openmausbot 0.1.73 → 0.1.75

package/dist-server/server/message-db.js

@@ -10,7 +10,7 @@
 // Legacy JSON thread files import lazily: the first read of a thread with
 // no rows pulls the old file in, after which the DB is the source of
 // truth (the JSON file is left behind as a one-time backup).
-import { chmodSync, closeSync, existsSync, openSync, readFileSync, renameSync } from "node:fs";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { DATA_DIR } from "./config.js";
@@ -19,6 +19,7 @@ const DB_FILE = () => join(DATA_DIR, "messages.db");
 let handle = null;
 let handlePath = null;
 function open() {
+    mkdirSync(DATA_DIR, { recursive: true, mode: 0o700 });
     const file = DB_FILE();
     // Transcripts can contain private conversations and tool output. Create
     // the database with owner-only permissions and also repair an existing
@@ -47,6 +48,16 @@ function open() {
       thread_id TEXT PRIMARY KEY,
       active_leaf_id TEXT
     );
+    CREATE TABLE IF NOT EXISTS chat_followups (
+      id TEXT PRIMARY KEY,
+      kind TEXT NOT NULL,
+      owner_id TEXT NOT NULL,
+      thread_id TEXT NOT NULL,
+      send_id TEXT,
+      status TEXT NOT NULL,
+      payload TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS chat_followups_receipt ON chat_followups(kind, owner_id, thread_id, send_id);
   `);
     ensureRecallIndex(db);
     ensureMemoryIndex(db);
@@ -153,6 +164,59 @@ function db() {
     handlePath = DB_FILE();
     return handle;
 }
+/** A 202/cancel/dispatch claim must reach disk before publishing its result.
+ * Use the existing transcript DB (and backup path), with FULL sync for these
+ * small transactions only; ordinary transcript writes keep their policy. */
+function writeFollowups(write) {
+    const connection = db();
+    connection.exec("PRAGMA synchronous = FULL");
+    try {
+        connection.exec("BEGIN IMMEDIATE");
+        try {
+            write(connection);
+            connection.exec("COMMIT");
+        }
+        catch (error) {
+            connection.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    finally {
+        connection.exec("PRAGMA synchronous = NORMAL");
+    }
+}
+export function saveChatFollowup(followup) {
+    writeFollowups((connection) => connection.prepare("INSERT INTO chat_followups(id, kind, owner_id, thread_id, send_id, status, payload) VALUES (?, ?, ?, ?, ?, 'pending', ?)").run(followup.id, followup.kind, followup.ownerId, followup.threadId, followup.payload.sendId ?? null, JSON.stringify(followup.payload)));
+}
+/** Null retires a dispatch whose canonical transcript is already durable.
+ * Cancellation tombstones remain so a retried sendId cannot resurrect it. */
+export function settleChatFollowups(ids, status) {
+    if (!ids.length)
+        return;
+    writeFollowups((connection) => {
+        const statement = connection.prepare(status === null
+            ? "DELETE FROM chat_followups WHERE id = ?"
+            : status === "cancelled"
+                ? "UPDATE chat_followups SET status = ?, payload = '{\"text\":\"\"}' WHERE id = ?"
+                : "UPDATE chat_followups SET status = ? WHERE id = ?");
+        for (const id of ids) {
+            if (status === null)
+                statement.run(id);
+            else
+                statement.run(status, id);
+        }
+    });
+}
+export function chatFollowups(kind) {
+    const rows = (kind
+        ? db().prepare("SELECT * FROM chat_followups WHERE kind = ? ORDER BY rowid").all(kind)
+        : db().prepare("SELECT * FROM chat_followups ORDER BY rowid").all());
+    return rows.map((row) => ({ id: row.id, kind: row.kind, ownerId: row.owner_id, threadId: row.thread_id,
+        status: row.status, payload: JSON.parse(row.payload) }));
+}
+export function cancelledChatFollowup(kind, ownerId, threadId, sendId) {
+    return Boolean(db().prepare("SELECT 1 FROM chat_followups WHERE kind = ? AND owner_id = ? AND thread_id = ? AND send_id = ? AND status = 'cancelled'").get(kind, ownerId, threadId, sendId));
+}
 const rowToMessage = (row) => JSON.parse(row.json);
 /** Read one thread, importing its legacy JSON file on first touch. */
 export function readThread(threadId, legacyFile) {
@@ -268,8 +332,11 @@ export function setActiveLeaf(threadId, leafId) {
         .run(threadId, leafId);
 }
 export function deleteThread(threadId) {
-    db().prepare("DELETE FROM messages WHERE thread_id = ?").run(threadId);
-    db().prepare("DELETE FROM thread_state WHERE thread_id = ?").run(threadId);
+    writeFollowups((connection) => {
+        connection.prepare("DELETE FROM chat_followups WHERE thread_id = ?").run(threadId);
+        connection.prepare("DELETE FROM messages WHERE thread_id = ?").run(threadId);
+        connection.prepare("DELETE FROM thread_state WHERE thread_id = ?").run(threadId);
+    });
 }
 /** Case-insensitive substring search over text messages, newest first.
