openmausbot 0.1.72 → 0.1.74

package/dist-server/server/message-db.js

@@ -10,7 +10,7 @@
 // Legacy JSON thread files import lazily: the first read of a thread with
 // no rows pulls the old file in, after which the DB is the source of
 // truth (the JSON file is left behind as a one-time backup).
-import { chmodSync, closeSync, existsSync, openSync, readFileSync, renameSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { DATA_DIR } from "./config.js";
@@ -19,6 +19,7 @@ const DB_FILE = () => join(DATA_DIR, "messages.db");
 let handle = null;
 let handlePath = null;
 function open() {
+    mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 });
     const file = DB_FILE();
     // Transcripts can contain private conversations and tool output. Create
     // the database with owner-only permissions and also repair an existing
@@ -47,6 +48,16 @@ function open() {
       thread_id TEXT PRIMARY KEY,
       active_leaf_id TEXT
     );
+    CREATE TABLE IF NOT EXISTS chat_followups (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      owner_id TEXT NOT NULL,
+      thread_id TEXT NOT NULL,
+      send_id TEXT,
+      status TEXT NOT NULL,
+      payload TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS chat_followups_receipt ON chat_followups(kind, owner_id, thread_id, send_id);
   `);
     ensureRecallIndex(db);
     ensureMemoryIndex(db);
@@ -153,6 +164,59 @@ function db() {
     handlePath = DB_FILE();
     return handle;
 }
+/** A 202/cancel/dispatch claim must reach disk before publishing its result.
+ * Use the existing transcript DB (and backup path), with FULL sync for these
+ * small transactions only; ordinary transcript writes keep their policy. */
+function writeFollowups(write) {
+    const connection = db();
+    connection.exec("PRAGMA synchronous = FULL");
+    try {
+        connection.exec("BEGIN IMMEDIATE");
+        try {
+            write(connection);
+            connection.exec("COMMIT");
+        }
+        catch (error) {
+            connection.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    finally {
+        connection.exec("PRAGMA synchronous = NORMAL");
+    }
+}
+export function saveChatFollowup(followup) {
+    writeFollowups((connection) => connection.prepare("INSERT INTO chat_followups(id, kind, owner_id, thread_id, send_id, status, payload) VALUES (?, ?, ?, ?, ?, 'pending', ?)").run(followup.id, followup.kind, followup.ownerId, followup.threadId, followup.payload.sendId ?? null, JSON.stringify(followup.payload)));
+}
+/** Null retires a dispatch whose canonical transcript is already durable.
+ * Cancellation tombstones remain so a retried sendId cannot resurrect it. */
+export function settleChatFollowups(ids, status) {
+    if (!ids.length)
+        return;
+    writeFollowups((connection) => {
+        const statement = connection.prepare(status === null
+            ? "DELETE FROM chat_followups WHERE id = ?"
+            : status === "cancelled"
+                ? "UPDATE chat_followups SET status = ?, payload = '{\"text\":\"\"}' WHERE id = ?"
+                : "UPDATE chat_followups SET status = ? WHERE id = ?");
+        for (const id of ids) {
+            if (status === null)
+                statement.run(id);
+            else
+                statement.run(status, id);
+        }
+    });
+}
+export function chatFollowups(kind) {
+    const rows = (kind
+        ? db().prepare("SELECT * FROM chat_followups WHERE kind = ? ORDER BY rowid").all(kind)
+        : db().prepare("SELECT * FROM chat_followups ORDER BY rowid").all());
+    return rows.map((row) => ({ id: row.id, kind: row.kind, ownerId: row.owner_id, threadId: row.thread_id,
+        status: row.status, payload: JSON.parse(row.payload) }));
+}
+export function cancelledChatFollowup(kind, ownerId, threadId, sendId) {
+    return Boolean(db().prepare("SELECT 1 FROM chat_followups WHERE kind = ? AND owner_id = ? AND thread_id = ? AND send_id = ? AND status = 'cancelled'").get(kind, ownerId, threadId, sendId));
+}
 const rowToMessage = (row) => JSON.parse(row.json);
 /** Read one thread, importing its legacy JSON file on first touch. */
 export function readThread(threadId, legacyFile) {
@@ -268,8 +332,11 @@ export function setActiveLeaf(threadId, leafId) {
         .run(threadId, leafId);
 }
 export function deleteThread(threadId) {
-    db().prepare("DELETE FROM messages WHERE thread_id = ?").run(threadId);
-    db().prepare("DELETE FROM thread_state WHERE thread_id = ?").run(threadId);
+    writeFollowups((connection) => {
+        connection.prepare("DELETE FROM chat_followups WHERE thread_id = ?").run(threadId);
+        connection.prepare("DELETE FROM messages WHERE thread_id = ?").run(threadId);
+        connection.prepare("DELETE FROM thread_state WHERE thread_id = ?").run(threadId);
+    });
 }
 /** Case-insensitive substring search over text messages, newest first.
  * A LIKE scan, deliberately: local transcripts are megabytes at most, a

