openmausbot 0.1.69 → 0.1.71

package/dist-server/prepare-cloudflared.js

@@ -173,9 +173,25 @@ async function releaseBytes(asset) {
   const cached = cacheDirectory ? join(cacheDirectory, asset.name) : "";
   if (cached && existsSync(cached)) return readFileSync(cached);
   const url = `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/${asset.name}`;
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(12e4) });
-  if (!response.ok) throw new Error(`could not download ${asset.name}: HTTP ${response.status}`);
-  return Buffer.from(await response.arrayBuffer());
+  const retryableStatuses = /* @__PURE__ */ new Set([408, 429, 500, 502, 503, 504]);
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    let failure;
+    try {
+      const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(12e4) });
+      if (response.ok) return Buffer.from(await response.arrayBuffer());
+      await response.body?.cancel().catch(() => {
+      });
+      failure = new Error(`could not download ${asset.name}: HTTP ${response.status}`);
+      if (!retryableStatuses.has(response.status)) throw failure;
+    } catch (error) {
+      if (!(error instanceof TypeError) && !["TimeoutError", "AbortError"].includes(error?.name)) throw error;
+      failure = error;
+    }
+    if (attempt === 3) throw failure;
+    const delay = 1e3 * 2 ** (attempt - 1);
+    console.warn(`cloudflared download attempt ${attempt}/3 failed: ${failure.message}; retrying in ${delay}ms`);
+    await new Promise((resolve) => setTimeout(resolve, delay));
+  }
 }
 async function stageTarget(root, target) {
   const asset = CLOUDFLARED_ASSETS[target];
@@ -251,6 +267,7 @@ export {
   executableTarget,
   parsePrepareCloudflaredArgs,
   prepareCloudflared,
+  releaseBytes,
   sha256,
   targetForCurrentHost,
   targetsForHost,

package/dist-server/proxy-paths.js

@@ -17,6 +17,7 @@ var SPAWNED_PROXIES = {
   agents: resolveProxy("drivers/agents-proxy"),
   dweb: resolveProxy("drivers/dweb-proxy"),
   connectors: resolveProxy("connector-proxy"),
+  mcpGate: resolveProxy("mcp-gate"),
   phone: resolveProxy("drivers/phone-proxy"),
   // Loaded by the external `pi` process via `-e`, not by this server — but
   // resolved through the same single source of truth so the packaged layout

package/dist-server/server/agent-tool-policy.js

@@ -0,0 +1,29 @@
+/** Reviewed local reads exposed by the built-in agents MCP integration.
+ * This exact catalog supplies MCP tool metadata only; names, prefixes, or
+ * third-party annotations alone must never grant read access.
+ * Session recall keeps its own-bot scope and may record a deduplicated access
+ * disclosure in a room; it does not edit recalled messages or launch work.
+ */
+export const READ_ONLY_AGENT_TOOL_NAMES = new Set([
+    "list_bots",
+    "list_rooms",
+    "list_threads",
+    "check_delegation",
+    "wait_delegation",
+    "session_search",
+    "session_read",
+    "list_routines",
+    "skills_list",
+]);
+const READ_ONLY_ANNOTATIONS = Object.freeze({
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false,
+});
+export function isReadOnlyAgentTool(name) {
+    return READ_ONLY_AGENT_TOOL_NAMES.has(name);
+}
+export function agentToolAnnotations(name) {
+    return isReadOnlyAgentTool(name) ? READ_ONLY_ANNOTATIONS : undefined;
+}

