openmausbot 0.1.72 → 0.1.74

package/dist-server/server/index.js

@@ -8,11 +8,10 @@ import { extname, join } from "node:path";
 import { z } from "zod";
 import { botAvatarUrlFromStoredPath } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
-import { approvalModeFor, supportsApprovalMode, requiresNativeApproval, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
+import { approvalModeFor, supportsApprovalMode, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, rememberableApprovalKey } from "./auto-approve.js";
-import { requestReview, resolveAutoReviewMode, shouldReview } from "./auto-review.js";
+import { HELD_NOTE, approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict } from "./auto-approve.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
 import { BrowserCleanupCoordinator, finalizeBrowserCleanupMutation, requireBrowserCleanupAcknowledged, } from "./browser-lifecycle-cleanup.js";
@@ -33,7 +32,7 @@ import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { peerAllowed, peerName, peerRosterSystemPrompt, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
 import { ComputerControl } from "./computer-control.js";
 import { MAX_REMOTE_COMMAND_LENGTH } from "./remote-computer.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -53,15 +52,15 @@ import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
 import { getOrCreateChannel, mirrorActivity, mirrorExchange, mirrorReply } from "./comms-visibility.js";
-import { readMessageText, recallMessages, searchMessages, closeMessageDb } from "./message-db.js";
+import { readMessageText, recallMessages, searchMessages, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups } from "./message-db.js";
 import { claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
 /** A session_read answer competes with the transcript for the context
  * window; a computer-use turn's output can run to hundreds of KB. */
 const SESSION_READ_MAX_CHARS = 8_000;
 import { promptWithReply, transcriptText } from "./replies.js";
 import { _loadPending, buildDelegationFailurePrompt, buildDelegationRevivalPrompt, DelegationWakeBudget, discardDelegations, drainDelegations, findDelegationReceipt, pendingDelegationInfo, pendingDelegationSnapshot, pendingThreads, queueDelegation, recordDelegationReceipt, releaseDelegationsWaitingOn, summarizeDelegatedActivity } from "./delegations.js";
-import { cancelSteeredMessage, drainSteeredMessages, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, } from "./steer-queue.js";
-import { cancelChannelMessage, drainChannelMessages, queuedChannelMessage, queueChannelMessage, } from "./channel-queue.js";
+import { cancelSteeredMessage, drainSteeredMessages, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreSteeredMessages, } from "./steer-queue.js";
+import { cancelChannelMessage, drainChannelMessages, queuedChannelMessage, queueChannelMessage, restoreChannelMessages, } from "./channel-queue.js";
 import { acceptedSendMatch, parseSendId, sendFingerprint, SendSequencer, } from "./send-idempotency.js";
 import { EventBus } from "./harness/bus.js";
 import { ProviderRegistry } from "./harness/registry.js";
@@ -481,6 +480,20 @@ class DirectTurnSetupCancelled extends Error {
 }
 const directTurnDispatchClaims = new Map();
 const directTurnGenerationByThread = new Map();
+// Stop revokes credentials before completion, but the receipt must retain its
+// exact provider-turn owner until that completion or explicit failure cleanup.
+const directFollowupTurns = new ProviderTurnGenerationRegistry();
+const directFollowupSettlers = new Map();
+function settleDirectFollowup(generation) {
+    if (!generation)
+        return;
+    const pending = directFollowupSettlers.get(generation);
+    if (!pending)
+        return;
+    directFollowupSettlers.delete(generation);
+    directFollowupTurns.deleteGeneration(pending.threadId, generation);
+    pending.settle();
+}
 // Keep the exact provider/profile settings that own a running conversation.
 // Selecting another thread or changing a default must not retarget its tools.
 const directTurnBots = new Map();
@@ -1001,6 +1014,7 @@ function checkedMemberIds(value) {
 }
 let bootSelection = { instanceId: "", model: "" };
 const store = new Store(() => bootSelection);
+let followupsReady = false;
 const sendSequencer = new SendSequencer();
 bootSelection = await defaultSelection();
 store.seedIfEmpty();
@@ -1184,15 +1198,11 @@ async function botOverview(bot) {
  * this too, but no provider dispatch or later permission callback relies on
  * persistence having been produced exclusively by that route. Delegation
  * uses the receiving bot's grant, never the sender's — see approvalModeForOrigin. */
-const approvalModeForTurn = (bot, peerInitiated = false, threadId = bot.threadId) => {
+const approvalModeForTurn = (bot, peerInitiated = false) => {
     const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
     if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
         return "ask";
     }
-    // Native reviewers can approve before a permission reaches this process.
-    // Unattended Auto must therefore downgrade before spawning the provider.
