openmausbot 0.1.74 → 0.1.75

package/dist-server/permission-proxy.js

@@ -1,6 +1,80 @@
 // server/permission-proxy.ts
 import { connect } from "node:net";
 import { randomUUID } from "node:crypto";
+
+// shared/ask-question.ts
+var MAX_QUESTIONS = 6;
+var MAX_OPTIONS = 12;
+var MAX_QUESTION_TEXT = 400;
+var MAX_LABEL = 120;
+var MAX_DESCRIPTION = 400;
+function text(value, limit) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed ? trimmed.slice(0, limit) : void 0;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseOption(value) {
+  if (typeof value === "string") {
+    const label2 = text(value, MAX_LABEL);
+    return label2 ? { label: label2 } : null;
+  }
+  if (!isRecord(value)) return null;
+  const label = text(value.label, MAX_LABEL);
+  if (!label) return null;
+  const description = text(value.description, MAX_DESCRIPTION);
+  return description ? { label, description } : { label };
+}
+function parseQuestion(value) {
+  if (!isRecord(value)) return null;
+  const question = text(value.question, MAX_QUESTION_TEXT);
+  if (!question) return null;
+  const options = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of Array.isArray(value.options) ? value.options : []) {
+    const option = parseOption(raw);
+    if (!option || seen.has(option.label)) continue;
+    seen.add(option.label);
+    options.push(option);
+    if (options.length === MAX_OPTIONS) break;
+  }
+  const header = text(value.header, MAX_LABEL);
+  return {
+    question,
+    ...header ? { header } : {},
+    ...value.multiSelect === true ? { multiSelect: true } : {},
+    options
+  };
+}
+function parseAskQuestions(input) {
+  if (!isRecord(input) || !Array.isArray(input.questions)) return null;
+  const questions = [];
+  for (const raw of input.questions) {
+    const question = parseQuestion(raw);
+    if (!question) continue;
+    questions.push(question);
+    if (questions.length === MAX_QUESTIONS) break;
+  }
+  return questions.length ? questions : null;
+}
+function questionAnswersByQuestion(message, questions) {
+  const answers = {};
+  const known = new Map(questions.map((entry) => [entry.question, entry.question]));
+  for (const block of message.split("\n\n")) {
+    const match = /^Q: ([\s\S]+?)\nA: ([\s\S]+)$/.exec(block.trim());
+    if (!match) continue;
+    const question = known.get(match[1].trim());
+    if (question) answers[question] = match[2].trim();
+  }
+  if (Object.keys(answers).length) return answers;
+  const only = questions.length === 1 ? questions[0] : void 0;
+  const flat = message.trim();
+  return only && flat ? { [only.question]: flat } : {};
+}
+
+// server/permission-proxy.ts
 var socketPath = process.argv[2] ?? "";
 var waiting = /* @__PURE__ */ new Map();
 var conn = connect(socketPath);
@@ -32,6 +106,40 @@ conn.on("data", (chunk) => {
   }
 });
 var send = (obj) => process.stdout.write(JSON.stringify(obj) + "\n");
+function askBroker(ask) {
+  return new Promise((resolve) => {
+    waiting.set(String(ask.id), resolve);
+    if (conn.destroyed) return dead();
+    try {
+      conn.write(JSON.stringify(ask) + "\n");
+    } catch {
+      dead();
+    }
+  });
+}
+var ASK_USER_QUESTION = "AskUserQuestion";
+var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+async function answerNativeQuestions(input) {
+  const questions = parseAskQuestions(input);
+  if (!questions?.length) {
+    return JSON.stringify({
+      behavior: "deny",
+      message: "OpenMausBot: this AskUserQuestion call had no answerable question (each one needs question text), so nobody was shown it. Ask again with a well-formed call, or continue without it."
+    });
+  }
+  const answer = await askBroker({
+    t: "ask",
+    id: randomUUID(),
+    kind: "question",
+    tool: ASK_USER_QUESTION,
+    input: { questions }
+  });
+  if (answer.behavior === "deny") {
+    return JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
+  }
+  const answers = answer.source === "user" && typeof answer.message === "string" ? questionAnswersByQuestion(answer.message, questions) : {};
+  return JSON.stringify({ behavior: "allow", updatedInput: { ...asRecord(input), answers } });
+}
 var TOOLS = [
   {
     name: "approve",
@@ -79,30 +187,27 @@ async function handle(msg) {
   if (msg.method === "tools/call") {
     const name = msg.params?.name;
     const args = msg.params?.arguments ?? {};
+    const reply = (text3) => send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text: text3 }] } });
+    if (name === "approve" && args.tool_name === ASK_USER_QUESTION) {
+      return reply(await answerNativeQuestions(args.input));
+    }
     const askId = randomUUID();
     const isQuestion = name === "ask_user";
     const suggestions = Array.isArray(args.permission_suggestions) ? args.permission_suggestions : Array.isArray(args.suggestions) ? args.suggestions : null;
-    const answer = await new Promise((resolve) => {
-      waiting.set(askId, resolve);
-      if (conn.destroyed) return dead();
-      const ask = isQuestion ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } } : { t: "ask", id: askId, tool: args.tool_name, input: args.input };
-      try {
-        conn.write(JSON.stringify(ask) + "\n");
-      } catch {
-        dead();
-      }
-    });
-    let text = answer.message || "No answer was given \u2014 use your best judgment.";
+    const answer = await askBroker(
+      isQuestion ? { t: "ask", id: askId, kind: "question", tool: "ask_user", input: { question: args.question, choices: args.choices } } : { t: "ask", id: askId, tool: args.tool_name, input: args.input }
+    );
+    let text2 = answer.message || "No answer was given \u2014 use your best judgment.";
     if (!isQuestion) {
       if (answer.behavior === "allow") {
         const result = { behavior: "allow", updatedInput: args.input ?? {} };
         if (answer.always && suggestions) result.updatedPermissions = suggestions;
-        text = JSON.stringify(result);
+        text2 = JSON.stringify(result);
       } else {
-        text = JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
+        text2 = JSON.stringify({ behavior: "deny", message: answer.message || "Denied from OpenMausBot" });
       }
     }
-    return send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text }] } });
+    return reply(text2);
   }
   if (String(msg.method ?? "").startsWith("notifications/")) return;
   if (msg.id != null) {