package/dist-server/server/bot-package.js

@@ -1,10 +1,14 @@
 import { z } from "zod";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { schemaIssue } from "./schema.js";
+import { isSkillName, parseSkillMd, SKILL_FILE_MAX_BYTES } from "./skills.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
 export const BOT_PACKAGE_FORMAT = "openmaus.package";
 export const BOT_PACKAGE_VERSION = 1;
 export const BOTMRR_MARKDOWN_VERSION = 1;
+export const BOT_PACKAGE_SKILLS_VERSION = 1;
+export const BOT_PACKAGE_MAX_SKILLS = 20;
+const BOT_PACKAGE_MARKDOWN_MAX_BYTES = 1_000_000;
 const COLORS = [
     "green",
     "blue",
@@ -27,6 +31,24 @@ const key = requiredText(64).regex(/^[a-z0-9][a-z0-9_-]*$/, {
     message: "may only contain lowercase letters, numbers, - and _",
 });
 const MAX_DATE_MS = 8_640_000_000_000_000;
+const skillName = requiredText(64).refine(isSkillName, {
+    message: "must be a lowercase skill name",
+});
+const portableSource = optionalText(2_000).refine((value) => value === undefined || !/^(?:[a-z]:[\\/]|[\\/]|\\\\|file:)/i.test(value), { message: "must not be an absolute path" });
+const skillInstructions = z
+    .string({ error: "must be text" })
+    .min(1, { message: "is required" })
+    .max(SKILL_FILE_MAX_BYTES, { message: "is too long" })
+    .refine((value) => Buffer.byteLength(value, "utf8") <= SKILL_FILE_MAX_BYTES, { message: "is too large" })
+    .refine((value) => /^---\r?\n/.test(value), { message: "must start with SKILL.md frontmatter" });
+const portableSkillSchema = z.object({
+    name: skillName,
+    description: requiredText(1_024),
+    source: portableSource,
+    license: optionalText(200),
+    compatibility: optionalText(200),
+    instructions: skillInstructions,
+});
 const CLOCK_TIME = /^([01]\d|2[0-3]):[0-5]\d$/;
 const intervalWeekdays = z.array(z.number().int().min(0).max(6)).min(1).max(7).refine((weekdays) => new Set(weekdays).size === weekdays.length, "must contain unique weekdays");
 const intervalWindow = z.object({
@@ -113,6 +135,7 @@ const packageSchema = z.object({
                 mascotBody: optionalText(40),
             }),
             playbooks: z.array(key).max(40).optional(),
+            skills: z.array(skillName).max(BOT_PACKAGE_MAX_SKILLS).optional(),
         })).min(1).max(200),
         chiefOfStaff: key.optional(),
         rooms: z.array(z.object({
@@ -144,6 +167,10 @@ const packageSchema = z.object({
             triggers: z.array(requiredText(100)).min(1).max(30),
             instructions: requiredText(24_000),
         })).max(80).optional(),
+        skills: z.object({
+            version: z.literal(BOT_PACKAGE_SKILLS_VERSION),
+            entries: z.array(portableSkillSchema).min(1).max(BOT_PACKAGE_MAX_SKILLS),
+        }).optional(),
         examples: z.array(z.object({
             title: requiredText(120),
             input: requiredText(4_000),
@@ -158,7 +185,7 @@ export function isBotPackage(value) {
         value.format === BOT_PACKAGE_FORMAT;
 }
 function markdownDocument(markdown) {
-    if (Buffer.byteLength(markdown) > 1_000_000)
+    if (Buffer.byteLength(markdown) > BOT_PACKAGE_MARKDOWN_MAX_BYTES)
         throw new Error("The bot playbook is too large");
     const frontmatter = markdown.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
     if (!frontmatter)
@@ -206,6 +233,7 @@ export function parseBotPackage(value) {
     };
     const agents = unique(pkg.agents.map((agent) => agent.key), "agent");
     const playbooks = unique((pkg.playbooks ?? []).map((playbook) => playbook.key), "playbook");
+    const skills = unique((pkg.skills?.entries ?? []).map((skill) => skill.name), "skill");
     unique((pkg.rooms ?? []).map((room) => room.key), "room");
     unique((pkg.routines ?? []).map((routine) => routine.key), "routine");
     if (pkg.chiefOfStaff && !agents.has(pkg.chiefOfStaff)) {
@@ -216,6 +244,28 @@ export function parseBotPackage(value) {
             if (!playbooks.has(playbook))
                 throw new Error(`Agent ${agent.key} references unknown playbook: ${playbook}`);
         }
+        const assignedSkills = unique(agent.skills ?? [], `skill in agent ${agent.key}`);
+        for (const skill of assignedSkills) {
+            if (!skills.has(skill))
+                throw new Error(`Agent ${agent.key} references unknown skill: ${skill}`);
+        }
+    }
+    const referencedSkills = new Set(pkg.agents.flatMap((agent) => agent.skills ?? []));
+    for (const skill of pkg.skills?.entries ?? []) {
+        const parsed = parseSkillMd(skill.instructions);
+        if ("error" in parsed)
+            throw new Error(`Skill ${skill.name} is invalid: ${parsed.error}`);
