openmausbot 0.1.70 → 0.1.71

package/dist-server/server/index.js

@@ -33,7 +33,7 @@ import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { peerAllowed, peerName, peerRosterSystemPrompt, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillRecorderEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
 import { ComputerControl } from "./computer-control.js";
 import { MAX_REMOTE_COMMAND_LENGTH } from "./remote-computer.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -67,14 +67,16 @@ import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
 import { isProjectEmoji, mentionedBots, roomResponders, sectionKey, Store, } from "./store.js";
 import * as tts from "./tts/index.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
-import { buildTurnContext, engineIsFresh } from "./turn-context.js";
+import { buildRecoveryText, buildTurnContext, engineIsFresh } from "./turn-context.js";
 import { extractTurnImages } from "./turn-images.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
 import { TurnResources, workspaceResource } from "./turn-resources.js";
-import { ensureWorkspace, ensureTaskWorkspace, updateMemory, listMemoryTopics, isMemoryTopicName, memorySystemPrompt, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
-import { readMemoryFile, readMemoryTopic, writeMemoryFile, MEMORY_FILE_MAX_BYTES, } from "./workspace.js";
+import { ensureWorkspace, ensureTaskWorkspace, updateMemory, appendMemoryLog, isMemoryTopicName, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
+import { readMemoryTopic } from "./workspace.js";
+import { MEMORY_INDEX, MemoryStoreError, memoryCapacity, memoryOverview, openMemoryLocation, readMemoryDoc, } from "./memory-store.js";
+import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, flushMemoryJournal, journalMemoryDelete, journalMemoryWrite, readMemoryJournal, revertMemoryChange, } from "./memory-journal.js";
 import { readSectionContext, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
-import { applyStagedSkillWrite, getStagedSkillWrite, installSkill, listSkills, listStagedSkillWrites, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
+import { applyStagedSkillWrite, getStagedSkillWrite, installSkill, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
 import { fetchSkillFromSource } from "./skill-fetch.js";
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
@@ -103,7 +105,7 @@ import { flushAllProfileHistory, flushProfileHistory, readHistory, recordProfile
 import { fetchBotDirectory, matchDirectoryBots } from "./bot-directory.js";
 import { scoutProject, suggestTeam } from "./project-scout.js";
 import { fetchGithubTeam, fetchLibraryTeam, fetchTeamCatalog } from "./team-library.js";
-import { isBotPackage, packageAgentAsMember, parseBotPackage, renderBotPackageMarkdown } from "./bot-package.js";
+import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageAgentAsMember, parseBotPackage, renderBotPackageMarkdown } from "./bot-package.js";
 import { createTeamManifest, importedMemberProfile, parseTeamManifest } from "./team-manifest.js";
 import { readThreadEvents } from "./thread-events.js";
 import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
@@ -884,6 +886,54 @@ function checkedModelSelection(raw, current, requireAvailableModel = false) {
     }
     return { ok: true, selection };
 }
+function checkedExportSkillNames(value, bots) {
+    // Sharing instructions is explicit: ordinary package exports include none.
+    if (value === undefined)
+        return { ok: true, names: [] };
+    if (!Array.isArray(value) || value.some((name) => typeof name !== "string" || !isSkillName(name))) {
+        return { ok: false, error: "skillIds must be a list of exact imported skill names" };
+    }
+    const names = [...value];
+    if (new Set(names).size !== names.length)
+        return { ok: false, error: "skillIds must not contain duplicates" };
+    if (names.length > BOT_PACKAGE_MAX_SKILLS)
+        return { ok: false, error: `skillIds must contain at most ${BOT_PACKAGE_MAX_SKILLS} names` };
+    const available = new Set(bots.flatMap((bot) => listSkills(bot.id).map((skill) => skill.name)));
+    const unknown = names.find((name) => !available.has(name));
+    if (unknown)
+        return { ok: false, error: `skillIds contains unknown imported skill "${unknown}"` };
+    return { ok: true, names };
+}
+function collectExportSkills(bots, names) {
+    const selected = new Set(names);
+    const byBot = new Map();
+    if (!selected.size)
+        return byBot;
+    for (const bot of bots) {
+        const assigned = [];
+        for (const listing of listSkills(bot.id)) {
+            if (!selected.has(listing.name))
+                continue;
+            const instructions = readSkillFile(bot.id, listing.name);
+            if (instructions === null) {
+                throw new Error(`Skill "${listing.name}" changed or is unavailable and cannot be exported safely`);
+            }
+            const skill = {
+                name: listing.name,
+                description: listing.description,
+                ...(listing.source ? { source: listing.source } : {}),
+                ...(listing.license ? { license: listing.license } : {}),
+                ...(listing.compatibility ? { compatibility: listing.compatibility } : {}),
+                instructions,
+            };
+            // The shared exporter validates duplicate bytes and metadata together.
+            assigned.push(skill);
+        }
+        if (assigned.length)
+            byBot.set(bot.id, assigned);
+    }
+    return byBot;
+}
 function checkedGroupResponder(value, memberIds) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return null;
@@ -1010,7 +1060,7 @@ function previewSystemPrompt(bot) {
             id: "setup",
             label: "Setup",
             text: setupSystemPrompt(agentsMounted && setupModeActive({ soul: bot.soul, description: bot.description, text: "" }), {
-                skills: skillRecorderEnabled(cfg),
+                skills: skillAuthoringEnabled(cfg),
                 cwd: bot.cwd,
             }),
         },
@@ -1447,6 +1497,165 @@ function groupGoalCoordinatorTurnForEvent(event) {
 function groupIsWorking(group) {
     return Boolean(group.busyBotId) || Boolean(groupTurnOperations.get(group.id)?.size);
 }
+// The public and Chief room tools use the same synchronous validation and write.
+// Keep authorization at each ingress; no internal caller gains public admin scope.