-    if (mode === "auto" && isUnattended(bot.id, threadId))
-        return "ask";
     return mode;
 };
 /** Privileged approval-mode transitions are deliberately absent from the
@@ -2162,7 +2172,9 @@ const askMessageByRequest = new Map(); // threadId:requestId -> messageId
  * the engine has no asks — is fail-closed: the action was never run. The
  * card is settled and a chip says so, instead of the answer vanishing into
  * a 500 while the card sits open forever. */
-async function answerRequest(threadId, instanceId, requestId, behavior, message, decidedFor) {
+async function answerRequest(threadId, instanceId, requestId, behavior, message, decidedFor, 
+/** "Always allow this session": the provider keeps the allow, not the app */
+always) {
     // Snapshot the card BEFORE delivering the answer: a delivered answer
     // resolves the request synchronously through the fold, which consumes
     // the askMessageByRequest entry — by the time the await returns, nobody
@@ -2179,7 +2191,7 @@ async function answerRequest(threadId, instanceId, requestId, behavior, message,
     let outcome = "unavailable";
     if (instance) {
         try {
-            outcome = await instance.adapter.respondToRequest(threadId, requestId, { behavior, message });
+            outcome = await instance.adapter.respondToRequest(threadId, requestId, { behavior, message, always: always && behavior === "allow" });
         }
         catch {
             outcome = "unavailable";
@@ -2248,6 +2260,16 @@ function requestBehavior(value) {
 // the last settled assistant text per thread, so a "finished" notification
 // can carry what the bot actually said
 const lastReply = new Map();
+/** the model each thread's provider session announced in session.started,
+ * so a fallback notice can name the model Auto is unavailable for */
+const sessionModelByThread = new Map();
+/** threads already told that the provider's reviewer never started */
+const nativeReviewNoticed = new Set();
+/** a driver kind as the chat should name it: "claudeAgent" → "Claude" */
+const providerLabel = (provider) => {
+    const bare = provider.replace(/Agent$/, "");
+    return bare.charAt(0).toUpperCase() + bare.slice(1);
+};
 /** Put a notification on the wire. Clients decide what to do with it — a
  * desktop notification now, a push to a paired phone later. */
 function notify(notification) {
@@ -2315,6 +2337,7 @@ const watchdog = new TurnWatchdog({
             kind: "activity",
             tool: { name: `error: no activity for ${minutes} minutes — the turn was stopped`, ok: false },
         });
+        settleDirectFollowup(stalledGeneration);
         finalizeDelegationWatch(turn.threadId, false, "", "Delegated turn stalled and was stopped");
         turnUsage.delete(turn.threadId);
         roomStallCompletions.stall(turn.threadId);
@@ -2370,66 +2393,6 @@ const watchdog = new TurnWatchdog({
     },
 });
 watchdog.start();
-async function reviewPermissionCard(args) {
-    const mode = resolveAutoReviewMode(args.asker.autoReview);
-    if (mode === "off" || !args.instance.reviewPermission)
-        return false;
-    const persona = [args.asker.name, args.asker.title, args.asker.description].filter(Boolean).join(" — ");
-    const reviewed = await requestReview(args.instance.reviewPermission.bind(args.instance), {
-        tool: args.tool,
-        summary: args.summary,
-        persona,
-    });
-    if (!reviewed)
-        return false;
-    if (mode === "shadow") {
-        appendDecision(DATA_DIR, {
-            threadId: args.threadId,
-            requestId: args.requestId,
-            botId: args.asker.id,
-            botName: args.asker.name,
-            tool: args.tool,
-            summary: args.summary,
-            decision: reviewed.allow ? "review-would-approve" : "review-would-deny",
-            source: "auto-review-shadow",
-            rule: reviewed.reason,
-        });
-        return false;
-    }
-    if (!reviewed.allow)
-        return false;
-    // The human can answer while review is running. Their click wins before
-    // the provider receives anything and before the audit log claims approval.
-    const card = store.messagesFor(args.threadId).find((message) => message.id === args.messageId)?.card;
-    if (!card || card.answered)
-        return false;
-    let outcome = "unavailable";
-    try {
-        outcome = await args.instance.adapter.respondToRequest(args.threadId, args.requestId, { behavior: "allow" });
-    }
-    catch {
-        return false;
-    }
-    if (outcome === "unavailable")
-        return false;
-    store.appendMessage(args.threadId, {
-        role: "bot",
-        kind: "activity",
-        tool: { name: `review approved ${args.tool}: ${reviewed.reason}`, ok: true },
-    });
-    appendDecision(DATA_DIR, {
-        threadId: args.threadId,
-        requestId: args.requestId,
-        botId: args.asker.id,
-        botName: args.asker.name,
-        tool: args.tool,
-        summary: args.summary,
-        decision: "auto-approved",
-        source: "auto-review",
-        rule: reviewed.reason,
-    });
-    return true;
-}
 bus.subscribe((event) => {
     if (shouldIgnoreProviderEvent(event))
         return;
@@ -2440,6 +2403,11 @@ bus.subscribe((event) => {
     else if (event.type === "turn.completed") {
         watchdog.settle(event.threadId);
         revokeInternalCapabilityForProviderEvent(event);
+        if (event.turnId) {
+            const owner = directFollowupTurns.complete(event.threadId, event.turnId);
+            if (owner)
+                settleDirectFollowup(owner.generation);
+        }
     }
     else if (event.type !== "session.exited")
         watchdog.touch(event.threadId);
@@ -2540,6 +2508,9 @@ let localVmProvisionBusy = false;
 let localVmModeChangeBusy = false;
 const activeVpsThreads = new Map();
 const boxLifecycleBusyBots = new Set();
+// A refresh is a reader, not a lifecycle change. Keep its reservation until
+// the provider settles even if the HTTP client leaves, and share it on retry.
