openmausbot 0.1.66 → 0.1.68

package/dist-server/server/local-computer-proxy.js

@@ -0,0 +1,28 @@
+// Near-side gate for the host CUA process. The descriptor and turn token
+// travel in environment variables, never command-line arguments or logs.
+import { runMcpBridge } from "./mcp-bridge.js";
+import { augmentedPath } from "./env-path.js";
+const { OMB_CUA_COMMAND: command, OMB_CUA_ARGS: encodedArgs, OMB_CONTROL_URL: url, OMB_CONTROL_TOKEN: token, ...childEnv } = process.env;
+let args;
+try {
+    const parsed = JSON.parse(encodedArgs ?? "");
+    const endpoint = new URL(url ?? "");
+    if (!command?.trim() || command.includes("\0") ||
+        !Array.isArray(parsed) || !parsed.every((arg) => typeof arg === "string" && !arg.includes("\0")) ||
+        !token || !["http:", "https:"].includes(endpoint.protocol) ||
+        !["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname) || endpoint.username || endpoint.password) {
+        throw new Error("invalid connection");
+    }
+    args = parsed;
+}
+catch {
+    process.stderr.write("invalid local computer proxy connection\n");
+    process.exit(2);
+}
+runMcpBridge({
+    command: command,
+    args,
+    env: { ...childEnv, PATH: augmentedPath() },
+    label: "Local Cua Driver",
+    gate: { url: url, token: token },
+});

package/dist-server/server/local-computer.js

@@ -1,6 +1,7 @@
 import { lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
+import { SPAWNED_PROXIES } from "./proxy-paths.js";
 export const REQUIRED_LINUX_TOOLS = ["click", "get_window_state", "list_apps", "type_text"];
 // Keep this exact field set synchronized with DRIVER_FILE_IDENTITY_KEYS in
 // electron/cua-linux.cjs; Electron publishes it and the server revalidates it.
@@ -14,6 +15,22 @@ export const DRIVER_FILE_IDENTITY_KEYS = [
     "mtimeNs",
     "ctimeNs",
 ];
+/** Keep the platform descriptor intact, but acquire computer authority only
+ * when the first actual tool call reaches the shared stdio gate. */
+export function gatedLocalComputer(connection, control) {
+    return {
+        ...connection,
+        command: process.execPath,
+        args: ["--experimental-strip-types", SPAWNED_PROXIES.localComputer],
+        env: {
+            ...connection.env,
+            OMB_CUA_COMMAND: connection.command,
+            OMB_CUA_ARGS: JSON.stringify(connection.args),
+            OMB_CONTROL_URL: control.url,
+            OMB_CONTROL_TOKEN: control.token,
+        },
+    };
+}
 function exactKeys(value, keys) {
     const expected = new Set(keys);
     return Object.keys(value).length === expected.size && Object.keys(value).every((key) => expected.has(key));