+function createChannel(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw Object.assign(new Error("channel must be a JSON object"), { status: 400 });
+    }
+    const body = value;
+    const roster = checkedMemberIds(body.memberIds);
+    if (!roster.ok)
+        throw Object.assign(new Error(roster.error), { status: 400 });
+    const { memberIds } = roster;
+    if (body.name !== undefined && typeof body.name !== "string") {
+        throw Object.assign(new Error("channel name must be a string"), { status: 400 });
+    }
+    const name = body.name?.trim() || `${store.bot(memberIds[0]).name} & co.`;
+    if (name.length > 100)
+        throw Object.assign(new Error("channel name must be at most 100 characters"), { status: 400 });
+    let section;
+    if (body.section !== undefined && body.section !== null) {
+        if (typeof body.section !== "string")
+            throw Object.assign(new Error("context must be a string"), { status: 400 });
+        section = body.section.trim() || undefined;
+        if (section && section.length > 60) {
+            throw Object.assign(new Error("context must be at most 60 characters"), { status: 400 });
+        }
+    }
+    let setup;
+    if (body.setup !== undefined) {
+        if (!body.setup || typeof body.setup !== "object" || Array.isArray(body.setup)) {
+            throw Object.assign(new Error("setup must be an object"), { status: 400 });
+        }
+        const requested = body.setup;
+        if (typeof requested.bulletin !== "string") {
+            throw Object.assign(new Error("setup.bulletin must be a string"), { status: 400 });
+        }
+        if (requested.bulletin.length > 12_000) {
+            throw Object.assign(new Error("setup.bulletin must be at most 12000 characters"), { status: 400 });
+        }
+        const responder = checkedGroupResponder(requested.defaultResponder, memberIds);
+        if (!responder)
+            throw Object.assign(new Error("invalid setup.defaultResponder"), { status: 400 });
+        setup = { bulletin: requested.bulletin, defaultResponder: responder, completed: true };
+    }
+    return store.createGroup(name, memberIds, false, section, setup);
+}
+function updateChannel(groupId, value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw Object.assign(new Error("body must be a JSON object"), { status: 400 });
+    }
+    const body = value;
+    const existing = store.group(groupId);
+    if (!existing)
+        throw Object.assign(new Error("no such room"), { status: 404 });
+    if (body.memberIds !== undefined && phoneSecretSubmissions.hasGroup(existing.id)) {
+        throw Object.assign(new Error("this channel is securely saving a credential — try again when it finishes"), { status: 409 });
+    }
+    if (channelTaskBlocked(existing) &&
+        (body.memberIds !== undefined || body.defaultResponder !== undefined || body.bulletin !== undefined)) {
+        throw Object.assign(new Error("this channel is working or waiting on you — finish that turn first"), { status: 409 });
+    }
+    const patch = {};
+    if (body.name !== undefined) {
+        if (typeof body.name !== "string")
+            throw Object.assign(new Error("room name must be a string"), { status: 400 });
+        const name = body.name.trim();
+        if (!name)
+            throw Object.assign(new Error("room name must not be empty"), { status: 400 });
+        if (name.length > 100)
+            throw Object.assign(new Error("room name must be at most 100 characters"), { status: 400 });
+        patch.name = name;
+    }
+    if (body.bulletin !== undefined) {
+        if (typeof body.bulletin !== "string")
+            throw Object.assign(new Error("bulletin must be a string"), { status: 400 });
+        if (body.bulletin.length > 12_000) {
+            throw Object.assign(new Error("bulletin must be at most 12000 characters"), { status: 400 });
+        }
+        patch.bulletin = body.bulletin;
+    }
+    if (body.unread !== undefined) {
+        if (typeof body.unread !== "boolean")
+            throw Object.assign(new Error("unread must be true or false"), { status: 400 });
+        patch.unread = body.unread;
+    }
+    if (body.memberIds !== undefined) {
+        // A DM is the pair it was opened for; only real rooms have a roster.
+        if (existing.dm)
+            throw Object.assign(new Error("direct-message channels cannot change members"), { status: 400 });
+        const roster = checkedMemberIds(body.memberIds);
+        if (!roster.ok)
+            throw Object.assign(new Error(roster.error.replace("channel", "room")), { status: 400 });
+        const removedGoalLead = routines.listRoutines().some((routine) => routine.enabled &&
+            routine.target === "room-goal" &&
+            routine.groupId === existing.id &&
+            !roster.memberIds.includes(routine.botId)) || routines.listRuns().some((run) => run.target === "room-goal" &&
+            run.groupId === existing.id &&
+            ["queued", "running", "waiting"].includes(run.status) &&
+            !roster.memberIds.includes(run.botId));
+        if (removedGoalLead) {
+            throw Object.assign(new Error("pause or reassign this room's team-goal routine before removing its lead"), { status: 409 });
+        }
+        patch.memberIds = roster.memberIds;
+    }
+    if (body.defaultResponder !== undefined) {
+        const memberIds = patch.memberIds ?? existing.memberIds;
+        const responder = checkedGroupResponder(body.defaultResponder, memberIds);
+        if (!responder)
+            throw Object.assign(new Error("invalid default responder"), { status: 400 });
+        patch.defaultResponder = responder;
+    }
+    if (body.cwd !== undefined) {
+        if (existing.dm)
+            throw Object.assign(new Error("direct-message channels cannot have a working folder"), { status: 400 });
+        if (existing.pinnedCwd !== undefined) {
+            throw Object.assign(new Error("the room's working folder is fixed after its first turn"), { status: 409 });
+        }
+        const checked = validateBotCwd(body.cwd);
+        if (!checked.ok)
+            throw Object.assign(new Error(checked.error), { status: 400 });
+        patch.cwd = checked.cwd ?? undefined;
+    }
+    // one pinned message per room; null/"" clears. The id is not
+    // validated against the transcript here — a pin whose message was
+    // edited away or deleted simply resolves to nothing in the UI.