package/dist-server/server/procs.js

@@ -34,6 +34,10 @@ export function assertSafeCliArgv(resolved, platform = process.platform) {
     error.code = "ENAMETOOLONG";
     throw error;
 }
+// Only spawnCli establishes a private POSIX group. A plain spawned child
+// (for example inside an MCP gate) may share our own group: never signal it.
+const cliGroups = new WeakSet();
+const stopping = new WeakMap();
 export function spawnCli(cli, args, opts) {
     const resolved = resolveCli(cli, args);
     assertSafeCliArgv(resolved);
@@ -43,6 +47,8 @@ export function spawnCli(cli, args, opts) {
         // win32: taskkill /T does the reaping instead (see killCliTree)
         ...(process.platform === "win32" ? { windowsHide: true } : { detached: true }),
     }); // callers always pipe all three
+    if (process.platform !== "win32")
+        cliGroups.add(child);
     // A write to a dying child's stdin fails differently per platform, and one
     // of the ways is fatal. On POSIX the kill is synchronous, the stream is
     // already destroyed by the time anything writes, and the write throws into
@@ -80,11 +86,78 @@ export function describeSpawnFailure(err, cli) {
         };
     return { message: `spawn failed: ${err.message}`, setup: false };
 }
-/** Stop a CLI and every process it spawned (MCP proxies included). */
+/** Stop an owned CLI group, including helpers after its root exits. timeoutMs
+ * is the TERM grace period; SIGKILL gets one further second to settle. Helpers
+ * that deliberately detach into another group are outside this ownership. */
 export function killCliTree(child, timeoutMs = 5_000) {
+    const existing = stopping.get(child);
+    if (existing)
+        return existing;
     const pid = child.pid;
-    if (!pid || child.exitCode !== null || child.signalCode !== null)
+    if (!pid)
         return Promise.resolve(true);
+    if (!Number.isInteger(pid) || pid <= 1 || pid === process.pid)
+        return Promise.resolve(false);
+    const run = stopCliTree(child, pid, Number.isFinite(timeoutMs) ? Math.max(0, timeoutMs) : 5_000);
+    stopping.set(child, run);
+    // A failed attempt may be retried. Remember success so a delayed caller
+    // cannot signal a reused PID/group after this child's group disappeared.
+    void run.then((stopped) => { if (!stopped)
+        stopping.delete(child); });
+    return run;
+}
+async function stopCliTree(child, pid, timeoutMs) {
+    const exited = () => child.exitCode !== null || child.signalCode !== null;
+    if (process.platform !== "win32") {
+        const group = cliGroups.has(child);
+        const settled = () => {
+            if (!exited())
+                return false;
+            if (!group)
+                return true;
+            try {
+                process.kill(-pid, 0);
+                return false;
+            }
+            catch (error) {
+                // EPERM and other failures do not prove that the group is gone.
+                return error.code === "ESRCH";
+            }
+        };
+        const signal = (value) => {
+            try {
+                if (group)
+                    process.kill(-pid, value);
+                else
+                    child.kill(value);
+            }
+            catch {
+                try {
+                    child.kill(value);
+                }
+                catch { /* report uncertainty below */ }
+            }
+        };
+        const wait = async (ms) => {
+            const deadline = Date.now() + ms;
+            while (!settled()) {
+                const remaining = deadline - Date.now();
+                if (remaining <= 0)
+                    return false;
+                await new Promise((resolve) => setTimeout(resolve, Math.min(25, remaining)));
+            }
+            return true;
+        };
+        if (settled())
+            return true;
+        signal("SIGTERM");
+        if (await wait(timeoutMs))
+            return true;
+        signal("SIGKILL");
+        return wait(1_000);
+    }
+    if (exited())
+        return true;
     return new Promise((resolve) => {
         let timer;
         const done = (stopped) => {
@@ -96,32 +169,18 @@ export function killCliTree(child, timeoutMs = 5_000) {
         child.once("close", closed);
         timer = setTimeout(() => done(false), timeoutMs);
         timer.unref?.();
-        if (process.platform === "win32") {
-            execFile("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
-                if (!err)
-                    return;
-                try {
-                    // taskkill is unavailable or the tree lookup failed. At least stop
-                    // the process we own instead of leaving the entire turn running.
-                    child.kill();
-                }
-                catch {
-                    /* already gone */
-                }
-            });
-            return;
-        }
-        try {
-            process.kill(-pid, "SIGTERM");
-        }
-        catch {
+        execFile("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
+            if (!err)
+                return;
             try {
-                child.kill("SIGTERM");
+                // taskkill is unavailable or the tree lookup failed. At least stop
+                // the process we own instead of leaving the entire turn running.
+                child.kill();
             }
             catch {
                 /* already gone */
             }
-        }
+        });
     });
 }
 /** Per-turn broker channel: unix socket on POSIX, named pipe on Windows

