openmausbot 0.1.75 → 0.1.77

package/dist-server/server/store.js

@@ -6,6 +6,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, mkdirSync, rmSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
+import { ensureSections, readSections, changeEmptySection } from "./section-context.js";
 import { removeBotFolder, soulFile, soulHash, writeSoulMirror } from "./bot-folder.js";
 import { peerAllowKey } from "./peer-approval-key.js";
 import { DATA_DIR, loadBrowserProfileIdAliases } from "./config.js";
@@ -294,6 +295,8 @@ export class Store {
     threads = new Map();
     defaultSelection;
     listeners = new Set();
+    /** A broken team registry must not prevent loading independent chat data. */
+    registeringInitialSections = true;
     /** Room turns and old callers have their own activity slot. Clearing
      * that slot must not clear a concurrently running independent task. */
     legacyActivities = new Map();
@@ -312,6 +315,7 @@ export class Store {
         catch {
             this.groups = [];
         }
+        this.rememberSections([...this.bots, ...this.groups].map((record) => record.section));
         // busy never survives a restart — no turn does either. Rooms saved
         // before default responders existed adopt their first member as lead.
         let botsMigrated = false;
@@ -359,6 +363,11 @@ export class Store {
                 delete b.autoStartVps;
                 botsMigrated = true;
             }
+            if (b.managedSections !== undefined && (!b.chiefOfStaff || !Array.isArray(b.managedSections) ||
+                b.managedSections.length > 100 || b.managedSections.some(section => typeof section !== "string" || section.length > 60))) {
+                delete b.managedSections;
+                botsMigrated = true;
+            }
             if (b.approvalMode !== undefined && !isApprovalMode(b.approvalMode)) {
                 delete b.approvalMode;
                 botsMigrated = true;
@@ -369,15 +378,27 @@ export class Store {
             // bots.json write. Revoke it before schedulers, listeners, or HTTP can
             // start any new work.
             if (b.approvalGrant !== undefined) {
-                b.approvalMode = "ask";
-                b.autoApprove = false;
-                delete b.approvalGrant;
-                for (const task of b.tasks ?? []) {
-                    if (task.approvalMode === "full" || task.approvalMode === "custom") {
-                        task.approvalMode = "ask";
-                        task.autoApprove = false;
+                const threadOnly = b.approvalGrant.threadOnly === true;
+                if (threadOnly) {
+                    // A crash may land between saving the target and clearing its
+                    // journal. Revoke that target only, never unrelated threads.
+                    const target = b.tasks?.find(task => task.threadId === b.approvalGrant?.threadId);
+                    if (target) {
+                        target.approvalMode = "ask";
+                        target.autoApprove = false;
                     }
                 }
+                if (!threadOnly) {
+                    b.approvalMode = "ask";
+                    b.autoApprove = false;
+                    for (const task of b.tasks ?? []) {
+                        if (task.approvalMode === "full" || task.approvalMode === "custom") {
+                            task.approvalMode = "ask";
+                            task.autoApprove = false;
+                        }
+                    }
+                }
+                delete b.approvalGrant;
                 botsMigrated = true;
             }
             const avatar = botAvatarProfile(b);
@@ -403,6 +424,7 @@ export class Store {
                 continue;
             }
             b.chiefOfStaff = false;
+            delete b.managedSections;
             botsMigrated = true;
         }
         // Peer grants originally used mutable display names (ask_bot:@Helper).
