIsNews } from "./screen-frame-gate.js";
 import { RoutineRequestService } from "./routine-requests.js";
@@ -117,7 +120,7 @@ import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
 import { describeEdition, editionStatus, loadEnterpriseLayer } from "./enterprise.js";
 import { environmentDescriptor, loadEnvironmentId } from "./environment.js";
-import { createCustomDomainVerifier, normalizeCustomDomain } from "./custom-domain.js";
+import { createCustomDomainVerifier, customDomainIpv4, normalizeCustomDomain } from "./custom-domain.js";
 import { ProviderAuthSessions } from "./provider-auth-sessions.js";
 import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, labelFromUserAgent, requestOrigin, requestSource, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
 import { cookieMaxAgeSeconds, formatPairingCode, SessionRegistry } from "./sessions.js";
@@ -191,6 +194,7 @@ function customDomainStatus() {
     return {
         customDomain: savedCustomDomain(), publicUrl: publicUrl(), fallbackUrl: FALLBACK_PUBLIC_URL,
         supported: !DESKTOP_MANAGED, appPort: PORT, webhookPort: WEBHOOK_PORT,
+        serverIpv4: DESKTOP_MANAGED ? null : customDomainIpv4(),
     };
 }
 const registry = new ProviderRegistry(BUILT_IN_DRIVERS);
@@ -248,7 +252,7 @@ const browserCleanup = new BrowserCleanupCoordinator({
             ? Promise.all(sessions.map(async (session) => {
                 const ok = await clearBrowserSessionState(status.binaryPath, session, { encryptionKey: browserEngineEncryptionKey() });
                 if (!ok)
-                    console.warn(`browser cleanup: could not clear the engine's saved state for session ${session}; clear it with \`agent-browser --session ${session} state clear --all\``);
+                    console.warn(`browser cleanup: could not clear saved state for session ${session}; restart OpenMausBot to retry this profile's cleanup. Do not use state clear --all: it erases other profiles too.`);
                 return ok;
             }))
             : Promise.resolve([true]);
@@ -443,10 +447,7 @@ function purgeGeneratedImagesForThread(threadId) {
             continue;
         generatedImagesByTurn.delete(key);
         for (const attachment of attachments) {
-            try {
-                unlinkSync(attachment.path);
-            }
-            catch { }
+            deleteAttachment(attachment.path);
         }
     }
 }
@@ -466,10 +467,7 @@ function retireProviderTurn(turnId) {
             continue;
         generatedImagesByTurn.delete(key);
         for (const attachment of attachments) {
-            try {
-                unlinkSync(attachment.path);
-            }
-            catch { }
+            deleteAttachment(attachment.path);
         }
     }
 }
@@ -524,7 +522,40 @@ function cancelDirectTurnDispatch(botId, expectedThreadId) {
 /** The bot's browser for this turn: agent-browser, one isolated session per
  * browser profile or per bot (docs/plans/browser-engine.md). Null, with the
  * reason logged once, when the engine is not on this machine. */
-function browserIntegration(botId, profile) {
+const browserRuntime = new BrowserRuntime();
+const browserLive = new BrowserLive({ runtime: browserRuntime });
+// Temporary profiles last for this server run, but are never saved to disk.
+// The viewer and the agent must address the SAME temporary browser.
+const temporaryBrowserSessions = new Map();
+function currentBrowserSession(botId, profile) {
+    if (profile === "guest") {
+        let session = temporaryBrowserSessions.get(botId);
+        if (!session) {
+            session = browserSessionId(botId, "guest");
+            temporaryBrowserSessions.set(botId, session);
+        }
+        return session;
+    }
+    const target = profile ? browserProfilePartitionTarget(cfg, profile) : null;
+    return browserSessionId(botId, target?.partitionId ?? "");
+}
+async function forgetTemporaryBrowser(botId) {
+    const session = temporaryBrowserSessions.get(botId);
+    if (!session)
+        return;
+    temporaryBrowserSessions.delete(botId);
+    const engine = browserEngineStatus();
+    if (engine.kind !== "ready")
+        return;
+    const closed = await clearBrowserSessionState(engine.binaryPath, session, {
+        env: { PATH: augmentedPath() }, encryptionKey: browserEngineEncryptionKey(),
+    });
+    if (closed)
+        await browserRuntime.close(session);
+    else
+        console.warn(`temporary browser ${session}: could not close its session; run agent-browser --session ${session} close on this server`);
+}
+async function browserIntegration(botId, profile, turn) {
     const status = browserEngineStatus();
     if (status.kind !== "ready") {
         if (!engineUnavailableLogged) {
@@ -536,17 +567,29 @@ function browserIntegration(botId, profile) {
     // A profile that no longer exists falls back to the bot's own session.
