openmausbot 0.1.76 → 0.1.77

package/dist-server/server/index.js

@@ -6,6 +6,8 @@ import { existsSync, readFileSync, rmSync, unlinkSync } from "node:fs";
 import { createServer } from "node:http";
 import { extname, join } from "node:path";
 import { z } from "zod";
+import { SharedComputers, sharedComputerOperation, sharedComputerRegistration } from "./shared-computers.js";
+import { SharedComputerControl } from "./shared-computer-control.js";
 import { RoomHandoffs } from "./room-handoffs.js";
 import { botAvatarUrlFromStoredPath } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
@@ -26,6 +28,7 @@ import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from "./room-turn-timeout.js";
 import * as box from "./box.js";
+import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
 import { boxCreateRecoverySnapshot, retireDeletedBoxCreate } from "./box-create-idempotency.js";
 import { boxAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
@@ -33,7 +36,7 @@ import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
 import { ComputerControl } from "./computer-control.js";
 import { MAX_REMOTE_COMMAND_LENGTH } from "./remote-computer.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -43,6 +46,7 @@ import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
 import { assertWithinBudget, noteSpend, spendState } from "./spend.js";
 import { fleetAvailable, fleetRequest, fleetSocketPath } from "./fleet-client.js";
 import { entitled } from "./enterprise.js";
+import { HOSTED_CONTRACT_HEADER, HOSTED_CONTRACT_METADATA, HOSTED_CONTRACT_VERSION } from "./hosted-contract.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
 import { blockedTarget, buildNotification } from "./notify.js";
 import { isEffortLevel, newId, } from "./contracts.js";
@@ -129,15 +133,15 @@ import { resolveSurface } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
-import { describeEdition, editionStatus, loadEnterpriseLayer } from "./enterprise.js";
+import { createWorkspaceAccess, describeEdition, editionStatus, hostedWorkspaceConfiguration, hostedWorkspaceConfigured, loadEnterpriseLayer } from "./enterprise.js";
 import { environmentDescriptor, loadEnvironmentId, serverVersion } from "./environment.js";
 import { WorkspaceBackupMaintenance } from "./workspace-backup-maintenance.js";
 import { createWorkspaceBackupRoutes, isWorkspaceBackupSessionControl } from "./workspace-backup-http.js";
 import { applyPendingWorkspaceRestore, readLastWorkspaceRestore } from "./workspace-backup.js";
 import { createCustomDomainVerifier, customDomainIpv4, normalizeCustomDomain } from "./custom-domain.js";
-import { createEmailSignIn, parseAllowList } from "./account-signin.js";
+import { allowedScopes, createEmailSignIn, parseAllowList } from "./account-signin.js";
 import { ProviderAuthSessions } from "./provider-auth-sessions.js";
-import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, labelFromUserAgent, requestOrigin, requestSource, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
+import { clearSessionCookie, clientBotPatchViolation, clientGroupPatchViolation, isLoopbackHost, isProxied, labelFromUserAgent, requestOrigin, requestSource, resolveRequestAuth, parseCookies, serializeSessionCookie, sessionCookieName, } from "./request-auth.js";
 import { cookieMaxAgeSeconds, formatPairingCode, SessionRegistry } from "./sessions.js";
 import { describeBrand, loadBrand } from "./brand.js";
 import { deliverSseFrame } from "./sse-fanout.js";
@@ -192,8 +196,22 @@ const workspaceMaintenance = new WorkspaceBackupMaintenance();
 // Remote clients (server/request-auth.ts, server/sessions.ts): a stable identity
 // for this server, the paired sessions, and the cookie the served UI uses.
 const ENVIRONMENT_ID = loadEnvironmentId(DATA_DIR);
-const sessions = new SessionRegistry({ file: join(DATA_DIR, "sessions.json") });
+function signInAllowList() {
+    const current = loadConfig().signIn;
+    return { admins: parseAllowList(current?.admins?.join(",")), members: parseAllowList(current?.members?.join(",")) };
+}
+const sessions = new SessionRegistry({
+    file: join(DATA_DIR, "sessions.json"),
+    emailScopesSnapshot: () => {
+        const membership = signInAllowList();
+        return (email) => allowedScopes(email, membership);
+    },
+    portalMembership: hostedWorkspaceConfiguration()?.portalMembership === true,
+});
+const sharedComputers = new SharedComputers(id => sessions.isLive(id));
 const SESSION_COOKIE = sessionCookieName(PORT, ENVIRONMENT_ID);
+const HOSTED_WORKSPACE = hostedWorkspaceConfigured();
+let workspaceAccess = null;
 const DESKTOP_MANAGED = process.env.OMB_DESKTOP_PARENT === "1";
 // Empty is deliberately a deny-all bootstrap state. Only Electron's private
 // utility-process port can replace it with the per-launch owner capability.
