openmausbot 0.1.73 → 0.1.74

package/dist-server/server/message-db.js

@@ -10,7 +10,7 @@
 // Legacy JSON thread files import lazily: the first read of a thread with
 // no rows pulls the old file in, after which the DB is the source of
 // truth (the JSON file is left behind as a one-time backup).
-import { chmodSync, closeSync, existsSync, openSync, readFileSync, renameSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { DATA_DIR } from "./config.js";
@@ -19,6 +19,7 @@ const DB_FILE = () => join(DATA_DIR, "messages.db");
 let handle = null;
 let handlePath = null;
 function open() {
+    mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 });
     const file = DB_FILE();
     // Transcripts can contain private conversations and tool output. Create
     // the database with owner-only permissions and also repair an existing
@@ -47,6 +48,16 @@ function open() {
       thread_id TEXT PRIMARY KEY,
       active_leaf_id TEXT
     );
+    CREATE TABLE IF NOT EXISTS chat_followups (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      owner_id TEXT NOT NULL,
+      thread_id TEXT NOT NULL,
+      send_id TEXT,
+      status TEXT NOT NULL,
+      payload TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS chat_followups_receipt ON chat_followups(kind, owner_id, thread_id, send_id);
   `);
     ensureRecallIndex(db);
     ensureMemoryIndex(db);
@@ -153,6 +164,59 @@ function db() {
     handlePath = DB_FILE();
     return handle;
 }
+/** A 202/cancel/dispatch claim must reach disk before publishing its result.
+ * Use the existing transcript DB (and backup path), with FULL sync for these
+ * small transactions only; ordinary transcript writes keep their policy. */
+function writeFollowups(write) {
+    const connection = db();
+    connection.exec("PRAGMA synchronous = FULL");
+    try {
+        connection.exec("BEGIN IMMEDIATE");
+        try {
+            write(connection);
+            connection.exec("COMMIT");
+        }
+        catch (error) {
+            connection.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    finally {
+        connection.exec("PRAGMA synchronous = NORMAL");
+    }
+}
+export function saveChatFollowup(followup) {
+    writeFollowups((connection) => connection.prepare("INSERT INTO chat_followups(id, kind, owner_id, thread_id, send_id, status, payload) VALUES (?, ?, ?, ?, ?, 'pending', ?)").run(followup.id, followup.kind, followup.ownerId, followup.threadId, followup.payload.sendId ?? null, JSON.stringify(followup.payload)));
+}
+/** Null retires a dispatch whose canonical transcript is already durable.
+ * Cancellation tombstones remain so a retried sendId cannot resurrect it. */
+export function settleChatFollowups(ids, status) {
+    if (!ids.length)
+        return;
+    writeFollowups((connection) => {
+        const statement = connection.prepare(status === null
+            ? "DELETE FROM chat_followups WHERE id = ?"
+            : status === "cancelled"
+                ? "UPDATE chat_followups SET status = ?, payload = '{\"text\":\"\"}' WHERE id = ?"
+                : "UPDATE chat_followups SET status = ? WHERE id = ?");
+        for (const id of ids) {
+            if (status === null)
+                statement.run(id);
+            else
+                statement.run(status, id);
+        }
+    });
+}
+export function chatFollowups(kind) {
+    const rows = (kind
+        ? db().prepare("SELECT * FROM chat_followups WHERE kind = ? ORDER BY rowid").all(kind)
+        : db().prepare("SELECT * FROM chat_followups ORDER BY rowid").all());
+    return rows.map((row) => ({ id: row.id, kind: row.kind, ownerId: row.owner_id, threadId: row.thread_id,
+        status: row.status, payload: JSON.parse(row.payload) }));
+}
+export function cancelledChatFollowup(kind, ownerId, threadId, sendId) {
+    return Boolean(db().prepare("SELECT 1 FROM chat_followups WHERE kind = ? AND owner_id = ? AND thread_id = ? AND send_id = ? AND status = 'cancelled'").get(kind, ownerId, threadId, sendId));
+}
 const rowToMessage = (row) => JSON.parse(row.json);
 /** Read one thread, importing its legacy JSON file on first touch. */
 export function readThread(threadId, legacyFile) {
@@ -268,8 +332,11 @@ export function setActiveLeaf(threadId, leafId) {
         .run(threadId, leafId);
 }
 export function deleteThread(threadId) {
-    db().prepare("DELETE FROM messages WHERE thread_id = ?").run(threadId);
-    db().prepare("DELETE FROM thread_state WHERE thread_id = ?").run(threadId);
+    writeFollowups((connection) => {
+        connection.prepare("DELETE FROM chat_followups WHERE thread_id = ?").run(threadId);
+        connection.prepare("DELETE FROM messages WHERE thread_id = ?").run(threadId);
+        connection.prepare("DELETE FROM thread_state WHERE thread_id = ?").run(threadId);
+    });
 }
 /** Case-insensitive substring search over text messages, newest first.
  * A LIKE scan, deliberately: local transcripts are megabytes at most, a

