openmausbot 0.1.69 → 0.1.71

package/dist-server/server/routines.js

@@ -449,6 +449,7 @@ export class RoutineManager {
                         timeoutMinutes: loadTimeoutMinutes(routine.timeoutMinutes),
                         attachments: loadAttachments(routine.attachments),
                         sourceThreadId: persistedSourceThreadId.parse(routine.sourceThreadId),
+                        resultsThreadId: persistedSourceThreadId.parse(routine.resultsThreadId),
                     };
                     if (loaded.timeoutMinutes === undefined)
                         delete loaded.timeoutMinutes;
@@ -467,6 +468,7 @@ export class RoutineManager {
                         timeoutMinutes: loadTimeoutMinutes(run.timeoutMinutes),
                         attachments: loadAttachments(run.attachments),
                         sourceThreadId: persistedSourceThreadId.parse(run.sourceThreadId),
+                        resultsThreadId: persistedSourceThreadId.parse(run.resultsThreadId),
                     };
                     if (loaded.timeoutMinutes === undefined)
                         delete loaded.timeoutMinutes;
@@ -619,11 +621,12 @@ export class RoutineManager {
             createdAt: at,
             updatedAt: at,
         };
+        const discardResults = this.applyResultsInput(routine, input.resultsThreadId);
         this.commitMutation(() => {
             this.routines.unshift(routine);
             if (request)
                 this.rememberRoutineRequest(request, routine.id, at);
-        });
+        }, discardResults);
         this.emitRoutine(routine);
         return cloneRoutine(routine);
     }
@@ -664,9 +667,14 @@ export class RoutineManager {
         if (clean.schedule.type === "interval" && clean.enabled && nextRunAt === null) {
             throw new Error("This interval has no future runs. Choose a later end date or turn it off.");
         }
+        const destination = { ...routine, ...clean };
+        if (destination.botId !== routine.botId)
+            delete destination.resultsThreadId;
+        const discardResults = this.applyResultsInput(destination, patch.resultsThreadId);
         const cancelledRuns = [];
         this.commitMutation(() => {
             Object.assign(routine, clean, {
+                resultsThreadId: destination.resultsThreadId,
                 nextRunAt,
                 // `updatedAt` doubles as the optimistic revision on durable routine
                 // confirmation cards. Keep it monotonic even for two writes in one ms.
@@ -692,7 +700,7 @@ export class RoutineManager {
             }
             if (request)
                 this.rememberRoutineRequest(request, routine.id, now);
-        });
+        }, discardResults);
         for (const run of cancelledRuns)
             this.emitRun(run);
         this.emitRoutine(routine);
@@ -803,15 +811,19 @@ export class RoutineManager {
         if (!routine)
             return null;
         let run;
+        const allocations = [];
+        const previousDestination = routine.resultsThreadId;
         this.commitMutation(() => {
-            run = this.newRun(routine, this.now(), true);
-            // A chat-confirmed "run now" reports back to the conversation that
-            // invoked this one run. It must not silently rebind future schedules.
+            run = this.newRun(routine, this.now(), true, allocations, request?.threadId ?? routine.sourceThreadId);
+            // Preserve the invoking chat as provenance/fallback for this run.
+            // An explicitly configured results destination continues to win.
             if (request)
                 run.sourceThreadId = request.threadId;
             if (request)
                 this.rememberRoutineRequest(request, run.id, this.now());
-        });
+        }, () => this.discardResultsThreads(allocations));
+        if (routine.resultsThreadId !== previousDestination)
+            this.emitRoutine(routine);
         this.emitRun(run);
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
@@ -978,55 +990,57 @@ export class RoutineManager {
                     await this.options.interruptTurn?.(run.botId, threadId, run.runOn ?? "maus").catch(() => { });
                 }
             }
-            let changed = false;
-            const missedRuns = [];
-            for (const routine of this.routines) {
-                if (!routine.enabled || routine.nextRunAt == null || routine.nextRunAt > now)
-                    continue;
-                const pendingAt = routine.nextRunAt;
-                const late = now - pendingAt;
-                const scheduledFor = routine.schedule.type === "interval" && late <= CATCH_UP_MS
-                    ? latestIntervalOccurrence(routine.schedule, now) ?? pendingAt
-                    : pendingAt;