+    if (body.pinnedMessageId !== undefined) {
+        if (body.pinnedMessageId === null || body.pinnedMessageId === "")
+            patch.pinnedMessageId = undefined;
+        else if (typeof body.pinnedMessageId === "string" && /^[\w-]+$/.test(body.pinnedMessageId)) {
+            patch.pinnedMessageId = body.pinnedMessageId;
+        }
+        else
+            throw Object.assign(new Error("pinnedMessageId must be a message id"), { status: 400 });
+    }
+    // same contract as a bot's sidebar section: null/"" clears, 60 chars max
+    if (body.section !== undefined) {
+        if (body.section === null)
+            patch.section = undefined;
+        else if (typeof body.section !== "string")
+            throw Object.assign(new Error("section must be a string"), { status: 400 });
+        else {
+            const trimmed = body.section.trim();
+            if (!trimmed)
+                patch.section = undefined;
+            else if (trimmed.length > 60)
+                throw Object.assign(new Error("section must be at most 60 characters"), { status: 400 });
+            else
+                patch.section = trimmed;
+        }
+    }
+    const group = store.patchGroup(groupId, patch);
+    if (!group)
+        throw Object.assign(new Error("no such room"), { status: 404 });
+    return group;
+}
+const channelTaskBlocked = (group) => groupIsWorking(group) ||
+    store.groupTasks(group.id).some((task) => store.messagesFor(task.threadId).some((message) => message.kind === "options" &&
+        message.card?.requestId &&
+        !message.card.answered &&
+        !message.card.dismissed));
 function publicGroupState(group) {
     return { ...group, working: groupIsWorking(group) };
 }
@@ -1899,7 +2108,7 @@ function broadcast(payload) {
     replayBuffer.push({ seq, kind, frame: kind === "screen" ? null : frame, clientFrame: kind === "screen" ? null : clientFrame });
     if (replayBuffer.length > REPLAY_MAX)
         replayBuffer.shift();
-    for (const client of [...sseClients]) {
+    for (const client of Array.from(sseClients)) {
         if (!wants(client, kind))
             continue;
         // Screen frames are replaceable and durable events are not: see
@@ -2205,6 +2414,18 @@ bus.subscribe((event) => {
     else if (event.type !== "session.exited")
         watchdog.touch(event.threadId);
 });
+// Memory journal turn boundary (server/memory-journal.ts). A bot's own
+// file-tool writes to MEMORY.md and memory/ have no hook to tap, so the
+// diff against the baseline taken at dispatch is made when the turn
+// settles — session.exited too, because a turn that died may still have
+// written. Fire-and-forget by construction: endMemoryTurn swallows its own
+// failures and never reaches the fold below.
+bus.subscribe((event) => {
+    if (shouldIgnoreProviderEvent(event))
+        return;
+    if (event.type === "turn.completed" || event.type === "session.exited")
+        endMemoryTurn(event.threadId);
+});
 // Bots currently working with nobody at the keyboard — a webhook turn, or a
 // turn a webhook-driven bot handed to a teammate. Auto mode is a decision
 // someone made for turns they were present for, so these don't inherit it:
@@ -2616,7 +2837,7 @@ bus.subscribe((event) => {
                     const existing = store.messagesFor(event.threadId).find((m) => m.id === messageId)?.tool;
                     toolName = existing?.name ?? "tool";
                     store.patchMessage(event.threadId, messageId, {
-                        tool: { name: toolName, ok: event.ok, spoken: existing?.spoken },
+                        tool: { name: toolName, ok: event.ok, spoken: existing?.spoken, summary: existing?.summary },
                     });
                     toolMessageByItem.delete(itemKey);
                 }
@@ -2648,7 +2869,7 @@ bus.subscribe((event) => {
                 const message = pushMessage({
                     role: "bot",
                     kind: "activity",
-                    tool: { name, spoken: narrateTool(name) ?? undefined },
+                    tool: { name, spoken: narrateTool(name) ?? undefined, summary: event.summary },
                 });
                 if (event.itemId)
                     toolMessageByItem.set(`${event.threadId}:${event.itemId}`, message.id);
@@ -3880,7 +4101,7 @@ async function startTurn(botId, text, opts) {
     // that never mounts agent tools (or a turn already at the comms-depth cap)
     // must not be steered into — or told about — tools it cannot call.
     const agentsMounted = commsDepth < MAX_COMMS_DEPTH && instance.adapter.capabilities.agentsMcp === true;
-    const skillAuthoring = skillRecorderEnabled(cfg) && agentsMounted;
+    const skillAuthoring = skillAuthoringEnabled(cfg) && agentsMounted;
     // Setup mode's turn-text rewrite (parseSetupCommand/expandSetupTurnText)
     // must not run ahead of a system prompt that can't explain it: a driver
     // without agent tools sees the user's literal "/setup ..." message. The
@@ -3901,6 +4122,10 @@ async function startTurn(botId, text, opts) {
     // this already-built turn must either keep its old session or replay on the
     // following turn, never start a blank session with no transcript.
     const resumeCursor = resume ? task.resumeCursors[instanceId] : undefined;
+    // A cursor the provider no longer honours must not brick the thread: the
+    // driver may fall back to ONE fresh session, and this is what it sends
+    // there, so the new session is not blank (server/resume-recovery.ts).
+    const recoveryText = resumeCursor !== undefined ? buildRecoveryText({ text: turnText, transcript }) : undefined;
     const persona = [
         `You are ${bot.name}, a personal bot in OpenMausBot.`,
         bot.title && `Role: ${bot.title}.`,
@@ -3968,8 +4193,11 @@ async function startTurn(botId, text, opts) {
             // desk, not the whole house — and the workspace is where its
             // MEMORY.md lives. API/box engines have no local filesystem story.