package/dist-server/server/routines.js

@@ -6,6 +6,14 @@ import { DATA_DIR } from "./config.js";
 import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
+const webhookRunReceiptSchema = z.object({
+    webhookId: z.string().min(1).max(200),
+    deliveryId: z.string().min(1).max(200),
+    runId: z.string().min(1),
+    acceptedAt: z.number().finite().nonnegative(),
+});
+const WEBHOOK_RETRY_WINDOW_MS = 7 * 24 * 60 * 60_000;
+const MAX_WEBHOOK_RECEIPTS = 20_000;
 function routineRequestOwnerKey(owner) {
     return JSON.stringify([owner.requestId, owner.messageId, owner.botId, owner.threadId]);
 }
@@ -426,6 +434,7 @@ export class RoutineManager {
     routines = [];
     runs = [];
     routineRequestReceipts = [];
+    webhookRunReceipts = [];
     timer = null;
     ticking = false;
     constructor(options) {
@@ -486,11 +495,29 @@ export class RoutineManager {
                     typeof receipt?.resultId === "string" &&
                     Number.isFinite(receipt?.appliedAt))
                 : [];
+            this.webhookRunReceipts = Array.isArray(disk.webhookRunReceipts)
+                ? disk.webhookRunReceipts.flatMap((receipt) => {
+                    const parsed = webhookRunReceiptSchema.safeParse(receipt);
+                    return parsed.success ? [parsed.data] : [];
+                })
+                : [];
+            // Upgrade old run logs before history pruning can discard their IDs.
+            const known = new Set(this.webhookRunReceipts.map((r) => JSON.stringify([r.webhookId, r.deliveryId])));
+            for (const run of this.runs) {
+                if (!run.webhookId || !run.deliveryId || run.createdAt < this.now() - WEBHOOK_RETRY_WINDOW_MS)
+                    continue;
+                const key = JSON.stringify([run.webhookId, run.deliveryId]);
+                if (known.has(key))
+                    continue;
+                this.webhookRunReceipts.push({ webhookId: run.webhookId, deliveryId: run.deliveryId, runId: run.id, acceptedAt: run.createdAt });
+                known.add(key);
+            }
         }
         catch {
             this.routines = [];
             this.runs = [];
             this.routineRequestReceipts = [];
+            this.webhookRunReceipts = [];
         }
         // A local process cannot still own these turns after a full restart.
         const recovered = [];
@@ -828,11 +855,22 @@ export class RoutineManager {
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
     }
-    /** Queue an event-driven job without inventing a calendar schedule. Webhook
-     * definitions live in their own store; the execution receipt deliberately
-     * reuses this manager so busy-bot ordering, task creation and VM routing stay
-     * identical for every unattended job. */
+    /** Look up an accepted delivery independently of run-log retention. */
+    webhookRunReceipt(webhookId, deliveryId) {
+        const receipt = this.webhookRunReceipts.find((candidate) => candidate.webhookId === webhookId && candidate.deliveryId === deliveryId &&
+            candidate.acceptedAt >= this.now() - WEBHOOK_RETRY_WINDOW_MS);
+        if (receipt)
+            return { id: receipt.runId };
+        // Never duplicate work that is still pending, even beyond the retry window.