-                // One slow interval run must not build an unbounded queue of stale
-                // copies behind it. The series still advances on its original phase.
-                const overlapping = routine.schedule.type === "interval" && this.runs.some((run) => run.routineId === routine.id && ["queued", "running", "waiting"].includes(run.status));
-                if (!overlapping) {
-                    if (late > CATCH_UP_MS) {
-                        const missed = this.newRun(routine, scheduledFor, false);
-                        missed.status = "missed";
-                        missed.finishedAt = now;
-                        missed.error = "This computer was offline for more than 12 hours after the scheduled time";
-                        this.emitRun(missed);
-                        missedRuns.push(cloneRun(missed));
-                    }
-                    else {
-                        const run = this.newRun(routine, scheduledFor, false);
-                        this.emitRun(run);
+            const dueRoutines = this.routines.filter((routine) => routine.enabled && routine.nextRunAt != null && routine.nextRunAt <= now);
+            const scheduledRuns = [];
+            const allocations = [];
+            if (dueRoutines.length > 0) {
+                this.commitMutation(() => {
+                    for (const routine of dueRoutines) {
+                        const pendingAt = routine.nextRunAt;
+                        const late = now - pendingAt;
+                        const scheduledFor = routine.schedule.type === "interval" && late <= CATCH_UP_MS
+                            ? latestIntervalOccurrence(routine.schedule, now) ?? pendingAt
+                            : pendingAt;
+                        // One slow interval run must not build an unbounded queue of stale
+                        // copies behind it. The series still advances on its original phase.
+                        const overlapping = routine.schedule.type === "interval" && this.runs.some((run) => run.routineId === routine.id && ["queued", "running", "waiting"].includes(run.status));
+                        if (!overlapping) {
+                            const run = this.newRun(routine, scheduledFor, false, allocations);
+                            if (late > CATCH_UP_MS) {
+                                run.status = "missed";
+                                run.finishedAt = now;
+                                run.error = "This computer was offline for more than 12 hours after the scheduled time";
+                            }
+                            scheduledRuns.push(run);
+                        }
+                        routine.nextRunAt =
+                            routine.schedule.type === "once" ? null : nextOccurrence(routine.schedule, Math.max(now, scheduledFor));
+                        // `updatedAt` is the optimistic definition revision carried by
+                        // routine confirmation cards. Moving the scheduler cursor is runtime
+                        // progress, not a definition edit, so recurring ticks must not make a
+                        // still-accurate pending confirmation stale. A one-time routine does
+                        // mutate its definition by auto-disabling after its occurrence.
+                        if (routine.schedule.type === "once") {
+                            routine.enabled = false;
+                            routine.updatedAt = Math.max(now, routine.updatedAt + 1);
+                        }
+                        else if (routine.schedule.type === "interval" && routine.nextRunAt === null) {
+                            routine.enabled = false;
+                            routine.updatedAt = Math.max(now, routine.updatedAt + 1);
+                        }
                     }
-                }
-                routine.nextRunAt =
-                    routine.schedule.type === "once" ? null : nextOccurrence(routine.schedule, Math.max(now, scheduledFor));
-                // `updatedAt` is the optimistic definition revision carried by
-                // routine confirmation cards. Moving the scheduler cursor is runtime
-                // progress, not a definition edit, so recurring ticks must not make a
-                // still-accurate pending confirmation stale. A one-time routine does
-                // mutate its definition by auto-disabling after its occurrence.
-                if (routine.schedule.type === "once") {
-                    routine.enabled = false;
-                    routine.updatedAt = Math.max(now, routine.updatedAt + 1);
-                }
-                else if (routine.schedule.type === "interval" && routine.nextRunAt === null) {
-                    routine.enabled = false;