     const profileTarget = profile && profile !== "guest" ? browserProfilePartitionTarget(cfg, profile) : null;
     const partitionId = profile === "guest" ? "guest" : (profileTarget?.partitionId ?? "");
-    const session = browserSessionId(botId, partitionId);
-    return {
-        profile: partitionId,
-        integration: agentBrowserIntegration({
-            binaryPath: status.binaryPath,
-            session,
-            encryptionKey: browserEngineEncryptionKey(),
-            persistent: profile !== "guest",
-            env: { ...process.env, PATH: augmentedPath() },
-        }),
-    };
+    const session = currentBrowserSession(botId, profile);
+    const spec = agentBrowserIntegration({
+        binaryPath: status.binaryPath,
+        session,
+        encryptionKey: browserEngineEncryptionKey(),
+        persistent: profile !== "guest",
+        env: { ...process.env, PATH: augmentedPath() },
+    });
+    await prepareBrowserSessionState(status.binaryPath, session, { env: spec.env, persistent: profile !== "guest", isCurrent: () => {
+            const current = store.bot(botId);
+            return !!current && current.browser !== false && builtInBrowserEnabled(cfg)
+                && currentBrowserSession(current.id, current.browserProfile) === session
+                && (!turn || activeInternalGenerationByThread.get(turn.threadId) === turn.generation);
+        } });
+    if (!turn)
+        return { profile: partitionId, session, spec, integration: spec };
+    const token = mintInternalCapability({ botId, ...turn, browserSession: session,
+        kind: "browser", depth: 0, skillAuthoring: false, createdBots: 0 });
+    return { profile: partitionId, session, spec, integration: {
+            command: process.execPath, args: [SPAWNED_PROXIES.browser], env: {
+                ...AGENTS_NODE_FLAG, OMB_BROWSER_TOKEN: token, OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
+            },
+        } };
 }
 let engineUnavailableLogged = false;
 let browserEngineInstall = null;
@@ -718,6 +761,9 @@ function checkedModelSelection(raw, current, requireAvailableModel = false) {
         return { ok: false, status: 409, error: "the bot is working — stop it before changing models" };
     }
     const target = registry.get(selection.instanceId);
+    if (providerInstancesChanging.has(selection.instanceId)) {
+        return { ok: false, status: 409, error: "this provider account is being updated — try again shortly" };
+    }
     // Model IDs remain free-form at the app's general API boundary. Custom
     // engines can accept IDs that are not in their discovery catalog, and
     // several drivers only learn the final catalog when a turn starts. The
@@ -3434,6 +3480,9 @@ async function startTurn(botId, text, opts) {
     }
     console.error(`[omb-turn] bot=${botId} text=${JSON.stringify(resolvedImages.text.slice(0, 70))} images=${turnImages.length} depth=${commsDepth} card=${Boolean(opts?.cardContinuation)}`);
     const instanceId = instance.instanceId;
+    if (providerInstancesChanging.has(instanceId)) {
+        throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
+    }
     const model = opts?.runOn === "cloud" ? instance.models.default : bot.modelSelection.model;
     // a cloud routine borrows the instance default model, so it borrows no
     // per-bot effort either
@@ -3877,7 +3926,7 @@ async function startTurn(botId, text, opts) {
                 liveBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true) {
                 const selectedProfile = liveBot.browserProfile;
-                browser = browserIntegration(bot.id, selectedProfile);
+                browser = await browserIntegration(bot.id, selectedProfile, { threadId, generation: dispatchClaimId });
                 if (browser)
                     integrations.browser = browser.integration;
                 // The browser lost its frame source when the Electron surface was
@@ -3887,8 +3936,9 @@ async function startTurn(botId, text, opts) {
                 // the work was a web page, because agent-browser runs its own headless
                 // Chrome on the host rather than inside that desktop.