  * A LIKE scan, deliberately: local transcripts are megabytes at most, a

package/dist-server/server/permission-proxy.js

@@ -10,9 +10,18 @@
 //   ask_user  — the agent can pose a question mid-run and wait; the
 //               human's words come back verbatim.
 //
+// One tool arrives through `approve` that is not a permission at all: the
+// CLI's own AskUserQuestion. It is the tool the model actually reaches for
+// when it wants a person to choose, and acceptEdits will not run it unasked,
+// so it lands here looking like "may I run a tool?" — which is how a question
+// ended up on screen as an Allow/Deny box over a JSON blob. It is intercepted
+// below and asked as what it is: one card carrying every question it posed,
+// answered through the tool's own `answers` field.
+//
 // stdout is the MCP channel — never console.log here.
 import { connect } from "node:net";
 import { randomUUID } from "node:crypto";
+import { parseAskQuestions, questionAnswersByQuestion } from "../shared/ask-question.js";
 const socketPath = process.argv[2] ?? "";
 const waiting = new Map();
 const conn = connect(socketPath);
@@ -45,6 +54,77 @@ conn.on("data", (chunk) => {
     }
 });
 const send = (obj) => process.stdout.write(JSON.stringify(obj) + "\n");
+/** Hand one ask to the broker and wait for the human's answer. */
+function askBroker(ask) {
+    return new Promise((resolve) => {
+        waiting.set(String(ask.id), resolve);
+        if (conn.destroyed)
+            return dead();
+        try {
+            conn.write(JSON.stringify(ask) + "\n");
+        }
+        catch {
+            dead();
+        }
+    });
+}
+// ── the CLI's own AskUserQuestion ──────────────────────────────────────
+const ASK_USER_QUESTION = "AskUserQuestion";
+const asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+/** One question, in the shape the broker and the option card understand. */
+/**
+ * Ask the person every question at once, then answer the tool the way it
+ * documents.
+ *
+ * The answer is NOT a bare allow. A bare allow tells the CLI to go and run
+ * AskUserQuestion, and a headless run has no dialog to collect anything —
+ * the model gets "The user did not answer the questions." back and the
+ * click is thrown away. The `answers` object is the field the tool's own
+ * schema calls "User answers collected by the permission component":
+ * keyed by the question's text, one comma-joined string per question.
+ *
+ * One ask, not one per question: the card draws the whole set with a tab
+ * each, so a person sees what they are committing to before answering any
+ * of it. `questionAnswersByQuestion` maps the answer text back per question.
+ *
+ * There is deliberately no "fall through to the permission path" here. That
+ * path cannot answer this tool — allowing it throws the click away, as
+ * above — so the fallback offered a person an Allow/Deny box over raw JSON.
+ * That box is the bug this file exists to remove.
+ */
+async function answerNativeQuestions(input) {
+    // Unanswerable entries are SKIPPED by the parser, not fatal: one bad entry
+    // must not cost the user the good questions beside it. Nothing left means
+    // the whole call was unanswerable, which becomes a denial.