@@ -547,16 +569,59 @@ export class Store {
             if (existsSync(legacyFile))
                 mdb.readThread(threadId, legacyFile);
         }
+        this.registeringInitialSections = false;
     }
     saveBots(bots = this.bots) {
+        this.rememberSections([...this.bots, ...bots].map((bot) => bot.section));
         writeFileAtomic(BOTS_FILE, JSON.stringify(bots.map(({ busy: _busy, activity: _activity, ...bot }) => ({
             ...bot,
             tasks: bot.tasks?.map(({ busy: _taskBusy, activity: _taskActivity, ...task }) => task),
         })), null, 2));
     }
     saveGroups() {
+        this.rememberSections(this.groups.map((group) => group.section));
         writeFileAtomic(GROUPS_FILE, JSON.stringify(this.groups.map(({ busyBotId: _busyBotId, ...g }) => g), null, 2));
     }
+    get sections() { return readSections(); }
+    rememberSections(names) {
+        try {
+            if (ensureSections(names))
+                this.emit({ type: "sections" });
+        }
+        catch (error) {
+            if (!this.registeringInitialSections)
+                throw error;
+            console.warn(`[teams] Startup could not register team names; saved teams and shared instructions were left unchanged: ${error.message}`);
+        }
+    }
+    /** Empty-only changes cannot merge teams or silently change anybody's access. */
+    changeEmptySection(name, nextName) {
+        if (!this.sections.includes(name))
+            return "No such team";
+        if ([...this.bots, ...this.groups].some((record) => sectionKey(record.section) === name)) {
+            return "Move all bots (including archived bots) and group chats out of this team first";
+        }
+        if (nextName !== null && nextName !== name && this.sections.includes(nextName)) {
+            return "A team with that name already exists";
+        }
+        if (nextName === name)
+            return undefined;
+        const revoked = this.bots.filter((bot) => bot.managedSections?.some((section) => sectionKey(section) === name));
+        if (revoked.length) {
+            const grants = new Map(revoked.map((bot) => [bot.id, bot.managedSections.filter((section) => sectionKey(section) !== name)]));
+            // Revoke durably before freeing the name. If the registry write then
+            // fails, authority stays narrowed; recreating a name can never revive
+            // its old grants. Update existing objects so in-flight checks see it.
+            this.saveBots(this.bots.map((bot) => grants.has(bot.id) ? { ...bot, managedSections: grants.get(bot.id) } : bot));
+            for (const bot of revoked)
+                bot.managedSections = grants.get(bot.id);
+            for (const bot of revoked)
+                this.emit({ type: "bot", botId: bot.id });
+        }
+        changeEmptySection(name, nextName);
+        this.emit({ type: "sections" });
+        return undefined;
+    }
     // ── groups ────────────────────────────────────────────────────────────
     /** Subscribe to every write. Listeners run after the write and after
      * save; a throwing listener never breaks the write. */
@@ -581,6 +646,7 @@ export class Store {
         return this.groups.find((group) => group.threadId === threadId || group.tasks?.some((task) => task.threadId === threadId));
     }
     createGroup(name, memberIds, dm = false, section, setup) {
+        this.rememberSections([section]);
         const threadId = newId();
         const createdAt = Date.now();
         const group = {
@@ -616,6 +682,9 @@ export class Store {
         const group = this.group(id);
         if (!group)
             return null;
+        if (Object.prototype.hasOwnProperty.call(patch, "section")) {
+            this.rememberSections([patch.section]);
+        }
         Object.assign(group, patch);
         if (!group.dm && Object.prototype.hasOwnProperty.call(patch, "pinnedMessageId")) {
             const active = this.activeGroupTask(group.id);
@@ -782,12 +851,20 @@ export class Store {
         return this.patchMessage(threadId, messageId, { reactions: next.length ? next : undefined });
     }
     thread(threadId) {
-        let t = this.threads.get(threadId);
+        const t = this.threads.get(threadId);
         if (t)
             return t;
         // SQLite is the source of truth; a thread with no rows imports its
         // legacy messages-<threadId>.json once, inside readThread
-        const { messages, activeLeafId: storedLeaf } = mdb.readThread(threadId, messagesFile(threadId));
+        return this.cacheThread(threadId, mdb.readThread(threadId, messagesFile(threadId)));
+    }
+    /** Finish hydrating a full set of thread rows into the cache: chain any
+     * legacy (pre-branching) rows' parentId in array order, default the
+     * active leaf to the newest message, and store it. Shared by a full load
+     * and by messagesTail() when its bounded read turns out to be the whole
+     * thread anyway. */
+    cacheThread(threadId, rows) {
+        const { messages, activeLeafId: storedLeaf } = rows;
         let activeLeafId = storedLeaf;
         // legacy rows carry no parentId — chain them in array order
         let prev = null;
@@ -798,13 +875,44 @@ export class Store {
         }
         if (!activeLeafId)
             activeLeafId = messages.at(-1)?.id ?? null;
-        t = { messages, activeLeafId };
+        const t = { messages, activeLeafId };
         this.threads.set(threadId, t);
         return t;
     }
     messagesFor(threadId) {
         return this.thread(threadId).messages;
     }
+    /** A bounded page of a thread's newest messages, for callers that only
+     * need a display page — the startup/reconnect hydrate and a fresh
+     * scrollback view. Reads just `limit` rows at the SQL boundary instead of
+     * the whole transcript, unless the thread is already cached from other
+     * work (then it's a plain in-memory slice, no extra SQL) or the bounded
+     * read comes back as the complete thread anyway (short thread, or a
+     * one-time legacy import) — that gets cached like any other full load so