                 if (browser) {
-                    const frame = { binaryPath: browser.integration.command, env: browser.integration.env };
-                    browserCapture = () => agentBrowserFrame(frame);
+                    const frame = { binaryPath: browser.spec.command, env: browser.spec.env };
+                    const session = browser.session;
+                    browserCapture = () => browserRuntime.withAgentAction(session, () => agentBrowserFrame(frame));
                 }
             }
             // A cancelled adapter can be between accepting sendTurn and revealing
@@ -4619,6 +4669,10 @@ setupRetry = 0) {
     const preparedComposio = bot.composio;
     const instance = registry.get(bot.modelSelection.instanceId);
     const userName = cfg.profile?.name?.trim() || "User";
+    if (providerInstancesChanging.has(bot.modelSelection.instanceId)) {
+        onDispatchError?.(`${bot.name}'s provider account is being updated — try again shortly`);
+        return true;
+    }
     if (!instance) {
         const message = `${bot.name}'s model is unavailable`;
         store.appendMessage(threadId, {
@@ -4801,6 +4855,11 @@ setupRetry = 0) {
             return true;
         }
         store.setActivity(bot.id, "working");
+        // Claim cleanup ownership before browser preparation can yield or reject.
+        // The finally block must release exactly this setup, never a newer turn.
+        roomSpeaker = { botId: bot.id, name: bot.name, color: bot.color };
+        groupSpeakers.set(threadId, roomSpeaker);
+        store.patchGroup(readyGroup.id, { busyBotId: bot.id });
         orchestration?.onClaimed?.();
         // Connected-app discovery above can yield for a network round trip. A
         // profile may be removed, or the browser feature switched off, during that
@@ -4811,24 +4870,19 @@ setupRetry = 0) {
             readyBot.browser !== false &&
             instance.adapter.capabilities.browserMcp === true) {
             const selectedProfile = readyBot.browserProfile;
-            const browser = browserIntegration(readyBot.id, selectedProfile);
+            const browser = await browserIntegration(readyBot.id, selectedProfile, { threadId, generation: internalGeneration });
             if (browser)
                 integrations.browser = browser.integration;
         }
-        // Stop/delete may land while Electron is registering the capability. The
-        // callback above prevents publication; this second check also unwinds the
-        // room's setup claim so no provider turn starts after Stop returned.
+        // Stop/delete may land while browser state is being prepared. Capability
+        // publication and this exact claim are both fenced; finally releases only
+        // this setup, so a replacement turn's busy state is never cleared here.
         const browserReadyBot = store.bot(readyBot.id);
-        if (isCancelled?.() || !browserReadyBot || !browserReadyBot.busy) {
-            if (browserReadyBot?.busy) {
-                store.setActivity(browserReadyBot.id, "idle");
-                retryDelegationsWaitingOn(browserReadyBot.id);
-            }
+        if (isCancelled?.() || !browserReadyBot?.busy ||
+            groupSpeakers.get(threadId) !== roomSpeaker ||
+            activeInternalGenerationByThread.get(threadId) !== internalGeneration) {
             return false;
         }
-        store.patchGroup(readyGroup.id, { busyBotId: bot.id }); // the store's change stream carries the frame
-        roomSpeaker = { botId: bot.id, name: bot.name, color: bot.color };
-        groupSpeakers.set(threadId, roomSpeaker);
         // Room and Goal turns use the speaker's desktop, never the coordinator's.
         // Claim the same lease as direct turns before asynchronous VM setup.
         if (readyBot.computer === "vm") {
@@ -6594,6 +6648,41 @@ function persistMcpServers(next) {
     // when an empty section is omitted by an older config file.
     cfg.mcpServers = next;
 }
+async function describeInstances() {
+    const configs = instanceConfigs(cfg);
+    return (await registry.describe()).map((instance) => {
+        const entry = configs[instance.instanceId];
+        if (entry?.driver !== "claudeAgent")
+            return instance;
+        try {
+            const claudeAccount = claudeAccountInfo(instance.instanceId, entry, instance.cli ?? instance.cliDefault ?? "claude");
+            return { ...instance, claudeAccount, install: { ...instance.install, signInCommand: claudeAccount.signInCommand } };
+        }
+        catch {
+            // A malformed saved config remains a repairable shadow, never takes
+            // the model picker down or offers a login for the wrong directory.