package/dist-server/server/procs.js

@@ -34,6 +34,10 @@ export function assertSafeCliArgv(resolved, platform = process.platform) {
     error.code = "ENAMETOOLONG";
     throw error;
 }
+// Only spawnCli establishes a private POSIX group. A plain spawned child
+// (for example inside an MCP gate) may share our own group: never signal it.
+const cliGroups = new WeakSet();
+const stopping = new WeakMap();
 export function spawnCli(cli, args, opts) {
     const resolved = resolveCli(cli, args);
     assertSafeCliArgv(resolved);
@@ -43,6 +47,8 @@ export function spawnCli(cli, args, opts) {
         // win32: taskkill /T does the reaping instead (see killCliTree)
         ...(process.platform === "win32" ? { windowsHide: true } : { detached: true }),
     }); // callers always pipe all three
+    if (process.platform !== "win32")
+        cliGroups.add(child);
     // A write to a dying child's stdin fails differently per platform, and one
     // of the ways is fatal. On POSIX the kill is synchronous, the stream is
     // already destroyed by the time anything writes, and the write throws into
@@ -80,11 +86,78 @@ export function describeSpawnFailure(err, cli) {
         };
     return { message: `spawn failed: ${err.message}`, setup: false };
 }
-/** Stop a CLI and every process it spawned (MCP proxies included). */
+/** Stop an owned CLI group, including helpers after its root exits. timeoutMs
+ * is the TERM grace period; SIGKILL gets one further second to settle. Helpers
+ * that deliberately detach into another group are outside this ownership. */
 export function killCliTree(child, timeoutMs = 5_000) {
+    const existing = stopping.get(child);
+    if (existing)
+        return existing;
     const pid = child.pid;
-    if (!pid || child.exitCode !== null || child.signalCode !== null)
+    if (!pid)
         return Promise.resolve(true);
+    if (!Number.isInteger(pid) || pid <= 1 || pid === process.pid)
+        return Promise.resolve(false);
+    const run = stopCliTree(child, pid, Number.isFinite(timeoutMs) ? Math.max(0, timeoutMs) : 5_000);
+    stopping.set(child, run);
+    // A failed attempt may be retried. Remember success so a delayed caller
+    // cannot signal a reused PID/group after this child's group disappeared.
+    void run.then((stopped) => { if (!stopped)
+        stopping.delete(child); });
+    return run;
+}
+async function stopCliTree(child, pid, timeoutMs) {
+    const exited = () => child.exitCode !== null || child.signalCode !== null;
+    if (process.platform !== "win32") {
+        const group = cliGroups.has(child);
+        const settled = () => {
+            if (!exited())
+                return false;
+            if (!group)
+                return true;
+            try {
+                process.kill(-pid, 0);
+                return false;
+            }
+            catch (error) {
+                // EPERM and other failures do not prove that the group is gone.
+                return error.code === "ESRCH";
+            }
+        };
+        const signal = (value) => {
+            try {
+                if (group)
+                    process.kill(-pid, value);
+                else
+                    child.kill(value);
+            }
+            catch {
+                try {
+                    child.kill(value);
+                }
+                catch { /* report uncertainty below */ }
+            }
+        };
+        const wait = async (ms) => {
+            const deadline = Date.now() + ms;
+            while (!settled()) {
+                const remaining = deadline - Date.now();
+                if (remaining <= 0)
+                    return false;
+                await new Promise((resolve) => setTimeout(resolve, Math.min(25, remaining)));
+            }
+            return true;
+        };
+        if (settled())
+            return true;
+        signal("SIGTERM");
+        if (await wait(timeoutMs))
+            return true;
+        signal("SIGKILL");
+        return wait(1_000);
+    }
+    if (exited())
+        return true;
     return new Promise((resolve) => {
         let timer;
         const done = (stopped) => {
@@ -96,32 +169,18 @@ export function killCliTree(child, timeoutMs = 5_000) {
         child.once("close", closed);
         timer = setTimeout(() => done(false), timeoutMs);
         timer.unref?.();
-        if (process.platform === "win32") {
-            execFile("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
-                if (!err)
-                    return;
-                try {
-                    // taskkill is unavailable or the tree lookup failed. At least stop
-                    // the process we own instead of leaving the entire turn running.
-                    child.kill();
-                }
-                catch {
-                    /* already gone */
-                }
-            });
-            return;
-        }
-        try {
-            process.kill(-pid, "SIGTERM");
-        }
-        catch {
+        execFile("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
+            if (!err)
+                return;
             try {
-                child.kill("SIGTERM");
+                // taskkill is unavailable or the tree lookup failed. At least stop
+                // the process we own instead of leaving the entire turn running.
+                child.kill();
             }
             catch {
                 /* already gone */
             }
-        }
+        });
     });
 }
 /** Per-turn broker channel: unix socket on POSIX, named pipe on Windows