package/dist-server/server/mcp-bridge.js

@@ -1,5 +1,4 @@
-// The one stdio bridge behind both MCP entry points
-// (container-mcp.ts for the Local VM, vps-container-mcp.ts for the BYO VPS).
+// The shared stdio bridge for the host computer, Local VM, and BYO VPS.
 //
 // It is almost transparent — bytes in, bytes out — with two deliberate
 // near-side exceptions:
@@ -152,7 +151,7 @@ export function createGateInterceptor(options) {
                 options.forward(line);
                 return;
             }
-            const held = await options.isHeld().catch(() => false);
+            const held = await options.isHeld().catch(() => true);
             if (!held) {
                 options.forward(line);
                 return;
@@ -160,9 +159,10 @@ export function createGateInterceptor(options) {
             options.refuse(JSON.stringify({
                 jsonrpc: "2.0",
                 id: frame.id ?? null,
-                result: { content: [{ type: "text", text: refusalText }], isError: true },
+                result: { content: [{ type: "text", text: options.getRefusalReason?.() ?? refusalText }], isError: true },
             }));
         });
+        return queue;
     };
 }
 /** The near-side MCP method filter. `ping` is answered here so the bundled
@@ -175,8 +175,9 @@ export function createMcpBridgeInterceptor(options) {
             forward: options.forward,
             refuse: options.answer,
             refusalText: options.gate.refusalText,
+            getRefusalReason: options.gate.getRefusalReason,
         })
-        : options.forward;
+        : (line) => { options.forward(line); };
     return (line) => {
         let frame = null;
         try {
@@ -192,13 +193,13 @@ export function createMcpBridgeInterceptor(options) {
             }
             return;
         }
-        afterPing(line);
+        return afterPing(line);
     };
 }
 export function runMcpBridge(options) {
     const child = spawn(options.command, options.args, {
         shell: false,
-        env: { ...process.env, PATH: augmentedPath() },
+        env: options.env ?? { ...process.env, PATH: augmentedPath() },
         stdio: ["pipe", "pipe", "pipe"],
     });
     // docker may exit before it drains stdin; pipe() leaves this error unhandled.
@@ -207,24 +208,39 @@ export function runMcpBridge(options) {
     const client = options.gate
         ? createControlClient({ url: options.gate.url, token: options.gate.token })
         : null;
+    let refusalReason;
     const answer = (line) => process.stdout.write(line + "\n");
     const forward = (line) => child.stdin.write(line + "\n");
-    const inbound = createLineSplitter(createMcpBridgeInterceptor({
+    const intercept = createMcpBridgeInterceptor({
         answer,
         forward,
         ...(options.gate
             ? {
                 gate: {
-                    isHeld: async () => (await client.state(true)).held,
+                    isHeld: async () => {
+                        refusalReason = undefined;
+                        const state = await client.state(true);
+                        refusalReason = state.blockedReason;
+                        return state.held;
+                    },
+                    getRefusalReason: () => refusalReason,
                 },
             }
             : {}),
-    }));
+    });
+    let pendingInput = Promise.resolve();
+    const inbound = createLineSplitter((line) => {
+        const completion = intercept(line);
+        if (completion)
+            pendingInput = completion;
+    });
     const onStdin = (chunk) => inbound.push(chunk);
     process.stdin.on("data", onStdin);
     process.stdin.on("end", () => {
         inbound.flush();
-        child.stdin.end();
+        // A final tools/call can still be awaiting the control endpoint. Do not
+        // close the far end before the serialized gate has forwarded it.
+        void pendingInput.finally(() => child.stdin.end());
     });
     // Injected responses and refusals must never land inside one of the
     // child's half-written frames, so the child's stdout is re-emitted at

package/dist-server/server/peer-approval.js

@@ -31,9 +31,17 @@ function settleCard(pending, behavior, source) {
     });
     // answered (by whoever): the turn is working again — the same hand-back
     // the request.resolved fold does for a provider's card
-    const waiting = pending.bus.store.bot(pending.fromBotId);
-    if (waiting?.activity === "waiting-on-you")
-        pending.bus.store.setActivity(waiting.id, "working");
+    const store = pending.bus.store;
+    const task = store.projectBotForTask(pending.fromBotId, pending.threadId);
+    if (task) {
+        if (task.activity === "waiting-on-you")
+            store.setTaskActivity(task.id, pending.threadId, "working");
+    }
+    else if (store.groupByThread(pending.threadId)) {
+        const waiting = store.bot(pending.fromBotId);
+        if (waiting?.activity === "waiting-on-you")
+            store.setActivity(waiting.id, "working");
+    }
 }
 /** requestId → pending ask. Lives only in memory — restarting the
  * server cancels every in-flight approval, like provider permissions do. */
@@ -79,10 +87,15 @@ function pushApprovalCard(bus, from, target, message, action, requestId, sourceT
 function announceCard(bus, from, card, sourceThreadId) {
     // the bot is not working now — it is waiting on a person. A delegation
     // drained after its turn has already settled is idle, and stays so.
-    const live = bus.store.bot(from.id);
-    if (live?.busy)
-        bus.store.setActivity(from.id, "waiting-on-you");
+    const task = bus.store.projectBotForTask(from.id, sourceThreadId);
     const room = bus.store.groupByThread(sourceThreadId);
+    if (task) {
+        if (task.busy)
+            bus.store.setTaskActivity(from.id, sourceThreadId, "waiting-on-you");
+    }
+    else if (room && bus.store.bot(from.id)?.busy) {
+        bus.store.setActivity(from.id, "waiting-on-you");
+    }
     const group = room && !room.dm ? { id: room.id, name: room.name } : undefined;
     const title = card.card?.title ?? "";
     const detail = card.card?.subtitle ? `${title} — ${card.card.subtitle}` : title;