package/dist-server/server/auto-approve.js

@@ -17,7 +17,22 @@ export function approvalModeForOrigin(mode, origin) {
         return "auto";
     return mode;
 }
+// Tools that ask a PERSON something. A question exists so that a human
+// decides; any mode answering one on their behalf defeats the only reason
+// it was asked. They normally arrive typed as questions and never reach a
+// verdict at all — this is the backstop for the path where one arrives
+// mis-typed as a permission (a malformed AskUserQuestion call falls back to
+// the permission path in permission-proxy). Approving it there does not
+// produce an answer: the CLI runs the tool with none and the model is told
+// "The user did not answer the questions." — a question silently lost.
+const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user"]);
 export function autoVerdict(mode, tool, context) {
+    // A question is for a person, whatever channel it arrived on — and
+    // whatever the mode: even Full has no answer to give, only an approval
+    // that would run the tool with none.
+    if (ASKS_A_PERSON.has(tool.replace(/^mcp__[^_]+__/, "").toLowerCase())) {
+        return { approve: null, source: "no-grant" };
+    }
     // Full's promise is literal: even a sandbox widening is approved. Entering
     // Full is separately consent-gated by the bot PATCH endpoint, and the
     // request.opened caller invokes this for permissions only, never questions.

package/dist-server/server/drivers/acp/core.js

@@ -745,7 +745,8 @@ export function createAcpDriver(support) {
                             }
                         }
                         const images = turn.images ?? [];
-                        const runtimeAcceptsImages = init?.agentCapabilities?.promptCapabilities?.image === true;
+                        const runtimeAcceptsImages = init?.agentCapabilities?.promptCapabilities?.image === true ||
+                            support.acceptsUnadvertisedImages?.(init) === true;
                         if (images.length && support.images === true && !runtimeAcceptsImages) {
                             throw new Error(`${support.displayName} is configured for image attachments, but this installed runtime does not advertise ACP image input. Update the ${support.displayName} CLI or send the message without an image.`);
                         }

package/dist-server/server/drivers/acp/grok.js

@@ -175,10 +175,21 @@ export function ensureGrokInjectSlug(modelId, env = process.env) {
     writeFileSync(path, next);
     return slug;
 }
+/** Grok 1.0.25 consumes native image blocks but advertises image:false.
+ * Verified with the real CLI and a loopback model: scripts/verify-grok-images.ts.
+ * Keep unknown/older runtimes on the normal capability negotiation path. */
+export function grokAcceptsUnadvertisedImages(init) {
+    const meta = init?._meta;
+    if (meta?.grokShell !== true || typeof meta.agentVersion !== "string")
+        return false;
+    const version = /^1\.0\.(\d+)$/.exec(meta.agentVersion);
+    return Boolean(version && Number(version[1]) >= 25);
+}
 const support = {
     driverKind: "grokAgent",
     displayName: "Grok",
-    images: false,
+    images: true,
+    acceptsUnadvertisedImages: grokAcceptsUnadvertisedImages,
     models: STATIC_GROK_MODELS,
     resolveModels: (env) => mergeLocalInject(readGrokModelCatalog(env), env),
     // Grok's accepted levels vary by model and the CLI validates lazily — a