+        const active = this.runs.find((run) => run.webhookId === webhookId && run.deliveryId === deliveryId &&
+            ["queued", "running", "waiting"].includes(run.status));
+        return active ? { id: active.id } : null;
+    }
+    /** Queue webhook work through the same dispatcher as scheduled routines. */
     enqueueWebhook(input) {
+        const existing = this.webhookRunReceipt(input.webhookId, input.deliveryId);
+        if (existing)
+            return existing;
         if (this.options.botState(input.botId) === "missing") {
             throw Object.assign(new Error("The assigned MAUS no longer exists"), { status: 410 });
         }
@@ -853,8 +891,26 @@ export class RoutineManager {
             attachments: [],
             createdAt: this.now(),
         };
+        const previousReceipts = this.webhookRunReceipts;
+        const receipts = previousReceipts.filter((receipt) => receipt.acceptedAt >= this.now() - WEBHOOK_RETRY_WINDOW_MS);
+        // Never evict a promised retry identity to admit fresh work.
+        if (receipts.length >= MAX_WEBHOOK_RECEIPTS) {
+            throw Object.assign(new Error("Webhook retry history is full; try again later"), { status: 429 });
+        }
+        receipts.push({ webhookId: input.webhookId, deliveryId: input.deliveryId, runId: run.id, acceptedAt: this.now() });
+        const previousRuns = this.runs.slice();
         this.runs.push(run);
-        this.save();
+        this.webhookRunReceipts = receipts;
+        try {
+            this.save();
+        }
+        catch (error) {
+            // Restore pruned history too, retaining the live run objects that tick()
+            // may be awaiting rather than replacing them with cloned snapshots.
+            this.runs = previousRuns;
+            this.webhookRunReceipts = previousReceipts;
+            throw error;
+        }
         this.emitRun(run);
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
@@ -1044,9 +1100,11 @@ export class RoutineManager {
             }
             // Oldest queued requests have priority. New manual/webhook arrivals
             // must not continually overtake work that has already waited. Snapshot
-            // the queue because each dispatch can asynchronously add/cancel work.
-            for (const run of this.runs.slice()) {
-                if (run.status !== "queued")
+            // IDs retain order across awaits without holding stale objects after
+            // another request rolls back a failed routine-definition write.
+            for (const id of this.runs.map((run) => run.id)) {
+                const run = this.runs.find((candidate) => candidate.id === id);
+                if (!run || run.status !== "queued")
                     continue;
                 // A queued interval represents the latest useful check, not a backlog
                 // item. If the bot stayed busy across later occurrences, align this
@@ -1430,6 +1488,7 @@ export class RoutineManager {
             routines: this.routines,
             runs: this.runs,
             routineRequestReceipts: this.routineRequestReceipts,
+            webhookRunReceipts: this.webhookRunReceipts,
         }, null, 2), { mode: 0o600 });
     }
 }