package/dist-server/server/proxy-paths.js

@@ -33,6 +33,7 @@ export function resolveProxy(relative) {
 export const SPAWNED_PROXIES = {
     browser: resolveProxy("browser-proxy"),
     computer: resolveProxy("computer-proxy"),
+    localComputer: resolveProxy("local-computer-proxy"),
     permission: resolveProxy("permission-proxy"),
     containerMcp: resolveProxy("container-mcp"),
     vpsContainerMcp: resolveProxy("vps-container-mcp"),

package/dist-server/server/routines.js

@@ -449,6 +449,10 @@ export class RoutineManager {
     isActiveThread(threadId) {
         return this.runs.some((run) => run.threadId === threadId && ["running", "waiting"].includes(run.status));
     }
+    runForThread(threadId) {
+        const run = this.runs.find((candidate) => candidate.threadId === threadId);
+        return run ? cloneRun(run) : null;
+    }
     create(input, request) {
         if (request) {
             const receipt = this.matchingRoutineRequestReceipt(request);
@@ -510,9 +514,15 @@ export class RoutineManager {
         if (this.targetState(clean) === "missing")
             throw new Error(this.missingTargetMessage(clean.target));
         const cancelledRuns = [];
+        const scheduleChanged = JSON.stringify(clean.schedule) !== JSON.stringify(routine.schedule);
+        const enabledChanged = clean.enabled !== routine.enabled;
         this.commitMutation(() => {
             Object.assign(routine, clean, {
-                nextRunAt: clean.enabled ? this.initialOccurrence(clean.schedule, now) : null,
+                // Renaming/editing instructions must not skip an occurrence that
+                // became due since the last tick (or erase an offline catch-up).
+                nextRunAt: !clean.enabled ? null : scheduleChanged || enabledChanged
+                    ? this.initialOccurrence(clean.schedule, now)
+                    : routine.nextRunAt,
                 // `updatedAt` doubles as the optimistic revision on durable routine
                 // confirmation cards. Keep it monotonic even for two writes in one ms.
                 updatedAt: Math.max(now, routine.updatedAt + 1),
@@ -868,7 +878,10 @@ export class RoutineManager {
                 this.save();
             for (const missed of missedRuns)
                 this.options.onRunFailed?.(missed);
-            for (const run of [...this.runs].reverse()) {
+            // Oldest queued requests have priority. New manual/webhook arrivals
+            // must not continually overtake work that has already waited. Snapshot
+            // the queue because each dispatch can asynchronously add/cancel work.
+            for (const run of this.runs.slice()) {
                 if (run.status !== "queued")
                     continue;
                 // A queued interval represents the latest useful check, not a backlog
@@ -949,9 +962,19 @@ export class RoutineManager {
         // completion and private coordinator envelope are only intermediate
         // protocol, never the routine receipt's result.
         if (run.target === "room-goal" &&
-            (event.type === "turn.completed" || (event.type === "item.completed" && event.itemType === "assistant_text")))
+            (
+            // These outcomes ended the goal operation. Later room traffic is
+            // not a resume of that run; only the goal lifecycle can change its
+            // receipt. In-flight provider approvals have no goalStatus and
+            // continue to resolve normally below.
+            run.goalStatus === "needs-input" || run.goalStatus === "paused" ||
+                event.type === "turn.completed" || (event.type === "item.completed" && event.itemType === "assistant_text")))
             return null;
-        if (event.type === "request.opened") {
+        if (event.type === "turn.started") {
+            run.status = "running";
+            run.attention = undefined;
+        }
+        else if (event.type === "request.opened") {
             run.status = "waiting";
             run.attention = redactSecretsInText(event.summary).trim().slice(0, 500) || undefined;
         }
@@ -971,16 +994,20 @@ export class RoutineManager {
             return null;
         }
         else if (event.type === "turn.completed") {
-            run.cost = event.cost;
-            run.denials = event.denials;
+            if (event.cost != null)
+                run.cost = (run.cost ?? 0) + event.cost;
+            if (event.denials?.length)
+                run.denials = [...new Set([...(run.denials ?? []), ...event.denials])];
             if (!event.ok) {
                 this.failRun(run, event.stopReason ?? run.error ?? "The bot did not complete this run");
                 queueMicrotask(() => void this.tick());
                 return cloneRun(run);
             }
-            run.status = "completed";
-            run.attention = undefined;
-            run.finishedAt = this.now();
+            const pending = this.options.hasPendingDelegations?.(event.threadId) === true;
+            run.status = pending ? "waiting" : "completed";
+            run.attention = pending ? "Waiting for delegated work to finish" : undefined;
+            if (!pending)
+                run.finishedAt = this.now();
             run.error = undefined;
         }
         else {