package/dist-server/server/drivers/claude.js

@@ -26,6 +26,7 @@ import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS }
 import { applyClaudeInject, decodeInjectId, mergeLocalInject, probeLocalInjects, resolveInjectId, } from "./local-inject.js";
 import { appendNative } from "./native.js";
 import { SPAWNED_PROXIES } from "../proxy-paths.js";
+import { ASK_USER_QUESTION_TOOL, askQuestionSummary, parseAskQuestions, questionChoices, } from "../../shared/ask-question.js";
 /** Whether `claude` has been signed in.
  *
  * Credential storage is deliberately not inspected here. Claude Code uses the
@@ -150,6 +151,30 @@ function claudeEnvironment(model, source = process.env, configDir, instanceEnvir
 function inheritsUserConfig(env) {
     return env.OMB_CLAUDE_INHERIT_USER_CONFIG === "1";
 }
+/** Retain the selected CLI account's authentication without importing its
+ * hooks, permissions, MCP servers or personal instructions. Explicit OMB
+ * connections/local endpoints own their entire routing + credential pair. */
+export function readClaudeAuthSettings(env, instanceEnvironment = {}) {
+    if (CLAUDE_ACCOUNT_ENV_KEYS.some((key) => instanceEnvironment[key]))
+        return {};
+    try {
+        const settings = JSON.parse(readFileSync(join(resolveClaudeConfigDir(undefined, env), "settings.json"), "utf8"));
+        const authEnv = {};
+        for (const key of CLAUDE_ACCOUNT_ENV_KEYS) {
+            if (!key.endsWith("_FILE_DESCRIPTOR") && typeof settings?.env?.[key] === "string") {
+                authEnv[key] = settings.env[key];
+            }
+        }
+        return {
+            ...(Object.keys(authEnv).length ? { env: authEnv } : {}),
+            ...(typeof settings?.apiKeyHelper === "string" && settings.apiKeyHelper.trim()
+                ? { apiKeyHelper: settings.apiKeyHelper } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
 /** MCP servers the bot's own project declares in `<cwd>/.mcp.json`.
  *
  * The CLI would find this file itself, but the harness launches it with
@@ -370,8 +395,17 @@ function systemEndedReply(kind) {
         ? { behavior: "answer", message: "OpenMausBot: the turn is ending — wrap up." }
         : { behavior: "deny", message: "OpenMausBot: the turn ended" };
 }
+/** The structured questions behind an ask, when it is one. Claude's own
+ * AskUserQuestion carries them; everything else answers null and keeps the
+ * plain summary/choices card. */
+function askQuestions(ask) {
+    return ask.tool === ASK_USER_QUESTION_TOOL ? parseAskQuestions(ask.input) : null;
+}
 /** One human-readable line for an ask — what the card subtitle shows. */
 function askSummary(ask) {
+    const questions = askQuestions(ask);
+    if (questions)
+        return askQuestionSummary(questions).slice(0, 300);
     return askInputSummary(ask.input) ?? ask.tool ?? "tool";
 }
 export function permissionSocketPath(threadId) {
@@ -490,7 +524,10 @@ export async function createPermissionBroker(opts) {
                         // `always` rides to the proxy, which hands the CLI's own suggested
                         // permission rules back as updatedPermissions: Claude remembers
                         // the allow for the session, the harness remembers nothing.
-                        conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message, ...(always ? { always: true } : {}) }) + "\n");
+                        // `source` travels with the answer too: a proxy that cannot tell
+                        // the human's words from a timeout note would file the timeout
+                        // note as the human's words.
+                        conn.write(JSON.stringify({ t: "answer", id: askId, behavior, message, source, ...(always ? { always: true } : {}) }) + "\n");
                     }
                     catch { }
                     opts.onResolve({ ...ask, behavior, source });
@@ -1028,6 +1065,12 @@ export const ClaudeDriver = {
                 args.push("--allowedTools", allowed.join(","));