@@ -206,10 +224,7 @@ const customDomainVerifier = createCustomDomainVerifier({ environmentId: ENVIRON
 // "Sign in with your email" on /pair: the allow-list is read per call so a
 // Settings change or an env bootstrap applies without a restart.
 const emailSignIn = createEmailSignIn({
-    allow: () => {
-        const current = loadConfig().signIn;
-        return { admins: parseAllowList(current?.admins?.join(",")), members: parseAllowList(current?.members?.join(",")) };
-    },
+    allow: signInAllowList,
 });
 let customDomainRevision = 0;
 function savedCustomDomain() {
@@ -418,6 +433,12 @@ function authorizedInternalCapability(header) {
     return null;
 }
 function internalCapabilityIsActive(capability) {
+    if (capability.teamComputerId) {
+        const pinned = teamComputerTurns.get(capability.threadId);
+        if (pinned?.computerId !== capability.teamComputerId || pinned.owner.generation !== capability.generation ||
+            pinned.botId !== capability.botId)
+            return false;
+    }
     if (capability.localVmTarget) {
         const owner = localVmLeaseFor(capability.localVmTarget).current(localVmOwnerBusy);
         if (localVmThreadTargets.get(capability.threadId) !== capability.localVmTarget ||
@@ -454,7 +475,7 @@ const agentsProxyPath = SPAWNED_PROXIES.agents;
 const phoneProxyPath = SPAWNED_PROXIES.phone;
 // in the packaged app process.execPath is Electron — run the proxy as node
 const AGENTS_NODE_FLAG = { ELECTRON_RUN_AS_NODE: "1" };
-function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, roomHandoffId, roomCoordination = false) {
+function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, roomHandoffId, roomCoordination = false, ownThreadCreation = false) {
     const token = mintInternalCapability({
         botId,
         threadId,
@@ -466,6 +487,7 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
         openedThreads: 0,
         roomHandoffId,
         roomCoordination,
+        ownThreadCreation,
     });
     return {
         command: process.execPath,
@@ -478,7 +500,11 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
             OMB_COMMS_TOKEN: token,
             OMB_TURN_DEPTH: String(depth),
             OMB_ROOM_TURN: roomCoordination ? "1" : "0",
+            OMB_OWN_THREAD_CREATION: ownThreadCreation ? "1" : "0",
             OMB_SKILL_AUTHORING_ENABLED: skillAuthoring ? "1" : "0",
+            // The shared-computer tools are advertised only while the workspace
+            // gate is on; the routes behind them refuse regardless.
+            OMB_SHARED_COMPUTERS_ENABLED: sharedComputersEnabled(cfg) ? "1" : "0",
         },
     };
 }
@@ -516,8 +542,10 @@ function settleDirectFollowup(generation) {
 const directTurnBots = new Map();
 let providerFleetReloading = false;
 const turnResources = new TurnResources();
+const sharedComputerControl = new SharedComputerControl(turnResources, () => store.bots.some(bot => botComputerControlSnapshot(bot.id).held));
 const turnResourceOwners = new Map();
 const turnComputerResources = new Map();
+const teamComputerTurns = new Map();
 const settlingResourceOwners = new Map();
 function claimTurnResource(owner, resource) {
     if (!turnResources.claim(resource, owner))
@@ -535,6 +563,11 @@ function releaseTurnResources(owner) {
         turnResourceOwners.delete(owner.threadId);
     if (turnComputerResources.get(owner.threadId)?.owner.generation === owner.generation)
         turnComputerResources.delete(owner.threadId);
+    const teamTurn = teamComputerTurns.get(owner.threadId);
+    if (teamTurn?.owner.generation === owner.generation) {
+        stopScreenPoller(teamTurn.botId, owner.threadId);
+        teamComputerTurns.delete(owner.threadId);
+    }
 }
 function bindTurnComputer(owner, resource, exclusive = false) {
     if (exclusive && !claimTurnResource(owner, resource)) {
@@ -790,16 +823,21 @@ function connectedAppsIntegration(botId, threadId, generation) {
 // they hold it, the bot's computer proxies refuse every action. The record
 // lives here; the proxies consult it over loopback with the boot token.
 const computerControlRevision = new Map();
-const computerControl = new ComputerControl((botId, snapshot) => {
-    computerControlRevision.set(botId, (computerControlRevision.get(botId) ?? 0) + 1);
-    // One-way, fail-closed mirror into the Electron process that owns the
-    // native browser. Never send release: a loopback caller can influence the
-    // server record, while only the trusted Browser panel may clear Electron's
-    // local gate after its server-first release succeeds.