+    const questions = parseAskQuestions(input);
+    if (!questions?.length) {
+        return JSON.stringify({
+            behavior: "deny",
+            message: "OpenMausBot: this AskUserQuestion call had no answerable question (each one needs question text), so nobody was shown it. Ask again with a well-formed call, or continue without it.",
+        });
+    }
+    const answer = await askBroker({
+        t: "ask",
+        id: randomUUID(),
+        kind: "question",
+        tool: ASK_USER_QUESTION,
+        input: { questions },
+    });
+    // A question is only ever denied when the broker is gone.
+    if (answer.behavior === "deny") {
+        return JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
+    }
+    // What lands in `answers` turns on WHO answered, not on whether there are
+    // words. The broker's own notes are words — the timeout's "nobody answered
+    // in time, use your best judgment" is a whole sentence — so filing anything
+    // non-blank hands the model system text in the slot reserved for what the
+    // person chose. Left out, the CLI reports the question as unanswered, which
+    // is the truth.
+    const answers = answer.source === "user" && typeof answer.message === "string"
+        ? questionAnswersByQuestion(answer.message, questions)
+        : {};
+    return JSON.stringify({ behavior: "allow", updatedInput: { ...asRecord(input), answers } });
+}
 const TOOLS = [
     {
         name: "approve",
@@ -93,6 +173,12 @@ async function handle(msg) {
     if (msg.method === "tools/call") {
         const name = msg.params?.name;
         const args = msg.params?.arguments ?? {};
+        const reply = (text) => send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }] } });
+        // AskUserQuestion is a question wearing a permission's clothes. It never
+        // continues into the permission path below — see nativeQuestions.
+        if (name === "approve" && args.tool_name === ASK_USER_QUESTION) {
+            return reply(await answerNativeQuestions(args.input));
+        }
         const askId = randomUUID();
         const isQuestion = name === "ask_user";
         // the CLI may include its own suggested permission rules; on allow we
@@ -103,20 +189,9 @@ async function handle(msg) {
             : Array.isArray(args.suggestions)
                 ? args.suggestions
                 : null;
-        const answer = await new Promise((resolve) => {
-            waiting.set(askId, resolve);
-            if (conn.destroyed)
-                return dead();
-            const ask = isQuestion
-                ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } }
-                : { t: "ask", id: askId, tool: args.tool_name, input: args.input };
-            try {
-                conn.write(JSON.stringify(ask) + "\n");
-            }
-            catch {
-                dead();
-            }
-        });
+        const answer = await askBroker(isQuestion
+            ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } }
+            : { t: "ask", id: askId, tool: args.tool_name, input: args.input });
         let text = answer.message || "No answer was given — use your best judgment.";
         if (!isQuestion) {
             if (answer.behavior === "allow") {
@@ -129,7 +204,7 @@ async function handle(msg) {
                 text = JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
             }
         }
-        return send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }] } });
+        return reply(text);
     }
     if (String(msg.method ?? "").startsWith("notifications/"))
         return;

package/dist-server/server/procs.js

@@ -34,6 +34,10 @@ export function assertSafeCliArgv(resolved, platform = process.platform) {
     error.code = "ENAMETOOLONG";
     throw error;
 }
+// Only spawnCli establishes a private POSIX group. A plain spawned child
+// (for example inside an MCP gate) may share our own group: never signal it.
+const cliGroups = new WeakSet();
+const stopping = new WeakMap();
 export function spawnCli(cli, args, opts) {
     const resolved = resolveCli(cli, args);
     assertSafeCliArgv(resolved);
@@ -43,6 +47,8 @@ export function spawnCli(cli, args, opts) {
         // win32: taskkill /T does the reaping instead (see killCliTree)
         ...(process.platform === "win32" ? { windowsHide: true } : { detached: true }),
     }); // callers always pipe all three
+    if (process.platform !== "win32")
+        cliGroups.add(child);
     // A write to a dying child's stdin fails differently per platform, and one
     // of the ways is fatal. On POSIX the kill is synchronous, the stream is
     // already destroyed by the time anything writes, and the write throws into
@@ -80,11 +86,78 @@ export function describeSpawnFailure(err, cli) {
         };
     return { message: `spawn failed: ${err.message}`, setup: false };
 }
-/** Stop a CLI and every process it spawned (MCP proxies included). */
+/** Stop an owned CLI group, including helpers after its root exits. timeoutMs
+ * is the TERM grace period; SIGKILL gets one further second to settle. Helpers
+ * that deliberately detach into another group are outside this ownership. */
 export function killCliTree(child, timeoutMs = 5_000) {
+    const existing = stopping.get(child);
+    if (existing)
+        return existing;
     const pid = child.pid;
-    if (!pid || child.exitCode !== null || child.signalCode !== null)
+    if (!pid)
         return Promise.resolve(true);
+    if (!Number.isInteger(pid) || pid <= 1 || pid === process.pid)
+        return Promise.resolve(false);
+    const run = stopCliTree(child, pid, Number.isFinite(timeoutMs) ? Math.max(0, timeoutMs) : 5_000);
+    stopping.set(child, run);
+    // A failed attempt may be retried. Remember success so a delayed caller
+    // cannot signal a reused PID/group after this child's group disappeared.