             }
             const env = environment(turnModel);
+            const authSettings = isolated && !injected.injected
+                ? readClaudeAuthSettings(env, input.environment) : {};
+            const authSettingsPath = mcpConfigPath && Object.keys(authSettings).length
+                ? join(dirname(mcpConfigPath), "auth-settings.json") : null;
+            if (authSettingsPath)
+                args.push("--settings", authSettingsPath);
             // Our approvals and browser credentials expire at the user-turn
             // boundary. Native background workers cannot outlive that boundary;
             // parallel bot work must use the harness's durable delegate_bot path.
@@ -1035,7 +1078,7 @@ export const ClaudeDriver = {
             const cwd = turn.cwd ?? homedir();
             // Everything that shapes the process, minus session/turn-specific temp
             // paths. Their contents are represented directly in the key instead.
-            const privateFileFlags = new Set(["--mcp-config"]);
+            const privateFileFlags = new Set(["--mcp-config", "--settings"]);
             const keyArgs = args.filter((a, i) => !privateFileFlags.has(a) && !privateFileFlags.has(args[i - 1] ?? ""));
             const argsKey = JSON.stringify({
                 args: keyArgs,
@@ -1047,6 +1090,11 @@ export const ClaudeDriver = {
                 model: injected.model ?? null,
                 base: env.ANTHROPIC_BASE_URL ?? null,
                 configDir: env.CLAUDE_CONFIG_DIR ?? null,
+                // Rotating an account's key/helper must not reuse the old process.
+                auth: createHash("sha256").update(JSON.stringify({
+                    settings: authSettings,
+                    env: Object.fromEntries(CLAUDE_ACCOUNT_ENV_KEYS.map((key) => [key, env[key]])),
+                })).digest("hex"),
             });
             // Reuse the live process when it is idle, unchanged, and is the session
             // the harness wants resumed. Anything else: close it and spawn fresh
@@ -1137,6 +1185,7 @@ export const ClaudeDriver = {
                             const nativeReview = permissionMode === "auto" && nativeMode !== null
                                 ? nativeMode === "auto" ? "active" : "inactive"
                                 : undefined;
+                            const questions = askQuestions(ask);
                             emit({
                                 ...base(threadId, eventTurnId),
                                 type: "request.opened",
@@ -1151,7 +1200,12 @@ export const ClaudeDriver = {
                                 approvalScope: typeof ask.tool === "string" && controlsHost && ask.tool.startsWith("mcp__computer")
                                     ? "local-computer"
                                     : undefined,
-                                choices: Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
+                                questions: questions ?? undefined,
+                                // A structured ask still offers flat labels, for the phone
+                                // companions and any client that predates the question card.
+                                choices: questions
+                                    ? questionChoices(questions)
+                                    : Array.isArray(ask.input?.choices) ? ask.input.choices.slice(0, 5) : undefined,
                             });
                         },
                         onResolve: (resolved) => {
@@ -1180,6 +1234,9 @@ export const ClaudeDriver = {
                 if (mcpConfigPath) {
                     writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
                 }
+                if (authSettingsPath) {
+                    writeFileSync(authSettingsPath, JSON.stringify(authSettings), { mode: 0o600 });
+                }
                 if (sessionId)
                     args.push("--resume", sessionId);
                 else