+        if (parsed.name !== skill.name)
+            throw new Error(`Skill ${skill.name} does not match its SKILL.md name`);
+        if (parsed.description !== skill.description)
+            throw new Error(`Skill ${skill.name} does not match its description`);
+        for (const field of ["license", "compatibility"]) {
+            if (skill[field] !== undefined && skill[field] !== parsed[field]) {
+                throw new Error(`Skill ${skill.name} does not match its ${field}`);
+            }
+        }
+        if (!referencedSkills.has(skill.name))
+            throw new Error(`Skill ${skill.name} is not referenced by an agent`);
     }
     for (const room of pkg.rooms ?? []) {
         const members = unique(room.members, `member in room ${room.key}`);
@@ -301,7 +351,10 @@ export function renderBotPackageMarkdown(document) {
     const connections = pkg.requirements.apps.length
         ? pkg.requirements.apps.map((app) => `- **${app.label}${app.optional ? " (optional)" : ""}:** ${app.reason}`).join("\n")
         : "- No connected apps are required.";
-    return `---\n${frontmatter}\n---\n\n# ${pkg.name}\n\n${pkg.tagline}\n\n> **Give this file to your Chief of Staff.** It is the complete team blueprint. Any agent system can run it; OpenMausBot can also install it directly.\n\n## Activation\n\nYou are the Chief of Staff for this blueprint. Read the whole document before acting. Confirm the user's goal and any missing inputs, then create or delegate to the specialist roles below. Preserve their names, ownership, boundaries, shared-room rules, and playbooks. If your platform cannot literally spawn agents, perform the roles one at a time and keep their outputs clearly separated.\n\nNever request pasted passwords or secret keys. Use the platform's normal connection flow. Do not send messages, publish content, spend money, delete data, or enable a schedule without the user's explicit approval. All routines start paused.\n\n## Mission\n\n${pkg.summary}\n\n## Outcomes\n\n${list(pkg.outcomes)}\n\n## Connections\n\n${connections}\n\n## Team\n\n${agents}\n\n## Chief of Staff\n\nThe Chief of Staff role is \`${pkg.chiefOfStaff ?? pkg.agents[0].key}\`. This role owns delegation, synthesis, conflict resolution, and the final answer to the user.\n${rooms ? `\n## Shared rooms\n\n${rooms}\n` : ""}${routines ? `\n## Suggested routines\n\n${routines}\n` : ""}${playbooks ? `\n## Playbooks\n\n${playbooks}\n` : ""}${examples ? `\n## Example job\n\n${examples}\n` : ""}\n## Completion rule\n\nReturn one clear result to the user, distinguish evidence from inference, cite source links when the work uses external material, and state what still needs human approval or a connected app.\n`;
+    const markdown = `---\n${frontmatter}\n---\n\n# ${pkg.name}\n\n${pkg.tagline}\n\n> **Give this file to your Chief of Staff.** It is the complete team blueprint. Any agent system can run it; OpenMausBot can also install it directly.\n\n## Activation\n\nYou are the Chief of Staff for this blueprint. Read the whole document before acting. Confirm the user's goal and any missing inputs, then create or delegate to the specialist roles below. Preserve their names, ownership, boundaries, shared-room rules, and playbooks. If your platform cannot literally spawn agents, perform the roles one at a time and keep their outputs clearly separated.\n\nNever request pasted passwords or secret keys. Use the platform's normal connection flow. Do not send messages, publish content, spend money, delete data, or enable a schedule without the user's explicit approval. All routines start paused.\n\n## Mission\n\n${pkg.summary}\n\n## Outcomes\n\n${list(pkg.outcomes)}\n\n## Connections\n\n${connections}\n\n## Team\n\n${agents}\n\n## Chief of Staff\n\nThe Chief of Staff role is \`${pkg.chiefOfStaff ?? pkg.agents[0].key}\`. This role owns delegation, synthesis, conflict resolution, and the final answer to the user.\n${rooms ? `\n## Shared rooms\n\n${rooms}\n` : ""}${routines ? `\n## Suggested routines\n\n${routines}\n` : ""}${playbooks ? `\n## Playbooks\n\n${playbooks}\n` : ""}${examples ? `\n## Example job\n\n${examples}\n` : ""}\n## Completion rule\n\nReturn one clear result to the user, distinguish evidence from inference, cite source links when the work uses external material, and state what still needs human approval or a connected app.\n`;
+    if (Buffer.byteLength(markdown) > BOT_PACKAGE_MARKDOWN_MAX_BYTES)
+        throw new Error("The bot playbook is too large");
+    return markdown;
 }
 export function packageAgentAsMember(agent) {
     return {