             const worksInWorkspace = instance.driverKind !== "grok" && instance.driverKind !== "boxAgent";
-            if (worksInWorkspace)
+            if (worksInWorkspace) {
                 ensureWorkspace(bot.id);
+                // baseline for the journal's turn-boundary diff (see the bus hook)
+                beginMemoryTurn(bot.id, threadId);
+            }
             const privateWorkspace = worksInWorkspace ? ensureTaskWorkspace(bot.id, threadId) : undefined;
             const skillInstructions = renderSkillInstructions(selectedSkills, {
                 includeRoot: worksInWorkspace && opts?.runOn !== "cloud",
@@ -4343,8 +4571,11 @@ async function startTurn(botId, text, opts) {
                 // the active task's own session — another task's cursor would
                 // resume the wrong conversation and defeat the context bubble
                 resumeCursor,
+                ...(recoveryText !== undefined ? { recoveryText } : {}),
                 transcript,
                 system: prompt.text,
+                systemStable: prompt.stable,
+                systemVolatile: prompt.volatile,
                 integrations,
                 cwd,
             }), () => !directTurnClaimExists(bot.id, dispatchClaimId, threadId), async () => {
@@ -5141,7 +5372,7 @@ setupRetry = 0) {
     };
     try {
         const integrations = {};
-        const skillAuthoring = skillRecorderEnabled(cfg) &&
+        const skillAuthoring = skillAuthoringEnabled(cfg) &&
             hop === 0 &&
             !skillAuthoringClaim.claimed &&
             !cardContinuation &&
@@ -5382,6 +5613,9 @@ setupRetry = 0) {
         // conversation, not a different bot
         const worksInWorkspace = instance.driverKind !== "grok" && instance.driverKind !== "boxAgent";
         const workspace = worksInWorkspace ? ensureWorkspace(bot.id) : undefined;
+        // a room member's memory writes are journaled the same as a 1:1 turn's
+        if (workspace)
+            beginMemoryTurn(bot.id, threadId);
         // The room's folder pins here — on the first turn that actually
         // dispatches, not at PATCH time — so a folder set on a never-used room
         // still takes effect, while a room that already worked somewhere never
@@ -5401,12 +5635,14 @@ setupRetry = 0) {
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
             // the room path has always put a newline before memory and trimmed
             // the block's leading space; keep that so existing prompts are
-            // byte-identical
-            { id: "memory", label: "Memory", text: workspace ? `\n${memorySystemPrompt(bot.id).trim()}` : "" },
+            // byte-identical. The write guidance follows the tools actually
+            // mounted, exactly as the 1:1 path decides it: memory_update is on the
+            // agents server, so a room turn with it must be told to use it too.
+            { id: "memory", label: "Memory", text: workspace ? `\n${memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents) }).trim()}` : "" },
             { id: "skills", label: "Skills index", text: workspace ? skillsSystemPrompt(bot.id) : "" },
             { id: "skill-instructions", label: "Skill instructions", text: renderSkillInstructions(selectedSkills, { includeRoot: Boolean(workspace) }) },
             { id: "playbooks", label: "Playbooks", text: installedPlaybookInstructions(text, bot.playbooks) },
-        ]).text;
+        ]);
         // run the turn and wait for it to settle, folding the reply text so a
         // chained @mention can be routed afterwards
         // Claim only after setup succeeded. An unavailable, busy, unsupported, or
@@ -5509,7 +5745,9 @@ setupRetry = 0) {
                 text,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(readyBot, false, threadId),
-                system: roomSystem,
+                system: roomSystem.text,
+                systemStable: roomSystem.stable,
+                systemVolatile: roomSystem.volatile,
                 cwd,
                 integrations,
                 ...memberTurnSelection(readyBot.modelSelection),
@@ -7044,7 +7282,7 @@ function configStatus() {
             maxInstances: localVmMaxInstances(cfg),
         },
         features: {
-            skillRecorder: skillRecorderEnabled(cfg),
+            skillAuthoring: skillAuthoringEnabled(cfg),
             showToolCalls: showToolCallsEnabled(cfg),
             browser: builtInBrowserEnabled(cfg),
         },
@@ -7235,6 +7473,26 @@ function json(res, status, body) {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(data);
 }
+/** A store refusal is a client error with a status of its own (400 path,
+ * 409 conflict, 413 too large); a 409 also carries what is on disk now so
+ * the editor can show the bot's version instead of guessing. Anything else
+ * is a real failure and goes to the handler's catch-all. */
+function replyMemoryError(res, error) {
+    if (!(error instanceof MemoryStoreError))
+        throw error;
+    if (error.code === "conflict") {
+        return json(res, error.status, { error: error.message, code: error.code, currentHash: error.currentHash, current: error.current });
+    }
+    return json(res, error.status, { error: error.message, code: error.code });
+}
+/** The journal row as the panel shows it: the full prior text stays on
+ * the server (a revert needs it there, the list does not), and the thread
+ * id becomes the chat title people recognise. */
+function journalEntryForClient(botId, entry) {
+    const { before: _before, ...visible } = entry;
+    const threadTitle = entry.threadId ? store.taskByThread(botId, entry.threadId)?.title : undefined;
+    return threadTitle ? { ...visible, threadTitle } : visible;
+}
 function readBody(req, limit = 1_000_000) {
     return new Promise((resolve, reject) => {
         let data = "";
@@ -7602,10 +7860,23 @@ const handleRequest = async (req, res) => {
                     throw Object.assign(new Error("the internal turn capability has expired"), { status: 401 });
                 }
             };
+            // Where an entry came from, as the person will read it in MEMORY.md:
+            // the room or the thread title, never a bare id unless nothing else
+            // names the conversation.
+            const memorySource = () => memorySourceLabel({
+                room: store.groupByThread(internalCapability.threadId),
+                task: store.taskByThread(internalSender.id, internalCapability.threadId),
+                threadId: internalCapability.threadId,
+            });
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
-                const result = updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText });
-                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : result.code === "too-large" ? 413 : 400, result);
+                const result = updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText }, { source: memorySource() });
+                return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : result.code === "over-budget" ? 413 : 400, result);
+            }
+            if (method === "POST" && path === "/api/internal/memory/log") {
+                const body = await readInternalBody();
+                const result = appendMemoryLog(internalSender.id, body.text, { source: memorySource() });
+                return json(res, result.ok ? 200 : 400, result);
             }
             if (method === "POST" && path === "/api/internal/browser/mcp") {
                 const body = await readInternalBody();
@@ -7910,6 +8181,16 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "q is required" });
                 const rawLimit = Number(url.searchParams.get("limit"));
                 const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(Math.trunc(rawLimit), 25) : 12;
+                // Memory files ride along by default: the bot's own notes are as
+                // much its notebook as its transcripts, and scoped the same way —
+                // the caller's own bot, never another's.
+                const scope = url.searchParams.get("scope") ?? "all";
+                if (scope !== "all" && scope !== "conversations" && scope !== "memory") {
+                    return json(res, 400, { error: "scope must be all, conversations, or memory" });
+                }
+                const memoryHits = scope === "conversations" ? [] : searchMemoryFiles(from.id, q, limit);
+                if (scope === "memory")
+                    return json(res, 200, { hits: [], memoryHits });
                 const ownThreads = [...new Set([from.threadId, ...(from.tasks ?? []).map((task) => task.threadId)])];
                 // A room is the only place a recall can be a disclosure: in a 1:1 the
                 // user already owns every thread the bot can reach.