package/dist-server/server/drivers/codex.js

@@ -524,6 +524,7 @@ export const CodexDriver = {
                 const earlyNotifications = [];
                 const state = {
                     settled: false,
+                    lastError: "",
                     lastText: "",
                     sawStreamDelta: false,
                     // codex reports token usage as a running THREAD total; the harness
@@ -878,7 +879,15 @@ export const CodexDriver = {
                         }
                         case "turn/completed": {
                             const t = p.turn ?? {};
-                            void settle(t.status === "completed", t.status === "completed" ? null : (t.error?.message ?? t.status ?? "failed"));
+                            const message = typeof t.error?.message === "string" ? t.error.message.slice(0, 400) : "";
+                            if (t.status !== "completed" && message && message !== state.lastError) {
+                                state.lastError = message;
+                                emit({ ...base(threadId, turnId), type: "runtime.error", message,
+                                    ...(classifyError({ text: message }).reason === "auth" ? { setup: true } : {}),
+                                });
+                            }
+                            void settle(t.status === "completed", t.status === "completed" ? null :
+                                (classifyError({ text: message || state.lastError }).reason === "provider_safety" ? "provider_safety" : (message || t.status || "failed")));
                             break;
                         }
                         case "error":
@@ -886,8 +895,10 @@ export const CodexDriver = {
                             // {error:{message}} — surface either (agentcal armor)
                             {
                                 const message = p.message ?? p.error?.message;
-                                if (message)
-                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: String(message).slice(0, 400) });
+                                if (message) {
+                                    state.lastError = String(message).slice(0, 400);
+                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: state.lastError });
+                                }
                             }
                             break;
                     }
@@ -1145,7 +1156,7 @@ export const CodexDriver = {
                             message,
                             ...(needsAuth ? { setup: true } : {}),
                         });
-                        await settle(false, needsAuth ? "auth_required" : "rpc_error");
+                        await settle(false, needsAuth ? "auth_required" : verdict.reason === "provider_safety" ? "provider_safety" : "rpc_error");
                     }
                 }
             };

package/dist-server/server/drivers/retry.js

@@ -1,3 +1,4 @@
+import { isProviderSafetyBlock } from "../../shared/provider-safety.js";
 export const RETRY_MAX_ATTEMPTS = 3;
 /** Backoff schedule before attempt N (N is 1-based over retries): 1s / 3s / 8s. */
 export const BACKOFF_BASE_MS = [1_000, 3_000, 8_000];
@@ -42,6 +43,9 @@ const messageOf = (err) => {
  */
 export function classifyError(err) {
     const text = messageOf(err);
+    // A surrounding HTTP 5xx/429 must not replay a provider safety block.
+    if (isProviderSafetyBlock(text))
+        return { transient: false, reason: "provider_safety" };
     if (err && "exitCode" in err) {
         const { exitCode: code } = err;
         if (code !== null && code < 0)