package/dist-server/server/routines.js

@@ -6,6 +6,14 @@ import { DATA_DIR } from "./config.js";
 import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
+const webhookRunReceiptSchema = z.object({
+    webhookId: z.string().min(1).max(200),
+    deliveryId: z.string().min(1).max(200),
+    runId: z.string().min(1),
+    acceptedAt: z.number().finite().nonnegative(),
+});
+const WEBHOOK_RETRY_WINDOW_MS = 7 * 24 * 60 * 60_000;
+const MAX_WEBHOOK_RECEIPTS = 20_000;
 function routineRequestOwnerKey(owner) {
     return JSON.stringify([owner.requestId, owner.messageId, owner.botId, owner.threadId]);
 }
@@ -426,6 +434,7 @@ export class RoutineManager {
     routines = [];
     runs = [];
     routineRequestReceipts = [];
+    webhookRunReceipts = [];
     timer = null;
     ticking = false;
     constructor(options) {
@@ -486,11 +495,29 @@ export class RoutineManager {
                     typeof receipt?.resultId === "string" &&
                     Number.isFinite(receipt?.appliedAt))
                 : [];
+            this.webhookRunReceipts = Array.isArray(disk.webhookRunReceipts)
+                ? disk.webhookRunReceipts.flatMap((receipt) => {
+                    const parsed = webhookRunReceiptSchema.safeParse(receipt);
+                    return parsed.success ? [parsed.data] : [];
+                })
+                : [];
+            // Upgrade old run logs before history pruning can discard their IDs.
+            const known = new Set(this.webhookRunReceipts.map((r) => JSON.stringify([r.webhookId, r.deliveryId])));
+            for (const run of this.runs) {
+                if (!run.webhookId || !run.deliveryId || run.createdAt < this.now() - WEBHOOK_RETRY_WINDOW_MS)
+                    continue;
+                const key = JSON.stringify([run.webhookId, run.deliveryId]);
+                if (known.has(key))
+                    continue;
+                this.webhookRunReceipts.push({ webhookId: run.webhookId, deliveryId: run.deliveryId, runId: run.id, acceptedAt: run.createdAt });
+                known.add(key);
+            }
         }
         catch {
             this.routines = [];
             this.runs = [];
             this.routineRequestReceipts = [];
+            this.webhookRunReceipts = [];
         }
         // A local process cannot still own these turns after a full restart.
         const recovered = [];
@@ -828,11 +855,22 @@ export class RoutineManager {
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
     }
-    /** Queue an event-driven job without inventing a calendar schedule. Webhook
-     * definitions live in their own store; the execution receipt deliberately
-     * reuses this manager so busy-bot ordering, task creation and VM routing stay
-     * identical for every unattended job. */
+    /** Look up an accepted delivery independently of run-log retention. */
+    webhookRunReceipt(webhookId, deliveryId) {
+        const receipt = this.webhookRunReceipts.find((candidate) => candidate.webhookId === webhookId && candidate.deliveryId === deliveryId &&
+            candidate.acceptedAt >= this.now() - WEBHOOK_RETRY_WINDOW_MS);
+        if (receipt)
+            return { id: receipt.runId };
+        // Never duplicate work that is still pending, even beyond the retry window.