package/dist-server/server/service-cli.js

@@ -0,0 +1,63 @@
+// The `openmausbot service` command, kept separate from cli.ts so it can be
+// tested with explicit inputs: it renders the unit for this platform, writes
+// it next to the data, and prints the commands that install it.
+import { mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { currentUser, launchdPlist, servicePlan, systemdUnit, unstableInstallWarning } from "./service-unit.js";
+/** The `serve` arguments the service repeats, from the options given to `service install`. */
+export function serviceServeArgs(input) {
+    const args = ["--port", String(input.port), "--data-dir", input.dataDir, "--no-pair"];
+    if (input.domain)
+        args.push("--domain", input.domain);
+    else if (input.tunnel)
+        args.push("--tunnel");
+    else if (input.tailscale)
+        args.push("--tailscale");
+    if (input.label)
+        args.push("--label", input.label);
+    return args;
+}
+export function runServiceCommand(input, io) {
+    const platform = input.platform ?? process.platform;
+    const home = input.home ?? homedir();
+    const plan = servicePlan(platform, input.dataDir, home);
+    if (!plan) {
+        io.error("services are written for Linux (systemd) and macOS (launchd); on Windows, use Task Scheduler to run `openmausbot serve` at startup");
+        return 1;
+    }
+    if (input.action === "uninstall") {
+        io.log(`to stop and remove the service:`);
+        for (const line of plan.deactivate)
+            io.log(`  ${line}`);
+        return 0;
+    }
+    const warning = unstableInstallWarning(input.script);
+    if (warning) {
+        io.error(warning);
+        return 1;
+    }
+    const spec = {
+        node: input.node,
+        script: input.script,
+        serveArgs: serviceServeArgs(input),
+        dataDir: input.dataDir,
+        user: input.user ?? currentUser(),
+        home,
+        bindsLowPorts: Boolean(input.domain),
+        ...(input.label ? { label: input.label } : {}),
+    };
+    const rendered = platform === "darwin" ? launchdPlist(spec) : systemdUnit(spec);
+    mkdirSync(input.dataDir, { recursive: true, mode: 0o700 });
+    writeFileSync(plan.file, rendered, { mode: 0o644 });
+    io.log(`wrote ${plan.file}`);
+    io.log("");
+    io.log(platform === "darwin" ? "to install and start it (runs at login):" : "to install and start it (runs at boot, restarts if it stops):");
+    for (const line of plan.activate)
+        io.log(`  ${line}`);
+    io.log("");
+    if (input.domain && platform === "linux")
+        io.log("the unit grants Caddy the capability for ports 80 and 443, so no setcap is needed under the service");
+    io.log(`logs: ${platform === "darwin" ? `${input.dataDir}/logs/service.log` : "journalctl -u openmausbot -f"}`);
+    io.log(`change options later by running \`openmausbot service install\` again with the new ones, then: ${platform === "darwin" ? plan.activate[1] : "sudo systemctl daemon-reload && sudo systemctl restart openmausbot"}`);
+    return 0;
+}