+            return { ...instance, install: { ...instance.install, signInCommand: undefined } };
+        }
+    });
+}
+async function persistProviderInstance(instanceId, instances) {
+    saveConfig({ instances }, { replaceInstances: true });
+    cfg.instances = instances;
+    providerAuthSessions.clearInstance(instanceId);
+    bus.detach(instanceId);
+    // No whole-fleet reload: other bots keep their live CLI processes, event
+    // subscriptions and approval capabilities while this one is replaced.
+    if (Object.hasOwn(instances, instanceId)) {
+        await registry.load({ [instanceId]: instanceConfigs(cfg)[instanceId] });
+        const live = registry.get(instanceId);
+        if (live)
+            bus.attach([live]);
+    }
+    else {
+        await registry.dispose(instanceId);
+    }
+    resetPathCache();
+}
 /** Rebuild the provider fleet after a config change so new keys take
  * effect without a server restart (kills any in-flight turns). */
 async function reloadProviders() {
@@ -6634,6 +6723,7 @@ async function reloadProviders() {
 // and reload sequence single-flight so two settings requests cannot drop one
 // another's changes or dispose a fleet while another reload is creating it.
 let providerConfigBusy = false;
+const providerInstancesChanging = new Set();
 let mcpConfigBusy = false;
 const MAX_CONCURRENT_MCP_PROBES = 2;
 let mcpProbesInFlight = 0;
@@ -6944,11 +7034,13 @@ const handleRequest = async (req, res) => {
             if (!internalSender) {
                 return json(res, 401, { error: "unauthorized" });
             }
-            const requiredCapabilityKind = path.startsWith("/api/internal/connectors/")
-                ? "connectors"
-                : path === "/api/internal/computer-control"
-                    ? "computer"
-                    : "agents";
+            const requiredCapabilityKind = path === "/api/internal/browser/mcp"
+                ? "browser"
+                : path.startsWith("/api/internal/connectors/")
+                    ? "connectors"
+                    : path === "/api/internal/computer-control"
+                        ? "computer"
+                        : "agents";
             if (internalCapability.kind !== requiredCapabilityKind) {
                 return json(res, 403, { error: "this internal capability cannot access that service" });
             }
@@ -6992,6 +7084,30 @@ const handleRequest = async (req, res) => {
                     throw Object.assign(new Error("the internal turn capability has expired"), { status: 401 });
                 }
             };
+            if (method === "POST" && path === "/api/internal/browser/mcp") {
+                const body = await readInternalBody();
+                const bot = store.bot(internalCapability.botId);
+                if (!bot || bot.browser === false || !builtInBrowserEnabled(cfg)) {
+                    return json(res, 403, { error: "browser tools are not enabled for this bot" });
+                }
+                const browser = await browserIntegration(bot.id, bot.browserProfile);
+                if (!browser || browser.session !== internalCapability.browserSession) {
+                    return json(res, 409, { error: "this browser profile changed; start a new turn" });
+                }
+                if (body?.method !== "tools/list" && body?.method !== "tools/call") {
+                    return json(res, 400, { error: "unsupported browser method" });
+                }
+                const result = await browserRuntime.agentRpc(browser.session, browser.spec, body.method, body.params, () => {
+                    requireActiveInternalCapability();
+                    const current = store.bot(bot.id);
+                    if (!current || current.browser === false || !builtInBrowserEnabled(cfg) ||
+                        currentBrowserSession(current.id, current.browserProfile) !== browser.session) {
+                        throw Object.assign(new Error("Browser access changed while connecting."), { status: 409 });
+                    }
+                });
+                requireActiveInternalCapability();
+                return json(res, 200, { result });
+            }
             if (method === "GET" && path === "/api/internal/agents") {
                 const sender = internalSender;
                 // title/description included so the caller can judge the team (who
@@ -8084,6 +8200,45 @@ const handleRequest = async (req, res) => {
                 : json(res, 404, { error: "no such webhook" });
         }
         // ── events stream ──
+        // Owner-only (default-deny in request-auth). Never mix login frames into
+        // the general events feed, which is also visible to client-only devices.