package/dist-server/server/browser-live.js

@@ -7,6 +7,9 @@ const execute = promisify(execFile);
 const MAX_FRAME = 3 * 1024 * 1024;
 const MAX_BUFFER = 4 * 1024 * 1024;
 const HEARTBEAT_MS = 10_000;
+// The native press resolver supplies the virtual key codes and Enter/Tab text
+// that its raw input_keyboard relay omits. Keep unknown keys literal.
+const DISCRETE_KEYS = new Set(["Backspace", "Enter", "Tab", "Escape", "Delete", "ArrowUp", "ArrowDown", "ArrowLeft", "ArrowRight", "Home", "End", "PageUp", "PageDown"]);
 export class BrowserLiveError extends Error {
     status;
     constructor(message, status = 400) { super(message); this.name = "BrowserLiveError"; this.status = status; }
@@ -308,17 +311,20 @@ export class BrowserLive {
             throw new BrowserLiveError("The browser stream is not connected.", 409);
         let command;
         const { type, eventType, ...fields } = message;
+        const key = String(fields.code || fields.key);
         const shortcut = Number(fields.modifiers) > 0 && !["Alt", "Control", "Meta", "Shift"].includes(String(fields.key))
             && !(fields.modifiers === 8 && text(fields.key, 64) && [...fields.key].length === 1);
-        if (type === "input_keyboard" && eventType === "keyUp" && shortcut)
-            return; // press already releases the chord.
+        // press already released the key. Match raw held keys, not the modifiers
+        // on keyUp: they may have changed, or blur may flush releases with zero.
+        if (type === "input_keyboard" && eventType === "keyUp" && !viewer.pressedKeys.has(key))
+            return;
         if (type === "input_mouse")
             command = { action: "input_mouse", type: eventType, ...fields };
         else if (eventType === "char")
             command = { action: "keyboard", subaction: "insertText", text: fields.text };
-        else if (eventType === "keyDown" && shortcut) {
-            // The native input_keyboard handler omits CDP modifiers. Its press
-            // action resolves chords and awaits the complete key-down/up pair.
+        else if (eventType === "keyDown" && (shortcut || DISCRETE_KEYS.has(String(fields.key)))) {
+            // press resolves virtual key codes, required text and modifiers, and
+            // acknowledges the complete key-down/up pair before hand-back.
             const modifiers = fields.modifiers;
             const chord = [[1, "Alt"], [2, "Control"], [4, "Meta"], [8, "Shift"]];
             command = { action: "press", key: [...chord.filter(([bit]) => modifiers & bit).map(([, key]) => key), fields.key].join("+") };
@@ -326,7 +332,6 @@ export class BrowserLive {
         else
             command = { action: "input_keyboard", type: eventType, key: fields.key,
                 ...(fields.code === undefined ? {} : { code: fields.code }), ...(fields.text === undefined ? {} : { text: fields.text }) };
-        const key = String(fields.code || fields.key);
         if (command.action === "input_keyboard" && eventType === "keyDown") {
             if (viewer.pressedKeys.size >= 64 && !viewer.pressedKeys.has(key))
                 throw new BrowserLiveError("Too many keys are held. Restart the browser before continuing.", 409);
@@ -354,7 +359,7 @@ export class BrowserLive {
             }
             if (object(JSON.parse(Buffer.concat(chunks).toString("utf8")))?.success !== true)
                 throw new Error("input failed");
-            if (command.action === "input_keyboard" && eventType === "keyUp")
+            if (command.action === "press" || (command.action === "input_keyboard" && eventType === "keyUp"))
                 viewer.pressedKeys.delete(key);
             if (type === "input_mouse" && eventType === "mouseReleased")
                 viewer.pressedButtons.delete(String(fields.button));