+        const active = this.runs.find((run) => run.webhookId === webhookId && run.deliveryId === deliveryId &&
+            ["queued", "running", "waiting"].includes(run.status));
+        return active ? { id: active.id } : null;
+    }
+    /** Queue webhook work through the same dispatcher as scheduled routines. */
     enqueueWebhook(input) {
+        const existing = this.webhookRunReceipt(input.webhookId, input.deliveryId);
+        if (existing)
+            return existing;
         if (this.options.botState(input.botId) === "missing") {
             throw Object.assign(new Error("The assigned MAUS no longer exists"), { status: 410 });
         }
@@ -853,8 +891,26 @@ export class RoutineManager {
             attachments: [],
             createdAt: this.now(),
         };
+        const previousReceipts = this.webhookRunReceipts;
+        const receipts = previousReceipts.filter((receipt) => receipt.acceptedAt >= this.now() - WEBHOOK_RETRY_WINDOW_MS);
+        // Never evict a promised retry identity to admit fresh work.
+        if (receipts.length >= MAX_WEBHOOK_RECEIPTS) {
+            throw Object.assign(new Error("Webhook retry history is full; try again later"), { status: 429 });
+        }
+        receipts.push({ webhookId: input.webhookId, deliveryId: input.deliveryId, runId: run.id, acceptedAt: this.now() });
+        const previousRuns = this.runs.slice();
         this.runs.push(run);
-        this.save();
+        this.webhookRunReceipts = receipts;
+        try {
+            this.save();
+        }
+        catch (error) {
+            // Restore pruned history too, retaining the live run objects that tick()
+            // may be awaiting rather than replacing them with cloned snapshots.
+            this.runs = previousRuns;
+            this.webhookRunReceipts = previousReceipts;
+            throw error;
+        }
         this.emitRun(run);
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
@@ -1044,9 +1100,11 @@ export class RoutineManager {
             }
             // Oldest queued requests have priority. New manual/webhook arrivals
             // must not continually overtake work that has already waited. Snapshot
-            // the queue because each dispatch can asynchronously add/cancel work.
-            for (const run of this.runs.slice()) {
-                if (run.status !== "queued")
+            // IDs retain order across awaits without holding stale objects after
+            // another request rolls back a failed routine-definition write.
+            for (const id of this.runs.map((run) => run.id)) {
+                const run = this.runs.find((candidate) => candidate.id === id);
+                if (!run || run.status !== "queued")
                     continue;
                 // A queued interval represents the latest useful check, not a backlog
                 // item. If the bot stayed busy across later occurrences, align this
@@ -1430,6 +1488,7 @@ export class RoutineManager {
             routines: this.routines,
             runs: this.runs,
             routineRequestReceipts: this.routineRequestReceipts,
+            webhookRunReceipts: this.webhookRunReceipts,
         }, null, 2), { mode: 0o600 });
     }
 }