+        const liveBrowserMatch = /^\/api\/bots\/([\w-]+)\/browser\/(live|action)$/.exec(path);
+        if (liveBrowserMatch) {
+            res.setHeader("cache-control", "no-store");
+            const bot = store.bot(liveBrowserMatch[1]);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            if (!builtInBrowserEnabled(cfg) || bot.browser === false) {
+                return json(res, 409, { error: "Enable this bot's browser in its profile first." });
+            }
+            const browser = await browserIntegration(bot.id, bot.browserProfile);
+            if (!browser)
+                return json(res, 503, { error: "Install the browser engine first." });
+            const owner = auth.kind === "session" ? auth.session.id : "local-owner";
+            const isCurrent = () => {
+                const current = store.bot(bot.id);
+                return !!current && current.browser !== false && builtInBrowserEnabled(cfg)
+                    && currentBrowserSession(current.id, current.browserProfile) === browser.session
+                    && (auth.kind !== "session" || sessions.isLive(auth.session.id));
+            };
+            if (method === "GET" && liveBrowserMatch[2] === "live") {
+                req.socket.setTimeout(0);
+                return await browserLive.open({ botId: bot.id, session: browser.session, spec: browser.spec, owner, isCurrent, res });
+            }
+            if (method === "POST" && liveBrowserMatch[2] === "action") {
+                const body = await readBody(req, 32_768);
+                if (!isCurrent())
+                    return json(res, 409, { error: "This browser session changed. Reopen the browser panel." });
+                if (typeof body?.viewerId !== "string")
+                    return json(res, 400, { error: "A live browser connection is required." });
+                if (body.type === "restart" && store.bots.some((candidate) => candidate.busy &&
+                    currentBrowserSession(candidate.id, candidate.browserProfile) === browser.session)) {
+                    return json(res, 409, { error: "Stop every bot using this profile before restarting its browser." });
+                }
+                return json(res, 200, await browserLive.action({ viewerId: body.viewerId, botId: bot.id, owner, body }));
+            }
+            return json(res, 405, { error: "method not allowed" });
+        }
         if (method === "GET" && path === "/api/events") {
             const client = {
                 res,
@@ -9472,10 +9627,7 @@ const handleRequest = async (req, res) => {
             if (!bot) {
                 // There are no awaits between the refreshed lookup and this patch, but
                 // keep the attachment invariant explicit if the store ever changes.
-                try {
-                    unlinkSync(saved.path);
-                }
-                catch { }
+                deleteAttachment(saved.path);
                 return json(res, 404, { error: "no such bot" });
             }
             const visible = wireBot(bot);
@@ -9581,6 +9733,8 @@ const handleRequest = async (req, res) => {
             if (body.requireAvailableModel !== undefined && typeof body.requireAvailableModel !== "boolean") {
                 return json(res, 400, { error: "requireAvailableModel must be true or false" });
             }
+            const beforeBrowserProfile = existingBot?.browserProfile;
+            const beforeBrowserEnabled = existingBot?.browser;
             // Neither Codex (free-form string field) nor Grok (lazy, logs-only)
             // rejects an unknown effort level at their own boundary — this is the
             // only real gate, so it stays. But it fires only when the target
@@ -9697,6 +9851,10 @@ const handleRequest = async (req, res) => {
                 if (existingBot?.busy && requestedProfile !== existingBot.browserProfile) {
                     return json(res, 409, { error: "stop this bot's turn before changing its browser profile" });
                 }
+                if (existingBot && requestedProfile !== existingBot.browserProfile &&
+                    browserRuntime.heldBy(currentBrowserSession(existingBot.id, existingBot.browserProfile))) {
+                    return json(res, 409, { error: "Release browser control before changing its profile." });
+                }
                 if (requestedProfile === undefined)
                     patch.browserProfile = undefined;
                 else if (typeof requestedProfile === "string" &&
@@ -9909,6 +10067,12 @@ const handleRequest = async (req, res) => {
                 section !== undefined &&
                 sectionKey(existingBot?.section) !== sectionKey(section);
             let bot;