+    void run.then((stopped) => { if (!stopped)
+        stopping.delete(child); });
+    return run;
+}
+async function stopCliTree(child, pid, timeoutMs) {
+    const exited = () => child.exitCode !== null || child.signalCode !== null;
+    if (process.platform !== "win32") {
+        const group = cliGroups.has(child);
+        const settled = () => {
+            if (!exited())
+                return false;
+            if (!group)
+                return true;
+            try {
+                process.kill(-pid, 0);
+                return false;
+            }
+            catch (error) {
+                // EPERM and other failures do not prove that the group is gone.
+                return error.code === "ESRCH";
+            }
+        };
+        const signal = (value) => {
+            try {
+                if (group)
+                    process.kill(-pid, value);
+                else
+                    child.kill(value);
+            }
+            catch {
+                try {
+                    child.kill(value);
+                }
+                catch { /* report uncertainty below */ }
+            }
+        };
+        const wait = async (ms) => {
+            const deadline = Date.now() + ms;
+            while (!settled()) {
+                const remaining = deadline - Date.now();
+                if (remaining <= 0)
+                    return false;
+                await new Promise((resolve) => setTimeout(resolve, Math.min(25, remaining)));
+            }
+            return true;
+        };
+        if (settled())
+            return true;
+        signal("SIGTERM");
+        if (await wait(timeoutMs))
+            return true;
+        signal("SIGKILL");
+        return wait(1_000);
+    }
+    if (exited())
+        return true;
     return new Promise((resolve) => {
         let timer;
         const done = (stopped) => {
@@ -96,32 +169,18 @@ export function killCliTree(child, timeoutMs = 5_000) {
         child.once("close", closed);
         timer = setTimeout(() => done(false), timeoutMs);
         timer.unref?.();
-        if (process.platform === "win32") {
-            execFile("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
-                if (!err)
-                    return;
-                try {
-                    // taskkill is unavailable or the tree lookup failed. At least stop
-                    // the process we own instead of leaving the entire turn running.
-                    child.kill();
-                }
-                catch {
-                    /* already gone */
-                }
-            });
-            return;
-        }
-        try {
-            process.kill(-pid, "SIGTERM");
-        }
-        catch {
+        execFile("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }, (err) => {
+            if (!err)
+                return;
             try {
-                child.kill("SIGTERM");
+                // taskkill is unavailable or the tree lookup failed. At least stop
+                // the process we own instead of leaving the entire turn running.
+                child.kill();
             }
             catch {
                 /* already gone */
             }
-        }
+        });
     });
 }
 /** Per-turn broker channel: unix socket on POSIX, named pipe on Windows

package/dist-server/server/routines.js

@@ -6,6 +6,14 @@ import { DATA_DIR } from "./config.js";
 import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
+const webhookRunReceiptSchema = z.object({
+    webhookId: z.string().min(1).max(200),
+    deliveryId: z.string().min(1).max(200),
+    runId: z.string().min(1),
+    acceptedAt: z.number().finite().nonnegative(),
+});
+const WEBHOOK_RETRY_WINDOW_MS = 7 * 24 * 60 * 60_000;
+const MAX_WEBHOOK_RECEIPTS = 20_000;
 function routineRequestOwnerKey(owner) {
     return JSON.stringify([owner.requestId, owner.messageId, owner.botId, owner.threadId]);
 }
@@ -426,6 +434,7 @@ export class RoutineManager {
     routines = [];
     runs = [];
     routineRequestReceipts = [];
+    webhookRunReceipts = [];
     timer = null;
     ticking = false;
     constructor(options) {
@@ -486,11 +495,29 @@ export class RoutineManager {
                     typeof receipt?.resultId === "string" &&
                     Number.isFinite(receipt?.appliedAt))
                 : [];
+            this.webhookRunReceipts = Array.isArray(disk.webhookRunReceipts)
+                ? disk.webhookRunReceipts.flatMap((receipt) => {
+                    const parsed = webhookRunReceiptSchema.safeParse(receipt);
+                    return parsed.success ? [parsed.data] : [];
+                })
+                : [];
+            // Upgrade old run logs before history pruning can discard their IDs.