package/dist-server/server/config.js

@@ -195,9 +195,13 @@ const browserProfilesSchema = z.array(browserProfileSchema).max(20).superRefine(
         });
     });
 });
+// Deliberately non-strict: an unknown flag (such as `skillRecorder`, the
+// pre-rename name a stale client may still PATCH) is dropped as a no-op
+// instead of failing the whole stored config or the request.
 const featureConfigSchema = z.object({
-    /** Experimental desktop workflow recorder. Hidden unless explicitly enabled. */
-    skillRecorder: z.boolean().optional(),
+    /** Bots may draft skills (skill_manage, /learn) for your review. Off unless
+     * explicitly enabled. */
+    skillAuthoring: z.boolean().optional(),
     /** Show each tool run in the transcript. Off unless explicitly enabled. */
     showToolCalls: z.boolean().optional(),
     /** Experimental built-in browser. Off until explicitly enabled; each bot
@@ -378,8 +382,8 @@ export function localVmMode(cfg) {
 export function localVmMaxInstances(cfg) {
     return cfg.localVm?.maxInstances ?? DEFAULT_LOCAL_VM_MAX_INSTANCES;
 }
-export function skillRecorderEnabled(cfg) {
-    return cfg.features?.skillRecorder === true;
+export function skillAuthoringEnabled(cfg) {
+    return cfg.features?.skillAuthoring === true;
 }
 export function showToolCallsEnabled(cfg) {
     return cfg.features?.showToolCalls === true;
@@ -407,6 +411,38 @@ export function ensureDirs() {
     }
     for (const dir of [DATA_DIR, EVENTS_DIR, NATIVE_DIR])
         mkdirSync(dir, { recursive: true });
+    migrateLegacyFeatureFlags();
+}
+/** `features.skillRecorder` became `features.skillAuthoring` when the Teach a
+ * skill recorder was removed. featureConfigSchema is non-strict, so
+ * parseStoredConfig would silently drop the old key (reading the opt-in as
+ * off) while saveConfig's raw section merge would carry it on disk forever.
+ * Rewrite it once, here, before the server's single loadConfig() at boot: an
+ * explicit `skillAuthoring` already on disk wins over the legacy key, and a
+ * file without the legacy key is left untouched. */
+function migrateLegacyFeatureFlags() {
+    const p = join(DATA_DIR, "config.json");
+    try {
+        if (!existsSync(p))
+            return;
+        const disk = jsonObjectSchema.safeParse(parseJson(readFileSync(p, "utf8")));
+        if (!disk.success)
+            return;
+        const features = jsonObjectSchema.safeParse(disk.data.features);
+        if (!features.success || !Object.hasOwn(features.data, "skillRecorder"))
+            return;
+        const next = { ...features.data };
+        if (!Object.hasOwn(next, "skillAuthoring"))
+            next.skillAuthoring = next.skillRecorder === true;
+        delete next.skillRecorder;
+        writeFileAtomic(p, JSON.stringify({ ...disk.data, features: next }, null, 2), { mode: 0o600 });
+        console.log(`[config] features.skillRecorder renamed to features.skillAuthoring (${String(next.skillAuthoring)})`);
+    }
+    catch (error) {
+        // A readable but unwritable config would otherwise lose the opt-in on
+        // every boot with no trace: parseStoredConfig drops the legacy key.
+        console.error(`[config] could not rename features.skillRecorder: ${error instanceof Error ? error.message : String(error)}`);
+    }
 }
 export function loadConfig() {
     let cfg = {};