+            const freshBrowserBot = store.bot(m[1]);
+            if (freshBrowserBot && body.browserProfile !== undefined &&
+                patch.browserProfile !== freshBrowserBot.browserProfile &&
+                (freshBrowserBot.busy || browserRuntime.heldBy(currentBrowserSession(freshBrowserBot.id, freshBrowserBot.browserProfile)))) {
+                return json(res, 409, { error: "Stop the bot and release browser control before changing its profile." });
+            }
             if (profile.patch.soul !== undefined) {
                 // A mixed settings request must not turn a runtime revocation into
                 // a persist-first edit. Apply runtime fields with their existing
@@ -9925,6 +10089,12 @@ const handleRequest = async (req, res) => {
             }
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            if (existingBot && (bot.browserProfile !== beforeBrowserProfile || bot.browser !== beforeBrowserEnabled)) {
+                browserLive.closeForBot(bot.id);
+                if (beforeBrowserProfile === "guest" && (bot.browserProfile !== "guest" || bot.browser === false)) {
+                    void forgetTemporaryBrowser(bot.id).catch((error) => console.warn("temporary browser cleanup failed", error));
+                }
+            }
             const chiefChanges = body.chiefOfStaff === true || chiefMovedSections
                 ? store.setChiefOfStaff(bot.id)
                 : [];
@@ -10121,6 +10291,8 @@ const handleRequest = async (req, res) => {
                     localVmIdles.get(target.key)?.cancel();
                     localVmIdles.delete(target.key);
                     store.deleteBot(bot.id);
+                    browserLive.closeForBot(bot.id);
+                    await forgetTemporaryBrowser(bot.id);
                 }
                 catch (error) {
                     if (browserCleanupRequest)
@@ -11239,7 +11411,26 @@ const handleRequest = async (req, res) => {
             // Windows never pushes PATH changes into a live process, so without
             // this the answer is frozen at boot and "check again" is a no-op.
             resetPathCache();
-            return json(res, 200, { instances: await registry.describe() });
+            return json(res, 200, { instances: await describeInstances() });
+        }
+        if (method === "POST" && path === "/api/instances/claude-accounts") {
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            const parsed = createClaudeAccountSchema.safeParse(await readBody(req, 8192));
+            if (!parsed.success)
+                return json(res, 400, { error: "Enter an account name (up to 80 characters) and an optional configuration directory." });
+            if (providerConfigBusy)
+                return json(res, 409, { error: "provider settings are already being updated" });
+            providerConfigBusy = true;
+            try {
+                const { instanceId, instances } = newClaudeAccount(cfg, parsed.data);
+                await persistProviderInstance(instanceId, instances);
+                return json(res, 201, { instanceId, instances: await describeInstances() });
+            }
+            finally {
+                providerConfigBusy = false;
+            }
         }
         const authStatus = /^\/api\/instances\/([\w.-]+)\/auth\/status$/.exec(path);
         if (method === "GET" && authStatus) {
@@ -11261,12 +11452,12 @@ const handleRequest = async (req, res) => {
                 if (action === "refresh-models") {
                     if (!(await registry.refreshModels(instanceId)))
                         return json(res, 404, { error: "unknown instance" });
-                    return json(res, 200, { instances: await registry.describe() });
+                    return json(res, 200, { instances: await describeInstances() });
                 }
                 if (action === "install") {
                     if (!(await registry.installRuntime(instanceId)))
                         return json(res, 404, { error: "managed installation is unavailable" });
-                    return json(res, 200, { instances: await registry.describe() });
+                    return json(res, 200, { instances: await describeInstances() });
                 }
                 if (action === "auth/start") {
                     const instance = registry.get(instanceId);
@@ -11372,38 +11563,80 @@ const handleRequest = async (req, res) => {
         }
         // ── per-instance CLI path override (custom builds / versioned bins) ──
         // PATCH /api/instances/:id {cli: "/path/to/cli" | ""} — "" reverts to the
-        // driver default. Kills in-flight turns like any provider reload.
+        // driver default. Only this idle instance is replaced; siblings keep running.