-    if (snapshot.held && /^[A-Za-z0-9_-]{1,120}$/.test(botId)) {
-        postDesktopPrivateMessage({ type: "openmausbot:browser-control", botId, held: true });
-    }
-    broadcast({ kind: "computer-control", botId, held: snapshot.held, helpReason: snapshot.helpReason });
+const computerControl = new ComputerControl((key, snapshot) => {
+    const members = key.startsWith("computer_")
+        ? store.bots.filter(bot => inheritedTeamComputer(bot)?.id === key.slice("computer_".length)).map(bot => bot.id)
+        : [key];
+    for (const botId of members) {
+        computerControlRevision.set(botId, (computerControlRevision.get(botId) ?? 0) + 1);
+        // One-way, fail-closed mirror into the Electron process that owns the
+        // native browser. Never send release: a loopback caller can influence the
+        // server record, while only the trusted Browser panel may clear Electron's
+        // local gate after its server-first release succeeds.
+        if (snapshot.held && /^[A-Za-z0-9_-]{1,120}$/.test(botId)) {
+            postDesktopPrivateMessage({ type: "openmausbot:browser-control", botId, held: true });
+        }
+        broadcast({ kind: "computer-control", botId, held: snapshot.held, helpReason: snapshot.helpReason });
+    }
 });
 const controlLeaseIdSchema = z.string().min(16).max(120).regex(/^[A-Za-z0-9_-]+$/);
 const routineRequestSourceSchema = {
@@ -827,6 +865,7 @@ function controlIntegration(botId, threadId, generation, localVmTarget) {
             depth: 0,
             kind: "computer",
             ...(localVmTarget ? { localVmTarget } : {}),
+            ...(teamComputerTurns.get(threadId) ? { teamComputerId: teamComputerTurns.get(threadId).computerId } : {}),
             skillAuthoring: false,
             createdBots: 0,
             openedThreads: 0,
@@ -1064,6 +1103,7 @@ function checkedMemberIds(value) {
 }
 let bootSelection = { instanceId: "", model: "" };
 const store = new Store(() => bootSelection);
+const teamComputers = new TeamComputers(join(DATA_DIR, "team-computers.json"), ENVIRONMENT_ID);
 let followupsReady = false;
 const sendSequencer = new SendSequencer();
 bootSelection = await defaultSelection();
@@ -1105,7 +1145,7 @@ const wireBot = (bot) => {
     // An elevated selection is inert until the desktop confirms its exact
     // private reply. Every ordinary client sees the effective Ask state during
     // that two-phase window, never a grant that may still roll back.
-    const visible = approvalGrant
+    const visible = approvalGrant && !approvalGrant.threadOnly
         ? { ...rest, approvalMode: "ask", autoApprove: false }
         : rest;
     return { ...visible, ...(activeCoordinationForThread(bot.threadId) && !visible.busy ? { busy: true, activity: "working" } : {}),
@@ -1115,7 +1155,7 @@ const wireBot = (bot) => {
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
     const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, ...rest } = bot;
-    return { ...rest, avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
+    return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
  * provisioning or credentials are needed to inspect it. The selected engine
@@ -1132,11 +1172,13 @@ function previewSystemPrompt(bot) {
         .join(" ");
     const instance = registry.get(bot.modelSelection.instanceId);
     const caps = instance?.adapter.capabilities;
-    const computerPromptKind = bot.computer === "vm"
+    const teamComputer = inheritedTeamComputer(bot);
+    const previewComputer = teamComputer ? "cloud" : bot.computer;
+    const computerPromptKind = previewComputer === "vm"
         ? caps?.computerMcp ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null
-        : bot.computer === "cloud"
+        : previewComputer === "cloud"
             ? instance?.driverKind === "boxAgent" ? "box-agent" : caps?.computerMcp ? bot.cloudBackend === "vps" ? "vps" : "box" : null
-            : bot.computer === "local"
+            : previewComputer === "local"
                 ? caps?.localComputerMcp ? "local" : null
                 : null;
     const peers = reachablePeers(store.bots, bot);
@@ -1154,7 +1196,7 @@ function previewSystemPrompt(bot) {
     // Spelling the browser rule out a second time here is what let Off keep a
     // browser in one place while the preview said it had none.