package/dist-server/server/delegations.js

@@ -86,19 +86,26 @@ export function threadsWaitingOn(toBotId) {
 }
 /** Mark a target's observed busy period as finished and return the source
  * threads that should be retried. This makes retries count distinct busy
- * periods, not unrelated drain requests on the same source thread. */
-export function releaseDelegationsWaitingOn(toBotId) {
-    const threads = threadsWaitingOn(toBotId);
-    if (!threads.length)
-        return threads;
-    for (const threadId of threads) {
-        for (const item of pendingDelegations.get(threadId) ?? []) {
-            if (item.toBotId === toBotId)
-                delete item.waitingOnBusy;
+ * periods, not unrelated drain requests on the same source thread.
+ * `only` narrows the release: a bot that is still busy in one thread has
+ * nevertheless freed a slot for the fresh-thread handoffs waiting on it,
+ * while its active-thread handoffs go on waiting for it to go idle. */
+export function releaseDelegationsWaitingOn(toBotId, only) {
+    const released = [];
+    for (const [threadId, items] of pendingDelegations) {
+        let any = false;
+        for (const item of items) {
+            if (item.toBotId !== toBotId || item.waitingOnBusy !== true || (only && !only(item)))
+                continue;
+            delete item.waitingOnBusy;
+            any = true;
         }
+        if (any)
+            released.push(threadId);
     }
-    savePending();
-    return threads;
+    if (released.length)
+        savePending();
+    return released;
 }
 function savePending() {
     try {
@@ -140,6 +147,9 @@ export function _loadPending() {
                 if (typeof item.originatingGroupId === "string" && item.originatingGroupId) {
                     loaded.originatingGroupId = item.originatingGroupId;
                 }
+                if (typeof item.targetThreadId === "string" && item.targetThreadId) {
+                    loaded.targetThreadId = item.targetThreadId;
+                }
                 return [loaded];
             });
             if (items.length)
@@ -195,6 +205,7 @@ export function pendingDelegationSnapshot() {
         sourceBotId: item.sourceBotId,
         toBotId: item.toBotId,
         ...(item.reason ? { reason: item.reason } : {}),
+        ...(item.targetThreadId ? { targetThreadId: item.targetThreadId } : {}),
     })));
 }
 /** How many handoffs one turn may queue. Small on purpose: this is the only
@@ -231,18 +242,27 @@ export function queueDelegation(bus, from, item, maxDepth, sourceThreadId = from
     list.push({ ...item, id, sourceBotId: from.id, attempts: 0, ...(groupId ? { originatingGroupId: groupId } : {}) });
     pendingDelegations.set(sourceThreadId, list);
     savePending();
-    const label = `Delegated to @${target.name}${item.reason ? `: ${item.reason}` : ""}`;
     const sourceGroup = sourceThreadId ? bus.store.groupByThread(sourceThreadId) : undefined;
-    bus.store.appendMessage(sourceThreadId, {
+    // A fresh-thread handoff is announced as the thread it opened, with a
+    // link to it; a classic one as the delegation it is.
+    const openedThread = item.targetThreadId ? bus.store.taskByThread(target.id, item.targetThreadId) : undefined;
+    const chip = {
         role: "bot",
         kind: "activity",
         // settled at birth: queueing is the whole act. Left open, the chip
         // would spin until the transcript is closed — the chat never patches it
-        tool: { name: label, ok: true },
-        ...(sourceGroup && !sourceGroup.dm
-            ? { from: { botId: from.id, name: from.name, color: from.color } }
-            : {}),
-    });
+        tool: {
+            name: openedThread
+                ? `Opened thread #${openedThread.title} on ${target.name}`
+                : `Delegated to @${target.name}${item.reason ? `: ${item.reason}` : ""}`,
+            ok: true,
+        },
+    };
+    if (openedThread)
+        chip.threadRef = { botId: target.id, threadId: openedThread.threadId, title: openedThread.title };
+    if (sourceGroup && !sourceGroup.dm)
+        chip.from = { botId: from.id, name: from.name, color: from.color };
+    bus.store.appendMessage(sourceThreadId, chip);
     return { result: "ok", id };
 }
 /** Drain queued delegations for a source thread (called on its
@@ -418,35 +438,12 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     if (dropIfUnreachable(bus, sender, target, sourceThreadId, item)) {
         return "settled";
     }
-    if (target.busy) {
-        if (item.waitingOnBusy)
-            return "requeued";
-        item.attempts += 1;
-        item.waitingOnBusy = true;
-        if (item.attempts < MAX_BUSY_ATTEMPTS) {
-            savePending();
-            bus.store.appendMessage(sourceThreadId, {
-                role: "bot",
-                kind: "activity",
-                tool: { name: `Delegation to @${target.name} waiting — they're busy (retry ${item.attempts}/${MAX_BUSY_ATTEMPTS} when they finish)` },
-            });
-            return "requeued";
-        }
-        recordDelegationReceipt({
-            id: item.id,
-            sourceThreadId,
-            toBotId: target.id,
-            toBotName: target.name,
-            status: "busy_gave_up",
-            result: `@${target.name} stayed busy through ${MAX_BUSY_ATTEMPTS} retries`,
-        });
-        bus.store.appendMessage(sourceThreadId, {
-            role: "bot",
-            kind: "activity",
-            tool: { name: `Delegation to @${target.name} canceled — still busy after ${MAX_BUSY_ATTEMPTS} retries`, ok: false },
-        });
+    if (dropIfThreadGone(bus, target, sourceThreadId, item)) {
         return "settled";
     }
+    const held = holdWhileTargetBusy(bus, target, sourceThreadId, item);
+    if (held)
+        return held;
     if (item.waitingOnBusy) {
         delete item.waitingOnBusy;
         savePending();
@@ -494,35 +491,12 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
         if (dropIfUnreachable(bus, currentSender, current, sourceThreadId, item)) {
             return "settled";
         }
-        if (current.busy) {
-            if (item.waitingOnBusy)
-                return "requeued";