         const instancePatch = /^\/api\/instances\/([\w.-]+)$/.exec(path);
         if (method === "PATCH" && instancePatch) {
             // same non-simple-request gate as the local-VM lifecycle routes
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
             }
-            const body = await readBody(req);
-            if (typeof body?.cli !== "string")
-                return json(res, 400, { error: "cli must be a string" });
-            if (/[\n\r]/.test(body.cli))
-                return json(res, 400, { error: "cli must not contain newlines" });
+            const parsed = instanceSettingsSchema.safeParse(await readBody(req, 16384));
+            if (!parsed.success)
+                return json(res, 400, { error: "Supply a valid CLI path, account name or configuration directory." });
+            const body = parsed.data;
+            const instanceId = instancePatch[1];
             if (providerConfigBusy)
                 return json(res, 409, { error: "provider settings are already being updated" });
+            if (store.bots.some((bot) => bot.busy && bot.modelSelection.instanceId === instanceId)) {
+                return json(res, 409, { error: "Wait for bots using this account to finish before changing its settings." });
+            }
             providerConfigBusy = true;
+            providerInstancesChanging.add(instanceId);
             try {
-                const result = withInstanceCli(cfg, instancePatch[1], body.cli);
-                if (!result.ok)
-                    return json(res, 404, { error: `unknown instance "${instancePatch[1]}"` });
-                // persist the whole instances map this rebuild produced — a fresh
-                // saveConfig({instances}) merge would re-derive defaults identically,
-                // but writing the resolved map keeps disk and runtime in lockstep
-                saveConfig({ instances: result.config.instances });
-                Object.assign(cfg, loadConfig());
-                await reloadProviders();
-                // rescan BEFORE describe(): the response's cliCandidates are computed
-                // from the memoized PATH, so resetting after would answer this request
-                // with the pre-reset cache
-                resetPathCache();
-                return json(res, 200, { instances: await registry.describe() });
+                const result = body.cli === undefined ? { ok: true, config: cfg } : withInstanceCli(cfg, instanceId, body.cli);
+                const instances = persistableInstanceConfigs(result.config);
+                if (!result.ok || !Object.hasOwn(instances, instanceId))
+                    return json(res, 404, { error: `unknown instance "${instanceId}"` });
+                const entry = instances[instanceId];
+                if ((body.displayName !== undefined || body.configDir !== undefined) && entry.driver !== "claudeAgent") {
+                    return json(res, 400, { error: "Account settings are currently available for Claude only." });
+                }
+                if (body.displayName !== undefined)
+                    entry.displayName = body.displayName;
+                if (body.configDir !== undefined) {
+                    let previousDir;
+                    try {
+                        previousDir = configuredAccountDirectory(entry);
+                    }
+                    catch { /* Allow repairing an unused malformed account. */ }
+                    entry.config = { ...entry.config, configDir: body.configDir };
+                    if (previousDir !== configuredAccountDirectory(entry)) {
+                        const used = store.bots.some((bot) => bot.modelSelection.instanceId === instanceId || store.tasks(bot.id).some((task) => task.resumeCursors[instanceId] || task.lastInstanceId === instanceId));
+                        if (used)
+                            return json(res, 409, { error: "This account is used by bots or conversation history. Add another account and select it for the bot instead." });
+                        assertSeparateClaudeAccount(instances, instanceId, entry);
+                    }
+                }
+                await persistProviderInstance(instanceId, instances);
+                return json(res, 200, { instances: await describeInstances() });
+            }
+            finally {
+                providerInstancesChanging.delete(instanceId);
+                providerConfigBusy = false;
+            }
+        }
+        if (method === "DELETE" && instancePatch) {
+            const instanceId = instancePatch[1];
+            if (providerConfigBusy)
+                return json(res, 409, { error: "provider settings are already being updated" });
+            const instances = persistableInstanceConfigs(cfg);
+            if (!Object.hasOwn(instances, instanceId))
+                return json(res, 404, { error: "unknown instance" });
+            if (instances[instanceId].driver !== "claudeAgent" || instanceId === "claude") {
+                return json(res, 400, { error: "Only added Claude accounts can be removed here." });
+            }
+            if (cfg.defaultModelSelection?.instanceId === instanceId || store.bots.some((bot) => bot.modelSelection.instanceId === instanceId)) {
+                return json(res, 409, { error: "Choose another account for the bots and default model using this account before removing it." });
+            }
+            providerConfigBusy = true;
+            providerInstancesChanging.add(instanceId);
