openmausbot 0.1.66 → 0.1.68

package/dist-server/server/cli.js

@@ -7,7 +7,7 @@
 //   openmausbot setup [--data-dir ~/.openmausbot]
 //   openmausbot start [serve options]
 //   openmausbot serve [--port 8799] [--data-dir ~/.openmausbot] [--label "cab mini"]
-//                     [--public-url https://host] [--tailscale | --tunnel] [--no-pair]
+//                     [--public-url https://host] [--tailscale | --tunnel | --domain HOST] [--no-pair]
 //   openmausbot pair  [--label "My MacBook"] [--client] [--public-url https://host]
 //   openmausbot sessions [revoke <id>]
 //   openmausbot status
@@ -29,12 +29,16 @@ import { dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import qrcode from "qrcode-terminal";
+import { parseAllowList } from "./account-signin.js";
+import { writeFileAtomic } from "./atomic.js";
+import { ensureCaddy, normalizeDomainOption, startCaddy } from "./caddy.js";
+import { runServiceCommand } from "./service-cli.js";
 import { explainTailscaleFailure, tailscaleServe, tailscaleServeOff, tailscaleStatus } from "./tailscale.js";
 import { defaultSetupIo, SetupCancelled } from "./cli-prompts.js";
 import { normalizePhoneOrigin, phonePairingInstructions, runPhoneSetup } from "./cli-phone-setup.js";
-import { cleanupTunnelOrigin, createTunnelAccount, createTunnelOrigin, describeTunnelAccount, describeTunnelState, ensureCloudflared, guardianEntry, startTunnel, tunnelAccess, } from "./tunnel.js";
+import { cleanupTunnelOrigin, createTunnelAccount, createTunnelOrigin, describeTunnelAccount, describeTunnelState, ensureCloudflared, FLEET_CREDENTIAL_ENV, fleetAccess, fleetCredential, guardianEntry, startTunnel, tunnelAccess, } from "./tunnel.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
-const COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "browser", "help", "--help", "-h"];
+const COMMANDS = ["setup", "start", "serve", "pair", "sessions", "status", "login", "logout", "access", "service", "browser", "help", "--help", "-h"];
 export function parseArgs(argv, env = process.env) {
     const implicitStart = !argv.length || (argv[0].startsWith("--") && argv[0] !== "--help");
     const [command = "start", ...rest] = implicitStart ? ["start", ...argv] : argv;
@@ -51,6 +55,7 @@ export function parseArgs(argv, env = process.env) {
         pair: true,
         withDeps: false,
         json: false,
+        chatOnly: false,
     };
     for (let i = 0; i < rest.length; i += 1) {
         const arg = rest[i];
@@ -72,6 +77,12 @@ export function parseArgs(argv, env = process.env) {
                 options.publicUrl = value().replace(/\/+$/, "");
             else if (arg === "--tailscale")
                 options.tailscale = true;
+            else if (arg === "--domain") {
+                const domain = normalizeDomainOption(value());
+                if (typeof domain !== "string")
+                    return domain;
+                options.domain = domain;
+            }
             else if (arg === "--tunnel")
                 options.tunnel = true;
             else if (arg === "--client")
@@ -88,6 +99,15 @@ export function parseArgs(argv, env = process.env) {
                 options.email = value();
             else if (options.command === "sessions" && arg === "revoke")
                 options.revoke = value();
+            else if (options.command === "access" && !options.accessAction && (arg === "list" || arg === "add" || arg === "remove")) {
+                options.accessAction = arg;
+                if (arg !== "list")
+                    options.email = value();
+            }
+            else if (options.command === "access" && arg === "--chat-only")
+                options.chatOnly = true;
+            else if (options.command === "service" && !options.serviceAction && (arg === "install" || arg === "uninstall"))
+                options.serviceAction = arg;
             else if (options.command === "browser" && (arg === "install" || arg === "status"))
                 options.browserAction = arg;
             else if (options.command === "browser" && arg === "--with-deps")
@@ -105,6 +125,12 @@ export function parseArgs(argv, env = process.env) {
         return { error: "--public-url must start with http:// or https://" };
     if (options.tailscale && options.tunnel)