+            const known = new Set(this.webhookRunReceipts.map((r) => JSON.stringify([r.webhookId, r.deliveryId])));
+            for (const run of this.runs) {
+                if (!run.webhookId || !run.deliveryId || run.createdAt < this.now() - WEBHOOK_RETRY_WINDOW_MS)
+                    continue;
+                const key = JSON.stringify([run.webhookId, run.deliveryId]);
+                if (known.has(key))
+                    continue;
+                this.webhookRunReceipts.push({ webhookId: run.webhookId, deliveryId: run.deliveryId, runId: run.id, acceptedAt: run.createdAt });
+                known.add(key);
+            }
         }
         catch {
             this.routines = [];
             this.runs = [];
             this.routineRequestReceipts = [];
+            this.webhookRunReceipts = [];
         }
         // A local process cannot still own these turns after a full restart.
         const recovered = [];
@@ -828,11 +855,22 @@ export class RoutineManager {
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
     }
-    /** Queue an event-driven job without inventing a calendar schedule. Webhook
-     * definitions live in their own store; the execution receipt deliberately
-     * reuses this manager so busy-bot ordering, task creation and VM routing stay
-     * identical for every unattended job. */
+    /** Look up an accepted delivery independently of run-log retention. */
+    webhookRunReceipt(webhookId, deliveryId) {
+        const receipt = this.webhookRunReceipts.find((candidate) => candidate.webhookId === webhookId && candidate.deliveryId === deliveryId &&
+            candidate.acceptedAt >= this.now() - WEBHOOK_RETRY_WINDOW_MS);
+        if (receipt)
+            return { id: receipt.runId };
+        // Never duplicate work that is still pending, even beyond the retry window.
+        const active = this.runs.find((run) => run.webhookId === webhookId && run.deliveryId === deliveryId &&
+            ["queued", "running", "waiting"].includes(run.status));
+        return active ? { id: active.id } : null;
+    }
+    /** Queue webhook work through the same dispatcher as scheduled routines. */
     enqueueWebhook(input) {
+        const existing = this.webhookRunReceipt(input.webhookId, input.deliveryId);
+        if (existing)
+            return existing;
         if (this.options.botState(input.botId) === "missing") {
             throw Object.assign(new Error("The assigned MAUS no longer exists"), { status: 410 });
         }
@@ -853,8 +891,26 @@ export class RoutineManager {
             attachments: [],
             createdAt: this.now(),
         };
+        const previousReceipts = this.webhookRunReceipts;
+        const receipts = previousReceipts.filter((receipt) => receipt.acceptedAt >= this.now() - WEBHOOK_RETRY_WINDOW_MS);
+        // Never evict a promised retry identity to admit fresh work.
+        if (receipts.length >= MAX_WEBHOOK_RECEIPTS) {
+            throw Object.assign(new Error("Webhook retry history is full; try again later"), { status: 429 });
+        }
+        receipts.push({ webhookId: input.webhookId, deliveryId: input.deliveryId, runId: run.id, acceptedAt: this.now() });
+        const previousRuns = this.runs.slice();
         this.runs.push(run);
-        this.save();
+        this.webhookRunReceipts = receipts;
+        try {
+            this.save();
+        }
+        catch (error) {
+            // Restore pruned history too, retaining the live run objects that tick()
+            // may be awaiting rather than replacing them with cloned snapshots.