-                    routine.updatedAt = Math.max(now, routine.updatedAt + 1);
-                }
+                }, () => this.discardResultsThreads(allocations));
+            }
+            // Reporting may persist transcript cards, so publish only after the
+            // scheduler batch (including each destination) is durable.
+            for (const routine of dueRoutines)
                 this.emitRoutine(routine);
-                changed = true;
+            for (const run of scheduledRuns)
+                this.emitRun(run);
+            for (const run of scheduledRuns) {
+                if (run.status === "missed")
+                    this.options.onRunFailed?.(cloneRun(run));
             }
-            if (changed)
-                this.save();
-            for (const missed of missedRuns)
-                this.options.onRunFailed?.(missed);
             // Oldest queued requests have priority. New manual/webhook arrivals
             // must not continually overtake work that has already waited. Snapshot
             // the queue because each dispatch can asynchronously add/cancel work.
@@ -1262,7 +1276,16 @@ export class RoutineManager {
             return schedule.at;
         return nextOccurrence(schedule, now);
     }
-    newRun(routine, scheduledFor, manual) {
+    newRun(routine, scheduledFor, manual, allocations, sourceThreadId = routine.sourceThreadId) {
+        if (routine.target === "bot" && this.options.resolveResultsThread) {
+            const destination = this.options.resolveResultsThread({ ...routine, sourceThreadId }, false);
+            if (destination !== routine.resultsThreadId) {
+                if (destination)
+                    allocations.push({ botId: routine.botId, threadId: destination });
+                routine.resultsThreadId = destination;
+                routine.updatedAt = Math.max(this.now(), routine.updatedAt + 1);
+            }
+        }
         const run = {
             id: randomUUID(),
             routineId: routine.id,
@@ -1279,12 +1302,44 @@ export class RoutineManager {
             status: "queued",
             manual,
             triggerSource: manual ? "manual" : "schedule",
-            sourceThreadId: routine.sourceThreadId,
+            sourceThreadId,
+            resultsThreadId: routine.resultsThreadId,
             createdAt: this.now(),
         };
         this.runs.push(run);
         return run;
     }
+    discardResultsThreads(allocations) {
+        for (const { botId, threadId } of allocations) {
+            try {
+                this.options.discardResultsThread?.(botId, threadId);
+            }
+            catch (error) {
+                console.error("routine: could not discard uncommitted results thread", error);
+            }
+        }
+    }
+    applyResultsInput(routine, value) {
+        if (routine.target !== "bot") {
+            if (value != null)
+                throw Object.assign(new Error("Results threads are only available for bot routines"), { status: 400 });
+            delete routine.resultsThreadId;
+            return;
+        }
+        if (value === undefined)
+            return;
+        if (value === null) {
+            const destination = this.options.resolveResultsThread?.(routine, true);
+            if (!destination)
+                throw new Error("Could not create a results thread for this routine");
+            routine.resultsThreadId = destination;
+            return () => this.options.discardResultsThread?.(routine.botId, destination);
+        }
+        if (typeof value !== "string" || !value.trim() || !this.options.isResultsThread?.(routine.botId, value.trim())) {
+            throw Object.assign(new Error("Choose a visible results thread belonging to this bot"), { status: 400 });
+        }
+        routine.resultsThreadId = value.trim();
+    }
     emitRoutine(routine) {
         this.options.emit?.({ kind: "routine", routine: cloneRoutine(routine) });
     }
@@ -1331,7 +1386,7 @@ export class RoutineManager {
      * state if writing or renaming that file fails so a retry cannot mistake an
      * uncommitted action for a durable one.
      */
-    commitMutation(mutate) {
+    commitMutation(mutate, rollback) {
         const before = {
             routines: this.routines.map(cloneRoutine),
             runs: this.runs.map(cloneRun),
@@ -1345,6 +1400,12 @@ export class RoutineManager {
             this.routines = before.routines;
             this.runs = before.runs;
             this.routineRequestReceipts = before.receipts;
+            try {
+                rollback?.();
+            }
+            catch (cleanupError) {
+                console.error("routine: could not discard uncommitted results thread", cleanupError);
+            }
             throw error;
         }
     }