         return { error: "choose one of --tailscale (your tailnet) and --tunnel (a public address)" };
+    if (options.command === "access" && !options.accessAction)
+        return { error: "access needs one of: list, add EMAIL [--chat-only], remove EMAIL" };
+    if (options.command === "service" && !options.serviceAction)
+        return { error: "service needs one of: install [the same options as serve], uninstall" };
+    if (options.domain && (options.tailscale || options.tunnel || options.publicUrl))
+        return { error: "--domain already gives the server its address; drop --tailscale, --tunnel and --public-url" };
     if (options.local && (options.tailscale || options.tunnel || options.publicUrl))
         return { error: "--local cannot be combined with a remote-access option" };
     if (options.command === "browser" && !options.browserAction)
@@ -117,12 +143,14 @@ export const USAGE = `openmausbot — your team of AI bots, ready in a few steps
   openmausbot setup [--data-dir DIR]
   openmausbot start [the same options as serve]
   openmausbot serve [--port 8799] [--data-dir DIR] [--label NAME]
-                    [--public-url https://host] [--tailscale | --tunnel] [--no-pair]
+                    [--public-url https://host] [--tailscale | --tunnel | --domain HOST] [--no-pair]
   openmausbot pair  [--label NAME] [--client] [--public-url https://host]
   openmausbot sessions [revoke ID]
   openmausbot status
   openmausbot login [--email you@example.com]
   openmausbot logout
+  openmausbot access list | add EMAIL [--chat-only] | remove EMAIL
+  openmausbot service install [--domain HOST | --tunnel | --tailscale] [--port N] [--data-dir DIR] | uninstall
   openmausbot browser install [--with-deps] | status
 
 setup   choose AI access and optional phone access; keep existing bots and chats
@@ -134,6 +162,13 @@ status  what the server says about itself
 login   signs this machine in to an OpenMausBot account (an emailed code)
         and reserves its public address for --tunnel
 logout  releases that address and signs out
+access  who may sign in with an emailed code at /pair: an address or
+        @domain; --chat-only gives chat and approvals without settings.
+        Takes effect at once, no restart.
+service keep the server running across reboots: writes a systemd unit
+        (Linux) or a launchd agent (macOS) for the same serve options and
+        prints the commands that install it. Install the package
+        permanently first (npm install -g openmausbot).
 browser install: the bots' browser engine (agent-browser, pinned) into the
         data dir, and Chrome for Testing into the user's browser cache.
         --with-deps also installs
@@ -147,6 +182,10 @@ browser install: the bots' browser engine (agent-browser, pinned) into the
 --tunnel     serve at a public https://….openmausbot.com address through a
              Cloudflare tunnel: no domain, no proxy, no open port. Run
              \`openmausbot login\` once on this machine first.
+--domain     serve at https://HOST on your own domain: a pinned Caddy is
+             downloaded once and run alongside the server, and gets the
+             certificate itself. Point the domain's DNS at this machine and
+             open ports 80 and 443.
 
 --no-open   do not open a browser window
 --no-pair   skip phone setup and do not print a pairing code
@@ -418,13 +457,80 @@ export async function runStatus(options, io = defaultIo()) {
     }
     if (!options.json) {
         const account = describeTunnelAccount(createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() }).credentials.read());
-        if (account.address)
+        if (fleetCredential())
+            io.log(`public address: managed by the fleet (${FLEET_CREDENTIAL_ENV} is set; the address is fetched when serve --tunnel starts)`);
+        else if (account.address)
             io.log(`public address: ${account.address} (signed in as ${account.email ?? "?"}; serve it with --tunnel)`);
     }
     return code;
 }
+/** The sign-in allow-list, edited straight in config.json: the server reads
+ * it per request, so this works with the server running or stopped and
+ * needs no restart. Environment variables (OMB_SIGNIN_EMAILS) win when set.