package/dist-server/server/steer-queue.js

@@ -4,11 +4,11 @@
 // here until the bot settles, then lands in the thread and runs as ONE
 // follow-up turn whose prompt is the queued texts separated by a blank line.
 //
-// The queue is memory-only and is NOT in `messages[]` while the current
+// The durable queue is NOT in `messages[]` while the current
 // turn is running: appending immediately would make the queued line the
 // active leaf, so remaining tool/assistant events of *this* turn would
-// hang off a user line the model has not seen. Restart loses the queue
-// (same as delegations / approvals). The composer shows a pending chip
+// hang off a user line the model has not seen. Restart restores only sends
+// whose dispatch has not begun. The composer shows a pending chip
 // until drain appends the words.
 //
 // Unlike the delegation drain, an interrupted or failed turn does NOT
@@ -17,7 +17,20 @@
 // stop-then-steer (queue a correction, hit Stop, the correction runs) is
 // the feature.
 import { newId } from "./contracts.js";
+import { chatFollowups, saveChatFollowup, settleChatFollowups } from "./message-db.js";
 const queues = new Map(); // threadId → waiting sends
+export function restoreSteeredMessages() {
+    queues.clear();
+    for (const row of chatFollowups("bot")) {
+        if (row.status !== "pending")
+            continue;
+        const entry = queues.get(row.threadId) ?? { botId: row.ownerId, items: [] };
+        if (entry.botId !== row.ownerId)
+            throw new Error("queued task belongs to another bot");
+        entry.items.push({ ...row.payload, messageId: row.id, prompt: row.payload.prompt ?? row.payload.text });
+        queues.set(row.threadId, entry);
+    }
+}
 const listeners = new Set();
 const changed = () => {
     for (const listener of listeners) {
@@ -50,7 +63,7 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
     // queues even if a corrupt caller reuses a thread id.
     if (entry.botId !== botId)
         throw new Error("queued task belongs to another bot");
-    entry.items.push({
+    const item = {
         messageId: id,
         text,
         prompt: options.prompt ?? text,
@@ -58,7 +71,9 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         sendId: options.sendId,
         reason: options.reason,
         unattended: options.unattended,
-    });
+    };
+    saveChatFollowup({ id, kind: "bot", ownerId: botId, threadId, payload: item });
+    entry.items.push(item);
     queues.set(threadId, entry);
     changed();
     return { id };
@@ -93,6 +108,7 @@ export function drainSteeredMessages(store, run, isBlocked) {
             : store.bot(entry.botId);
         if (!bot) {
             // the bot or task was deleted while messages waited
+            settleChatFollowups(entry.items.map((item) => item.messageId), "cancelled");
             queues.delete(threadId);
             changed();
             continue;
@@ -101,6 +117,8 @@ export function drainSteeredMessages(store, run, isBlocked) {
             continue;
         // committed to draining: the entry leaves the map before anything runs,
         // so a settle racing another settle can never fire the same queue twice
+        const ids = entry.items.map((item) => item.messageId);
+        settleChatFollowups(ids, "dispatching");
         queues.delete(threadId);
         changed();
         const appended = [];
@@ -124,10 +142,11 @@ export function drainSteeredMessages(store, run, isBlocked) {
         // message into one HTML block, which makes that attachment stop being a
         // native image when the combined follow-up is dispatched.
         const prompt = entry.items.map((item) => item.prompt).join("\n\n");
-        void run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
+        const running = run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
         // one unattended line makes the whole drained turn unattended: a
         // person's words in the same queue cannot re-attend a bot's own
         entry.items.some((item) => item.unattended === true));
+        void Promise.resolve(running).then(() => settleChatFollowups(ids, null), () => settleChatFollowups(ids, "interrupted")).catch((error) => console.warn("steer-queue: could not settle durable follow-up", error));
     }
 }
 /** Find the receipt for a retry whose message is still waiting to drain. */
@@ -141,7 +160,7 @@ export function queuedSteeredMessage(botId, threadId, sendId) {
 /** Drop one waiting send owned by this bot so it never drains. The queue id
  * is stable even if the bot switches away from the task while the request is
  * in flight. Returns false when it was already drained, belongs to another
- * bot, or a restart lost the in-memory auto-run intent. */
+ * bot, or dispatch has already started. */
 export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
     for (const [threadId, entry] of queues) {
         if (entry.botId !== botId || (expectedThreadId !== undefined && threadId !== expectedThreadId))
@@ -149,6 +168,7 @@ export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
         const items = entry.items.filter((item) => item.messageId !== messageId);
         if (items.length === entry.items.length)
             continue;
+        settleChatFollowups([messageId], "cancelled");
         if (items.length === 0)
             queues.delete(threadId);
         else

package/dist-server/server/team-manifest.js

@@ -139,7 +139,7 @@ export function parseTeamManifest(value) {
  *
  * 1. Allowlist, not blocklist. The returned object is built field by field
  *    from the parsed member, so every privilege-bearing BotRecord field —
- *    approvalMode, autoApprove, autoReview, alwaysAllow, chiefOfStaff, approvePeerComms, composio,
+ *    approvalMode, autoApprove, alwaysAllow, chiefOfStaff, approvePeerComms, composio,
  *    computer, cloudBackend, cwd — is structurally absent, whatever the
  *    file claimed. parseTeamManifest already drops unknown member keys;
  *    this keeps the guarantee even if the schema grows a field later,