package/dist-server/server/screen-frame-gate.js

@@ -73,13 +73,16 @@ const SCREEN_TOUCHING_TOOLS = new Set([
     "bring_to_front",
     "zoom",
 ]);
-/** The same tool reaches the poke site under three spellings: the Claude
- * driver's `mcp__computer__click`, Codex's bare `click`, and pi's
- * `computer_click` (server_tool, lowercased). A server prefix is stripped
+// Keep legacy MCP namespaces accepted; desktop server__tool names follow
+// MCP_NAME in mcp-registry.ts (lowercase letters, digits, underscores, hyphens).
+const TOOL_NAMESPACE = /^(?:mcp__.+?|[a-z][a-z0-9_-]{0,31})__/;
+/** The same tool reaches the poke site as `mcp__computer__click`,
+ * `computer__click`, bare `click`, or pi's `computer_click`.
+ * A single-underscore server prefix is stripped
  * at most once, so pi's `computer_computer_exec` lands on `computer_exec`
  * — still a shell — and never on a bare `exec`. */
 export function screenTouchingTool(toolName) {
-    const bare = toolName.toLowerCase().replace(/^mcp__.+?__/, "");
+    const bare = toolName.toLowerCase().replace(TOOL_NAMESPACE, "");
     return SCREEN_TOUCHING_TOOLS.has(bare) || SCREEN_TOUCHING_TOOLS.has(bare.replace(/^(?:computer|browser)_/, ""));
 }
 /** sha256 over the base64 frame — the same fingerprint the model-side
@@ -104,9 +107,9 @@ export function screenSurfaceForTool(toolName) {
     // in agent-browser. Keep the server identity before stripping prefixes.
     if (name.startsWith("mcp__computer__") || name.startsWith("computer_"))
         return "computer";
-    if (name.startsWith("mcp__browser__"))
+    if (name.startsWith("mcp__browser__") || name.startsWith("browser__"))
         return "browser";
-    const bare = name.replace(/^mcp__.+?__/, "");
+    const bare = name.replace(TOOL_NAMESPACE, "");
     // Codex reports bare names. These two belong to computer-proxy; the
     // standalone browser now uses the unambiguous agent_browser_* names.
     if (bare === "browser_click" || bare === "browser_fill")

package/dist-server/server/skill-library.js

@@ -64,9 +64,9 @@ export function loadBundledSkills(root = process.env.OMB_SKILLS_DIR || join(proc
     }
     return skills;
 }
-/** User-authored skills are hot-loaded on each turn so a just-recorded skill
- * works without restarting the desktop app. One hand-edited broken folder is
- * isolated instead of taking down every bot turn. */
+/** User skills are hot-loaded on each turn so a skill that was just enabled
+ * or hand-authored works without restarting the desktop app. One broken
+ * folder is isolated instead of taking down every bot turn. */
 export function loadUserSkills(root) {
     if (!existsSync(root))
         return [];
@@ -85,8 +85,8 @@ export function loadUserSkills(root) {
                 skills.push(skill);
         }
         catch {
-            // The recorder always writes atomically validated folders, but people
-            // are free to edit them later. A malformed edit disables only itself.
+            // Skills the app writes are validated first, but people are free to
+            // hand-edit the folders later. A malformed edit disables only itself.
         }
     }
     return skills;

package/dist-server/server/steer-queue.js

@@ -57,11 +57,27 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         replyToId: options.replyToId,
         sendId: options.sendId,
         reason: options.reason,
+        unattended: options.unattended,
     });
     queues.set(threadId, entry);
     changed();
     return { id };
 }
+/** Where a thread stands among this bot's threads waiting for a free slot:
+ * 1 for the next to start. The drain visits queues in insertion order, so
+ * insertion order is the line. Null when nothing of this bot's is waiting
+ * on that thread. */
+export function queuedThreadPosition(botId, threadId) {
+    let position = 0;
+    for (const [candidate, entry] of queues) {
+        if (entry.botId !== botId || !entry.items.some((item) => item.reason === "capacity"))
+            continue;
+        position += 1;
+        if (candidate === threadId)
+            return position;
+    }
+    return null;
+}
 /** Drain every queue whose task is idle: append the held lines (leaf is now
  * the finished turn's last item), then one run per thread whose prompt is
  * the texts separated by a blank line. `userMessage` is the last appended line
@@ -108,7 +124,10 @@ export function drainSteeredMessages(store, run, isBlocked) {
         // message into one HTML block, which makes that attachment stop being a
         // native image when the combined follow-up is dispatched.
         const prompt = entry.items.map((item) => item.prompt).join("\n\n");
-        void run(entry.botId, threadId, prompt, last, appended.map((message) => message.id));
+        void run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
+        // one unattended line makes the whole drained turn unattended: a
+        // person's words in the same queue cannot re-attend a bot's own
+        entry.items.some((item) => item.unattended === true));
     }
 }
 /** Find the receipt for a retry whose message is still waiting to drain. */