+ * Written the way the server writes it (atomic, 0600), touching only the
+ * one key, so nothing else in the file moves. */
+export async function runAccess(options, io = defaultIo()) {
+    const file = join(options.dataDir, "config.json");
+    let raw = {};
+    if (existsSync(file)) {
+        try {
+            const parsed = JSON.parse(readFileSync(file, "utf8"));
+            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+                throw new Error("not an object");
+            raw = Object.fromEntries(Object.entries(parsed));
+        }
+        catch (error) {
+            io.error(`${file} could not be read (${message(error)}); fix it before changing who can sign in`);
+            return 1;
+        }
+    }
+    const current = typeof raw.signIn === "object" && raw.signIn !== null ? Object(raw.signIn) : {};
+    const list = (value) => parseAllowList(Array.isArray(value) ? value.map(String).join(",") : "");
+    const admins = list(Reflect.get(current, "admins"));
+    const members = list(Reflect.get(current, "members"));
+    const overridden = process.env.OMB_SIGNIN_EMAILS !== undefined || process.env.OMB_SIGNIN_MEMBER_EMAILS !== undefined;
+    const write = (next) => {
+        mkdirSync(options.dataDir, { recursive: true, mode: 0o700 });
+        writeFileAtomic(file, `${JSON.stringify({ ...raw, signIn: next }, null, 2)}\n`, { mode: 0o600 });
+    };
+    if (options.accessAction === "list") {
+        if (!admins.length && !members.length) {
+            io.log("nobody can sign in with an email yet; pairing codes only. Add someone with: openmausbot access add you@example.com");
+            return 0;
+        }
+        for (const entry of admins)
+            io.log(`${entry.padEnd(40)} full access`);
+        for (const entry of members)
+            io.log(`${entry.padEnd(40)} chat and approvals`);
+        if (overridden)
+            io.log("(OMB_SIGNIN_EMAILS / OMB_SIGNIN_MEMBER_EMAILS are set in the environment and win over this list while the server runs)");
+        return 0;
+    }
+    const entry = (options.email ?? "").trim().toLowerCase();
+    if (!entry || (!entry.startsWith("@") && !entry.includes("@")) || /\s/.test(entry)) {
+        io.error("give an email address, or @domain for everyone at that domain");
+        return 2;
+    }
+    const without = (items) => items.filter((item) => item !== entry);
+    if (options.accessAction === "remove") {
+        if (!admins.includes(entry) && !members.includes(entry)) {
+            io.error(`${entry} is not on the list`);
+            return 1;
+        }
+        write({ admins: without(admins), members: without(members) });
+        io.log(`${entry} can no longer sign in (existing sessions stay until they expire or are revoked with \`openmausbot sessions revoke\`)`);
+        return 0;
+    }
+    write(options.chatOnly ? { admins: without(admins), members: [...without(members), entry] } : { admins: [...without(admins), entry], members: without(members) });
+    io.log(`${entry} can sign in at /pair with an emailed code (${options.chatOnly ? "chat and approvals" : "full access"})`);
+    if (overridden)
+        io.log("note: OMB_SIGNIN_EMAILS / OMB_SIGNIN_MEMBER_EMAILS are set in the environment and win over this list while the server runs");
+    return 0;
+}
 export async function runLogin(options, io = defaultIo()) {
     const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+    if (fleetCredential())
+        io.log(`note: ${FLEET_CREDENTIAL_ENV} is set, so serve --tunnel will use that credential rather than this account`);
     if (account.credentials.status === "unavailable") {
         io.error(`${account.credentials.file} exists but could not be read; fix or remove it, then try again`);
         return 1;
@@ -549,24 +655,38 @@ export function serverEntry(here = HERE) {
 /** Everything `--tunnel` needs before the server starts, or the one reason
  * it cannot have it. Fails closed: no silent fallback to a local-only server. */
 async function planTunnel(options, log) {
-    const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
-    if (account.credentials.status === "unavailable")
-        return { error: `${account.credentials.file} exists but could not be read; fix or remove it` };
-    if (!describeTunnelAccount(account.credentials.read()).email) {
-        return { error: "no account on this machine yet: run `openmausbot login` first, then `openmausbot serve --tunnel`" };
-    }
-    // A fresh connector token when the control plane answers; the saved one otherwise.
-    try {
-        const state = await account.service.retry();
-        if (state.message && !tunnelAccess(account.credentials.read()))
-            log(`tunnel: ${state.message}`);
+    let access = null;
+    const credential = fleetCredential();
+    if (credential) {
+        // A fleet-started container: the credential is the whole identity.