+     * a later messagesFor() doesn't re-read it. Legacy rows that predate
+     * per-message parentId are only chained correctly on a full load, so a
+     * bounded page missing that context falls back to one rather than
+     * returning messages with a broken parent chain. */
+    messagesTail(threadId, limit) {
+        let state = this.threads.get(threadId);
+        if (!state) {
+            const tail = mdb.readThreadTail(threadId, messagesFile(threadId), limit);
+            const legacyRows = tail.hasMore !== undefined && tail.messages.some((m) => m.parentId === undefined);
+            if (tail.hasMore !== true || legacyRows) {
+                state = this.cacheThread(threadId, legacyRows ? mdb.readThread(threadId, messagesFile(threadId)) : tail);
+            }
+            else {
+                return {
+                    messages: tail.messages,
+                    hasMore: tail.hasMore,
+                    activeLeafId: tail.activeLeafId ?? tail.messages.at(-1)?.id ?? null,
+                };
+            }
+        }
+        const { messages, activeLeafId } = state;
+        const start = Math.max(0, messages.length - limit);
+        return { messages: messages.slice(start), hasMore: start > 0, activeLeafId };
+    }
     /** Used only with newly allocated import threads. No live actions are
      * replayed: the importer supplies inert text and freshly remapped IDs. */
     importTranscript(threadId, messages, activeLeafId) {
@@ -982,6 +1090,7 @@ export class Store {
         return this.bots.find((b) => b.threadId === threadId || b.tasks?.some((t) => t.threadId === threadId)) ?? null;
     }
     createBot(profile = {}, opts = {}) {
+        this.rememberSections([profile.section]);
         const name = profile.name?.trim() || pickBotName(this.bots.map((b) => b.name));
         const section = sectionKey(profile.section);
         const bot = {
@@ -1037,11 +1146,103 @@ export class Store {
         }
         return bot;
     }
-    deleteBot(id) {
+    /** All setup fields and the Chief's receipt commit before publishing any
+     * mutation. Model defaults never rewrite saved thread selections. */
+    applyTeamSetup(request) {
+        const chief = this.bot(request.botId);
+        if (!chief)
+            throw new Error("The requesting Chief no longer exists");
+        if (chief.lastTeamSetupReceipt?.requestId === request.requestId)
+            return chief.lastTeamSetupReceipt.result;
+        const managedSections = [...new Set([...(chief.managedSections ?? []), ...request.newTeams])];
+        if (managedSections.length > 100 || managedSections.some((name) => name.trim() !== name || name.length > 60) ||
+            request.newTeams.some((name) => !name) || (request.newTeams.length && !chief.chiefOfStaff))
+            throw new Error("Invalid reviewed Chief team scope");
+        const nextBots = [...this.bots];
+        const changed = [];
+        for (const operation of request.operations) {
+            const at = nextBots.findIndex((bot) => bot.id === operation.botId);
+            let next;
+            if (operation.action === "create") {
+                if (at >= 0 || !operation.threadId || !operation.fields.name || !operation.fields.modelSelection)
+                    throw new Error("Invalid new bot in team setup");
+                const createdAt = Date.now();
+                next = { id: operation.botId, threadId: operation.threadId, name: operation.fields.name,
+                    title: "", description: "", soul: "", notifications: true, color: COLORS[nextBots.length % COLORS.length], unread: false,
+                    modelSelection: operation.fields.modelSelection, resumeCursors: {}, createdAt, ...operation.fields,
+                    approvalMode: "ask", autoApprove: false, composio: false, approvePeerComms: false,
+                    tasks: [{ threadId: operation.threadId, title: UNTITLED_THREAD, createdAt, resumeCursors: {},
+                            modelSelection: structuredClone(operation.fields.modelSelection), approvalMode: "ask", autoApprove: false,
+                            unread: false, activity: "idle", busy: false }],
+                };
+                nextBots.unshift(next);
+            }
+            else {
+                if (at < 0)
+                    throw new Error("A setup target no longer exists");
+                const previous = nextBots[at];
+                next = { ...previous, ...operation.fields };
+                if (operation.fields.modelSelection)
+                    next.tasks = previous.tasks?.map((task) => ({
+                        ...task,
+                        modelSelection: structuredClone(task.modelSelection ?? previous.modelSelection),
+                        approvalMode: approvalModeFor(this.projectBotForTask(previous.id, task.threadId)),
+                        autoApprove: task.autoApprove ?? previous.autoApprove,
+                        alwaysAllow: structuredClone(task.alwaysAllow ?? previous.alwaysAllow ?? []),
+                    }));
+                nextBots[at] = next;
+            }
+            next.section = sectionKey(next.section) || undefined;
+            if (operation.fields.soul !== undefined) {
+                next.soulHash = soulHash(operation.fields.soul);
+                next.soulDrift = false;
+            }
+            changed.push(next);
+        }
+        const result = { state: "applied", newTeams: request.newTeams, bots: changed.map((bot, index) => ({
+                id: bot.id, name: bot.name, section: bot.section, modelSelection: structuredClone(bot.modelSelection),
+                action: request.operations[index].action === "create" ? "created" : "updated",
+            })) };
+        const chiefAt = nextBots.findIndex((bot) => bot.id === chief.id);
+        const nextChief = { ...nextBots[chiefAt], lastTeamSetupReceipt: { requestId: request.requestId, result } };
+        // Only the newly-created teams explicitly named in the human review may
+        // extend this Chief's reach. Existing teams require owner settings.