     const previewPlan = resolveSurface({
-        destination: bot.computer,
+        destination: previewComputer,
         browserOn: caps?.browserMcp === true && builtInBrowserEnabled(cfg) && bot.browser !== false,
     });
     const privateWorkspace = instance && !["grok", "boxAgent"].includes(instance.driverKind);
@@ -1168,6 +1210,7 @@ function previewSystemPrompt(bot) {
             }),
         },
         { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
+        { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
         { id: "plan", label: "Surface", text: previewPlan.note },
         { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? COMPOSIO_PROMPT : "" },
         { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(customMcpServers(cfg, bot.mcpServers))) : "" },
@@ -1275,13 +1318,22 @@ function handleDesktopTrustedApprovalMessage(raw) {
     if (!raw || typeof raw !== "object" || Array.isArray(raw))
         return false;
     const message = raw;
+    const grantTarget = (bot) => bot.approvalGrant?.threadOnly
+        ? store.projectBotForTask(bot.id, bot.approvalGrant.threadId) : bot;
+    const grantBusy = (bot) => bot.approvalGrant?.threadOnly
+        ? threadBusy(bot.id, bot.approvalGrant.threadId) : bot.busy;
+    const grantSupported = (bot, mode) => supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode);
+    const clearGrant = (bot) => store.patchBot(bot.id, {
+        ...(!bot.approvalGrant?.threadOnly ? { approvalMode: "ask", autoApprove: false } : {}),
+        approvalGrant: undefined,
+    });
     const threadCanReceiveGrant = (bot) => {
         const threadId = bot.approvalGrant?.threadId;
         if (!threadId)
             return true;
         const target = store.projectBotForTask(bot.id, threadId);
-        return Boolean(target && !threadBusy(bot.id, threadId) &&
-            registry.cliTarget(target.modelSelection.instanceId)?.driverKind === registry.cliTarget(bot.modelSelection.instanceId)?.driverKind);
+        return Boolean(target && !threadBusy(bot.id, threadId) && (bot.approvalGrant?.threadOnly ||
+            registry.cliTarget(target.modelSelection.instanceId)?.driverKind === registry.cliTarget(bot.modelSelection.instanceId)?.driverKind));
     };
     if (message.type === "approval-trusted-mode-commit") {
         const requestId = typeof message.requestId === "string" && /^[A-Za-z0-9_-]{1,80}$/.test(message.requestId)
@@ -1299,17 +1351,22 @@ function handleDesktopTrustedApprovalMessage(raw) {
         if (bot?.approvalGrant?.requestId === requestId &&
             bot.approvalGrant.mode === mode &&
             bot.approvalGrant.phase === "committed" &&
-            bot.approvalMode === mode &&
-            !bot.busy &&
+            (bot.approvalGrant.threadOnly || bot.approvalMode === mode) &&
+            !grantBusy(bot) &&
             threadCanReceiveGrant(bot) &&
-            supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
+            grantSupported(bot, mode)) {
             if (bot.approvalGrant.threadId) {
                 store.patchTask(botId, bot.approvalGrant.threadId, { approvalMode: mode, autoApprove: false });
             }
             store.patchBot(botId, { approvalGrant: undefined });
+            postDesktopPrivateMessage({ type: "approval-trusted-mode-commit-result", requestId, ok: true, bot: wireBot(store.bot(botId)) });
         }
         else if (bot?.approvalGrant?.requestId === requestId) {
-            store.patchBot(botId, { approvalMode: "ask", autoApprove: false, approvalGrant: undefined });
+            clearGrant(bot);
+            postDesktopPrivateMessage({ type: "approval-trusted-mode-commit-result", requestId, ok: false });
+        }
+        else {
+            postDesktopPrivateMessage({ type: "approval-trusted-mode-commit-result", requestId, ok: false });
         }
         return true;
     }
@@ -1339,9 +1396,9 @@ function handleDesktopTrustedApprovalMessage(raw) {
         if (bot?.approvalGrant?.requestId === requestId &&
             bot.approvalGrant.mode === mode &&
             bot.approvalGrant.phase === "prepared" &&
-            bot.approvalMode === mode) {
-            if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
-                store.patchBot(botId, { approvalMode: "ask", autoApprove: false, approvalGrant: undefined });
+            (bot.approvalGrant.threadOnly || bot.approvalMode === mode)) {
+            if (!grantSupported(bot, mode)) {
+                clearGrant(bot);
                 confirm(false, "This provider does not support the selected approval level");
                 return true;
             }
@@ -1354,7 +1411,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
         // A matching journal whose other fields no longer agree is ambiguous.
         // Revoke only that request; never clear a newer grant for the same bot.
         if (bot?.approvalGrant?.requestId === requestId) {
-            store.patchBot(botId, { approvalMode: "ask", autoApprove: false, approvalGrant: undefined });
+            clearGrant(bot);
         }
         confirm(false, "The approval confirmation no longer matches this bot");
         return true;
@@ -1385,10 +1442,10 @@ function handleDesktopTrustedApprovalMessage(raw) {
         if (bot?.approvalGrant?.requestId === requestId &&
             bot.approvalGrant.mode === mode &&
             bot.approvalGrant.phase === "confirmed" &&
-            bot.approvalMode === mode) {
-            if (bot.busy || !supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
-                store.patchBot(botId, { approvalMode: "ask", autoApprove: false, approvalGrant: undefined });
-                activate(false, bot.busy
+            (bot.approvalGrant.threadOnly || bot.approvalMode === mode)) {
+            if (grantBusy(bot) || !grantSupported(bot, mode)) {
+                clearGrant(bot);
+                activate(false, grantBusy(bot)
                     ? "Stop this bot's turn before changing its approval level"
                     : "This provider does not support the selected approval level");
                 return true;
@@ -1400,7 +1457,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
             return true;
         }
         if (bot?.approvalGrant?.requestId === requestId) {
-            store.patchBot(botId, { approvalMode: "ask", autoApprove: false, approvalGrant: undefined });
+            clearGrant(bot);
         }
         activate(false, "The approval activation no longer matches this bot");
         return true;
@@ -1431,10 +1488,10 @@ function handleDesktopTrustedApprovalMessage(raw) {
         if (bot?.approvalGrant?.requestId === requestId &&
             bot.approvalGrant.mode === mode &&
             bot.approvalGrant.phase === "activated" &&
-            bot.approvalMode === mode &&
-            !bot.busy &&
+            (bot.approvalGrant.threadOnly || bot.approvalMode === mode) &&
+            !grantBusy(bot) &&
             threadCanReceiveGrant(bot) &&
-            supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
+            grantSupported(bot, mode)) {
             // Durable but still inert. Electron must observe this exact ACK before
             // sending the one-way commit release that clears the journal.