package/dist-server/server/index.js

@@ -75,7 +75,7 @@ import { buildRecoveryText, buildTurnContext, engineIsFresh } from "./turn-conte
 import { extractTurnImages } from "./turn-images.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
 import { TurnResources, workspaceResource } from "./turn-resources.js";
-import { ensureWorkspace, ensureTaskWorkspace, updateMemory, appendMemoryLog, isMemoryTopicName, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
+import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, updateMemory, appendMemoryLog, isMemoryTopicName, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
 import { readMemoryTopic } from "./workspace.js";
 import { MEMORY_INDEX, MemoryStoreError, memoryCapacity, memoryOverview, openMemoryLocation, readMemoryDoc, } from "./memory-store.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, flushMemoryJournal, journalMemoryDelete, journalMemoryWrite, readMemoryJournal, revertMemoryChange, } from "./memory-journal.js";
@@ -1213,6 +1213,14 @@ function handleDesktopTrustedApprovalMessage(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return false;
     const message = raw;
+    const threadCanReceiveGrant = (bot) => {
+        const threadId = bot.approvalGrant?.threadId;
+        if (!threadId)
+            return true;
+        const target = store.projectBotForTask(bot.id, threadId);
+        return Boolean(target && !threadBusy(bot.id, threadId) &&
+            registry.cliTarget(target.modelSelection.instanceId)?.driverKind === registry.cliTarget(bot.modelSelection.instanceId)?.driverKind);
+    };
     if (message.type === "approval-trusted-mode-commit") {
         const requestId = typeof message.requestId === "string" && /^[A-Za-z0-9_-]{1,80}$/.test(message.requestId)
             ? message.requestId
@@ -1231,7 +1239,11 @@ function handleDesktopTrustedApprovalMessage(raw) {
             bot.approvalGrant.phase === "committed" &&
             bot.approvalMode === mode &&
             !bot.busy &&
+            threadCanReceiveGrant(bot) &&
             supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
+            if (bot.approvalGrant.threadId) {
+                store.patchTask(botId, bot.approvalGrant.threadId, { approvalMode: mode, autoApprove: false });
+            }
             store.patchBot(botId, { approvalGrant: undefined });
         }
         else if (bot?.approvalGrant?.requestId === requestId) {
@@ -1272,7 +1284,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
                 return true;
             }
             store.patchBot(botId, {
-                approvalGrant: { requestId, mode, phase: "confirmed" },
+                approvalGrant: { ...bot.approvalGrant, requestId, mode, phase: "confirmed" },
             });
             confirm(true);
             return true;
@@ -1321,7 +1333,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
             }
             // Still inert: Electron must receive this acknowledgement and request
             // finalization before the durable mode can affect any turn.
-            store.patchBot(botId, { approvalGrant: { requestId, mode, phase: "activated" } });
+            store.patchBot(botId, { approvalGrant: { ...bot.approvalGrant, requestId, mode, phase: "activated" } });
             activate(true);
             return true;
         }
@@ -1359,10 +1371,11 @@ function handleDesktopTrustedApprovalMessage(raw) {
             bot.approvalGrant.phase === "activated" &&
             bot.approvalMode === mode &&
             !bot.busy &&
+            threadCanReceiveGrant(bot) &&
             supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
             // Durable but still inert. Electron must observe this exact ACK before
             // sending the one-way commit release that clears the journal.
-            store.patchBot(botId, { approvalGrant: { requestId, mode, phase: "committed" } });
+            store.patchBot(botId, { approvalGrant: { ...bot.approvalGrant, requestId, mode, phase: "committed" } });
             finalize(true);
             return true;
         }
@@ -1406,6 +1419,20 @@ function handleDesktopTrustedApprovalMessage(raw) {
         return true;
     }
     const currentMode = approvalModeFor(existing);
+    const threadId = message.threadId;
+    if (threadId !== undefined) {
+        const target = typeof threadId === "string" && /^[\w-]{1,128}$/.test(threadId)
+            ? store.projectBotForTask(botId, threadId) : null;
+        if (!target || (mode !== "full" && mode !== "custom") || currentMode !== mode || existing.approvalGrant) {
+            respond({ ok: false, error: "Choose this bot's approval level in bot settings before applying it to an existing thread" });
+            return true;