+        log(`tunnel: using the installation credential from ${FLEET_CREDENTIAL_ENV}`);
+        try {
+            access = await fleetAccess({ credential });
+        }
+        catch (error) {
+            return { error: `--tunnel: ${message(error)}` };
+        }
     }
-    catch (error) {
-        log(`tunnel: control plane not reachable right now (${message(error)}); using the saved address`);
+    else {
+        const account = createTunnelAccount({ dataDir: options.dataDir, version: serverVersion() });
+        if (account.credentials.status === "unavailable")
+            return { error: `${account.credentials.file} exists but could not be read; fix or remove it` };
+        if (!describeTunnelAccount(account.credentials.read()).email) {
+            return { error: "no account on this machine yet: run `openmausbot login` first, then `openmausbot serve --tunnel`" };
+        }
+        // A fresh connector token when the control plane answers; the saved one otherwise.
+        try {
+            const state = await account.service.retry();
+            if (state.message && !tunnelAccess(account.credentials.read()))
+                log(`tunnel: ${state.message}`);
+        }
+        catch (error) {
+            log(`tunnel: control plane not reachable right now (${message(error)}); using the saved address`);
+        }
+        access = tunnelAccess(account.credentials.read());
+        if (!access)
+            return { error: "this machine has no public address; run `openmausbot login` again" };
     }
-    const access = tunnelAccess(account.credentials.read());
-    if (!access)
-        return { error: "this machine has no public address; run `openmausbot login` again" };
     let binary;
     try {
         binary = await ensureCloudflared({ dataDir: options.dataDir, log });
@@ -607,6 +727,17 @@ export async function runServe(options, log = console.log) {
             log(`note: --public-url is ignored with --tunnel; the address is ${plan.access.endpoint}`);
         publicUrl = plan.access.endpoint;
     }
+    let caddyBinary = null;
+    if (options.domain) {
+        try {
+            caddyBinary = await ensureCaddy({ dataDir: options.dataDir, log });
+        }
+        catch (error) {
+            console.error(`--domain: ${message(error)}`);
+            return 1;
+        }
+        publicUrl = `https://${options.domain}`;
+    }
     const entry = serverEntry();
     if (!entry.staticDir)
         log("note: no built UI found next to the server; the API runs but browsers get no page (build with `pnpm exec vite build`)");
@@ -685,12 +816,15 @@ export async function runServe(options, log = console.log) {
         child.once("exit", (code, signal) => { exited = code ?? (signal === "SIGTERM" || signal === "SIGINT" ? 0 : 1); done(exited); });
     });
     let tunnel = null;
+    let caddy = null;
     let stopping = null;
     const stop = () => {
         stopping ??= (async () => {
-            // The gateway stops accepting before the server it forwards to goes away.
+            // The gateway and the edge stop accepting before the server they forward to goes away.
             if (tunnel)
                 await tunnel.stop().catch(() => undefined);
+            if (caddy)
+                await caddy.stop().catch(() => undefined);
             if (tailscaleServing && tailscale)
                 await tailscaleServeOff(tailscale).catch(() => undefined);
             if (exited === null) {
@@ -729,6 +863,21 @@ export async function runServe(options, log = console.log) {
         }
         if (stopping || exited !== null)
             return await childExit;
+        if (options.domain && caddyBinary) {
+            try {
+                caddy = await startCaddy({ binary: caddyBinary, dataDir: options.dataDir, domain: options.domain, appPort: options.port, webhookPort: Number(env.OMB_WEBHOOK_PORT), log });
+                log(`https: Caddy serves ${publicUrl} → http://127.0.0.1:${options.port}; it gets the certificate from Let's Encrypt once DNS for ${options.domain} points at this machine`);
+                void caddy.exited.then((code) => {
+                    if (!stopping)
+                        log(`caddy: stopped (exit ${code ?? "signal"}); ${publicUrl} is no longer served. Stop and start the server again.`);
+                });
+            }
+            catch (error) {
+                console.error(`--domain: ${message(error)}`);
+                await stop();
+                return 1;
+            }
+        }
         if (plan && child.pid) {
             tunnel = startTunnel({
                 dataDir: options.dataDir,
@@ -872,6 +1021,20 @@ export async function main(argv = process.argv.slice(2)) {
             return runStatus(options);
         case "login":
             return runLogin(options);
+        case "access":
+            return runAccess(options);
+        case "service":
+            return runServiceCommand({