             store.patchBot(botId, { approvalGrant: { ...bot.approvalGrant, requestId, mode, phase: "committed" } });
@@ -1442,7 +1499,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
             return true;
         }
         if (bot?.approvalGrant?.requestId === requestId) {
-            store.patchBot(botId, { approvalMode: "ask", autoApprove: false, approvalGrant: undefined });
+            clearGrant(bot);
         }
         finalize(false, bot?.busy
             ? "Stop this bot's turn before changing its approval level"
@@ -1482,6 +1539,41 @@ function handleDesktopTrustedApprovalMessage(raw) {
     }
     const currentMode = approvalModeFor(existing);
     const threadId = message.threadId;
+    if (message.threadOnly !== undefined && typeof message.threadOnly !== "boolean") {
+        respond({ ok: false, error: "Invalid thread approval scope" });
+        return true;
+    }
+    if (message.threadOnly === true) {
+        const target = typeof threadId === "string" ? store.projectBotForTask(botId, threadId) : null;
+        if (!target || message.modelSelection !== undefined || message.updateBotDefault !== undefined) {
+            respond({ ok: false, error: "Choose an existing thread for this approval change" });
+            return true;
+        }
+        // An ambiguous scoped grant may be cleared, but never a different grant.
+        const clearsOwnGrant = mode === "ask" && existing.approvalGrant?.threadOnly && existing.approvalGrant.threadId === threadId;
+        if ((existing.approvalGrant && !clearsOwnGrant) || threadBusy(botId, target.threadId)) {
+            respond({ ok: false, error: "Stop this thread and finish its pending approval change first" });
+            return true;
+        }
+        if (!supportsApprovalMode(registry.cliTarget(target.modelSelection.instanceId)?.driverKind, mode)) {
+            respond({ ok: false, error: "This thread's provider does not support that approval level" });
+            return true;
+        }
+        if (mode === "auto" && target.computer === "local" && approvalModeFor(target) !== "auto" && message.acknowledgeLocalAuto !== true) {
+            respond({ ok: false, error: "Auto mode on this computer requires confirming the warning" });
+            return true;
+        }
+        if (mode === "full" || mode === "custom") {
+            store.patchBot(botId, { approvalGrant: { requestId, mode, phase: "prepared", threadId: target.threadId, threadOnly: true } });
+        }
+        else {
+            if (clearsOwnGrant)
+                clearGrant(existing);
+            store.patchTask(botId, target.threadId, { approvalMode: mode, autoApprove: mode === "auto", alwaysAllow: [] });
+        }
+        respond({ ok: true, bot: wireTrustedApprovalBot(store.bot(botId)) });
+        return true;
+    }
     if (message.modelSelection !== undefined) {
         const target = typeof threadId === "string" ? store.projectBotForTask(botId, threadId) : null;
         if (mode !== "ask" || !target || typeof message.updateBotDefault !== "boolean") {
@@ -2385,8 +2477,8 @@ function messageWindow(threadId, messageId, limit) {
     return { messages: all.slice(start, stop).map(slimMessage), hasMore: start > 0 };
 }
 const sseClients = new Set();
-sessions.onSessionRevoked((sessionId) => {
-    providerAuthSessions.revokeOwner(sessionId);
+function closeSessionStreams(sessionId) {
+    browserLive.closeForOwner(sessionId);
     for (const client of sseClients) {
         if (client.sessionId !== sessionId)
             continue;
@@ -2398,6 +2490,10 @@ sessions.onSessionRevoked((sessionId) => {
             /* already gone */
         }
     }
+}
+sessions.onSessionRevoked((sessionId) => {
+    providerAuthSessions.revokeOwner(sessionId);
+    closeSessionStreams(sessionId);
 });
 /** Every frame is numbered, and the last few hundred are kept, so a client
  * whose connection dropped can ask for what it missed instead of
@@ -2432,6 +2528,9 @@ function cursorSeq(raw) {
     return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null;
 }
 function broadcast(payload) {
+    // Membership may also change through fleet/CLI config writes. Close stale
+    // email streams before any further workspace data is delivered.