-            item.attempts += 1;
-            item.waitingOnBusy = true;
-            if (item.attempts < MAX_BUSY_ATTEMPTS) {
-                savePending();
-                bus.store.appendMessage(sourceThreadId, {
-                    role: "bot",
-                    kind: "activity",
-                    tool: { name: `Delegation to @${current.name} waiting — they're busy (retry ${item.attempts}/${MAX_BUSY_ATTEMPTS} when they finish)` },
-                });
-                return "requeued";
-            }
-            recordDelegationReceipt({
-                id: item.id,
-                sourceThreadId,
-                toBotId: current.id,
-                toBotName: current.name,
-                status: "busy_gave_up",
-                result: `@${current.name} stayed busy through ${MAX_BUSY_ATTEMPTS} retries`,
-            });
-            bus.store.appendMessage(sourceThreadId, {
-                role: "bot",
-                kind: "activity",
-                tool: { name: `Delegation to @${current.name} canceled — still busy after ${MAX_BUSY_ATTEMPTS} retries`, ok: false },
-            });
+        if (dropIfThreadGone(bus, current, sourceThreadId, item)) {
             return "settled";
         }
+        const heldAfterApproval = holdWhileTargetBusy(bus, current, sourceThreadId, item);
+        if (heldAfterApproval)
+            return heldAfterApproval;
         sender = currentSender;
         target = current;
     }
@@ -533,10 +507,94 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     const channel = getOrCreateChannel(bus.store, sender, target, originatingGroup);
     mirrorExchange(bus, sender, target, item.message, channel, sourceThreadId);
     const reasonLine = item.reason ? `\n\n[Reason: ${item.reason}]` : "";
-    const prefixed = `[Delegated by @${sender.name}, another bot in this OpenMausBot workspace. Do the work and reply directly.]\n\n${item.message}${reasonLine}`;
-    await runTarget(item.toBotId, prefixed, item.depth + 1, sourceThreadId, channel, item.id, sender.id);
+    // A fresh thread's first line gets the shared peer-provenance note from
+    // the harness (which knows whether the opener was unattended); the
+    // classic handoff keeps the prefix it has always had.
+    const prefixed = item.targetThreadId
+        ? item.message
+        : `[Delegated by @${sender.name}, another bot in this OpenMausBot workspace. Do the work and reply directly.]\n\n${item.message}${reasonLine}`;
+    await runTarget(item.toBotId, prefixed, item.depth + 1, sourceThreadId, channel, item.id, sender.id, item.targetThreadId);
     return "dispatched";
 }
+/** A busy target holds the handoff. What "busy" means depends on where the
+ * turn will run: a classic delegation lands in the target's active thread,
+ * so it waits for the bot to go idle, with bounded retries so a stuck peer
+ * cannot pin the handoff forever. A fresh-thread handoff needs only a free
+ * slot, and waits in line for one without a bound — it IS the line, the
+ * same one a person's message joins at that limit. Returns null when the
+ * target can take the turn now. */
+function holdWhileTargetBusy(bus, target, sourceThreadId, item) {
+    if (item.targetThreadId) {
+        if (bus.threadSlotFree ? bus.threadSlotFree(target.id) : !target.busy)
+            return null;
+        if (item.waitingOnBusy)
+            return "requeued";
+        item.waitingOnBusy = true;
+        savePending();
+        // one chip per wait, not one per retry: the line moves on every settle
+        if (item.attempts === 0) {
+            item.attempts = 1;
+            const title = bus.store.taskByThread(target.id, item.targetThreadId)?.title ?? "thread";
+            bus.store.appendMessage(sourceThreadId, {
+                role: "bot",
+                kind: "activity",
+                tool: { name: `Thread #${title} on @${target.name} waiting for a free slot` },
+            });
+        }
+        return "requeued";
+    }
+    if (!target.busy)
+        return null;
+    if (item.waitingOnBusy)
+        return "requeued";
+    item.attempts += 1;
+    item.waitingOnBusy = true;
+    if (item.attempts < MAX_BUSY_ATTEMPTS) {
+        savePending();
+        bus.store.appendMessage(sourceThreadId, {
+            role: "bot",
+            kind: "activity",
+            tool: { name: `Delegation to @${target.name} waiting — they're busy (retry ${item.attempts}/${MAX_BUSY_ATTEMPTS} when they finish)` },
+        });
+        return "requeued";
+    }
+    recordDelegationReceipt({
+        id: item.id,
+        sourceThreadId,
+        toBotId: target.id,
+        toBotName: target.name,
+        status: "busy_gave_up",
+        result: `@${target.name} stayed busy through ${MAX_BUSY_ATTEMPTS} retries`,
+    });
+    bus.store.appendMessage(sourceThreadId, {
+        role: "bot",
+        kind: "activity",
+        tool: { name: `Delegation to @${target.name} canceled — still busy after ${MAX_BUSY_ATTEMPTS} retries`, ok: false },
+    });
+    return "settled";
+}
+/** The thread a fresh-thread handoff was opened in may be deleted while the
+ * handoff waits. There is nowhere for the turn to run then, and running it
+ * in the target's active thread would put a bot's job in front of the
+ * person unasked. */
+function dropIfThreadGone(bus, target, sourceThreadId, item) {
+    if (!item.targetThreadId || bus.store.taskByThread(target.id, item.targetThreadId))
+        return false;
+    recordDelegationReceipt({
+        id: item.id,
+        sourceThreadId,
+        toBotId: target.id,
+        toBotName: target.name,
+        status: "dropped",
+        result: `the thread opened on @${target.name} was deleted before it could start`,
+    });
+    bus.store.appendMessage(sourceThreadId, {
+        role: "bot",
+        kind: "activity",
+        tool: { name: `Thread on @${target.name} canceled — it was deleted before it could start`, ok: false },
+    });
+    return true;
+}
 /** The source thread may be a bot's own task or a shared group where the
  * bot is a member. This is the same check the API gate uses for group turns. */
 function sourceThreadBelongsToBot(store, botId, threadId) {