@@ -7923,7 +8204,7 @@ const handleRequest = async (req, res) => {
                 if (inRoom) {
                     discloseRecall(from, fromThreadId, hits.filter((hit) => hit.crossed).map((hit) => hit.threadId));
                 }
-                return json(res, 200, { hits });
+                return json(res, 200, { hits, memoryHits });
             }
             // session_read: the whole message behind a session_search hit. Same
             // own-bot scope — a message id from another bot's thread reads as
@@ -7957,8 +8238,8 @@ const handleRequest = async (req, res) => {
                 });
             }
             if (method === "GET" && path === "/api/internal/skills") {
-                if (!skillRecorderEnabled(cfg))
-                    return json(res, 403, { error: "learned skills are not enabled" });
+                if (!skillAuthoringEnabled(cfg))
+                    return json(res, 403, { error: "skill authoring is not enabled in Settings" });
                 if (!internalCapability.skillAuthoring) {
                     return json(res, 403, { error: "skill authoring is not enabled for this turn" });
                 }
@@ -7973,8 +8254,8 @@ const handleRequest = async (req, res) => {
                 });
             }
             if (method === "POST" && path === "/api/internal/skills/stage") {
-                if (!skillRecorderEnabled(cfg))
-                    return json(res, 403, { error: "learned skills are not enabled" });
+                if (!skillAuthoringEnabled(cfg))
+                    return json(res, 403, { error: "skill authoring is not enabled in Settings" });
                 if (!internalCapability.skillAuthoring) {
                     return json(res, 403, { error: "skill authoring is not enabled for this turn" });
                 }
@@ -8611,6 +8892,86 @@ const handleRequest = async (req, res) => {
                     model: safeBot.modelSelection.model,
                 });
             }
+            if (method === "POST" && (path === "/api/internal/create-room" || path === "/api/internal/manage-room")) {
+                const body = await readInternalBody();
+                const chief = store.bot(internalCapability.botId);
+                if (chief.hidden || !chief.chiefOfStaff || !connectorThread(chief.id, internalCapability.threadId)) {
+                    return json(res, 403, { error: "only an active section Chief of Staff can manage rooms" });
+                }
+                if (!body || typeof body !== "object" || Array.isArray(body)) {
+                    return json(res, 400, { error: "room request must be a JSON object" });
+                }
+                // ponytail: no new room-administration approval flow. Fail closed for
+                // chiefs whose peer changes need review; add a proposal card if needed.
+                if (chief.approvePeerComms) {
+                    return json(res, 403, { error: "peer approval is required; ask the user to make this room change" });
+                }
+                // Section labels are a permission boundary, not bot-owned organization.
+                // A Chief may not recruit excluded peers or acquire a foreign transcript.
+                const allowedIds = new Set([chief.id, ...reachablePeers(store.bots, chief).map((bot) => bot.id)]);
+                const allowedRoster = (ids) => ids.includes(chief.id) && ids.every((id) => allowedIds.has(id));
+                if (body.section !== undefined && (typeof body.section !== "string" || sectionKey(body.section) !== sectionKey(chief.section))) {
+                    return json(res, 403, { error: "rooms must stay in your own section; ask the user to move them" });
+                }
+                if (path === "/api/internal/create-room") {
+                    if ((internalCapability.createdRooms ?? 0) >= 4) {
+                        return json(res, 429, { error: "you can create at most 4 rooms in one turn" });
+                    }
+                    const parsed = z.object({
+                        fromBotId: z.string().optional(), fromThreadId: z.string().optional(),
+                        name: z.string().trim().min(1).max(100), memberIds: z.array(z.string()).min(1).max(100),
+                        section: z.string().optional(), bulletin: z.string().max(12_000).optional(),
+                    }).strict().safeParse(body);
+                    if (!parsed.success)
+                        return json(res, 400, { error: "provide a room name, memberIds, and optional bulletin (at most 12000 characters)" });
+                    const memberIds = [...new Set([chief.id, ...parsed.data.memberIds])];
+                    if (!allowedRoster(memberIds)) {
+                        return json(res, 403, { error: "include yourself and only active, allowed peers from your section" });
+                    }
+                    const group = createChannel({
+                        name: redactSecretsInText(parsed.data.name), memberIds, section: chief.section,
+                        setup: { bulletin: redactSecretsInText(parsed.data.bulletin ?? ""), defaultResponder: { kind: "member", botId: chief.id } },
+                    });
+                    internalCapability.createdRooms = (internalCapability.createdRooms ?? 0) + 1;
+                    return json(res, 201, { id: group.id, name: group.name, section: group.section || "General", memberIds: group.memberIds, memberCount: group.memberIds.length });
+                }
+                const parsed = z.object({
+                    fromBotId: z.string().optional(), fromThreadId: z.string().optional(),
+                    roomId: z.string(), action: z.enum(["add_members", "remove_members", "set_members", "rename", "set_bulletin"]),
+                    memberIds: z.array(z.string()).min(1).max(100).optional(),
+                    name: z.string().trim().min(1).max(100).optional(), bulletin: z.string().max(12_000).optional(),
+                }).strict().safeParse(body);
+                if (!parsed.success)
+                    return json(res, 400, { error: "provide roomId and a supported room action; section moves are user-only" });
+                const room = store.group(parsed.data.roomId);
+                if (!room || room.dm || sectionKey(room.section) !== sectionKey(chief.section) || !allowedRoster(room.memberIds)) {
+                    return json(res, 403, { error: "you can only manage rooms you belong to with allowed peers in your own section" });
+                }
+                const { action, memberIds, name, bulletin } = parsed.data;
+                const patch = {};
+                if (action === "rename") {
+                    if (name === undefined)
+                        return json(res, 400, { error: "rename requires a name" });
+                    patch.name = redactSecretsInText(name);
+                }
+                else if (action === "set_bulletin") {
+                    if (bulletin === undefined)
+                        return json(res, 400, { error: "set_bulletin requires bulletin text; use an empty string to clear it" });
+                    patch.bulletin = redactSecretsInText(bulletin);
+                }
+                else {
+                    if (!memberIds || memberIds.some((id) => !allowedIds.has(id))) {
+                        return json(res, 403, { error: "memberIds must name only yourself or active, allowed peers in your section" });
+                    }
+                    const next = action === "add_members" ? [...new Set([...room.memberIds, ...memberIds])]