+    sessions.revalidateEmailSessions();
     const seq = ++lastSeq;
     const kind = String(payload.kind ?? "");
     const frame = `id: ${STREAM_ID}:${seq}\ndata: ${JSON.stringify({ ...payload, seq })}\n\n`;
@@ -2836,20 +2935,116 @@ const LOCAL_VM_IDLE_MS = 8 * 60 * 60_000;
  * status it has rather than hanging on a container that will not come up. */
 const LOCAL_VM_DESKTOP_WAIT_MS = 90_000;
 const localVmIdles = new Map();
+function inheritedTeamComputer(bot) {
+    return teamComputers.forBot(bot);
+}
+function teamComputerPrompt(computer) {
+    return computer ? `Your team shares the Box computer ${JSON.stringify(computer.name)}. Its desktop files and desktop browser logins are shared with other Auto bots in your team; only one turn may drive it at a time. The separate built-in Browser is not this desktop and does not automatically share its logins.` : "";
+}
+function botComputerControlKey(bot) {
+    const computer = inheritedTeamComputer(bot);
+    return computer ? teamComputerOwner(computer.id) : bot.id;
+}
+function botComputerControlSnapshot(botId, pinnedComputerId) {
+    const own = computerControl.snapshot(botId);
+    const bot = store.bot(botId);
+    const key = pinnedComputerId ? teamComputerOwner(pinnedComputerId) : bot ? botComputerControlKey(bot) : botId;
+    const shared = computerControl.snapshot(key);
+    return own.held ? own : shared.held || shared.helpReason ? shared : own;
+}
+function teamComputerInUse(computer) {
+    computer = teamComputers.get(computer.id) ?? computer;
+    return computerControl.snapshot(teamComputerOwner(computer.id)).held ||
+        [...teamComputerTurns.values()].some(turn => turn.computerId === computer.id) ||
+        store.bots.some(bot => computer.section !== null && sectionKey(bot.section) === computer.section && (botHasActiveTurn(bot.id) || Boolean(routines?.activeRunForBot(bot.id)) || computerControl.snapshot(bot.id).held));
+}
+function assertTeamControlCanBeTaken(computerId) {
+    if ([...teamComputerTurns.values()].some(turn => turn.computerId === computerId && turn.remoteAgent)) {
+        throw Object.assign(new Error("Stop the Computer engine's active turn before taking control of this shared desktop"), { status: 409 });
+    }
+}
+function claimTeamComputerLifecycle(computer) {
+    if (computerProviderConfigTransitions.has("box"))
+        throw Object.assign(new Error(providerTransitionMessage("box")), { status: 409 });
+    if (teamComputerInUse(computer))
+        throw Object.assign(new Error("This team computer is in use; stop the team's work and release computer control first"), { status: 409 });
+    return claimBotComputerLifecycle(teamComputerOwner(computer.id));
+}
+function assertTeamComputerChangeIdle(before, after) {
+    const previous = inheritedTeamComputer(before);
+    const next = inheritedTeamComputer(after);
+    if (previous?.id === next?.id)
+        return;
+    if (botHasActiveTurn(before.id) || routines?.activeRunForBot(before.id) || botComputerControlSnapshot(before.id).held ||
+        [previous, next].some(computer => computer && (teamComputerInUse(computer) || boxLifecycleBusyBots.has(teamComputerOwner(computer.id))))) {
+        throw Object.assign(new Error("Stop the affected team's work and release computer control before changing its computer access"), { status: 409 });
+    }
+}
+async function teamComputersPayload() {
+    const entries = teamComputers.list();
+    const inventory = await box.listManagedBoxes(cfg, managedBoxOwners());
+    return {
+        configured: inventory.configured,
+        ...(inventory.problem ? { problem: inventory.problem } : {}),
+        computers: entries.map(entry => {
+            const machine = inventory.instances.find(instance => instance.ownerBotId === teamComputerOwner(entry.id));
+            return {
+                id: entry.id, name: entry.name, section: entry.section,
+                held: computerControl.snapshot(teamComputerOwner(entry.id)).held,
+                state: boxLifecycleBusyBots.has(teamComputerOwner(entry.id)) ? "working" : machine?.state ?? (inventory.available ? "missing" : "unavailable"),
+                ...(entry.problem || inventory.problem ? { problem: entry.problem || inventory.problem } : {}),
+            };
+        }),
+    };
+}
+/** The same named Box identity and whole-turn lease in chats and rooms.