+const vpsPreviewRequests = new Map();
 const orphanBoxLifecycleBusyIds = new Set();
 const boxInventoryRequestsBusyIds = new Set();
 const computerProviderConfigTransitions = new Set();
@@ -2588,7 +2559,7 @@ function providerOperationConflict(provider) {
     if (managedBoxOwners().some((owner) => owner.inUse)) {
         return `stop active bot work and computer control before changing ${provider === "box" ? "the Box account" : "the VPS connection"}`;
     }
-    if (boxLifecycleBusyBots.size > 0) {
+    if (boxLifecycleBusyBots.size > 0 || vpsPreviewRequests.size > 0) {
         return "wait for cloud computer actions to finish before changing provider settings";
     }
     if (provider === "box") {
@@ -2642,13 +2613,17 @@ function claimManagedBoxMutation(instance) {
     }
     return claimBotComputerLifecycle(ownerBotId);
 }
-/** One synchronous lane for every Box lifecycle consumer. Both Settings and
+/** One synchronous lane for cloud lifecycle consumers. Both Settings and
  * bot-scoped actions use it, so whichever operation starts first excludes the
- * other instead of relying on a stale check made before a provider await. */
-function claimBotComputerLifecycle(botId) {
+ * other instead of relying on a stale check made before a provider await.
+ * Only opening an existing VPS viewer may coexist with its pending preview. */
+function claimBotComputerLifecycle(botId, allowPreview = false) {
     if (boxLifecycleBusyBots.has(botId)) {
         throw Object.assign(new Error("this bot's cloud computer is being changed — wait for it to finish"), { status: 409 });
     }
+    if (!allowPreview && vpsPreviewRequests.has(botId)) {
+        throw Object.assign(new Error("a screen preview is still refreshing — wait before changing this computer"), { status: 409 });
+    }
     boxLifecycleBusyBots.add(botId);
     return () => boxLifecycleBusyBots.delete(botId);
 }
@@ -2828,6 +2803,8 @@ bus.subscribe((event) => {
             if (bot && event.sessionId && event.providerInstanceId) {
                 store.setResumeCursor(bot.id, event.providerInstanceId, event.sessionId, event.threadId);
             }
+            if (typeof event.model === "string" && event.model)
+                sessionModelByThread.set(event.threadId, event.model);
             break;
         case "item.completed":
             if (event.itemType === "assistant_text") {
@@ -2907,28 +2884,37 @@ bus.subscribe((event) => {
             break;
         case "request.opened": {
             const permission = event.requestType === "permission";
-            // Approval modes and always-allow can answer permission requests for
-            // the bot so it keeps working. A QUESTION always reaches the human —
-            // even Full access never invents a person's answer. Safe Auto stops on
-            // the guards in auto-approve.ts; explicitly acknowledged Full does not.
+            // A permission request here is one the provider left for a person: its
+            // own mode already ran (Ask, Edits, Auto's reviewer, Custom's config).
+            // OpenMausBot decides nothing about the action itself. Only Full access
+            // answers, because that is exactly what the person granted. A QUESTION
+            // always reaches the human — even Full access never invents an answer.
             const asker = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id, event.threadId) : false;
-            const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId), event.threadId) : "ask";
+            const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId)) : "ask";
             const verdict = permission && asker && event.requestId
-                ? autoVerdict({
-                    // Use the same receiving-bot mode as the provider dispatch.
-                    approvalMode: effectiveApprovalMode,
-                    autoApprove: false,
-                    alwaysAllow: asker.alwaysAllow,
-                }, event.tool, event.summary, {
-                    unattended,
-                    scope: event.approvalScope,
-                    requiresExplicitApproval: event.requiresExplicitApproval,
-                    // Match the dispatched mode for every provider, including
-                    // delegated Custom and unattended Auto downgrades.
-                    nativeApproval: requiresNativeApproval(event.provider, effectiveApprovalMode),
-                })
+                ? autoVerdict(effectiveApprovalMode, event.tool, { requiresExplicitApproval: event.requiresExplicitApproval })
                 : null;
+            // Auto's reviewer is the engine's own. Claude accepts `--permission-mode
+            // auto` for any model and starts in Manual without a word when auto is
+            // unavailable (Haiku 4.5, Sonnet 4.5, an org that disabled it), so the
+            // bot asks about everything. Say once per session why, and what stops it.