package/dist-server/server/steer-queue.js

@@ -4,11 +4,11 @@
 // here until the bot settles, then lands in the thread and runs as ONE
 // follow-up turn whose prompt is the queued texts separated by a blank line.
 //
-// The queue is memory-only and is NOT in `messages[]` while the current
+// The durable queue is NOT in `messages[]` while the current
 // turn is running: appending immediately would make the queued line the
 // active leaf, so remaining tool/assistant events of *this* turn would
-// hang off a user line the model has not seen. Restart loses the queue
-// (same as delegations / approvals). The composer shows a pending chip
+// hang off a user line the model has not seen. Restart restores only sends
+// whose dispatch has not begun. The composer shows a pending chip
 // until drain appends the words.
 //
 // Unlike the delegation drain, an interrupted or failed turn does NOT
@@ -17,7 +17,20 @@
 // stop-then-steer (queue a correction, hit Stop, the correction runs) is
 // the feature.
 import { newId } from "./contracts.js";
+import { chatFollowups, saveChatFollowup, settleChatFollowups } from "./message-db.js";
 const queues = new Map(); // threadId → waiting sends
+export function restoreSteeredMessages() {
+    queues.clear();
+    for (const row of chatFollowups("bot")) {
+        if (row.status !== "pending")
+            continue;
+        const entry = queues.get(row.threadId) ?? { botId: row.ownerId, items: [] };
+        if (entry.botId !== row.ownerId)
+            throw new Error("queued task belongs to another bot");
+        entry.items.push({ ...row.payload, messageId: row.id, prompt: row.payload.prompt ?? row.payload.text });
+        queues.set(row.threadId, entry);
+    }
+}
 const listeners = new Set();
 const changed = () => {
     for (const listener of listeners) {
@@ -50,7 +63,7 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
     // queues even if a corrupt caller reuses a thread id.
     if (entry.botId !== botId)
         throw new Error("queued task belongs to another bot");
-    entry.items.push({
+    const item = {
         messageId: id,
         text,
         prompt: options.prompt ?? text,
@@ -58,7 +71,9 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         sendId: options.sendId,
         reason: options.reason,
         unattended: options.unattended,
-    });
+    };
+    saveChatFollowup({ id, kind: "bot", ownerId: botId, threadId, payload: item });
+    entry.items.push(item);
     queues.set(threadId, entry);
     changed();
     return { id };
@@ -93,6 +108,7 @@ export function drainSteeredMessages(store, run, isBlocked) {
             : store.bot(entry.botId);
         if (!bot) {
             // the bot or task was deleted while messages waited
+            settleChatFollowups(entry.items.map((item) => item.messageId), "cancelled");
             queues.delete(threadId);
             changed();
             continue;
@@ -101,6 +117,8 @@ export function drainSteeredMessages(store, run, isBlocked) {
             continue;
         // committed to draining: the entry leaves the map before anything runs,
         // so a settle racing another settle can never fire the same queue twice
+        const ids = entry.items.map((item) => item.messageId);
+        settleChatFollowups(ids, "dispatching");
         queues.delete(threadId);
         changed();
         const appended = [];
@@ -124,10 +142,11 @@ export function drainSteeredMessages(store, run, isBlocked) {
         // message into one HTML block, which makes that attachment stop being a
         // native image when the combined follow-up is dispatched.
         const prompt = entry.items.map((item) => item.prompt).join("\n\n");
-        void run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
+        const running = run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
         // one unattended line makes the whole drained turn unattended: a
         // person's words in the same queue cannot re-attend a bot's own
         entry.items.some((item) => item.unattended === true));
+        void Promise.resolve(running).then(() => settleChatFollowups(ids, null), () => settleChatFollowups(ids, "interrupted")).catch((error) => console.warn("steer-queue: could not settle durable follow-up", error));
     }
 }
 /** Find the receipt for a retry whose message is still waiting to drain. */
@@ -141,7 +160,7 @@ export function queuedSteeredMessage(botId, threadId, sendId) {
 /** Drop one waiting send owned by this bot so it never drains. The queue id
  * is stable even if the bot switches away from the task while the request is
  * in flight. Returns false when it was already drained, belongs to another
- * bot, or a restart lost the in-memory auto-run intent. */
+ * bot, or dispatch has already started. */
 export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
     for (const [threadId, entry] of queues) {
         if (entry.botId !== botId || (expectedThreadId !== undefined && threadId !== expectedThreadId))
@@ -149,6 +168,7 @@ export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
         const items = entry.items.filter((item) => item.messageId !== messageId);
         if (items.length === entry.items.length)
             continue;
+        settleChatFollowups([messageId], "cancelled");
         if (items.length === 0)
             queues.delete(threadId);
         else