+ * Assignment authorizes waking, never replacing a missing paid machine. */
+async function attachTeamBox(computer, botId, owner, canMount, remoteAgent) {
+    if (!canMount)
+        throw new Error("This model engine cannot use the team's Box computer; choose an engine with computer tools or an explicit bot destination");
+    if (!box.boxConfigured(cfg))
+        throw new Error("The team's Box account is not configured; reconnect it in Settings");
+    const ownerId = teamComputerOwner(computer.id);
+    if (boxLifecycleBusyBots.has(ownerId))
+        throw new Error("The team computer is being changed; wait for it to finish");
+    if (computerControl.snapshot(ownerId).held)
+        throw new Error("Release human control of the team computer before starting another turn");
+    bindTurnComputer(owner, `computer:box-bot:${ownerId}`, true);
+    teamComputerTurns.set(owner.threadId, { owner, computerId: computer.id, botId, remoteAgent });
+    let machine = await box.findBox(cfg, ownerId);
+    if (!machine)
+        throw new Error("The team's Box computer is missing; explicitly create or retry it from the Team map");
+    bindTurnComputer(owner, `computer:box:${machine.id}`, true);
+    const action = box.boxTurnLifecycleAction({ explicitCloud: true, canMount: true, state: typeof machine.state === "string" ? machine.state : null });
+    if (action === "wake")
+        machine = await box.readyBox(cfg, ownerId);
+    if (!machine || box.boxTurnLifecycleAction({ explicitCloud: true, canMount: true, state: typeof machine.state === "string" ? machine.state : null }) !== "attach") {
+        throw new Error("The team computer is not ready; check it in the Team map");
+    }
+    if (turnResourceOwners.get(owner.threadId)?.generation !== owner.generation ||
+        !turnResources.owns(`computer:box:${machine.id}`, owner))
+        throw new Error("This computer turn ended while its machine was starting");
+    return {
+        integration: { kind: "box", boxId: machine.id, token: cfg.box.token, control: controlIntegration(botId, owner.threadId, owner.generation) },
+        capture: () => box.screenshotBox(cfg, ownerId, machine.id),
+    };
+}
 function managedBoxOwners() {
-    return store.bots.map((bot) => ({
-        botId: bot.id,
-        name: bot.name,
-        // A machine is not safe to mutate while any app-level work or human
-        // control lease still names its owner. This is deliberately conservative
-        // across destination changes: an old Box may still contain valuable state.
-        inUse: bot.busy === true ||
-            hasDirectDispatch(bot.id) ||
-            activeGroupTurnForBot(bot.id) !== null ||
-            Boolean(routines?.activeRunForBot(bot.id)) ||
-            activeVpsThreads.has(bot.id) ||
-            computerControl.snapshot(bot.id).held,
-    }));
+    return [...store.bots.map((bot) => ({
+            botId: bot.id,
+            name: bot.name,
+            // A machine is not safe to mutate while any app-level work or human
+            // control lease still names its owner. This is deliberately conservative
+            // across destination changes: an old Box may still contain valuable state.
+            inUse: bot.busy === true ||
+                hasDirectDispatch(bot.id) ||
+                activeGroupTurnForBot(bot.id) !== null ||
+                Boolean(routines?.activeRunForBot(bot.id)) ||
+                activeVpsThreads.has(bot.id) ||
+                computerControl.snapshot(bot.id).held,
+        })), ...teamComputers.list().map(computer => ({
+            botId: teamComputerOwner(computer.id), name: computer.name, inUse: teamComputerInUse(computer),
+        }))];
 }
 function botHasActiveTurn(botId) {
     const bot = store.bot(botId);
@@ -2891,6 +3086,8 @@ function providerOperationConflict(provider) {
 function turnProvider(bot, runOn) {
     if (runOn === "cloud" || registry.get(bot.modelSelection.instanceId)?.driverKind === "boxAgent")
         return "box";
+    if (inheritedTeamComputer(bot))
+        return "box";
     if (bot.computer !== undefined && bot.computer !== "cloud")
         return null;
     return bot.cloudBackend === "vps" ? "vps" : "box";
@@ -2913,6 +3110,9 @@ function claimBoxInventoryRequest(boxId) {
  * a new turn and an irreversible lifecycle action cannot pass each other. */
 function claimManagedBoxMutation(instance) {
     const ownerBotId = instance.ownerBotId;
+    const teamComputer = teamComputers.list().find(computer => teamComputerOwner(computer.id) === ownerBotId);
+    if (teamComputer)
+        return claimTeamComputerLifecycle(teamComputer);
     if (!ownerBotId) {
         if (orphanBoxLifecycleBusyIds.has(instance.boxId)) {
             throw Object.assign(new Error("this cloud computer is being changed — wait for it to finish"), { status: 409 });
@@ -3157,7 +3357,7 @@ bus.subscribe((event) => {
                     const existing = store.messagesFor(event.threadId).find((m) => m.id === messageId)?.tool;
                     toolName = existing?.name ?? "tool";
                     store.patchMessage(event.threadId, messageId, {
-                        tool: { name: toolName, ok: event.ok, spoken: existing?.spoken, summary: existing?.summary },
+                        tool: { ...existing, name: toolName, ok: event.ok, output: event.output },
                     });
                     toolMessageByItem.delete(itemKey);
                 }
@@ -3189,7 +3389,7 @@ bus.subscribe((event) => {
                 const message = pushMessage({
                     role: "bot",
                     kind: "activity",
-                    tool: { name, spoken: narrateTool(name) ?? undefined, summary: event.summary },
+                    tool: { name, spoken: narrateTool(name) ?? undefined, summary: event.summary, input: event.input },
                 });
                 if (event.itemId)
                     toolMessageByItem.set(`${event.threadId}:${event.itemId}`, message.id);
@@ -4054,9 +4254,9 @@ function drainQueuedSends() {
         return;
     drainSteeredMessages(store, (botId, threadId, prompt, userMessage, excludeIds, unattended) => 
     // A plain attended turn — no automationSource, no comms depth: exactly
-    // what typing the same words into an idle bot would run. The one
-    // exception is `unattended`: a thread a bot opened on itself while
-    // nobody was watching stays unwatched through the wait for a slot.