+            if (permission &&
+                asker &&
+                event.nativeReview === "inactive" &&
+                effectiveApprovalMode === "auto" &&
+                !nativeReviewNoticed.has(event.threadId)) {
+                nativeReviewNoticed.add(event.threadId);
+                const model = sessionModelByThread.get(event.threadId);
+                pushMessage({
+                    role: "bot",
+                    kind: "activity",
+                    tool: {
+                        name: `Approve for me: ${providerLabel(event.provider)}'s automatic reviewer is not available${model ? ` for ${model}` : ""}, so this bot asks before each action. Choose a model it supports, or Full access, to stop the prompts.`,
+                        ok: true,
+                    },
+                });
+            }
             if (verdict?.approve && asker && event.requestId) {
                 const settled = verdict.approve;
                 const instance = event.providerInstanceId
@@ -2964,7 +2950,6 @@ bus.subscribe((event) => {
                             summary,
                             decision: "auto-approved",
                             source: verdict.source,
-                            rule: verdict.rule,
                         });
                     }
                     catch {
@@ -2979,17 +2964,8 @@ bus.subscribe((event) => {
                                 options: ["Allow", "Deny"],
                                 requestId,
                                 tool,
-                                allowKey: rememberableApprovalKey(asker, tool, summary, {
-                                    source: verdict.source,
-                                    scope: event.approvalScope,
-                                    requiresExplicitApproval: event.requiresExplicitApproval,
-                                }),
-                                held: HELD_NOTE[verdict.source === "full-access"
-                                    ? "approval.held.undeliveredFull"
-                                    : "approval.held.undelivered"],
-                                heldCode: verdict.source === "full-access"
-                                    ? "approval.held.undeliveredFull"
-                                    : "approval.held.undelivered",
+                                held: HELD_NOTE["approval.held.undeliveredFull"],
+                                heldCode: "approval.held.undeliveredFull",
                                 approvalScope: event.approvalScope,
                             },
                         });
@@ -3003,24 +2979,12 @@ bus.subscribe((event) => {
                             summary,
                             decision: "card-shown",
                             source: "auto-fallback",
-                            rule: verdict.rule,
                         });
                     }
                 })();
                 break;
             }
-            // A card can outlive the bot record that raised it. Without one there is
-            // no mode to explain, but the sandbox note still applies.
-            const heldContext = {
-                source: verdict?.source,
-                permission,
-                requiresExplicitApproval: event.requiresExplicitApproval,
-                mode: asker ? approvalModeForOrigin(approvalModeFor(asker), { peerInitiated: isInternalTurn(event.threadId) }) : "ask",
-                unattended: Boolean(unattended),
-                fullAccessAvailable: asker && !isInternalTurn(event.threadId)
-                    ? supportsApprovalMode(registry.cliTarget(asker.modelSelection.instanceId)?.driverKind, "full")
-                    : false,
-            };
+            const heldContext = { source: verdict?.source, permission };
             const message = pushMessage({
                 role: "bot",
                 kind: "options",
@@ -3034,15 +2998,9 @@ bus.subscribe((event) => {
                     options: event.choices?.length ? event.choices : permission ? ["Allow", "Deny"] : [],
                     requestId: event.requestId,
                     tool: permission ? event.tool : undefined,
-                    // the exact grant "always allow" would remember, decided here so
-                    // client and server can never derive it differently
-                    allowKey: permission
-                        ? rememberableApprovalKey(asker, event.tool, event.summary, {
-                            source: verdict?.source,
-                            scope: event.approvalScope,
-                            requiresExplicitApproval: event.requiresExplicitApproval,
-                        })
-                        : undefined,
+                    // the provider can keep an allow for its session; the app keeps
+                    // no grant of its own for a provider's tool
+                    allowSession: permission && event.allowSession && !event.requiresExplicitApproval ? true : undefined,
                     // The text stays for cards saved before heldCode existed, and for
                     // clients that do not know the key yet.
                     held: approvalHeldReason(heldContext),
@@ -3052,37 +3010,8 @@ bus.subscribe((event) => {
             });
             if (event.requestId)
                 askMessageByRequest.set(`${event.threadId}:${event.requestId}`, message.id);
-            const reviewMode = resolveAutoReviewMode(asker?.autoReview);
-            let reviewTask;
-            if (permission &&
-                !event.requiresExplicitApproval &&
-                asker &&
-                event.requestId &&
-                shouldReview({
-                    source: verdict?.source,
-                    mode: reviewMode,
-                    approvalMode: approvalModeFor(asker),
-                    unattended: Boolean(unattended),
-                    approvalScope: event.approvalScope,
-                })) {
-                // Review stays on the provider boundary that opened the request.
-                // Falling back to an arbitrary sibling could disclose action details
-                // to a provider the user did not choose for this bot.
-                const instance = registry.get(event.providerInstanceId ?? asker.modelSelection.instanceId);
-                if (instance?.reviewPermission) {
-                    reviewTask = reviewPermissionCard({
-                        instance,
-                        asker,
-                        threadId: event.threadId,
-                        requestId: event.requestId,
-                        messageId: message.id,
-                        tool: event.tool,
-                        summary: event.summary,
-                    });
-                }
-            }
-            // Every card that reaches a human is a decision too — "a rule sent
-            // this to you, and here is which one". `question` marks the cards no
+            // Every card that reaches a human is a decision too: "the provider
+            // left this for you, in this mode". `question` marks the cards no
             // rule may ever answer; a permission card without a verdict (no known
             // asker, or no requestId to answer through) can only mean nothing was
             // granted.