+            this.runs = previousRuns;
+            this.webhookRunReceipts = previousReceipts;
+            throw error;
+        }
         this.emitRun(run);
         queueMicrotask(() => void this.tick());
         return cloneRun(run);
@@ -1044,9 +1100,11 @@ export class RoutineManager {
             }
             // Oldest queued requests have priority. New manual/webhook arrivals
             // must not continually overtake work that has already waited. Snapshot
-            // the queue because each dispatch can asynchronously add/cancel work.
-            for (const run of this.runs.slice()) {
-                if (run.status !== "queued")
+            // IDs retain order across awaits without holding stale objects after
+            // another request rolls back a failed routine-definition write.
+            for (const id of this.runs.map((run) => run.id)) {
+                const run = this.runs.find((candidate) => candidate.id === id);
+                if (!run || run.status !== "queued")
                     continue;
                 // A queued interval represents the latest useful check, not a backlog
                 // item. If the bot stayed busy across later occurrences, align this
@@ -1430,6 +1488,7 @@ export class RoutineManager {
             routines: this.routines,
             runs: this.runs,
             routineRequestReceipts: this.routineRequestReceipts,
+            webhookRunReceipts: this.webhookRunReceipts,
         }, null, 2), { mode: 0o600 });
     }
 }

package/dist-server/server/setup-mode.js

@@ -1,5 +1,5 @@
-// Setup mode: the coaching block a bot gets when it has not been set up yet,
-// or when the user asks for it with /setup. The bot interviews the user, says
+// Setup mode: optional coaching when the user asks for it with /setup.
+// An empty profile is not a request to interview the user. The bot says
 // what it intends, and then configures itself only through proposal cards
 // (propose_profile, propose_routine, skill_manage, request_credential) — so
 // nothing changes without the user's approval. Mirrors skill-learn.ts:
@@ -29,11 +29,10 @@ export function expandSetupTurnText(userText) {
         ? `Set yourself up for this job: ${setup.request}`
         : "Set yourself up. Ask me what you need to know, then propose your configuration.";
 }
-/** A bot with neither standing instructions nor a description has not been
- * set up. /setup re-enters the mode for a configured bot. */
+/** Only an explicit setup request enters coaching. Existing/blank bots must
+ * still do ordinary work, including delegated and scheduled requests. */
 export function setupModeActive(input) {
-    const blank = !(input.soul ?? "").trim() && !(input.description ?? "").trim();
-    return blank || parseSetupCommand(input.text) !== null;
+    return parseSetupCommand(input.text) !== null;
 }
 // skill_manage is only ever mounted alongside the other agent tools when
 // skill authoring is turned on for this turn (OMB_SKILL_AUTHORING_ENABLED);
@@ -46,7 +45,7 @@ function folderClause(cwd) {
         : "which folder on this computer it should work in (today it has none and works in a private workspace; offer to keep that, or ask for a path)";
 }
 function buildSetupPrompt(profileAside, cwd) {
-    return ("\n\nThis bot has not been set up yet, or the user asked you to set yourself up. Your job this conversation is to set yourself up from what the user tells you." +
+    return ("\n\nThe user explicitly asked you to set yourself up. For this setup request, help configure the bot from what the user tells you." +
         ` First ask at most four questions that change what you would build: what the job is, when it should happen (on demand, on a schedule, or when something arrives), which apps or accounts it touches, and ${folderClause(cwd)}.` +
         " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Wait for a yes." +
         " When they say yes, first send one message that lists the cards you are about to raise, then make the tool calls — the cards must appear after that message, never before it. After the tool calls add at most one short line and do not repeat the list." +

package/dist-server/server/steer-queue.js

@@ -4,11 +4,11 @@
 // here until the bot settles, then lands in the thread and runs as ONE
 // follow-up turn whose prompt is the queued texts separated by a blank line.
 //
-// The queue is memory-only and is NOT in `messages[]` while the current
+// The durable queue is NOT in `messages[]` while the current
 // turn is running: appending immediately would make the queued line the
 // active leaf, so remaining tool/assistant events of *this* turn would
-// hang off a user line the model has not seen. Restart loses the queue
-// (same as delegations / approvals). The composer shows a pending chip
+// hang off a user line the model has not seen. Restart restores only sends
+// whose dispatch has not begun. The composer shows a pending chip
 // until drain appends the words.