+                action: options.serviceAction ?? "install",
+                dataDir: options.dataDir,
+                port: options.port,
+                domain: options.domain,
+                tunnel: options.tunnel,
+                tailscale: options.tailscale,
+                label: options.label,
+                script: process.argv[1] ?? "",
+                node: process.execPath,
+            }, { log: (line) => console.log(line), error: (line) => console.error(line) });
         case "logout":
             return runLogout(options);
         case "browser":

package/dist-server/server/computer-proxy.js

@@ -734,14 +734,18 @@ async function semanticActAndObserve(id, action, ref, value, args) {
  * told when they finish, and the two that read nothing from the screen. */
 const OPEN_WHILE_DRIVEN = new Set(["computer_request_help", "computer_status", "observation_metrics"]);
 async function call(id, name, args) {
-    if (!OPEN_WHILE_DRIVEN.has(name) && (await control.state(true)).held) {
-        return text(id, CONTROL_REFUSAL, true);
+    if (!OPEN_WHILE_DRIVEN.has(name)) {
+        const state = await control.state(true);
+        if (state.held)
+            return text(id, state.blockedReason ?? CONTROL_REFUSAL, true);
     }
     if (name === "computer_request_help") {
         if (!control.configured) {
             return text(id, "nobody can be paged for this computer right now — carry on carefully", true);
         }
         const initial = await control.state(true);
+        if (initial.held && initial.blockedReason)
+            return text(id, initial.blockedReason, true);
         // If the person is already driving, don't clobber whatever plea they
         // are reading — just wait for the hand-back.
         const requestId = initial.held ? null : await control.requestHelp(String(args?.reason ?? ""));
@@ -753,6 +757,11 @@ async function call(id, name, args) {
         while (Date.now() < deadline) {
             await new Promise((resolve) => setTimeout(resolve, CONTROL_POLL_MS));
             const state = await control.state(true);
+            if (state.held && state.blockedReason) {
+                if (requestId)
+                    await control.expireHelp(requestId);
+                return text(id, state.blockedReason, true);
+            }
             if (state.held)
                 sawHold = true;
             if (!state.held && !state.helpOpen) {

package/dist-server/server/config.js

@@ -16,6 +16,8 @@ const BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
 export const DEFAULT_ROOM_TURN_TIMEOUT_MINUTES = 5;
 export const MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
 export const MAX_ROOM_TURN_TIMEOUT_MINUTES = 1_440;
+export const DEFAULT_MAX_CONCURRENT_BOT_THREADS = 3;
+export const MAX_CONCURRENT_BOT_THREADS = 10;
 export const DEFAULT_LOCAL_VM_MODE = "shared";
 export const DEFAULT_LOCAL_VM_MAX_INSTANCES = 2;
 export const MIN_LOCAL_VM_MAX_INSTANCES = 1;
@@ -218,6 +220,9 @@ const defaultModelSelectionSchema = z.object({
 const appConfigSchema = z.object({
     /** Verified by the dedicated domain endpoint, never a generic config patch. */
     customDomain: z.string().optional(),
+    /** Who may sign in with an emailed code (server/account-signin.ts):
+     * addresses or `@domain` entries; admins get every scope, members chat only. */
+    signIn: z.object({ admins: z.array(z.string().max(320)).max(500).optional(), members: z.array(z.string().max(320)).max(5000).optional() }).optional(),
     defaultModelSelection: defaultModelSelectionSchema.optional(),
     /** CLI-only launch preferences. Never enable remote access implicitly. */
     cliStartup: z.object({
@@ -250,6 +255,7 @@ const appConfigSchema = z.object({
      * system language. Unknown tags degrade to English in the renderer. */
     language: optionalText,
     rooms: roomConfigSchema.optional(),
+    threads: z.object({ maxConcurrentPerBot: z.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS) }).strict().optional(),
     localVm: localVmConfigSchema.optional(),
     features: featureConfigSchema.optional(),
     browserProfiles: browserProfilesSchema.optional(),
@@ -346,6 +352,9 @@ export function vpsSshAlias(cfg) {
 export function roomTurnTimeoutMinutes(cfg) {
     return cfg.rooms?.turnTimeoutMinutes ?? DEFAULT_ROOM_TURN_TIMEOUT_MINUTES;
 }
+export function maxConcurrentBotThreads(cfg) {
+    return cfg.threads?.maxConcurrentPerBot ?? DEFAULT_MAX_CONCURRENT_BOT_THREADS;
+}
 export function localVmMode(cfg) {
     return cfg.localVm?.mode ?? DEFAULT_LOCAL_VM_MODE;
 }
@@ -424,6 +433,16 @@ export function loadConfig() {
     cfg.imageGen = { ...cfg.imageGen };
     if (process.env.OMB_OPENAI_IMAGE_KEY !== undefined)
         cfg.imageGen.key = process.env.OMB_OPENAI_IMAGE_KEY;
+    // The sign-in allow-list: env is how a headless box or a container is
+    // bootstrapped before anyone can reach Settings.