@@ -3095,43 +3024,22 @@ bus.subscribe((event) => {
                 summary: event.summary,
                 decision: "card-shown",
                 source: !permission ? "question" : verdict ? verdict.source : "no-grant",
-                rule: verdict?.rule,
                 unattended: unattended || undefined,
             });
             // Notify from HERE, not from a separate subscriber on request.opened:
             // this is the branch where a card actually reached a human. Anything
-            // auto mode answered took the early return above and never buzzes.
-            const notifyHuman = () => {
-                if (!asker)
-                    return;
+            // Full access answered took the early return above and never buzzes.
+            if (asker) {
                 const card = store.messagesFor(event.threadId).find((candidate) => candidate.id === message.id)?.card;
-                if (!card || card.answered)
-                    return;
-                // the bot is not working now — it is waiting on a person
-                if (bot)
-                    store.setTaskActivity(bot.id, event.threadId, "waiting-on-you");
-                else if (asker.busy)
-                    store.setActivity(asker.id, "waiting-on-you");
-                const notificationBot = (routineRun && routineSourceOwner(routineRun)?.bot) || asker;
-                notify(buildNotification(permission ? "approval" : "question", notificationBot, (routineRun && routineSourceThread(routineRun)) || event.threadId, event.summary));
-            };
-            if (reviewTask && reviewMode === "enforce") {
-                // Avoid buzzing the owner for a card the reviewer is about to answer.
-                // A deny, failure, or timeout falls back to the normal notification;
-                // if the human already answered meanwhile, notifyHuman is a no-op.
-                void reviewTask
-                    .catch(() => false)
-                    .then((approved) => {
-                    if (!approved)
-                        notifyHuman();
-                });
-            }
-            else {
-                // Watch mode notifies immediately, but its background audit must not
-                // become an unhandled rejection if an unexpected store error occurs.
-                if (reviewTask)
-                    void reviewTask.catch(() => false);
-                notifyHuman();
+                if (card && !card.answered) {
+                    // the bot is not working now — it is waiting on a person
+                    if (bot)
+                        store.setTaskActivity(bot.id, event.threadId, "waiting-on-you");
+                    else if (asker.busy)
+                        store.setActivity(asker.id, "waiting-on-you");
+                    const notificationBot = (routineRun && routineSourceOwner(routineRun)?.bot) || asker;
+                    notify(buildNotification(permission ? "approval" : "question", notificationBot, (routineRun && routineSourceThread(routineRun)) || event.threadId, event.summary));
+                }
             }
             break;
         }
@@ -3782,6 +3690,8 @@ bus.subscribe((event) => {
     drainDelegationWakes();
 });
 function drainQueuedSends() {
+    if (!followupsReady)
+        return;
     drainSteeredMessages(store, (botId, threadId, prompt, userMessage, excludeIds, unattended) => 
     // A plain attended turn — no automationSource, no comms depth: exactly
     // what typing the same words into an idle bot would run. The one
@@ -3790,15 +3700,19 @@ function drainQueuedSends() {
     // Drain just appended the held lines; userMessage keeps startTurn
     // from duplicating the last one, and excludeIds drops every drained
     // line from the transcript-replay so they are not also in `prompt`.
-    startTurn(botId, prompt, { threadId, userMessage, excludeMessageIds: excludeIds, unattended }).then(() => undefined).catch((err) => {
-        store.appendMessage(threadId, {
-            role: "bot",
-            kind: "activity",
-            tool: {
-                name: `error: queued message could not start — ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`,
-                ok: false,
-            },
-        });
+    new Promise((resolve, reject) => {
+        void startTurn(botId, prompt, {
+            threadId, userMessage, excludeMessageIds: excludeIds, unattended, onTurnSettled: resolve,
+        }).catch((err) => {
+            store.appendMessage(threadId, {
+                role: "bot", kind: "activity",
+                tool: {
+                    name: `error: queued message could not start — ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`,
+                    ok: false,
+                },
+            });
+            resolve();
+        }).catch(reject);
     }), 
     // Provider completion can precede its dispatch promise: keep the queue
     // intact until that exact handshake releases its runtime-only claim.
@@ -4203,6 +4117,8 @@ async function startTurn(botId, text, opts) {
     const resourceOwner = { threadId, generation: dispatchClaimId };
     turnResourceOwners.set(threadId, resourceOwner);
     directTurnGenerationByThread.set(threadId, dispatchClaimId);
+    if (opts?.onTurnSettled)
+        directFollowupSettlers.set(dispatchClaimId, { threadId, settle: opts.onTurnSettled });
     directTurnDispatchClaims.set(threadId, { id: dispatchClaimId, botId, threadId, phase: "setup" });
     directTurnBots.set(threadId, bot);
     beginInternalCapabilityGeneration(threadId, dispatchClaimId);
@@ -4643,6 +4559,11 @@ async function startTurn(botId, text, opts) {
                 throw new DirectTurnSetupCancelled("turn stopped during provider setup");
             }
             bindInternalCapabilityToProviderTurn(threadId, dispatchClaimId, dispatch.value.turnId);
+            if (directFollowupSettlers.has(dispatchClaimId) && dispatch.value.turnId &&
+                !directFollowupTurns.bind(threadId, dispatchClaimId, dispatch.value.turnId)) {
+                // This exact queued turn completed before its dispatch ACK arrived.