+        if (request.newTeams.length) {
+            nextChief.managedSections = managedSections;
+        }
+        nextBots[chiefAt] = nextChief;
+        this.saveBots(nextBots);
+        this.bots = nextBots;
+        for (const bot of changed) {
+            try {
+                writeSoulMirror(bot.id, bot.soul ?? "");
+            }
+            catch (error) {
+                console.warn(`[bot-folder] could not refresh reviewed setup mirror for ${bot.id}: ${error.message}`);
+            }
+            this.emit({ type: "bot", botId: bot.id });
+        }
+        this.emit({ type: "bot", botId: chief.id });
+        return result;
+    }
+    deleteBot(id, setupRequest) {
         const bot = this.bot(id);
         if (!bot)
             return false;
-        this.bots = this.bots.filter((b) => b.id !== id);
+        let nextBots = this.bots.filter((b) => b.id !== id);
+        if (setupRequest) {
+            const chief = this.bot(setupRequest.botId);
+            if (!chief || chief.id === id || setupRequest.deletion?.botId !== id)
+                throw new Error("The reviewed deletion no longer has a valid owner");
+            const lastTeamSetupReceipt = { requestId: setupRequest.requestId, result: { state: "applied", newTeams: [], bots: [
+                        { id: bot.id, name: bot.name, action: "deleted" },
+                    ] } };
+            nextBots = nextBots.map((candidate) => candidate.id === chief.id ? { ...candidate, lastTeamSetupReceipt } : candidate);
+        }
+        // Persist removal and the review receipt before deleting conversation or
+        // workspace data. A failed save must leave the bot recoverable in place.
+        this.saveBots(nextBots);
+        this.bots = nextBots;
         this.legacyActivities.delete(id);
         // every task's transcript goes with the bot, not just the open one
         for (const threadId of new Set([bot.threadId, ...(bot.tasks ?? []).map((t) => t.threadId)])) {
@@ -1064,7 +1265,6 @@ export class Store {
         catch { }
         // The bot folder (SOUL.md mirror) is the bot's too.