+    const splitEmails = (value) => value.split(/[,\s]+/).map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+    if (process.env.OMB_SIGNIN_EMAILS !== undefined || process.env.OMB_SIGNIN_MEMBER_EMAILS !== undefined) {
+        cfg.signIn = { ...cfg.signIn };
+        if (process.env.OMB_SIGNIN_EMAILS !== undefined)
+            cfg.signIn.admins = splitEmails(process.env.OMB_SIGNIN_EMAILS);
+        if (process.env.OMB_SIGNIN_MEMBER_EMAILS !== undefined)
+            cfg.signIn.members = splitEmails(process.env.OMB_SIGNIN_MEMBER_EMAILS);
+    }
     return cfg;
 }
 /** After saveConfig() writes a credential, the running process's env must
@@ -531,7 +550,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "localVm", "features"]) {
+    for (const key of ["xai", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "localVm", "features"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -547,6 +566,8 @@ export function saveConfig(patch, options = {}) {
         disk.language = checkedPatch.language;
     if (checkedPatch.customDomain !== undefined)
         disk.customDomain = checkedPatch.customDomain;
+    if (checkedPatch.signIn !== undefined)
+        disk.signIn = checkedPatch.signIn;
     // A selection is replaced as one value, so changing engines also clears
     // an effort level omitted from the new selection.
     if (checkedPatch.defaultModelSelection !== undefined) {

package/dist-server/server/control-client.js

@@ -29,7 +29,13 @@ export function createControlClient(options) {
             if (!res.ok)
                 return UNAVAILABLE;
             const body = await res.json().catch(() => null);
-            return { held: body?.held === true, helpOpen: body?.helpOpen === true };
+            if (typeof body?.held !== "boolean" || typeof body?.helpOpen !== "boolean")
+                return UNAVAILABLE;
+            return {
+                held: body.held,
+                helpOpen: body.helpOpen,
+                ...(typeof body.blockedReason === "string" && body.blockedReason.trim() ? { blockedReason: body.blockedReason } : {}),
+            };
         }
         catch {
             return UNAVAILABLE;

package/dist-server/server/delegations.js

@@ -251,7 +251,10 @@ export function queueDelegation(bus, from, item, maxDepth, sourceThreadId = from
  * of the target turn is delegated to `runTarget` so delegations.ts
  * stays free of harness-level concerns (commsDepth is the only thing
  * the caller needs). */
-export function drainDelegations(bus, approvalBus, threadId, runTarget) {
+export function drainDelegations(bus, approvalBus, threadId, runTarget, 
+/** Terminal failures before dispatch also need to wake the source. A
+ * launched peer reports through its provider-turn finalizer instead. */
+onSettled) {
     if (drainingThreads.has(threadId)) {
         queuedRedrains.add(threadId);
         return;
@@ -263,6 +266,10 @@ export function drainDelegations(bus, approvalBus, threadId, runTarget) {
     drainingThreads.add(threadId);
     void (async () => {
         for (const item of snapshot) {
+            // Stop/deletion may remove queued work while another item awaits a
+            // person's approval. A stale snapshot is never authority to launch it.
+            if (!pendingDelegations.get(threadId)?.some((candidate) => candidate.id === item.id))
+                continue;
             // A shared channel's thread is not owned by any single bot, so each
             // queued item carries its own source bot identity.
             const from = bus.store.botByThread(threadId) ??
@@ -307,8 +314,19 @@ export function drainDelegations(bus, approvalBus, threadId, runTarget) {
             finally {
                 // A requeued item (busy target, retries left) stays for the drain
                 // that the target's own settling turn will trigger.