+                settleDirectFollowup(dispatchClaimId);
+            }
             clearDirectTurnDispatch(threadId, dispatchClaimId);
             // dispatched: the rewind is spent, and the old cursors are dead
             if (rewound)
@@ -4676,6 +4597,7 @@ async function startTurn(botId, text, opts) {
             }
         }
         catch (e) {
+            settleDirectFollowup(dispatchClaimId);
             clearCancelledProviderHandshake(threadId, `direct:${dispatchClaimId}`);
             clearDirectTurnDispatch(threadId, dispatchClaimId);
             revokeInternalCapabilityGeneration(threadId, dispatchClaimId);
@@ -5268,6 +5190,7 @@ const webhooks = new WebhookManager({
         return !bot ? "missing" : bot.busy ? "busy" : "ready";
     },
     enqueue: (input) => routines.enqueueWebhook(input),
+    findRun: (webhookId, deliveryId) => routines.webhookRunReceipt(webhookId, deliveryId),
     cancelQueued: (webhookId, message) => routines.cancelQueuedWebhook(webhookId, message),
     pendingRuns: (webhookId) => routines.activeWebhookRunCount(webhookId),
 });
@@ -5379,7 +5302,7 @@ setupRetry = 0) {
     }
     revokeInternalCapabilitiesForThread(threadId);
     spoken.add(botId);
-    const preparedApprovalMode = approvalModeForTurn(bot, false, threadId);
+    const preparedApprovalMode = approvalModeForTurn(bot, false);
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
     const instance = registry.get(bot.modelSelection.instanceId);
@@ -5502,7 +5425,7 @@ setupRetry = 0) {
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
         const setupChanged = registry.get(preparedSelection.instanceId) !== instance ||
-            approvalModeForTurn(readyBot, false, threadId) !== preparedApprovalMode ||
+            approvalModeForTurn(readyBot, false) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
             readyBot.modelSelection.effort !== preparedSelection.effort ||
@@ -5809,7 +5732,7 @@ setupRetry = 0) {
                 threadId,
                 text,
                 images: turnImages,
-                approvalMode: approvalModeForTurn(readyBot, false, threadId),
+                approvalMode: approvalModeForTurn(readyBot, false),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
                 systemVolatile: roomSystem.volatile,
@@ -6431,6 +6354,8 @@ function startGroupTurn(groupId, text, replyTo, sendId, channelMode = "chat", qu
     return message;
 }
 function drainQueuedChannelSends() {
+    if (!followupsReady)
+        return;
     drainChannelMessages((groupId) => {
         const group = store.group(groupId);
         return group ? groupIsWorking(group) : false;
@@ -6442,9 +6367,12 @@ function drainQueuedChannelSends() {
         if (!group || !ownsThread)
             return;
         try {
-            startGroupTurn(groupId, text, resolveReplyTarget(threadId, replyToId), sendId, mode, id, { via });
+            startGroupTurn(groupId, text, resolveReplyTarget(threadId, replyToId), sendId, mode, id, { via, threadId });
         }
         catch (error) {
+            if (!store.messagesFor(threadId).some((message) => message.queueId === id && message.role === "user")) {
+                store.appendMessage(threadId, { role: "user", kind: "text", text, replyToId, sendId, channelMode: mode, queueId: id, via });
+            }
             store.appendMessage(threadId, {
                 role: "bot",
                 kind: "activity",
@@ -6457,6 +6385,7 @@ function drainQueuedChannelSends() {
         // A message with no eligible responder creates no operation. Continue
         // draining instead of leaving later user messages behind it forever.
         queueMicrotask(drainQueuedChannelSends);
+        return groupQueues.get(groupId);
     });
 }
 function sameCalendarRoster(group, botIds) {
@@ -7364,6 +7293,14 @@ function configStatus() {
             showToolCalls: showToolCallsEnabled(cfg),
             browser: builtInBrowserEnabled(cfg),
         },
+        // first-run progress — not a secret; the app decides whether to show
+        // the welcome tour from this, never from browser storage
+        onboarding: {
+            completedAt: cfg.onboarding?.completedAt ?? "",
+            version: cfg.onboarding?.version ?? 0,
+            reelSeen: cfg.onboarding?.reelSeen === true,
+            hintsSeen: cfg.onboarding?.hintsSeen ?? [],
+        },
         // Which browser this server can give bots: the desktop app's surface,
         // the agent-browser engine, or nothing yet (with the reason).