package/dist-server/server/service-unit.js

@@ -0,0 +1,129 @@
+// `openmausbot service install`: keep the server running across reboots.
+// Renders a systemd unit (Linux) or a launchd agent (macOS) that runs the
+// same `openmausbot serve …` the operator just used, and either installs it
+// (when allowed to) or writes it next to the data and prints the two
+// commands that install it. Pure rendering lives here so it is testable;
+// the CLI decides where the file goes.
+import { homedir, userInfo } from "node:os";
+import { posix } from "node:path";
+// Unit files describe a Linux or macOS machine, so their paths are POSIX
+// whatever host renders them (the Windows CI runner included).
+const { basename, dirname, join } = posix;
+export const SYSTEMD_UNIT_NAME = "openmausbot.service";
+export const LAUNCHD_LABEL = "com.openmausbot.serve";
+function quoteSystemd(value) {
+    // systemd's ExecStart splits on whitespace and understands double quotes.
+    return /[\s"\\]/.test(value) ? `"${value.replace(/[\\"]/g, "\\$&")}"` : value;
+}
+function needsStripTypes(script) {
+    return script.endsWith(".ts");
+}
+export function serviceCommand(spec) {
+    return [spec.node, ...(needsStripTypes(spec.script) ? ["--experimental-strip-types"] : []), spec.script, "serve", ...spec.serveArgs];
+}
+export function systemdUnit(spec) {
+    const lines = [
+        "# Written by `openmausbot service install`. Re-run it to change the options.",
+        "[Unit]",
+        `Description=OpenMausBot${spec.label ? ` (${spec.label})` : ""}`,
+        "After=network-online.target",
+        "Wants=network-online.target",
+        "",
+        "[Service]",
+        "Type=simple",
+        `User=${spec.user}`,
+        `WorkingDirectory=${spec.home}`,
+        `Environment=HOME=${spec.home}`,
+        `Environment=OMB_DATA_DIR=${spec.dataDir}`,
+        `ExecStart=${serviceCommand(spec).map(quoteSystemd).join(" ")}`,
+        "Restart=always",
+        "RestartSec=3",
+        "KillMode=mixed",
+        "TimeoutStopSec=30",
+    ];
+    if (spec.bindsLowPorts) {
+        lines.push("# serve --domain: Caddy binds ports 80 and 443 without running as root.");
+        lines.push("AmbientCapabilities=CAP_NET_BIND_SERVICE");
+        lines.push("CapabilityBoundingSet=CAP_NET_BIND_SERVICE");
+    }
+    lines.push("", "[Install]", "WantedBy=multi-user.target", "");
+    return lines.join("\n");
+}
+function xml(value) {
+    return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+export function launchdPlist(spec) {
+    const args = serviceCommand(spec).map((arg) => `\t\t<string>${xml(arg)}</string>`).join("\n");
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        "<dict>",
+        "\t<key>Label</key>",
+        `\t<string>${LAUNCHD_LABEL}</string>`,
+        "\t<key>ProgramArguments</key>",
+        "\t<array>",
+        args,
+        "\t</array>",
+        "\t<key>EnvironmentVariables</key>",
+        "\t<dict>",
+        "\t\t<key>HOME</key>",
+        `\t\t<string>${xml(spec.home)}</string>`,
+        "\t\t<key>OMB_DATA_DIR</key>",
+        `\t\t<string>${xml(spec.dataDir)}</string>`,
+        "\t\t<key>PATH</key>",
+        "\t\t<string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin</string>",
+        "\t</dict>",
+        "\t<key>WorkingDirectory</key>",
+        `\t<string>${xml(spec.home)}</string>`,
+        "\t<key>RunAtLoad</key>",
+        "\t<true/>",
+        "\t<key>KeepAlive</key>",
+        "\t<true/>",
+        "\t<key>StandardOutPath</key>",
+        `\t<string>${xml(join(spec.dataDir, "logs", "service.log"))}</string>`,
+        "\t<key>StandardErrorPath</key>",
+        `\t<string>${xml(join(spec.dataDir, "logs", "service.log"))}</string>`,
+        "</dict>",
+        "</plist>",
+        "",
+    ].join("\n");
+}
+/** An `npx` cache path is pruned without notice; a service must not point at it. */
+export function unstableInstallWarning(script) {
+    const normalized = script.replace(/\\/g, "/");
+    if (/\/_npx\//.test(normalized) || /\/\.npm\/_npx\//.test(normalized)) {
+        return `this command runs from an npx cache (${dirname(script)}), which npm may delete at any time. Install it permanently first (npm install -g openmausbot) and run \`openmausbot service install\` from that install.`;
+    }
+    return null;
+}
+/** Where the rendered file goes and how to activate it, per platform. */
+export function servicePlan(platform, dataDir, home = homedir()) {
+    if (platform === "linux") {
+        const installed = `/etc/systemd/system/${SYSTEMD_UNIT_NAME}`;
+        return {
+            file: join(dataDir, SYSTEMD_UNIT_NAME),
+            installed,
+            activate: [`sudo install -m 644 ${join(dataDir, SYSTEMD_UNIT_NAME)} ${installed}`, "sudo systemctl daemon-reload", `sudo systemctl enable --now ${basename(SYSTEMD_UNIT_NAME, ".service")}`],
+            deactivate: [`sudo systemctl disable --now ${basename(SYSTEMD_UNIT_NAME, ".service")}`, `sudo rm ${installed}`, "sudo systemctl daemon-reload"],
+        };
+    }
+    if (platform === "darwin") {
+        const installed = join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+        return {
+            file: join(dataDir, `${LAUNCHD_LABEL}.plist`),
+            installed,
+            activate: [`mkdir -p ${dirname(installed)} && cp ${join(dataDir, `${LAUNCHD_LABEL}.plist`)} ${installed}`, `launchctl bootstrap gui/$(id -u) ${installed}`],
+            deactivate: [`launchctl bootout gui/$(id -u)/${LAUNCHD_LABEL}`, `rm ${installed}`],
+        };
+    }
+    return null;
+}
+export function currentUser() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return process.env.USER || process.env.USERNAME || "openmausbot";
+    }
+}