+                        : action === "remove_members" ? room.memberIds.filter((id) => !memberIds.includes(id)) : memberIds;
+                    if (!allowedRoster(next))
+                        return json(res, 403, { error: "keep yourself in the room; only the user can remove its managing Chief" });
+                    patch.memberIds = next;
+                }
+                const updated = updateChannel(room.id, patch);
+                return json(res, 200, { ok: true, memberIds: updated.memberIds, memberCount: updated.memberIds.length, message: `Updated room “${updated.name}”.` });
+            }
             if (method === "POST" && path === "/api/internal/request-credential") {
                 const body = await readInternalBody();
                 const from = internalSender;
@@ -9447,47 +9808,7 @@ const handleRequest = async (req, res) => {
         }
         // ── channels (persisted internally as groups) ───────────────────────
         if (method === "POST" && path === "/api/groups") {
-            const body = await readBody(req);
-            if (!body || typeof body !== "object" || Array.isArray(body)) {
-                return json(res, 400, { error: "channel must be a JSON object" });
-            }
-            const roster = checkedMemberIds(body.memberIds);
-            if (!roster.ok)
-                return json(res, 400, { error: roster.error });
-            const { memberIds } = roster;
-            if (body.name !== undefined && typeof body.name !== "string") {
-                return json(res, 400, { error: "channel name must be a string" });
-            }
-            const name = body.name?.trim() || `${store.bot(memberIds[0]).name} & co.`;
-            if (name.length > 100)
-                return json(res, 400, { error: "channel name must be at most 100 characters" });
-            let section;
-            if (body.section !== undefined && body.section !== null) {
-                if (typeof body.section !== "string")
-                    return json(res, 400, { error: "context must be a string" });
-                section = body.section.trim() || undefined;
-                if (section && section.length > 60) {
-                    return json(res, 400, { error: "context must be at most 60 characters" });
-                }
-            }
-            let setup;
-            if (body.setup !== undefined) {
-                if (!body.setup || typeof body.setup !== "object" || Array.isArray(body.setup)) {
-                    return json(res, 400, { error: "setup must be an object" });
-                }
-                const requested = body.setup;
-                if (typeof requested.bulletin !== "string") {
-                    return json(res, 400, { error: "setup.bulletin must be a string" });
-                }
-                if (requested.bulletin.length > 12_000) {
-                    return json(res, 400, { error: "setup.bulletin must be at most 12000 characters" });
-                }
-                const responder = checkedGroupResponder(requested.defaultResponder, memberIds);
-                if (!responder)
-                    return json(res, 400, { error: "invalid setup.defaultResponder" });
-                setup = { bulletin: requested.bulletin, defaultResponder: responder, completed: true };
-            }
-            const group = store.createGroup(name, memberIds, false, section, setup);
+            const group = createChannel(await readBody(req));
             return json(res, 201, { group: { ...publicGroupState(group), messages: [] } });
         }
         if (method === "POST" && path === "/api/teams/export") {
@@ -9506,12 +9827,17 @@ const handleRequest = async (req, res) => {
                     return json(res, 200, createTeamBackup(store, routines.listRoutines(), name));
                 }
                 if (body.format === "package") {
+                    const selectedBots = store.bots.filter((bot) => !bot.hidden);
+                    const skillNames = checkedExportSkillNames(body.skillIds, selectedBots);
+                    if (!skillNames.ok)
+                        return json(res, 400, { error: skillNames.error });
                     const document = createBotPackageExport({
                         name,
                         authorName: profileName,
-                        bots: store.bots,
+                        bots: selectedBots,
                         groups: store.groups,
                         routines: routines.listRoutines(),
+                        skillsByBot: collectExportSkills(selectedBots, skillNames.names),
                     });
                     return json(res, 200, {
                         name: document.package.name,
@@ -9656,8 +9982,8 @@ const handleRequest = async (req, res) => {
             const pkg = packageDocument?.package;
             const importName = pkg?.name ?? manifest.team.name;
             const sourceMembers = pkg
-                ? pkg.agents.map((agent) => ({ member: packageAgentAsMember(agent), playbookKeys: agent.playbooks ?? [] }))
-                : manifest.team.members.map((member) => ({ member, playbookKeys: [] }));
+                ? pkg.agents.map((agent) => ({ member: packageAgentAsMember(agent), playbookKeys: agent.playbooks ?? [], skillNames: agent.skills ?? [] }))
+                : manifest.team.members.map((member) => ({ member, playbookKeys: [], skillNames: [] }));
             const importedBots = [];
             const createdGroups = [];
             const createdRoutineIds = [];
@@ -9680,6 +10006,7 @@ const handleRequest = async (req, res) => {
                     }
                 }
                 const playbookByKey = new Map((pkg?.playbooks ?? []).map((playbook) => [playbook.key, playbook]));
+                const packageSkillByName = new Map((pkg?.skills?.entries ?? []).map((skill) => [skill.name, skill]));
                 for (const source of sourceMembers) {
                     const member = source.member;
                     // importedMemberProfile is the authority boundary: persona fields
@@ -9713,6 +10040,17 @@ const handleRequest = async (req, res) => {
                             }
                             : {}),
                     });
+                    for (const skillName of source.skillNames) {
+                        const skill = packageSkillByName.get(skillName);
+                        if (!skill)
+                            throw new Error(`Package skill "${skillName}" is unavailable`);
+                        const installed = installSkill(created.id, skill.source ?? `package:${pkg.id}`, [
+                            { path: "SKILL.md", content: skill.instructions },
+                        ]);
+                        if ("error" in installed) {
+                            throw new Error(`Package skill "${skillName}" could not be imported: ${installed.error}`);
+                        }
+                    }
                     memberIds.set(member.key, created.id);
                 }
                 // A package is an explicit structure import: its rooms are created
@@ -9835,11 +10173,6 @@ const handleRequest = async (req, res) => {
             return json(res, 200, { group: publicGroupState(updated) });
         }
         // ── channel tasks: separate conversations for the same team ────────
-        const channelTaskBlocked = (group) => groupIsWorking(group) ||
-            store.groupTasks(group.id).some((task) => store.messagesFor(task.threadId).some((message) => message.kind === "options" &&