+        }
+        if (threadBusy(botId, threadId) ||
+            registry.cliTarget(target.modelSelection.instanceId)?.driverKind !== registry.cliTarget(existing.modelSelection.instanceId)?.driverKind) {
+            respond({ ok: false, error: "Stop this thread and use the bot's provider before applying its approval level" });
+            return true;
+        }
+    }
     const emergencyDowngrade = existing.busy && isEmergencyApprovalDowngrade(currentMode, mode);
     const clearsPendingElevation = mode === "ask" && existing.approvalGrant !== undefined;
     if (existing.busy && !emergencyDowngrade && !clearsPendingElevation) {
@@ -1432,7 +1459,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
         approvalMode: mode,
         autoApprove: mode === "auto",
         approvalGrant: mode === "full" || mode === "custom"
-            ? { requestId, mode, phase: "prepared" }
+            ? { requestId, mode, phase: "prepared", ...(typeof threadId === "string" ? { threadId } : {}) }
             : undefined,
     });
     if (!updated) {
@@ -2197,6 +2224,15 @@ always) {
             outcome = "unavailable";
         }
     }
+    // An answered question keeps its words. `request.resolved` only records
+    // the behavior, so without this the card reads "answer" forever and the
+    // person can no longer see what they told the bot.
+    if (outcome !== "unavailable" && behavior === "answer" && message && cardMessage) {
+        const settled = store.messagesFor(threadId).find((m) => m.id === cardMessage.id)?.card;
+        if (settled) {
+            store.patchMessage(threadId, cardMessage.id, { card: { ...settled, answeredText: message } });
+        }
+    }
     // The human's verdict, recorded only when it actually reached the engine:
     // `unavailable` means the action never ran, and a "user-approved" row
     // over a request nothing answered would be the audit log lying. A
@@ -2883,7 +2919,11 @@ bus.subscribe((event) => {
             }
             break;
         case "request.opened": {
-            const permission = event.requestType === "permission";
+            // A structured ask carries the model's own options and has no
+            // allow/deny answer, so it is a question no matter which channel the
+            // provider routed it through — and, like every question, no approval
+            // mode may ever answer it for the person.
+            const permission = event.requestType === "permission" && !event.questions?.length;
             // A permission request here is one the provider left for a person: its
             // own mode already ran (Ask, Edits, Auto's reviewer, Custom's config).
             // OpenMausBot decides nothing about the action itself. Only Full access
@@ -2985,6 +3025,10 @@ bus.subscribe((event) => {
                 break;
             }
             const heldContext = { source: verdict?.source, permission };
+            // A structured ask (Claude's AskUserQuestion) is a question whatever
+            // the provider routed it as: it has no allow/deny answer, only the
+            // model's own options. The card carries them so the person can choose.
+            const questions = event.questions?.length ? event.questions : undefined;
             const message = pushMessage({
                 role: "bot",
                 kind: "options",
@@ -2998,6 +3042,7 @@ bus.subscribe((event) => {
                     options: event.choices?.length ? event.choices : permission ? ["Allow", "Deny"] : [],
                     requestId: event.requestId,
                     tool: permission ? event.tool : undefined,
+                    questionRequest: questions ? { version: 1, questions } : undefined,
                     // the provider can keep an allow for its session; the app keeps
                     // no grant of its own for a provider's tool
                     allowSession: permission && event.allowSession && !event.requiresExplicitApproval ? true : undefined,
@@ -4511,6 +4556,7 @@ async function startTurn(botId, text, opts) {
                 // to a turn whose engine actually mounted them (setupMode is already
                 // false when they are not — see agentsMounted above)
                 { id: "setup", label: "Setup", text: setupSystemPrompt(setupMode, { skills: skillAuthoring, cwd: liveBot?.cwd ?? bot.cwd }) },
+                { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
                 { id: "plan", label: "Surface", text: plan.note },
                 // gated on the integration, not the key: the hint only goes to a
@@ -5616,6 +5662,7 @@ setupRetry = 0) {
                 store.patchBot(bot.id, { soulDrift: drift.drift });
         }
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