 //
 // Unlike the delegation drain, an interrupted or failed turn does NOT
@@ -17,7 +17,20 @@
 // stop-then-steer (queue a correction, hit Stop, the correction runs) is
 // the feature.
 import { newId } from "./contracts.js";
+import { chatFollowups, saveChatFollowup, settleChatFollowups } from "./message-db.js";
 const queues = new Map(); // threadId → waiting sends
+export function restoreSteeredMessages() {
+    queues.clear();
+    for (const row of chatFollowups("bot")) {
+        if (row.status !== "pending")
+            continue;
+        const entry = queues.get(row.threadId) ?? { botId: row.ownerId, items: [] };
+        if (entry.botId !== row.ownerId)
+            throw new Error("queued task belongs to another bot");
+        entry.items.push({ ...row.payload, messageId: row.id, prompt: row.payload.prompt ?? row.payload.text });
+        queues.set(row.threadId, entry);
+    }
+}
 const listeners = new Set();
 const changed = () => {
     for (const listener of listeners) {
@@ -50,7 +63,7 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
     // queues even if a corrupt caller reuses a thread id.
     if (entry.botId !== botId)
         throw new Error("queued task belongs to another bot");
-    entry.items.push({
+    const item = {
         messageId: id,
         text,
         prompt: options.prompt ?? text,
@@ -58,7 +71,9 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         sendId: options.sendId,
         reason: options.reason,
         unattended: options.unattended,
-    });
+    };
+    saveChatFollowup({ id, kind: "bot", ownerId: botId, threadId, payload: item });
+    entry.items.push(item);
     queues.set(threadId, entry);
     changed();
     return { id };
@@ -93,6 +108,7 @@ export function drainSteeredMessages(store, run, isBlocked) {
             : store.bot(entry.botId);
         if (!bot) {
             // the bot or task was deleted while messages waited
+            settleChatFollowups(entry.items.map((item) => item.messageId), "cancelled");
             queues.delete(threadId);
             changed();
             continue;
@@ -101,6 +117,8 @@ export function drainSteeredMessages(store, run, isBlocked) {
             continue;
         // committed to draining: the entry leaves the map before anything runs,
         // so a settle racing another settle can never fire the same queue twice
+        const ids = entry.items.map((item) => item.messageId);
+        settleChatFollowups(ids, "dispatching");
         queues.delete(threadId);
         changed();
         const appended = [];
@@ -124,10 +142,11 @@ export function drainSteeredMessages(store, run, isBlocked) {
         // message into one HTML block, which makes that attachment stop being a
         // native image when the combined follow-up is dispatched.
         const prompt = entry.items.map((item) => item.prompt).join("\n\n");
-        void run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
+        const running = run(entry.botId, threadId, prompt, last, appended.map((message) => message.id), 
         // one unattended line makes the whole drained turn unattended: a
         // person's words in the same queue cannot re-attend a bot's own
         entry.items.some((item) => item.unattended === true));
+        void Promise.resolve(running).then(() => settleChatFollowups(ids, null), () => settleChatFollowups(ids, "interrupted")).catch((error) => console.warn("steer-queue: could not settle durable follow-up", error));
     }
 }
 /** Find the receipt for a retry whose message is still waiting to drain. */
@@ -141,7 +160,7 @@ export function queuedSteeredMessage(botId, threadId, sendId) {
 /** Drop one waiting send owned by this bot so it never drains. The queue id
  * is stable even if the bot switches away from the task while the request is
  * in flight. Returns false when it was already drained, belongs to another
- * bot, or a restart lost the in-memory auto-run intent. */
+ * bot, or dispatch has already started. */
 export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
     for (const [threadId, entry] of queues) {
         if (entry.botId !== botId || (expectedThreadId !== undefined && threadId !== expectedThreadId))
@@ -149,6 +168,7 @@ export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
         const items = entry.items.filter((item) => item.messageId !== messageId);
         if (items.length === entry.items.length)
             continue;
+        settleChatFollowups([messageId], "cancelled");
         if (items.length === 0)
             queues.delete(threadId);
         else