package/dist-server/server/vps-computer.js

@@ -35,6 +35,17 @@ const MANAGED_VPS_CONTAINER_NAME = /^openmausbot-vps-[a-z0-9]{1,12}-[a-f0-9]{12}
 const IMAGE_ID = /^sha256:[a-f0-9]{64}$/i;
 const PIDS_LIMIT = 512;
 const SCREENSHOT_PATH = "/tmp/openmausbot-vps-preview.png";
+// The Cua XFCE base includes Pillow in its existing Python environment. Keep
+// this panel-only conversion in the transfer exec: no extra SSH round trip,
+// image rebuild, driver settings change, or second temporary image. Older
+// containers without Pillow can still return the original PNG.
+const SCREENSHOT_TRANSFER = `/opt/venv/bin/python -I -c 'import base64, io, sys
+from PIL import Image
+with Image.open(sys.argv[1]) as image:
+    image.thumbnail((1280, 1280))
+    output = io.BytesIO()
+    image.convert("RGB").save(output, format="JPEG", quality=70)
+sys.stdout.write(base64.b64encode(output.getvalue()).decode("ascii"))' "$1" 2>/dev/null || { base64 < "$1" | tr -d "\\n"; }`;
 const INTERNAL_VIEWER_PORT = 6901;
 const VIEWER_VERSION = "1";
 const lifecycleLocks = new Map();
@@ -60,6 +71,9 @@ const LOCK_ACQUIRE_TIMEOUT_MS = 5_000;
 // pattern as container-computer's screenshotStatusCache, and the same TTL.
 const STATUS_CACHE_TTL_MS = 10_000;
 const statusCache = new Map();
+const SCREENSHOT_BUDGET_MS = 45_000;
+const SCREENSHOT_CLEANUP_BUDGET_MS = 10_000;
+const pendingScreenshots = new Map();
 const viewerConnections = new Map();
 const desktopTunnels = new Map();
 function containerNamePart(botId) {
@@ -494,6 +508,9 @@ export async function vpsComputerStatus(cfg, botId, runner = defaultRunner) {
     const key = vpsLockKey(cfg, botId);
     const cacheable = runner === defaultRunner && key !== null;
     if (cacheable) {
+        // A capture already checks this exact target. Let it finish instead of
+        // opening another six SSH connections while its readiness check is cold.
+        await pendingScreenshots.get(key)?.catch(() => { });
         const cached = statusCache.get(key);
         if (cached && cached.expiresAt > Date.now())
             return cached.status;
@@ -1042,22 +1059,56 @@ export async function vpsComputerScreenshot(cfg, botId, runner = defaultRunner)
     if (!alias)
         throw Object.assign(new Error("VPS is not configured"), { status: 409 });
     const key = `${alias}:${vpsContainerName(botId)}`;
+    const pending = pendingScreenshots.get(key);
+    if (pending)
+        return pending;
     const cacheable = runner === defaultRunner;
-    return withVpsLifecycleLock(key, async () => {
+    const deadline = Date.now() + SCREENSHOT_BUDGET_MS;
+    const workDeadline = deadline - SCREENSHOT_CLEANUP_BUDGET_MS;
+    let budgetExpired = false;
+    const timeoutError = () => Object.assign(new Error("The VPS screen preview timed out. Retry the preview when the connection recovers."), { status: 504 });
+    // Clamp each command and wait through the runner's termination grace,
+    // rather than racing its promise and releasing the lock before cleanup.
+    const boundedRunner = async (args, options = {}) => {
+        const remaining = workDeadline - Date.now() - COMMAND_TIMEOUT_KILL_GRACE_MS;
+        if (remaining <= 0) {
+            budgetExpired = true;
+            throw timeoutError();
+        }
+        try {
+            const result = await runner(args, { ...options, timeoutMs: Math.min(options.timeoutMs ?? 120_000, remaining) });
+            if (Date.now() >= workDeadline) {
+                budgetExpired = true;
+                throw timeoutError();
+            }
+            return result;
+        }
+        catch (error) {
+            if (Date.now() >= workDeadline - COMMAND_TIMEOUT_KILL_GRACE_MS)
+                budgetExpired = true;
+            throw budgetExpired ? timeoutError() : error;
+        }
+    };
+    const capture = withVpsLifecycleLock(key, async () => {
         // Same shape as containerComputerScreenshot's screenshotStatusCache: the
         // poller runs every few seconds, and re-verifying the whole container
         // between frames multiplied every frame's SSH cost.
         const cached = cacheable ? statusCache.get(key) : undefined;
         const status = cached && cached.expiresAt > Date.now()
             ? cached.status
-            : await computeVpsComputerStatus(cfg, botId, runner);
+            : await computeVpsComputerStatus(cfg, botId, boundedRunner);
+        // Status converts transport errors into displayable state. A deadline is
+        // still a timeout, not evidence that this container became incompatible.