package/dist-server/server/sessions.js

@@ -66,6 +66,9 @@ const sessionSchema = z.object({
     createdAt: z.number(),
     lastSeenAt: z.number(),
     expiresAt: z.number(),
+    /** Set when the session came from an account sign-in rather than a code. */
+    userId: z.string().max(256).optional(),
+    email: z.string().max(320).optional(),
 });
 const fileSchema = z.object({ version: z.literal(1), sessions: z.array(sessionSchema) });
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
@@ -102,7 +105,7 @@ export function formatPairingCode(code) {
     return code.match(/.{1,4}/g)?.join("-") ?? code;
 }
 function publicSession(record) {
-    return {
+    const view = {
         id: record.id,
         label: record.label,
         scopes: [...record.scopes],
@@ -110,6 +113,9 @@ function publicSession(record) {
         lastSeenAt: record.lastSeenAt,
         expiresAt: record.expiresAt,
     };
+    if (record.email)
+        view.email = record.email;
+    return view;
 }
 export class SessionRegistry {
     sessions = [];
@@ -284,6 +290,41 @@ export class SessionRegistry {
             this.replays.push({ codeHash: presented, attemptId, result, expiresAt: now + EXCHANGE_REPLAY_MS });
         return result;
     }
+    /** A session from a verified account sign-in (server/account-signin.ts)
+     * rather than a pairing code: same token, same term, same gates. */
+    issue(input) {
+        this.prune();
+        const now = this.now();
+        const token = `omb_sess_${randomBytes(32).toString("base64url")}`;
+        const record = {
+            id: randomUUID(),
+            tokenHash: sha256(token),
+            label: (input.label.trim() || "Unnamed device").slice(0, 80),
+            scopes: [...new Set(input.scopes)],
+            createdAt: now,
+            lastSeenAt: now,
+            expiresAt: now + Math.min(SESSION_TTL_MS, SESSION_MAX_AGE_MS),
+        };
+        if (input.userId)
+            record.userId = input.userId;
+        if (input.email)
+            record.email = input.email;
+        this.sessions.push(record);
+        this.lastSeenWrites.set(record.id, now);
+        this.persist();
+        return { token, session: publicSession(record) };
+    }
+    /** The pairing lockout, for other code-like exchanges on the same source. */
+    attemptAllowed(source) {
+        const lock = this.lockState(source);
+        return lock.locked ? { ok: false, retryAfterMs: lock.retryAfterMs } : { ok: true };
+    }
+    noteFailure(source) {
+        this.recordFailure(source);
+    }
+    clearFailures(source) {
+        this.failures.delete(source);
+    }
     // ── sessions ───────────────────────────────────────────────────────────
     authenticate(token) {
         if (!token)