package/dist-server/server/store.js

@@ -26,10 +26,12 @@ export function isProjectEmoji(value) {
 const TASK_PATCH_FIELDS = [
     "title", "projectId", "modelSelection", "approvalMode", "autoApprove", "alwaysAllow",
     "unread", "rewound", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
+    "routineRunId",
 ];
 /** Everything the BOT authored is scrubbed of content-shaped secrets before
  * it is stored: its reply text, a tool title (an ACP engine's title can be
- * the whole command line), a permission card's summary. What the user typed
+ * the whole command line) and the command beside it, a permission card's
+ * summary. What the user typed
  * is theirs and stays as typed. Stored, not just displayed: the transcript
  * is replayed into every rebuild, and a leaked key would otherwise be
  * permanent. */
@@ -39,8 +41,11 @@ function redactBotAuthored(message) {
     const out = { ...message };
     if (typeof out.text === "string")
         out.text = redactSecretsInText(out.text);
-    if (out.tool?.name)
+    if (out.tool?.name) {
         out.tool = { ...out.tool, name: redactSecretsInText(out.tool.name) };
+        if (out.tool.summary)
+            out.tool.summary = redactSecretsInText(out.tool.summary);
+    }
     if (out.routineRun) {
         const routineRun = { ...out.routineRun };
         routineRun.routineName = redactSecretsInText(routineRun.routineName);
@@ -541,7 +546,7 @@ export class Store {
         return () => this.listeners.delete(listener);
     }
     emit(change) {
-        for (const listener of [...this.listeners]) {
+        for (const listener of Array.from(this.listeners)) {
             try {
                 listener(change);
             }
@@ -1444,7 +1449,7 @@ export class Store {
     }
     /** A fresh context on the same bot: new thread, new session, same
      * persona/tools/computer. Becomes the active task. */
-    createTask(botId, title, activate = true, projectId) {
+    createTask(botId, title, activate = true, projectId, openedBy) {
         const bot = this.bot(botId);
         if (!bot)
             return null;
@@ -1455,6 +1460,7 @@ export class Store {
             title: title?.trim().slice(0, 80) || UNTITLED_THREAD,
             createdAt: Date.now(),
             ...(projectId ? { projectId } : {}),
+            ...(openedBy ? { openedBy: structuredClone(openedBy) } : {}),
             resumeCursors: {},
             modelSelection: structuredClone(bot.modelSelection),
             approvalMode: approvalModeFor(bot),
@@ -1472,6 +1478,20 @@ export class Store {
         this.emit({ type: "bot", botId });
         return task;
     }
+    /** Attach (or complete) the opener record after the thread exists — the
+     * handoff id is only known once the thread it targets has an id, so a
+     * peer-opened thread is created first and stamped second. Never reachable
+     * from the HTTP task PATCH: openedBy is not a TASK_PATCH_FIELD. */
+    setTaskOpenedBy(botId, threadId, openedBy) {
+        const bot = this.bot(botId);
+        const task = this.taskByThread(botId, threadId);
+        if (!bot || !task)
+            return null;
+        task.openedBy = structuredClone(openedBy);
+        this.saveBots();
+        this.emit({ type: "bot", botId });
+        return task;
+    }
     switchTask(botId, threadId) {
         const bot = this.bot(botId);
         const task = bot?.tasks?.find((t) => t.threadId === threadId);
@@ -1503,10 +1523,12 @@ export class Store {
         if (!bot.tasks.some((t) => t.threadId === threadId))
             return null;
         bot.tasks = bot.tasks.filter((t) => t.threadId !== threadId);
-        this.deleteThreadRecord(threadId);
-        if (bot.threadId === threadId) {
-            this.mirrorActiveTask(bot, bot.tasks[0]);
+        const visible = bot.tasks.find((task) => !task.routineRunId)
+            ?? this.createTask(botId, undefined, bot.threadId === threadId);
+        if (bot.threadId === threadId || this.taskByThread(botId, bot.threadId)?.routineRunId) {
+            this.mirrorActiveTask(bot, visible);
         }
+        this.deleteThreadRecord(threadId);
         bot.unread = bot.tasks.some((task) => task.unread);
         this.refreshBotActivity(bot);
         this.saveBots();