         removeBotFolder(id);
-        this.saveBots();
         this.emit({ type: "bot.deleted", botId: id });
         return true;
     }
@@ -1164,6 +1364,7 @@ export class Store {
             for (const botId of changedIds)
                 this.emit({ type: "bot", botId });
         }
+        this.rememberSections([targetSection]);
         return { ok: true, bots: ids.map((id) => this.bot(id)) };
     }
     /** Legacy bot/room activity occupies its own slot; direct conversations
@@ -1221,6 +1422,7 @@ export class Store {
             }
             else {
                 bot.chiefOfStaff = false;
+                delete bot.managedSections;
             }
             changed.push(bot);
         }
@@ -1427,6 +1629,7 @@ export class Store {
         return {
             ...bot,
             threadId: task.threadId,
+            approvalGrant: bot.approvalGrant?.threadOnly && bot.approvalGrant.threadId !== threadId ? undefined : bot.approvalGrant,
             modelSelection: structuredClone(task.modelSelection ?? bot.modelSelection),
             resumeCursors: structuredClone(task.resumeCursors),
             approvalMode: task.approvalMode ?? (task.autoApprove === undefined ? bot.approvalMode : undefined),
@@ -1460,6 +1663,37 @@ export class Store {
         this.emit({ type: "bot", botId });
         return task;
     }
+    /** Model/provider changes are one configuration transaction: never publish
+     * a new provider before its confirmed approval downgrade, or change the
+     * default while leaving the selected thread behind after a write failure. */
+    switchTaskModel(botId, threadId, selection, updateBotDefault, resetApprovalToAsk, taskPatch = {}) {
+        const bot = this.bot(botId);
+        const task = this.taskByThread(botId, threadId);
+        if (!bot || !task)
+            return null;
+        const patch = { modelSelection: structuredClone(selection),
+            ...(resetApprovalToAsk ? { approvalMode: "ask", autoApprove: false, alwaysAllow: [] } : {}) };
+        const nextTask = { ...task, ...taskPatch, ...patch,
+            ...(typeof taskPatch.title === "string" ? { title: taskPatch.title.trim().slice(0, 80) || UNTITLED_THREAD } : {}) };
+        // Older threads may still inherit settings. Freeze their effective
+        // values before updating the default so "other threads unchanged" also
+        // holds for workspaces created before per-thread approval settings.
+        const nextTasks = bot.tasks.map((candidate) => candidate === task ? nextTask : !updateBotDefault ? candidate : {
+            ...candidate,
+            modelSelection: structuredClone(candidate.modelSelection ?? bot.modelSelection),
+            approvalMode: approvalModeFor(this.projectBotForTask(botId, candidate.threadId)),
+            autoApprove: candidate.autoApprove ?? bot.autoApprove,
+            alwaysAllow: structuredClone(candidate.alwaysAllow ?? bot.alwaysAllow ?? []),
+        });
+        const next = { ...bot, ...(updateBotDefault ? patch : {}),
+            tasks: nextTasks };
+        this.saveBots(this.bots.map((candidate) => candidate === bot ? next : candidate));
+        bot.tasks.forEach((candidate, index) => Object.assign(candidate, nextTasks[index]));
+        if (updateBotDefault)
+            Object.assign(bot, patch);
+        this.emit({ type: "bot", botId });
+        return task;
+    }
     mirrorActiveTask(bot, task) {
         bot.threadId = task.threadId;
         bot.resumeCursors = structuredClone(task.resumeCursors);
@@ -1511,6 +1745,24 @@ export class Store {
         this.emit({ type: "bot", botId });
         return task;
     }
+    /** Stamp or clear the closer record. `null` reopens: the next turn in a
+     * closed thread calls this so the row comes back to the sidebar. Never
+     * reachable from the HTTP task PATCH: closedBy is not a TASK_PATCH_FIELD. */
+    setTaskClosedBy(botId, threadId, closedBy) {
+        const bot = this.bot(botId);
+        const task = this.taskByThread(botId, threadId);
+        if (!bot || !task)
+            return null;
+        if (closedBy)
+            task.closedBy = structuredClone(closedBy);
+        else if (!task.closedBy)
+            return task;
+        else
+            delete task.closedBy;
+        this.saveBots();
+        this.emit({ type: "bot", botId });
+        return task;
+    }
     switchTask(botId, threadId) {
         const bot = this.bot(botId);
         const task = bot?.tasks?.find((t) => t.threadId === threadId);
@@ -1534,10 +1786,10 @@ export class Store {
         this.emit({ type: "bot", botId });
     }
     /** Delete a task and its transcript, retaining generated project files.