+            try {
+                delete instances[instanceId];
+                await persistProviderInstance(instanceId, instances);
+                return json(res, 200, { instances: await describeInstances() });
             }
             finally {
+                providerInstancesChanging.delete(instanceId);
                 providerConfigBusy = false;
             }
         }
@@ -11520,12 +11753,24 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "nothing to save" });
             if (providerConfigBusy)
                 return json(res, 409, { error: "provider settings are already being updated" });
+            if (patch.browserProfiles !== undefined && body.expectedBrowserProfiles !== undefined) {
+                const current = (cfg.browserProfiles ?? []).map(({ id, name }) => ({ id, name }));
+                if (JSON.stringify(body.expectedBrowserProfiles) !== JSON.stringify(current)) {
+                    return json(res, 409, { error: "Browser profiles changed in another window. Review the refreshed list and try again." });
+                }
+            }
             const disablingBuiltInBrowser = patch.features?.browser === false && builtInBrowserEnabled(cfg);
             const removedBrowserProfileIds = patch.browserProfiles === undefined
                 ? []
                 : (cfg.browserProfiles ?? [])
                     .map((profile) => profile.id)
                     .filter((id) => !patch.browserProfiles.some((profile) => profile.id === id));
+            const profileControlConflict = () => removedBrowserProfileIds.some((id) => {
+                const target = browserProfilePartitionTarget(cfg, id);
+                return target && browserRuntime.heldBy(browserSessionId("", target.partitionId));
+            });
+            if (profileControlConflict())
+                return json(res, 409, { error: "Release browser control before deleting its profile." });
             if (patch.browserProfiles !== undefined) {
                 const currentProfiles = new Map((cfg.browserProfiles ?? []).map((profile) => [profile.id, profile]));
                 const nextProfiles = patch.browserProfiles.map((profile) => {
@@ -11754,6 +11999,8 @@ const handleRequest = async (req, res) => {
                         return json(res, 409, { error: conflict });
                 }
                 const browserCleanupRequests = [];
+                if (profileControlConflict())
+                    return json(res, 409, { error: "Release browser control before deleting its profile." });
                 try {
                     for (const profileId of removedBrowserProfileIds) {
                         const target = browserProfilePartitionTarget(cfg, profileId);
@@ -11818,6 +12065,12 @@ const handleRequest = async (req, res) => {
                     throw error;
                 }
                 let browserReferenceCleanupError = null;
+                if (disablingBuiltInBrowser)
+                    browserLive.closeAll();
+                for (const request of browserCleanupRequests) {
+                    if (request.kind === "profile")
+                        browserLive.closeForSession(browserSessionId("", request.partitionId));
+                }
                 if (patch.browserProfiles !== undefined) {
                     const retained = new Set(patch.browserProfiles.map((profile) => profile.id));
                     try {
@@ -12310,6 +12563,21 @@ calendarCalls.start();
 // Resolve the edition before accepting requests so /api/edition is never a guess.
 console.log(describeEdition(await loadEnterpriseLayer()));
 console.log(describeBrand(loadBrand()));
+// Reclaim upload partials a previous run crashed out of, and warm the
+// attachment quota cache off the same scan. This used to happen implicitly on
+// every reservation, which is exactly what made uploads quadratic in
+// directory size; do the initial sweep before accepting requests.
+// ponytail: once per boot, not periodic. A partial orphaned while this
+// process is up survives until the next restart — add a timer only if that
+// shows up as real quota pressure.
+try {
+    const reclaimedPartials = cleanupStaleAttachmentPartials();
+    if (reclaimedPartials > 0)
+        console.log(`reclaimed ${reclaimedPartials} abandoned upload partial(s)`);
+}
+catch (error) {
+    console.warn(`attachments: startup partial cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+}
 server.listen(PORT, "127.0.0.1", () => {
     console.log(`openmausbot server on http://127.0.0.1:${PORT}`);
 });
@@ -12335,6 +12603,7 @@ const gracefulShutdown = createGracefulShutdown({
             // asynchronous shutdown jobs drain. Invalidate their turn bearers before
             // any cleanup function reaches an await.
             revokeAllInternalCapabilities();
+            browserLive.closeAll();
             for (const idle of localVmIdles.values())
                 idle.cancel();
             vps.closeAllVpsDesktopTunnels();
@@ -12345,6 +12614,10 @@ const gracefulShutdown = createGracefulShutdown({
             tunnelListener?.close();
         },
         () => registry.disposeAll(),
+        async () => {
+            await Promise.all([...temporaryBrowserSessions.keys()].map((botId) => forgetTemporaryBrowser(botId)));
+            await browserRuntime.closeAll();
+        },
         () => flushAllProfileHistory(),
     ],
     // Cleanup jobs run concurrently. Release only after they settle (or reach