package/dist-server/server/team-manifest.js

@@ -139,7 +139,7 @@ export function parseTeamManifest(value) {
  *
  * 1. Allowlist, not blocklist. The returned object is built field by field
  *    from the parsed member, so every privilege-bearing BotRecord field —
- *    approvalMode, autoApprove, autoReview, alwaysAllow, chiefOfStaff, approvePeerComms, composio,
+ *    approvalMode, autoApprove, alwaysAllow, chiefOfStaff, approvePeerComms, composio,
  *    computer, cloudBackend, cwd — is structurally absent, whatever the
  *    file claimed. parseTeamManifest already drops unknown member keys;
  *    this keeps the guarantee even if the schema grows a field later,

package/dist-server/server/webhooks.js

@@ -370,7 +370,10 @@ export class WebhookManager {
         const requestedDeliveryId = String(event.deliveryId ?? "").trim().slice(0, 200);
         if (requestedDeliveryId) {
             const key = `${trigger.endpointId}:${requestedDeliveryId}`;
-            const duplicate = this.deliveries.find((delivery) => delivery.key === key);
+            const committed = this.options.findRun?.(trigger.id, requestedDeliveryId);
+            const duplicate = committed
+                ? { runId: committed.id }
+                : this.deliveries.find((delivery) => delivery.key === key);
             if (duplicate) {
                 this.appendAttempt(trigger, event, {
                     outcome: "duplicate",

package/dist-server/server/workspace-backup.js

@@ -32,7 +32,7 @@ const EXCLUSION_NOTES = [
     "External project folders, CLI login homes, browser session homes, OS keychains, companion devices and other servers.",
     "VM/container disk layers and remote cloud data; durable files inside this workspace are included.",
 ];
-const RESTORE_WARNING = "Restoring pauses routines, webhooks and calendar calls, and does not resume pending delegations or queued runs. Definitions and historical receipts are retained; review before enabling them again.";
+const RESTORE_WARNING = "Restoring pauses routines, webhooks and calendar calls, and does not resume pending delegations, queued chat messages or queued runs. Definitions and historical receipts are retained; review before enabling them again.";
 function excluded(name) {
     return EXCLUDED.has(name) || excludedWorkspaceAuthPath(name) || name.startsWith("openmausbot-server.lease.") || name.startsWith("box-create-requests.lock.") || /^perm-[A-Za-z0-9_-]+\.sock$/.test(name);
 }
@@ -887,17 +887,32 @@ function prepareRestore(dataDir, id, manifest) {
             });
     }
     const dbPath = join(prepared, "messages.db");
-    if (existsSync(dbPath) && manifest.sourceDataDir !== resolve(dataDir)) {
+    if (existsSync(dbPath)) {
         const db = new DatabaseSync(dbPath);
         try {
-            const update = db.prepare("UPDATE messages SET json = ?, text = ? WHERE thread_id = ? AND id = ?");
             db.exec("BEGIN");
-            for (const row of db.prepare("SELECT thread_id, id, json FROM messages").iterate()) {
-                const message = JSON.parse(String(row.json));
-                rebaseMessage(message, manifest.sourceDataDir, resolve(dataDir));
-                const json = JSON.stringify(message);
-                if (json !== row.json)
-                    update.run(json, record(message) && typeof message.text === "string" ? message.text : null, row.thread_id, row.id);
+            if (manifest.sourceDataDir !== resolve(dataDir)) {
+                const update = db.prepare("UPDATE messages SET json = ?, text = ? WHERE thread_id = ? AND id = ?");
+                for (const row of db.prepare("SELECT thread_id, id, json FROM messages").iterate()) {
+                    const message = JSON.parse(String(row.json));
+                    rebaseMessage(message, manifest.sourceDataDir, resolve(dataDir));
+                    const json = JSON.stringify(message);
+                    if (json !== row.json)
+                        update.run(json, record(message) && typeof message.text === "string" ? message.text : null, row.thread_id, row.id);
+                }
+            }
+            // Import is not a server restart: the source may still be running.
+            // Keep accepted words/receipts for review, but never execute a copy of
+            // its pending work (including when restoring to the original home).
+            if (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'chat_followups'").get()) {
+                const pause = db.prepare("UPDATE chat_followups SET status = 'interrupted', payload = ? WHERE id = ?");
+                for (const row of db.prepare("SELECT id, payload FROM chat_followups WHERE status IN ('pending', 'dispatching', 'interrupted')").iterate()) {
+                    const payload = JSON.parse(String(row.payload));
+                    rebaseMessage(payload, manifest.sourceDataDir, resolve(dataDir));
+                    if (record(payload))
+                        delete payload.prompt;
+                    pause.run(JSON.stringify(payload), row.id);
+                }
             }
             db.exec("COMMIT");
         }