package/dist-server/server/system-prompt.js

@@ -6,6 +6,17 @@
 // The sentences that both the direct-turn and room-turn paths use live
 // here too, so neither path can drift from the other or from the preview.
 import { soulSystemPrompt } from "./bot-folder.js";
+/** Sections whose text legitimately differs between two turns of one live
+ * conversation: memory, because a bot writes to MEMORY.md mid-conversation,
+ * and mentions, which describe the message being sent right now.
+ *
+ * They are reported apart from the rest so a driver that keeps one CLI
+ * process per thread can key that process on the stable half. Before this
+ * split, saving a memory changed the system prompt, which changed the spawn
+ * contract, which relaunched the CLI — and the provider then re-uploaded the
+ * entire conversation at the cache-write rate. Mentions did the same on any
+ * turn that tagged a bot. */
+const VOLATILE_SECTIONS = new Set(["memory", "mentions"]);
 export function buildSystemPrompt(persona, soul, parts) {
     const ordered = [
         { id: "persona", label: "Identity", text: persona },
@@ -15,7 +26,8 @@ export function buildSystemPrompt(persona, soul, parts) {
     const sections = ordered
         .filter((part) => part.text.length > 0)
         .map((part) => ({ ...part, bytes: Buffer.byteLength(part.text, "utf8") }));
-    return { text: sections.map((section) => section.text).join(""), sections };
+    const halves = (volatile) => sections.filter((section) => VOLATILE_SECTIONS.has(section.id) === volatile).map((section) => section.text).join("");
+    return { text: sections.map((section) => section.text).join(""), sections, stable: halves(false), volatile: halves(true) };
 }
 const PROTECTED_INPUT_GUARD = " At a sign-in, password, MFA, CAPTCHA, or other protected-input step, stop and ask the user to complete it on the visible computer. Never type their password or ask them to paste a password or one-time code into chat.";
 const COMPUTER_PARAGRAPH = {
@@ -36,6 +48,7 @@ export function computerPrompt(kind) {
 }
 export const COMPOSIO_PROMPT = " The user's connected apps (Gmail, Calendar, Slack, Notion, and the rest) are reachable through the composio tools — find the right one with COMPOSIO_SEARCH_TOOLS, read its arguments with COMPOSIO_GET_TOOL_SCHEMAS, then run it with COMPOSIO_MULTI_EXECUTE_TOOL. Reach for them before telling the user you have no access to a service.";
 export const CREDENTIAL_PROMPT = " If a supported API key is missing, use request_credential to create a secure credential request. A freshly QR-paired mobile app or the desktop app can show the secure entry card. Never claim it opened unless the request succeeded, and never ask the user to paste credentials into chat.";
+export const THREADS_PROMPT = " A thread is one conversation with its own history and its own run; a bot can have several running at once, and the person sees them as rows under that bot. Use start_thread to open one on yourself for separate work, or on a teammate to hand them a job that should run on its own. Use list_threads to see how the ones you opened are going. When you mention a thread to the person, write its title as #Title so it links. Do not use a ticket comment, a note, or a room post as a stand-in for a thread.";
 export const ROUTINE_PROMPT = " If the user explicitly asks to list or review, schedule, run, or change routines, use list_routines and propose_routine or propose_routine_action. A proposal is not applied until the user confirms its in-app card, so never claim the action completed before that confirmation.";
 export const ROUTINE_EXECUTION_PROMPT = " Execute this routine now: use available peer tools for required handoffs rather than merely announcing that you will wait; after an accepted delegation, end this turn for automatic resumption, and report a concrete blocker if no handoff is possible.";
 export const LEARN_PROMPT = " If the user sends /learn or asks you to save a reusable procedure from this work, use skills_list and skill_manage. Create new skills; update an existing learned skill only when the user explicitly asks to revise that exact name. Include source provenance and wait for the review card decision.";