+            { id: "files", label: "File locations", text: workspace ? workspaceLocationsPrompt(bot.id, cwd, readyBot.cwd) : "" },
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
             { id: "computer", label: "Computer", text: computerPrompt(roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
@@ -12392,15 +12439,17 @@ const handleRequest = async (req, res) => {
             const current = store.projectBotForTask(m[1], m[2]);
             if (!current)
                 return json(res, 404, { error: "no such task" });
-            const allowed = new Set(["title", "projectId", "modelSelection", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto"]);
+            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported thread setting" });
-            for (const key of ["requireAvailableModel", "acknowledgeLocalAuto"]) {
+            for (const key of ["requireAvailableModel", "acknowledgeLocalAuto", "updateBotDefault"]) {
                 if (body[key] !== undefined && typeof body[key] !== "boolean")
                     return json(res, 400, { error: `${key} must be a boolean` });
             }
             if (body.requireAvailableModel === true && body.modelSelection === undefined)
                 return json(res, 400, { error: "requireAvailableModel requires modelSelection" });
+            if (body.updateBotDefault === true && body.modelSelection === undefined)
+                return json(res, 400, { error: "updateBotDefault requires modelSelection" });
             const patch = {};
             if (body.projectId !== undefined) {
                 if (body.projectId === null)
@@ -12437,8 +12486,11 @@ const handleRequest = async (req, res) => {
                 const mode = body.approvalMode ?? (body.autoApprove ? "auto" : "ask");
                 // Elevated modes still require the trusted desktop transition. A
                 // thread settings PATCH cannot manufacture that grant.
-                if (mode !== "ask" && mode !== "auto")
-                    return json(res, 403, { error: "Full and Custom access require confirmation in bot settings" });
+                if (mode !== "ask" && mode !== "auto" && mode !== "edits")
+                    return json(res, 403, { error: "Full and Custom access require trusted desktop confirmation" });
+                if (!supportsApprovalMode(registry.cliTarget(current.modelSelection.instanceId)?.driverKind, mode)) {
+                    return json(res, 400, { error: "This provider does not support the selected approval level" });
+                }
                 if (threadBusy(current.id, current.threadId))
                     return json(res, 409, { error: "stop this thread before changing its approval mode" });
                 if (current.approvalGrant)
@@ -12458,6 +12510,24 @@ const handleRequest = async (req, res) => {
                     registry.cliTarget(patch.modelSelection.instanceId)?.driverKind !== registry.cliTarget(current.modelSelection.instanceId)?.driverKind)) {
                 return json(res, 400, { error: "Choose Ask for this thread before changing providers with elevated permissions" });
             }
+            if (body.updateBotDefault === true && patch.modelSelection) {
+                const profile = store.bot(current.id);
+                const checked = checkedModelSelection(patch.modelSelection, {
+                    selection: profile.modelSelection, busy: Boolean(activeGroupTurnForBot(current.id)),
+                });
+                if (!checked.ok)
+                    return json(res, checked.status, { error: checked.error });
+                const defaultMode = approvalModeFor(profile);
+                if ((defaultMode === "full" || defaultMode === "custom") &&
+                    (!supportsApprovalMode(registry.cliTarget(patch.modelSelection.instanceId)?.driverKind, defaultMode) ||
+                        registry.cliTarget(patch.modelSelection.instanceId)?.driverKind !== registry.cliTarget(profile.modelSelection.instanceId)?.driverKind)) {
+                    return json(res, 400, { error: "Choose Ask in bot settings before changing its default provider with elevated permissions" });
+                }
+                // Validate both scopes before saving either. Existing sibling threads
+                // retain their selections; only this pinned thread and future/group
+                // turns adopt the new default. Do not target the currently selected tab.
+                store.patchBot(current.id, { modelSelection: patch.modelSelection });
+            }
             const task = store.patchTask(m[1], m[2], patch);
             const fresh = botWithThread(store.bot(m[1]));
             broadcast({ kind: "bot", bot: fresh });