+        if (budgetExpired) {
+            if (cacheable)
+                statusCache.delete(key);
+            throw timeoutError();
+        }
         if (!status.ready) {
             if (cacheable)
                 statusCache.delete(key);
             throw Object.assign(new Error(status.problem ?? "The VPS computer is not ready"), { status: 409 });
         }
-        if (cacheable)
-            statusCache.set(key, { status, expiresAt: Date.now() + STATUS_CACHE_TTL_MS });
         const containerRef = status.container_id ?? status.container_name;
         // The ref goes straight into docker argv, and a cached status is one
         // more step removed from the inspect that produced it — revalidate the
@@ -1065,23 +1116,26 @@ export async function vpsComputerScreenshot(cfg, botId, runner = defaultRunner)
         if (!CONTAINER_ID.test(containerRef) && !CONTAINER_NAME.test(containerRef)) {
             throw Object.assign(new Error("the VPS container reference is malformed"), { status: 409 });
         }
+        let frame;
         try {
-            await runner(vpsDockerArgs(alias, cuaExecArgs(["call", "get_desktop_state", "{}", "--socket", CUA_SOCKET, "--screenshot-out-file", SCREENSHOT_PATH], { container: containerRef })), { timeoutMs: 30_000 });
-            const encoded = (await runner(vpsDockerArgs(alias, [
+            await boundedRunner(vpsDockerArgs(alias, cuaExecArgs(["call", "get_desktop_state", "{}", "--socket", CUA_SOCKET, "--screenshot-out-file", SCREENSHOT_PATH], { container: containerRef })), { timeoutMs: 30_000 });
+            const encoded = (await boundedRunner(vpsDockerArgs(alias, [
                 "exec",
                 "-u",
                 "cua",
                 "-e",
                 "HOME=/home/cua",
                 containerRef,
-                "base64",
-                "-w0",
+                "sh",
+                "-c",
+                SCREENSHOT_TRANSFER,
+                "openmausbot-preview",
                 SCREENSHOT_PATH,
             ]), { timeoutMs: 30_000 })).stdout.trim();
             const checked = wholeScreenshot(Buffer.from(encoded, "base64"));
             if (!checked.ok)
                 throw Object.assign(new Error("Cua Driver returned an incomplete VPS screenshot"), { status: 502 });
-            return { png: encoded, format: checked.mime === "image/jpeg" ? "jpeg" : "png" };
+            frame = { png: encoded, format: checked.mime === "image/jpeg" ? "jpeg" : "png" };
         }
         catch (error) {
             // The failure may mean the world changed (container stopped, link
@@ -1091,9 +1145,24 @@ export async function vpsComputerScreenshot(cfg, botId, runner = defaultRunner)
             throw error;
         }
         finally {
-            await runner(vpsDockerArgs(alias, ["exec", "-u", "cua", containerRef, "rm", "-f", SCREENSHOT_PATH]), {
-                timeoutMs: 10_000,
-            }).catch(() => { });
+            const cleanupMs = Math.min(5_000, deadline - Date.now() - COMMAND_TIMEOUT_KILL_GRACE_MS);
+            if (cleanupMs > 0)
+                await runner(vpsDockerArgs(alias, ["exec", "-u", "cua", containerRef, "rm", "-f", SCREENSHOT_PATH]), {
+                    timeoutMs: cleanupMs,
+                }).catch(() => { });
         }
+        // Start the TTL after transfer and cleanup; a slow but healthy frame must
+        // not return with its own readiness cache already expired.
+        if (cacheable)
+            statusCache.set(key, { status, expiresAt: Date.now() + STATUS_CACHE_TTL_MS });
+        return frame;
     });
+    pendingScreenshots.set(key, capture);
+    try {
+        return await capture;
+    }
+    finally {
+        if (pendingScreenshots.get(key) === capture)
+            pendingScreenshots.delete(key);
+    }
 }

package/dist-server/server/webhooks.js

@@ -370,7 +370,10 @@ export class WebhookManager {
         const requestedDeliveryId = String(event.deliveryId ?? "").trim().slice(0, 200);
         if (requestedDeliveryId) {
             const key = `${trigger.endpointId}:${requestedDeliveryId}`;
-            const duplicate = this.deliveries.find((delivery) => delivery.key === key);
+            const committed = this.options.findRun?.(trigger.id, requestedDeliveryId);
+            const duplicate = committed
+                ? { runId: committed.id }
+                : this.deliveries.find((delivery) => delivery.key === key);
             if (duplicate) {
                 this.appendAttempt(trigger, event, {
                     outcome: "duplicate",