-     * A bot always keeps one. */
+     * When no visible tasks remain, replace it with a fresh conversation. */
     deleteTask(botId, threadId) {
         const bot = this.bot(botId);
-        if (!bot || !bot.tasks || bot.tasks.length < 2)
+        if (!bot?.tasks)
             return null;
         if (!bot.tasks.some((t) => t.threadId === threadId))
             return null;

package/dist-server/server/surface.js

@@ -19,14 +19,25 @@ export function surfaceOfComputerKind(kind) {
     return kind;
 }
 const NO_BROWSER_NOTE = " This bot is set to work in the built-in browser, but the built-in browser is switched off in App Settings, so you have no browser and no computer this turn — say so instead of guessing.";
+const OFF_NOTE = " This bot's \"Works on\" setting is Off, so no computer and no built-in browser are mounted this turn: you cannot open a page, click, or type on any screen. If the user asks for something that needs one, tell them Works on is Off in this bot's settings — never claim you are opening a browser you do not have.";
 /** Decide what a turn mounts from the bot's destination, the task's pin
- * and what is actually reachable. Explicit choices are strict: a computer
- * destination keeps whatever browser the bot has (the prompt tells the
- * model which to use), a browser destination mounts only the browser. Auto
- * follows the task's pin while the pinned place still exists, and otherwise
- * re-resolves the way it always has. */
+ * and what is actually reachable. Explicit choices are strict: Off mounts
+ * neither surface, a computer destination keeps whatever browser the bot
+ * has (the prompt tells the model which to use), a browser destination
+ * mounts only the browser. Auto follows the task's pin while the pinned
+ * place still exists, and otherwise re-resolves the way it always has. */
 export function resolveSurface(input) {
     const { destination, browserOn } = input;
+    // Off is the whole answer: no computer and no browser. It used to withhold
+    // only the computer, which left a bot set to Off holding the built-in
+    // browser — the one surface the setting most obviously reads as forbidding,
+    // and the one people then watched it reach for. The overview ("Can't use a
+    // computer.") and the settings prompt preview already described Off this
+    // way; the dispatch was the odd one out. A bot that should keep the browser
+    // and nothing else has its own destination: Browser.
+    if (destination === "off") {
+        return { computer: "off", browser: false, pinned: null, clearPin: false, note: OFF_NOTE };
+    }
     if (destination === "browser") {
         return browserOn
             ? { computer: "off", browser: true, pinned: null, clearPin: false, note: "" }

package/dist-server/server/team-backup.js

@@ -66,6 +66,9 @@ export function createTeamBackup(store, routines, name) {
             openedBy: "openedBy" in task && task.openedBy
                 ? { botId: task.openedBy.botId, name: task.openedBy.name, at: task.openedBy.at }
                 : undefined,
+            closedBy: "closedBy" in task && task.closedBy
+                ? { botId: task.closedBy.botId, name: task.closedBy.name, at: task.closedBy.at }
+                : undefined,
             activeLeafId: store.activeLeaf(task.threadId),
             messages: store.messagesFor(task.threadId).map((message) => ({
                 id: message.id, role: message.role, text: messageText(message), at: message.at,
@@ -130,7 +133,10 @@ export function importTeamBackup(store, routines, input, selection) {
     const groupIds = new Map();
     const takenNames = new Set(store.bots.map((bot) => bot.name.trim().toLowerCase()));
     const takenGroups = new Set(store.groups.map((group) => group.name.trim().toLowerCase()));
-    const takenSections = new Set([...store.bots, ...store.groups].map((record) => record.section?.trim().toLowerCase() ?? ""));
+    const takenSections = new Set([
+        ...store.sections.map((section) => section.toLowerCase()),
+        ...[...store.bots, ...store.groups].map((record) => record.section?.trim().toLowerCase() ?? ""),
+    ]);
     const sections = new Map();
     const sectionFor = (section) => {
         const key = section?.trim() ?? "";
@@ -182,6 +188,12 @@ export function importTeamBackup(store, routines, input, selection) {
                 const opener = task.openedBy && botIds.get(task.openedBy.botId);
                 if (task.openedBy && opener)
                     record.openedBy = { botId: opener, name: task.openedBy.name, at: task.openedBy.at };
+                // A closed thread stays closed after import — the pile the person
+                // tidied does not come back as a pile — with the closer remapped
+                // the same way, or absent when it was a stranger.
+                const closer = task.closedBy && botIds.get(task.closedBy.botId);
+                if (task.closedBy && closer)
+                    record.closedBy = { botId: closer, name: task.closedBy.name, at: task.closedBy.at };
                 return record;
             });
             // Own the task IDs before writing their transcripts, so rollback also
@@ -228,6 +240,10 @@ export function importTeamBackup(store, routines, input, selection) {
         for (const bot of store.bots)
             if (!existingBotIds.has(bot.id))
                 store.deleteBot(bot.id);
+        for (const section of sections.values()) {
+            if (store.sections.includes(section))
+                store.changeEmptySection(section, null);
+        }
         throw error;
     }
 }

package/dist-server/server/team-computers.js

@@ -0,0 +1,108 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
+export const teamComputerCreate = z.object({
+    name: z.string().trim().min(1).max(60).refine(value => [...value].every(character => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127)),
+    acknowledgeCost: z.literal(true),
+    // Clients may keep this id across a lost create response. It is not a Box id.