package/dist-server/server/drivers/acp/core.js

@@ -35,6 +35,7 @@ import { supportsApprovalMode } from "../../../shared/approval-mode.js";
 // packaged server dir entirely. See server/proxy-paths.ts.
 const COMPUTER_PROXY_PATH = SPAWNED_PROXIES.computer;
 import { appendNative } from "../native.js";
+import { commandSummary } from "../../tool-summary.js";
 import { SPAWNED_PROXIES } from "../../proxy-paths.js";
 const envOr = (key, fallback) => Number(process.env[key] ?? fallback);
 const INIT_TIMEOUT = envOr("OPENMAUS_ACP_INIT_TIMEOUT_MS", 300_000);
@@ -568,6 +569,7 @@ export function createAcpDriver(support) {
                                 itemType: "tool",
                                 itemId: u.toolCallId,
                                 title: String(u.rawInput?.command ?? u.title ?? "tool").slice(0, 80),
+                                summary: commandSummary(u.rawInput),
                             });
                             break;
                         }

package/dist-server/server/drivers/acp/cursor.js

@@ -177,7 +177,7 @@ export function decodeCursorModelText(text) {
         const line = raw.trim();
         if (!line || line.startsWith("#") || /^available\s+models?\b/i.test(line) || /^models?\b/i.test(line))
             continue;
-        const stripped = line.replace(/^[\s*•\-]+\s*/, "");
+        const stripped = line.replace(/^[\s*•-]+\s*/, "");
         const parts = stripped.split(/\s+[—–|:]\s+|\s+-\s+|\s{2,}/);
         const id = (parts[0] ?? "").trim();
         const rawLabel = parts.slice(1).join(" ").trim();

package/dist-server/server/drivers/acp/grok.js

@@ -208,9 +208,13 @@ const support = {
     // and BEFORE `stdio` (`grok agent -m slug stdio`). Putting -m first is
     // accepted as a TUI option and then ignored, so ACP session/new keeps
     // [models].default (grok-4.6) and oMLX never sees a request.
+    // Auto selects Grok's native classifier; if its feature gate is disabled,
+    // residual requests still ask. Never replace it with bypassPermissions.
+    // Verified: grok 1.0.3 --help and xai-org/grok-build@37949780,
+    // crates/codegen/xai-grok-pager-bin/src/main.rs:1259-1273.
     spawnArgs: (config, turn) => [
         "--permission-mode",
-        config.fullAuto ? "bypassPermissions" : "default",
+        config.fullAuto ? "bypassPermissions" : turn.approvalMode === "auto" ? "auto" : "default",
         "agent",
         ...(turn.model ? ["-m", turn.model] : []),
         // long form on purpose: `--effort` is documented as an alias, and an