package/dist-server/server/steer-queue.js

@@ -32,28 +32,31 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         prompt: options.prompt ?? text,
         replyToId: options.replyToId,
         sendId: options.sendId,
+        reason: options.reason,
     });
     queues.set(threadId, entry);
     return { id };
 }
-/** Drain every queue whose bot is idle: append the held lines (leaf is now
+/** Drain every queue whose task is idle: append the held lines (leaf is now
  * the finished turn's last item), then one run per thread whose prompt is
  * the texts separated by a blank line. `userMessage` is the last appended line
  * so startTurn does not duplicate it; `excludeIds` is every drained line
  * so transcript-replay adapters do not also see earlier queued texts.
  * Entries leave the map BEFORE running so a settle racing another settle
  * can never fire the same queue twice. */
-export function drainSteeredMessages(store, run) {
+export function drainSteeredMessages(store, run, isBlocked) {
     // deleting only the entry being visited is safe under Map iteration
     for (const [threadId, entry] of queues) {
-        const bot = store.bot(entry.botId);
+        const bot = store.projectBotForTask
+            ? store.projectBotForTask(entry.botId, threadId)
+            : store.bot(entry.botId);
         if (!bot) {
-            // the bot was deleted while messages waited — nothing left to steer
+            // the bot or task was deleted while messages waited
             queues.delete(threadId);
             continue;
         }
-        if (bot.busy)
-            continue; // still working — the next settle tries again
+        if (bot.busy || isBlocked?.(entry.botId, threadId))
+            continue;
         // committed to draining: the entry leaves the map before anything runs,
         // so a settle racing another settle can never fire the same queue twice
         queues.delete(threadId);
@@ -87,15 +90,15 @@ export function queuedSteeredMessage(botId, threadId, sendId) {
     if (!entry || entry.botId !== botId)
         return null;
     const item = entry.items.find((candidate) => candidate.sendId === sendId);
-    return item ? { id: item.messageId, text: item.text, replyToId: item.replyToId } : null;
+    return item ? { id: item.messageId, text: item.text, replyToId: item.replyToId, ...(item.reason ? { reason: item.reason } : {}) } : null;
 }
 /** Drop one waiting send owned by this bot so it never drains. The queue id
  * is stable even if the bot switches away from the task while the request is
  * in flight. Returns false when it was already drained, belongs to another
  * bot, or a restart lost the in-memory auto-run intent. */
-export function cancelSteeredMessage(botId, messageId) {
+export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
     for (const [threadId, entry] of queues) {
-        if (entry.botId !== botId)
+        if (entry.botId !== botId || (expectedThreadId !== undefined && threadId !== expectedThreadId))
             continue;
         const items = entry.items.filter((item) => item.messageId !== messageId);
         if (items.length === entry.items.length)