package/dist-server/shared/approval-mode.js

@@ -1,9 +1,17 @@
-/** The four approval levels exposed by the desktop app. */
-export const APPROVAL_MODES = ["ask", "auto", "full", "custom"];
-/** Only providers with an implemented permission mapping may expose elevation. */
+/** The approval levels exposed by the app. Each one is a provider's own
+ * permission mode, passed through: OpenMausBot never decides a permission
+ * itself (Full access aside, which answers residual prompts because that is
+ * what the person granted). The order is the order the selector shows. */
+export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom"];
+/** Only providers with an implemented permission mapping may expose a level.
+ * `edits` (auto-accept edits) exists where the engine has such a mode:
+ * Claude and Grok `acceptEdits`, Antigravity `auto_edit`. Codex's Ask already
+ * runs `workspace-write`, so an edits level would change nothing there. */
 export function supportsApprovalMode(driverKind, mode) {
     if (mode === "custom")
         return driverKind === "codex";
+    if (mode === "edits")
+        return ["claudeAgent", "grokAgent", "antigravityAgent"].includes(driverKind ?? "");
     if (mode !== "full")
         return true;
     return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo"].includes(driverKind ?? "");
@@ -11,13 +19,6 @@ export function supportsApprovalMode(driverKind, mode) {
 export function hasNativeAutoReview(driverKind) {
     return ["codex", "claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind ?? "");
 }
-/** A native reviewer has already declined to decide, or Auto has no native
- * equivalent. Never second-guess that request with the app's heuristic rules.
- * Antigravity and OpenCode Full approve residual ACP tool-permission requests
- * through the app's explicit Full-access grant. Questions remain interactive. */
-export function requiresNativeApproval(driverKind, mode) {
-    return mode === "auto" || (mode === "full" && ["claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind));
-}
 export function isApprovalMode(value) {
     return typeof value === "string" && APPROVAL_MODES.includes(value);
 }

package/dist-server/vps-container-mcp.js

@@ -15114,6 +15114,14 @@ var featureConfigSchema = external_exports.object({
    * also has its own switch. */
   browser: external_exports.boolean().optional()
 });
+var onboardingConfigSchema = external_exports.object({
+  /** ISO timestamp of finishing (or skipping to the end of) the welcome flow. */
+  completedAt: external_exports.string().trim().max(40).optional(),
+  /** Which welcome flow was completed; a newer flow may re-show itself. */
+  version: external_exports.number().int().min(0).max(1e3).optional(),
+  reelSeen: external_exports.boolean().optional(),
+  hintsSeen: external_exports.array(external_exports.string().trim().min(1).max(60)).max(100).optional()
+}).strict();
 var instanceConfigSchema = external_exports.object({
   driver: external_exports.string().min(1),
   displayName: optionalText,
@@ -15207,6 +15215,7 @@ var appConfigSchema = external_exports.object({
   threads: external_exports.object({ maxConcurrentPerBot: external_exports.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS) }).strict().optional(),
   localVm: localVmConfigSchema.optional(),
   features: featureConfigSchema.optional(),
+  onboarding: onboardingConfigSchema.optional(),
   browserProfiles: browserProfilesSchema.optional(),
   instances: instanceConfigMapSchema.optional(),
   /** User-configured MCP servers, mounted into every capable engine. Kept

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmausbot",
-  "version": "0.1.73",
+  "version": "0.1.74",
   "description": "Run the OpenMausBot server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",