-                message.card?.requestId &&
-                !message.card.answered &&
-                !message.card.dismissed));
         // A scheduled goal starts in a detached task. Let the user open the
         // exact task that owns the live operation (or a durable approval card)
         // so they can observe or unblock it; switching to an unrelated task is
@@ -9955,113 +10288,7 @@ const handleRequest = async (req, res) => {
                 if (field)
                     return json(res, 403, { error: `forbidden: this session may rename or mark a room, not change "${field}" (needs the admin scope)` });
             }
-            if (!body || typeof body !== "object" || Array.isArray(body)) {
-                return json(res, 400, { error: "body must be a JSON object" });
-            }
-            const existing = store.group(m[1]);
-            if (!existing)
-                return json(res, 404, { error: "no such room" });
-            if (body.memberIds !== undefined && phoneSecretSubmissions.hasGroup(existing.id)) {
-                return json(res, 409, { error: "this channel is securely saving a credential — try again when it finishes" });
-            }
-            if (channelTaskBlocked(existing) &&
-                (body.memberIds !== undefined || body.defaultResponder !== undefined || body.bulletin !== undefined)) {
-                return json(res, 409, { error: "this channel is working or waiting on you — finish that turn first" });
-            }
-            const patch = {};
-            if (body.name !== undefined) {
-                if (typeof body.name !== "string")
-                    return json(res, 400, { error: "room name must be a string" });
-                const name = body.name.trim();
-                if (!name)
-                    return json(res, 400, { error: "room name must not be empty" });
-                if (name.length > 100)
-                    return json(res, 400, { error: "room name must be at most 100 characters" });
-                patch.name = name;
-            }
-            if (body.bulletin !== undefined) {
-                if (typeof body.bulletin !== "string")
-                    return json(res, 400, { error: "bulletin must be a string" });
-                if (body.bulletin.length > 12_000) {
-                    return json(res, 400, { error: "bulletin must be at most 12000 characters" });
-                }
-                patch.bulletin = body.bulletin;
-            }
-            if (body.unread !== undefined) {
-                if (typeof body.unread !== "boolean")
-                    return json(res, 400, { error: "unread must be true or false" });
-                patch.unread = body.unread;
-            }
-            if (body.memberIds !== undefined) {
-                // A DM is the pair it was opened for; only real rooms have a roster.
-                if (existing.dm)
-                    return json(res, 400, { error: "direct-message channels cannot change members" });
-                const roster = checkedMemberIds(body.memberIds);
-                if (!roster.ok)
-                    return json(res, 400, { error: roster.error.replace("channel", "room") });
-                const removedGoalLead = routines.listRoutines().some((routine) => routine.enabled &&
-                    routine.target === "room-goal" &&
-                    routine.groupId === existing.id &&
-                    !roster.memberIds.includes(routine.botId)) || routines.listRuns().some((run) => run.target === "room-goal" &&
-                    run.groupId === existing.id &&
-                    ["queued", "running", "waiting"].includes(run.status) &&
-                    !roster.memberIds.includes(run.botId));
-                if (removedGoalLead) {
-                    return json(res, 409, {
-                        error: "pause or reassign this room's team-goal routine before removing its lead",
-                    });
-                }
-                patch.memberIds = roster.memberIds;
-            }
-            if (body.defaultResponder !== undefined) {
-                const memberIds = patch.memberIds ?? existing.memberIds;
-                const responder = checkedGroupResponder(body.defaultResponder, memberIds);
-                if (!responder)
-                    return json(res, 400, { error: "invalid default responder" });
-                patch.defaultResponder = responder;
-            }
-            if (body.cwd !== undefined) {
-                if (existing.dm)
-                    return json(res, 400, { error: "direct-message channels cannot have a working folder" });
-                if (existing.pinnedCwd !== undefined) {
-                    return json(res, 409, { error: "the room's working folder is fixed after its first turn" });
-                }
-                const checked = validateBotCwd(body.cwd);
-                if (!checked.ok)
-                    return json(res, 400, { error: checked.error });
-                patch.cwd = checked.cwd ?? undefined;
-            }
-            // one pinned message per room; null/"" clears. The id is not
-            // validated against the transcript here — a pin whose message was
-            // edited away or deleted simply resolves to nothing in the UI.
-            if (body.pinnedMessageId !== undefined) {
-                if (body.pinnedMessageId === null || body.pinnedMessageId === "")
-                    patch.pinnedMessageId = undefined;
-                else if (typeof body.pinnedMessageId === "string" && /^[\w-]+$/.test(body.pinnedMessageId)) {
-                    patch.pinnedMessageId = body.pinnedMessageId;
-                }
-                else
-                    return json(res, 400, { error: "pinnedMessageId must be a message id" });
-            }
-            // same contract as a bot's sidebar section: null/"" clears, 60 chars max
-            if (body.section !== undefined) {
-                if (body.section === null)
-                    patch.section = undefined;
-                else if (typeof body.section !== "string")
-                    return json(res, 400, { error: "section must be a string" });
-                else {
-                    const trimmed = body.section.trim();
-                    if (!trimmed)
-                        patch.section = undefined;
-                    else if (trimmed.length > 60)
-                        return json(res, 400, { error: "section must be at most 60 characters" });
-                    else
-                        patch.section = trimmed;
-                }
-            }
-            const group = store.patchGroup(m[1], patch);
-            if (!group)
-                return json(res, 404, { error: "no such room" });
+            const group = updateChannel(m[1], body);
             return json(res, 200, { group: publicGroupState(group) });
         }
         m = path.match(/^\/api\/groups\/([\w-]+)\/read$/);
@@ -11339,31 +11566,130 @@ const handleRequest = async (req, res) => {
             broadcast({ kind: "bot", bot: visible });
             return json(res, 200, { bot: visible });
         }
-        // ── bot memory: MEMORY.md + memory/ topic files ─────────────────────
-        // The files already belong to the user (plain markdown in the bot's
-        // workspace); these routes only make them visible without a trip to
-        // the filesystem. Reads never create the workspace — a bot that has
-        // not run yet simply has nothing to show.