         browserEngine: browserEngineSummary(),
@@ -7482,6 +7419,7 @@ async function reloadProviders() {
                 });
                 store.setTaskActivity(botId, threadId, "idle");
             }
+            settleDirectFollowup(owner?.generation);
             retryDelegationsWaitingOn(botId);
         }
         for (const [threadId, speaker] of rooms) {
@@ -7634,7 +7572,7 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
         idle: () => !providerFleetReloading && !providerAuthSessions.active && !browserEngineInstall &&
             !routines?.isTicking && !calendarCalls?.isTicking &&
             !localVmImageBusy && !localVmProvisionBusy && !localVmModeChangeBusy &&
-            !localVmLifecycleBusy.size && !boxLifecycleBusyBots.size && !orphanBoxLifecycleBusyIds.size &&
+            !localVmLifecycleBusy.size && !boxLifecycleBusyBots.size && !vpsPreviewRequests.size && !orphanBoxLifecycleBusyIds.size &&
             !computerProviderConfigTransitions.size && !checkpointRestoreLeases.size &&
             store.bots.every((bot) => !botHasActiveTurn(bot.id) && !routines?.activeRunForBot(bot.id) && !computerControl.snapshot(bot.id).held) &&
             store.groups.every((group) => !groupIsWorking(group)),
@@ -10499,6 +10437,9 @@ const handleRequest = async (req, res) => {
             }
             const receipt = await sendSequencer.run(sendId ? `group:${group.id}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id, channelMode), async () => {
                 if (sendId) {
+                    if (cancelledChatFollowup("channel", group.id, threadId, sendId)) {
+                        throw Object.assign(new Error("this queued sendId was cancelled; send a new message to try again"), { status: 409 });
+                    }
                     const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id, channelMode);
                     if (accepted.kind === "conflict") {
                         throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
@@ -11094,12 +11035,6 @@ const handleRequest = async (req, res) => {
                     error: "This approval-level change can only be made from the packaged desktop app",
                 });
             }
-            if (body.autoReview !== undefined) {
-                if (body.autoReview !== "off" && body.autoReview !== "shadow" && body.autoReview !== "enforce") {
-                    return json(res, 400, { error: "autoReview must be off, shadow, or enforce" });
-                }
-                patch.autoReview = body.autoReview;
-            }
             // "Auto on this Mac" hands a bot the user's real session, so the grant
             // must prove a human saw the warning. The desktop dialog is the only
             // caller that sends acknowledgeLocalAuto; without it a PATCH that would
@@ -11455,6 +11390,7 @@ const handleRequest = async (req, res) => {
                     // staged provider images into a message, so dispose them here.
                     for (const task of store.tasks(bot.id)) {
                         purgeGeneratedImagesForThread(task.threadId);
+                        settleDirectFollowup(directTurnGenerationByThread.get(task.threadId));
                         directTurnGenerationByThread.delete(task.threadId);
                         directTurnBots.delete(task.threadId);
                     }
@@ -11998,6 +11934,9 @@ const handleRequest = async (req, res) => {
             const replyTo = resolveReplyTarget(threadId, body.replyToId);
             const receipt = await sendSequencer.run(sendId ? `bot:${bot.id}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id), async () => {
                 if (sendId) {
+                    if (cancelledChatFollowup("bot", bot.id, threadId, sendId)) {
+                        throw Object.assign(new Error("this queued sendId was cancelled; send a new message to try again"), { status: 409 });
+                    }
                     const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id);
                     if (accepted.kind === "conflict") {
                         throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
@@ -12197,7 +12136,7 @@ const handleRequest = async (req, res) => {
                 resolvePeerComms(approvalBus, String(body.requestId), behavior)) {
                 return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
             }
-            const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name });
+            const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true);
             return json(res, 200, { ok: true, outcome });
         }
         // Answer by THREAD, so a request raised inside a room can be answered
@@ -12282,7 +12221,7 @@ const handleRequest = async (req, res) => {
             if (!owner && !pending)
                 return json(res, 404, { error: "nothing is waiting on an answer in this conversation" });
             const requestOwner = owner ? botForThread(owner.id, threadId) : null;
-            const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined);
+            const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true);
             return json(res, 200, { ok: true, outcome });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/interrupt$/);
@@ -12539,6 +12478,7 @@ const handleRequest = async (req, res) => {
             const updated = store.deleteTask(m[1], m[2]);
             if (!updated)
                 return json(res, 400, { error: "a bot keeps at least one task" });
+            settleDirectFollowup(directTurnGenerationByThread.get(m[2]));
             rejectDeletedThreadSkillStages(stagedSkillCleanups);
             const fresh = botWithThread(updated);
             broadcast({ kind: "bot", bot: fresh });
@@ -13634,19 +13574,10 @@ const handleRequest = async (req, res) => {
                         browserReferenceCleanupError = error;
                     }
                 }
-                // Provider keys change the fleet. Profile, language, voice, VPS, and
-                // room timeout changes do not rebuild it: no driver reads them, and they
-                // should not interrupt in-flight turns.