+    requestId: z.string().uuid(),
+}).strict();
+export const teamComputerAssignment = z.object({
+    section: z.string().trim().max(60).nullable(),
+    acknowledgeSharedAccess: z.literal(true),
+}).strict();
+const entrySchema = z.object({
+    id: z.string().uuid(), name: teamComputerCreate.shape.name,
+    section: z.string().trim().max(60).nullable(), createdAt: z.number().finite().nonnegative(),
+    problem: z.string().max(500).optional(),
+}).strict();
+const fileSchema = z.object({ version: z.literal(1), environmentId: z.string().uuid(), computers: z.array(entrySchema).max(100) }).strict();
+export const teamComputerOwner = (id) => `computer_${id}`;
+const failure = (message, status = 409) => Object.assign(new Error(message), { status });
+/** One server writer owns the data directory. Persist identity before any
+ * provider call; failed/retried creates always retain the same Box journal key.
+ * Invalid or foreign restored state is never silently reset to an empty pool. */
+export class TeamComputers {
+    entries = [];
+    problem;
+    file;
+    environmentId;
+    constructor(file, environmentId) {
+        this.file = file;
+        this.environmentId = environmentId;
+        try {
+            if (!existsSync(file))
+                return;
+            const stat = lstatSync(file);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 100_000)
+                throw new Error("unsafe registry file");
+            const saved = fileSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+            if (saved.environmentId !== environmentId)
+                throw new Error("registry belongs to another workspace; its computers were not transferred");
+            if (new Set(saved.computers.map(entry => entry.id)).size !== saved.computers.length)
+                throw new Error("duplicate computer identity");
+            const sections = saved.computers.flatMap(entry => entry.section === null ? [] : [entry.section]);
+            if (new Set(sections).size !== sections.length)
+                throw new Error("a team has more than one computer");
+            this.entries = saved.computers;
+        }
+        catch (error) {
+            this.problem = `Team computer registry could not be loaded: ${error instanceof Error ? error.message : String(error)}`;
+        }
+    }
+    list() {
+        if (this.problem)
+            throw failure(this.problem, 503);
+        return this.entries.map(entry => ({ ...entry }));
+    }
+    get(id) { return this.list().find(entry => entry.id === id); }
+    forSection(section) {
+        return this.list().find(entry => entry.section !== null && entry.section === (section?.trim() || ""));
+    }
+    forBot(bot) {
+        // Explicit destinations are permissions, not suggestions. Only Auto inherits.
+        return bot.computer === undefined && bot.cloudBackend !== "vps" ? this.forSection(bot.section) : undefined;
+    }
+    create(name, id = randomUUID()) {
+        const entries = this.list();
+        const existing = entries.find(entry => entry.id === id);
+        if (existing) {
+            if (existing.name !== name)
+                throw failure("This creation id already names a different computer");
+            return existing;
+        }
+        if (entries.length >= 100)
+            throw failure("This workspace has reached its team computer limit");
+        const entry = entrySchema.parse({ id, name, section: null, createdAt: Date.now() });
+        this.save([...entries, entry]);
+        return { ...entry };
+    }
+    assign(id, section) {
+        section = entrySchema.shape.section.parse(section);
+        const entry = this.get(id);
+        if (!entry)
+            throw failure("No such team computer", 404);
+        if (entry.section !== null && section !== null && section !== entry.section)
+            throw failure("Unassign this computer before moving it to another team");
+        if (section !== null && this.list().some(other => other.id !== id && other.section === section))
+            throw failure("This team already has a computer; unassign it first");
+        return this.patch(id, { section });
+    }
+    setProblem(id, problem) {
+        return this.patch(id, { problem: problem?.slice(0, 500) });
+    }
+    patch(id, patch) {
+        const entries = this.list();
+        const entry = entries.find(candidate => candidate.id === id);
+        if (!entry)
+            throw failure("No such team computer", 404);
+        const next = entrySchema.parse({ ...entry, ...patch });
+        this.save(entries.map(candidate => candidate.id === id ? next : candidate));
+        return { ...next };
+    }
+    save(entries) {
+        writeFileAtomic(this.file, JSON.stringify({ version: 1, environmentId: this.environmentId, computers: entries }), { mode: 0o600 });
+        this.entries = entries;
+    }
+}