package/dist-server/server/team-backup.js

@@ -2,6 +2,38 @@ import { newId } from "./contracts.js";
 import { botMascotBody } from "../shared/mascot-bodies.js";
 import { takeImportName } from "../shared/import-name.js";
 import { MAX_TEAM_BACKUP_BYTES, parseTeamBackup } from "../shared/team-backup.js";
+import { redactSecretsInText } from "./redact.js";
+import { listMemoryLogs, listMemoryTopics, readMemoryFile, readMemoryLog, readMemoryTopic, writeMemoryFile, writeMemoryLog, writeMemoryTopic, } from "./workspace.js";
+/** A bot's memory as it travels: MEMORY.md, every topic file, every daily
+ * log — scrubbed on the way out, because a file the bot's own file tools
+ * wrote never passed the server's scrub. Absent when the bot has none, so
+ * a backup of a bot that never remembered anything is unchanged. */
+function memoryFor(botId) {
+    const file = redactSecretsInText(readMemoryFile(botId).text);
+    const topics = listMemoryTopics(botId).flatMap((topic) => {
+        const text = readMemoryTopic(botId, topic.name);
+        return text === null ? [] : [{ name: topic.name, text: redactSecretsInText(text) }];
+    });
+    const logs = listMemoryLogs(botId).flatMap((name) => {
+        const text = readMemoryLog(botId, name);
+        return text === null ? [] : [{ name, text: redactSecretsInText(text) }];
+    });
+    if (!file && !topics.length && !logs.length)
+        return undefined;
+    return { file, topics, logs };
+}
+/** Restore a bot's memory into its fresh workspace: the same writers the
+ * tool and the editor use, so modes (0700 folders, 0600 files), the scrub
+ * and the search index all come for free. Runs before any transcript is
+ * restored, inside the import's rollback — deleteBot removes the workspace. */
+function restoreMemory(botId, memory) {
+    if (memory.file)
+        writeMemoryFile(botId, memory.file);
+    for (const topic of memory.topics)
+        writeMemoryTopic(botId, topic.name, topic.text);
+    for (const log of memory.logs)
+        writeMemoryLog(botId, log.name, log.text);
+}
 /** Preserve readable history without importing executable cards, live queue
  * entries, approval requests, local paths or provider session handles. */
 function messageText(message) {
@@ -29,6 +61,11 @@ export function createTeamBackup(store, routines, name) {
         const tasks = record.tasks?.length ? record.tasks : [{ threadId: record.threadId, title: "Conversation", createdAt: record.createdAt }];
         return tasks.map((task) => ({
             key: task.threadId, title: task.title, createdAt: task.createdAt,
+            // Who opened the thread travels; the handoff id does not — the
+            // delegation ledger is process-local and never part of a backup.
+            openedBy: "openedBy" in task && task.openedBy
+                ? { botId: task.openedBy.botId, name: task.openedBy.name, at: task.openedBy.at }
+                : undefined,
             activeLeafId: store.activeLeaf(task.threadId),
             messages: store.messagesFor(task.threadId).map((message) => ({
                 id: message.id, role: message.role, text: messageText(message), at: message.at,
@@ -64,6 +101,7 @@ export function createTeamBackup(store, routines, name) {
             section: bot.section, color: bot.color,
             mascotExpression: bot.mascotExpression ?? undefined, mascotBody: bot.mascotBody ?? undefined,
             chiefOfStaff: Boolean(bot.chiefOfStaff), hidden: Boolean(bot.hidden), playbooks: bot.playbooks ?? [],
+            memory: memoryFor(bot.id),
             activeTask: bot.threadId, tasks: history(bot),
         })),
         groups,
@@ -128,13 +166,24 @@ export function importTeamBackup(store, routines, input, selection) {
             botIds.set(source.key, bot.id);
             store.patchBot(bot.id, { composio: false, computer: "off", browser: false, approvalMode: "ask", autoApprove: false,
                 hidden: source.hidden, chiefOfStaff: source.chiefOfStaff, playbooks: source.playbooks });
+            if (source.memory)
+                restoreMemory(bot.id, source.memory);
         }
         for (const source of backup.bots) {
             const bot = store.bot(botIds.get(source.key));
-            const tasks = source.tasks.map((task, i) => ({
-                threadId: i === 0 ? bot.threadId : newId(), title: task.title, createdAt: task.createdAt, resumeCursors: {},
-                modelSelection: structuredClone(selection), activity: "idle", busy: false, unread: false,
-            }));
+            const tasks = source.tasks.map((task, i) => {
+                const record = {
+                    threadId: i === 0 ? bot.threadId : newId(), title: task.title, createdAt: task.createdAt, resumeCursors: {},
+                    modelSelection: structuredClone(selection), activity: "idle", busy: false, unread: false,
+                };
+                // Same rule as a message's `from`: the opener is remapped to its
+                // imported twin, and an opener outside this backup leaves no record
+                // rather than a bot id that resolves to a stranger.
+                const opener = task.openedBy && botIds.get(task.openedBy.botId);
+                if (task.openedBy && opener)
+                    record.openedBy = { botId: opener, name: task.openedBy.name, at: task.openedBy.at };
+                return record;
+            });
             // Own the task IDs before writing their transcripts, so rollback also
             // removes partially imported history if persistence fails midway.
             store.patchBot(bot.id, { tasks, threadId: tasks[source.tasks.findIndex((task) => task.key === source.activeTask)].threadId });