-                const reloadKeys = Object.keys(patch).filter((key) => key !== "profile" &&
-                    key !== "language" &&
-                    key !== "tts" &&
-                    key !== "imageGen" &&
-                    key !== "vps" &&
-                    key !== "rooms" &&
-                    key !== "threads" &&
-                    key !== "localVm" &&
-                    key !== "features" &&
-                    key !== "browserProfiles");
+                // Provider keys change the fleet. Profile, language, voice, VPS, room
+                // timeout, and onboarding progress changes do not rebuild it: no driver
+                // reads them, and they should not interrupt in-flight turns.
+                const reloadKeys = providerReloadKeys(patch);
                 // Config is already durable. A provider credential or runtime change
                 // invalidates every old child immediately, including when browser
                 // cleanup below has to await Electron before reloadProviders begins.
@@ -14032,7 +13963,19 @@ const handleRequest = async (req, res) => {
                 return json(res, 409, { error: "this bot's cloud computer is being changed — wait for it to finish" });
             }
             if (bot.cloudBackend === "vps") {
-                const releaseComputerLifecycle = claimBotComputerLifecycle(botId);
+                if (m[2] === "screenshot") {
+                    let preview = vpsPreviewRequests.get(botId);
+                    if (!preview) {
+                        preview = vps.vpsComputerScreenshot(cfg, botId).finally(() => {
+                            vpsPreviewRequests.delete(botId);
+                        });
+                        vpsPreviewRequests.set(botId, preview);
+                    }
+                    return json(res, 200, await preview);
+                }
+                // Opening the existing SSH viewer can coexist with a capture. Start,
+                // stop, remove and Settings deletion still exclude pending previews.
+                const releaseComputerLifecycle = claimBotComputerLifecycle(botId, m[2] === "join");
                 try {
                     if (m[2] === "exec") {
                         return json(res, 409, { error: "the VPS console is available to the bot through its scoped computer tools" });
@@ -14046,8 +13989,6 @@ const handleRequest = async (req, res) => {
                     if (m[2] === "join") {
                         return json(res, 200, await vps.vpsComputerJoin(cfg, botId));
                     }
-                    if (m[2] === "screenshot")
-                        return json(res, 200, await vps.vpsComputerScreenshot(cfg, botId));
                     const action = m[2] === "provision" ? "provision" : m[2] === "remove" ? "remove" : "stop";
                     return json(res, 200, await vps.vpsComputerAction(action, cfg, botId));
                 }
@@ -14132,8 +14073,45 @@ try {
 catch (error) {
     console.warn(`attachments: startup partial cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
 }
+// A dispatch claim is deliberately committed before transcript/provider work.
+// If we died after that point, its outcome is unknown: recover the user's words
+// and a review notice, never hand them to a model for a second execution.
+for (const row of chatFollowups()) {
+    if (row.status !== "dispatching" && row.status !== "interrupted")
+        continue;
+    const owned = row.kind === "bot"
+        ? Boolean(store.taskByThread(row.ownerId, row.threadId))
+        : Boolean(store.groupByThread(row.threadId)?.id === row.ownerId);
+    if (!owned) {
+        settleChatFollowups([row.id], "cancelled");
+        continue;
+    }
+    settleChatFollowups([row.id], "interrupted");
+    const messages = store.messagesFor(row.threadId);
+    if (!messages.some((message) => message.queueId === row.id && message.role === "user")) {
+        store.appendMessage(row.threadId, {
+            role: "user", kind: "text", text: row.payload.text, replyToId: row.payload.replyToId,
+            sendId: row.payload.sendId, queueId: row.id,
+            ...(row.kind === "channel" ? { channelMode: row.payload.mode, via: row.payload.via } : {}),
+        });
+    }
+    if (!messages.some((message) => message.queueId === row.id && message.kind === "activity")) {
+        store.appendMessage(row.threadId, {
+            role: "bot", kind: "activity", queueId: row.id,
+            tool: { name: "Queued follow-up interrupted by restart or restore — it may have already run. Review the result before sending it again.", ok: false },
+        });
+    }
+    // The FULL-sync retirement also flushes both transcript writes. Retrying
+    // this sendId now finds the canonical message, without a permanent journal scan.
+    settleChatFollowups([row.id], null);
+}
+restoreSteeredMessages();
+restoreChannelMessages();
 server.listen(PORT, "127.0.0.1", () => {
     console.log(`openmausbot server on http://127.0.0.1:${PORT}`);
+    followupsReady = true;
+    drainQueuedSends();
+    drainQueuedChannelSends();
     // Startup work uses the same turn dispatcher and local tool endpoint as
     // ordinary chat. Start only once every registry is initialized and the
     // endpoint is listening; earlier dispatch can hit uninitialized bindings.
@@ -14171,6 +14149,7 @@ if (TUNNEL_SOCKET) {
 const gracefulShutdown = createGracefulShutdown({
     cleanup: [
         () => {
+            followupsReady = false;
             // Child MCP processes and the HTTP listener can remain alive while the
             // asynchronous shutdown jobs drain. Invalidate their turn bearers before
             // any cleanup function reaches an await.