+                const stillQueued = pendingDelegations.get(threadId)?.some((candidate) => candidate.id === item.id);
                 if (outcome !== "requeued")
                     acknowledgeDelegation(threadId, item.id);
+                if (outcome === "settled" && stillQueued) {
+                    const receipt = findDelegationReceipt(item.id);
+                    try {
+                        if (receipt)
+                            onSettled?.(receipt);
+                    }
+                    catch (error) {
+                        console.error("delegation settled but its source could not be resumed", error);
+                    }
+                }
             }
         }
     })().finally(() => {
@@ -321,7 +339,7 @@ export function drainDelegations(bus, approvalBus, threadId, runTarget) {
         const snapshotIds = new Set(snapshot.map((item) => item.id));
         const hasNewItems = pendingDelegations.get(threadId)?.some((item) => !snapshotIds.has(item.id)) ?? false;
         if (redrainRequested || hasNewItems) {
-            drainDelegations(bus, approvalBus, threadId, runTarget);
+            drainDelegations(bus, approvalBus, threadId, runTarget, onSettled);
         }
     });
 }
@@ -368,6 +386,19 @@ export function discardDelegations(bus, threadId) {
 async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarget) {
     let sender = from;
     let target = bus.store.bot(item.toBotId);
+    // Retained approval authorizes the message, not a deleted conversation or
+    // revoked room membership. Check every retry before writing to its source.
+    if (!sourceThreadBelongsToBot(bus.store, sender.id, sourceThreadId)) {
+        recordDelegationReceipt({
+            id: item.id,
+            sourceThreadId,
+            toBotId: item.toBotId,
+            toBotName: target?.name ?? item.toBotId,
+            status: "dropped",
+            result: "the source conversation no longer belongs to the delegating bot",
+        });
+        return "settled";
+    }
     if (!target) {
         recordDelegationReceipt({
             id: item.id,
@@ -422,6 +453,23 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     }
     if (sender.approvePeerComms && !item.approvalAlreadyGranted) {
         const verdict = await requestPeerApproval(approvalBus, sender, target, item.message, "delegate_bot", sourceThreadId);
+        if (!pendingDelegations.get(sourceThreadId)?.some((candidate) => candidate.id === item.id))
+            return "settled";
+        // Approval may have waited for minutes. Revalidate before even reporting
+        // a denial, which otherwise recreates a deleted source transcript.
+        const current = bus.store.bot(item.toBotId);
+        const currentSender = bus.store.bot(from.id);
+        if (!current || !currentSender || !sourceThreadBelongsToBot(bus.store, currentSender.id, sourceThreadId)) {
+            recordDelegationReceipt({
+                id: item.id,
+                sourceThreadId,
+                toBotId: item.toBotId,
+                toBotName: target.name,
+                status: "dropped",
+                result: "the peer or source conversation no longer exists",
+            });
+            return "settled";
+        }
         if (verdict !== "allow") {
             recordDelegationReceipt({
                 id: item.id,
@@ -438,14 +486,11 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
             });
             return "settled";
         }
-        // The approval could have been sitting for up to 15 minutes. Everything
-        // checked above is a stale snapshot now: re-read both bots and re-check
-        // busy, or an allow can start a second turn on a bot that is mid-turn —
-        // and mirror a "Messaged @X" chip for an exchange that never happens.
-        const current = bus.store.bot(item.toBotId);
-        const currentSender = bus.store.bot(from.id);
-        if (!current || !currentSender || !sourceThreadBelongsToBot(bus.store, currentSender.id, sourceThreadId))
-            return "settled";
+        // A busy-target retry must not ask for the very same approval again.
+        item.approvalAlreadyGranted = true;
+        savePending();
+        // Recheck peer access and busy state too: an approval must not start a
+        // second turn or mirror an exchange that cannot actually happen.
         if (dropIfUnreachable(bus, currentSender, current, sourceThreadId, item)) {
             return "settled";
         }
@@ -490,7 +535,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     const reasonLine = item.reason ? `\n\n[Reason: ${item.reason}]` : "";
     const prefixed = `[Delegated by @${sender.name}, another bot in this OpenMausBot workspace. Do the work and reply directly.]\n\n${item.message}${reasonLine}`;
     await runTarget(item.toBotId, prefixed, item.depth + 1, sourceThreadId, channel, item.id, sender.id);
-    return "settled";
+    return "dispatched";
 }
 /** The source thread may be a bot's own task or a shared group where the
  * bot is a member. This is the same check the API gate uses for group turns. */