package/dist-server/server/tool-summary.js

@@ -0,0 +1,39 @@
+// What a tool call is about to do, in words a chip or a permission card can
+// show. Redacted before it is cut: a command line is where credentials get
+// pasted, and a key sliced in half would slip past the shapes redaction knows.
+import { redactSecretsInText } from "./redact.js";
+const QUESTION_LIMIT = 300;
+const LIMIT = 200;
+function fieldsOf(input) {
+    if (input === null || typeof input !== "object" || Array.isArray(input))
+        return undefined;
+    return input;
+}
+const cut = (text, limit) => redactSecretsInText(text).trim().slice(0, limit);
+/** The shell command a tool call runs, on one redacted line of at most 200
+ * characters — what rides beside the tool name on the chip and what the
+ * Verify card reads as a step. Only a command: a Read's path or a fetch's
+ * URL is not something the bot ran, so those calls carry no summary. */
+export function commandSummary(input) {
+    const command = fieldsOf(input)?.command;
+    if (typeof command !== "string")
+        return undefined;
+    return cut(command.replace(/\s*[\r\n]+\s*/g, " "), LIMIT);
+}
+/** The permission card's subtitle: the question asked, else the command as
+ * the bot wrote it (newlines kept — a multi-line command reads on the card
+ * the way it will run), else the URL, else the arguments as JSON. Undefined
+ * when there is nothing to say (no input, or an empty object). */
+export function askInputSummary(input) {
+    const fields = fieldsOf(input);
+    if (!fields)
+        return undefined;
+    if (typeof fields.question === "string")
+        return cut(fields.question, QUESTION_LIMIT);
+    if (typeof fields.command === "string")
+        return cut(fields.command, LIMIT);
+    if (typeof fields.url === "string")
+        return cut(fields.url, LIMIT);
+    const text = JSON.stringify(fields);
+    return text === "{}" ? undefined : cut(text, LIMIT);
+}

package/dist-server/server/tts/speech-text.js

@@ -88,7 +88,9 @@ export function speakable(input) {
     text = shortenPaths(text);
     // emoji and the pictographic ranges: a voice either ignores them or,
     // worse, announces them by name
-    text = text.replace(/[\u{1F000}-\u{1FAFF}\u{2600}-\u{27BF}\u{FE00}-\u{FE0F}\u{2190}-\u{21FF}\u{2B00}-\u{2BFF}]/gu, "");
+    text = text.replace(
+    // oxlint-disable-next-line no-misleading-character-class -- variation selectors are stripped on their own, not as part of a grapheme
+    /[\u{1F000}-\u{1FAFF}\u{2600}-\u{27BF}\u{FE00}-\u{FE0F}\u{2190}-\u{21FF}\u{2B00}-\u{2BFF}]/gu, "");
     // a blank line is a paragraph break — make it an audible one
     text = text.replace(/\n{2,}/g, ". ");
     text = text.replace(/\n/g, ". ");