+        // ── bot memory: MEMORY.md + memory/ topic and log files ──────────────
+        // The files already belong to the person (plain markdown in the bot's
+        // workspace). server/memory-store.ts decides which paths can be reached
+        // and refuses a save whose expectedHash no longer matches the file;
+        // server/memory-journal.ts records every change made here so it can be
+        // read back and reverted. Reads never create the workspace — a bot that
+        // has not run yet simply has nothing to show. Admin scope by default
+        // (request-auth.ts), like the profile routes above.
         m = path.match(/^\/api\/bots\/([\w-]+)\/memory$/);
         if (m && method === "GET") {
             if (!store.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
-            return json(res, 200, { ...readMemoryFile(m[1]), topics: listMemoryTopics(m[1]) });
+            try {
+                const overview = memoryOverview(m[1]);
+                // `text` and `truncated` ride along one release for clients of the
+                // old whole-file shape; the panel reads the file through /memory/file
+                return json(res, 200, { ...overview, text: readMemoryDoc(m[1], MEMORY_INDEX).text, truncated: overview.index.truncated });
+            }
+            catch (error) {
+                return replyMemoryError(res, error);
+            }
         }
         if (m && method === "PUT") {
+            // The pre-panel whole-file write, kept one release: no hash check, so
+            // it can still overwrite a note the bot just wrote — journaled as the
+            // person's so at least the journal can undo it.
             if (!store.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
             const parsed = z.object({ text: z.string() }).safeParse(await readBody(req));
             if (!parsed.success)
                 return json(res, 400, { error: "text must be a string" });
-            if (Buffer.byteLength(parsed.data.text, "utf8") > MEMORY_FILE_MAX_BYTES) {
-                return json(res, 400, {
-                    error: `memory is capped at ${MEMORY_FILE_MAX_BYTES / 1024}KB — move longer notes into memory/<topic>.md files`,
+            try {
+                const { doc } = journalMemoryWrite(m[1], MEMORY_INDEX, parsed.data.text, { actor: "person", via: "api" });
+                return json(res, 200, { ok: true, hash: doc.hash, truncated: memoryCapacity(doc.text).truncated });
+            }
+            catch (error) {
+                // the old route answered 400 for an oversized body; keep that for
+                // its callers while the new route says 413
+                if (error instanceof MemoryStoreError && error.code === "too-large")
+                    return json(res, 400, { error: error.message });
+                return replyMemoryError(res, error);
+            }
+        }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/file$/);
+        if (m && method === "GET") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            try {
+                return json(res, 200, readMemoryDoc(m[1], url.searchParams.get("path") ?? MEMORY_INDEX));
+            }
+            catch (error) {
+                return replyMemoryError(res, error);
+            }
+        }
+        if (m && method === "PUT") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            const parsed = z
+                .object({ path: z.string().default(MEMORY_INDEX), text: z.string(), expectedHash: z.string().optional() })
+                .safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "text must be a string; path and expectedHash are optional strings" });
+            try {
+                const { doc, entry } = journalMemoryWrite(m[1], parsed.data.path, parsed.data.text, {
+                    actor: "person",
+                    via: "ui",
+                    expectedHash: parsed.data.expectedHash,
                 });
+                return json(res, 200, { ok: true, ...doc, entry: entry ? journalEntryForClient(m[1], entry) : null, overview: memoryOverview(m[1]) });
+            }
+            catch (error) {
+                return replyMemoryError(res, error);
+            }
+        }
+        if (m && method === "DELETE") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            const file = url.searchParams.get("path") ?? "";
+            try {
+                const entry = journalMemoryDelete(m[1], file, { actor: "person", via: "ui" });
+                return json(res, 200, { ok: true, path: file, entry: entry ? journalEntryForClient(m[1], entry) : null, overview: memoryOverview(m[1]) });
             }
-            writeMemoryFile(m[1], parsed.data.text);
-            // truncated echoes back so the editor can warn about the load budget
-            return json(res, 200, { ok: true, truncated: readMemoryFile(m[1]).truncated });
+            catch (error) {
+                return replyMemoryError(res, error);
+            }
+        }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/journal$/);
+        if (m && method === "GET") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            // the row a save queued a moment ago may not have reached disk yet
+            await flushMemoryJournal(m[1]);
+            const limit = Math.min(200, Math.max(1, Number(url.searchParams.get("limit") ?? 50) || 50));
+            const botId = m[1];
+            return json(res, 200, { entries: readMemoryJournal(botId, limit).map((entry) => journalEntryForClient(botId, entry)) });
+        }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/journal\/([\w-]+)\/revert$/);
+        if (m && method === "POST") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            await flushMemoryJournal(m[1]);
+            const result = revertMemoryChange(m[1], m[2]);
+            if (!result.ok)
+                return json(res, result.status, { error: result.error });
+            return json(res, 200, { ok: true, ...result.doc, entry: result.entry ? journalEntryForClient(m[1], result.entry) : null, overview: memoryOverview(m[1]) });
+        }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/open$/);
+        if (m && method === "POST") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            const parsed = z.object({ target: z.enum(["obsidian", "folder"]) }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "target must be obsidian or folder" });
+            // The folder is on this machine's disk; opening it only makes sense
+            // from this machine. A paired phone or a remote browser gets the path
+            // to open by hand instead.
+            const workspacePath = memoryOverview(m[1]).workspacePath;
+            if (auth.kind !== "loopback") {
+                return json(res, 403, { error: `This only works on the computer running OpenMausBot. The memory folder there is ${workspacePath}`, workspacePath });
+            }
+            const opened = await openMemoryLocation(m[1], parsed.data.target);
+            if (!opened.ok)
+                return json(res, 500, { error: opened.error, workspacePath: opened.workspacePath });
+            return json(res, 200, opened);
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/memory\/topics\/([^/]+)$/);
         if (m && method === "GET") {
@@ -13560,6 +13886,7 @@ const gracefulShutdown = createGracefulShutdown({
             await browserRuntime.closeAll();
         },
         () => flushAllProfileHistory(),
+        () => flushAllMemoryJournals(),
     ],
     // Cleanup jobs run concurrently. Release only after they settle (or reach
     // the shutdown deadline), immediately before the process exits, so no new