+    // what typing the same words into an idle bot would run. Self-opened
+    // work retains `unattended` and the message's bot-origin provenance
+    // through the wait for a slot.
     // Drain just appended the held lines; userMessage keeps startTurn
     // from duplicating the last one, and excludeIds drops every drained
     // line from the transcript-replay so they are not also in `prompt`.
@@ -4101,18 +4301,19 @@ const MAX_THREADS_OPENED_PER_TURN = 5;
 /** A thread a bot opened on itself gets its first turn exactly the way a
  * person's message would: it runs now if the bot has a free slot, and
  * otherwise waits in the same composer queue, in line behind whatever the
- * bot already has waiting. The only inheritance is `unattended` — a bot
- * nobody is watching does not become watched by opening a thread. */
+ * bot already has waiting. Its provenance survives the queue: this is the
+ * bot's own request, not a new human request authorizing recursive fan-out. */
 async function startOrQueueOpenedThread(botId, threadId, text, unattended) {
+    const peerAsk = { botId, name: store.bot(botId).name, unattended: unattended || undefined };
     // A room turn holds the bot too (startTurn refuses a direct turn during
     // one); the drain's own block check already waits for it, so the words
     // queue here rather than bounce.
     if (botAtThreadCapacity(botId) || activeGroupTurnForBot(botId)) {
-        queueSteeredMessage(botId, threadId, text, { reason: "capacity", unattended });
+        queueSteeredMessage(botId, threadId, text, { reason: "capacity", unattended, peerAsk });
         return { state: "queued", position: queuedThreadPosition(botId, threadId) ?? 1 };
     }
     try {
-        await startTurn(botId, text, { threadId, unattended });
+        await startTurn(botId, text, { threadId, unattended, peerAsk });
         return { state: "running" };
     }
     catch (error) {
@@ -4163,7 +4364,7 @@ function startScreenPoller(botId, threadId, captures, { screenIsTheWork = false
             browser: guarded(captures.browser, browserSession ? `browser:${browserSession}` : undefined),
         },
         control: () => ({
-            held: computerControl.snapshot(botId).held,
+            held: botComputerControlSnapshot(botId, teamComputerTurns.get(threadId)?.computerId).held,
             revision: computerControlRevision.get(botId) ?? 0,
         }),
         onFrame: (frame) => broadcast({ kind: "screen", botId, threadId, ...frame }),
@@ -4388,7 +4589,7 @@ async function startTurn(botId, text, opts) {
     // A card continuation neither starts nor ends the person's ask: it
     // resumes the turn their last message began, so that record stands.
     if (!opts?.cardContinuation) {
-        if (commsDepth === 0 && opts?.automationSource === undefined && !opts?.unattended) {
+        if (commsDepth === 0 && opts?.automationSource === undefined && !opts?.unattended && !userMessage.peerAsk) {
             personAskAt.set(threadId, userMessage.at);
             // Continuing an old run as a normal conversation makes that task
             // visible again; these new replies are not routine report updates.
@@ -4577,7 +4778,8 @@ async function startTurn(botId, text, opts) {
                 integrations.dweb = { url: dwebUrl };
             // Cloud routines always use Box/BoxAgent. The per-bot backend applies
             // only to ordinary turns that mount a computer into the local agent.
-            const cloudBackend = opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
+            const teamComputer = inheritedTeamComputer(bot);
+            const cloudBackend = teamComputer || opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
             const mountsComputerMcp = instance.adapter.capabilities.computerMcp === true;
             const mountsCloudComputer = mountsComputerMcp || instance.driverKind === "boxAgent";
             const mountsLocalComputer = instance.adapter.capabilities.localComputerMcp === true;
@@ -4590,7 +4792,7 @@ async function startTurn(botId, text, opts) {
                 bot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true;
             const plan = resolveSurface({
-                destination: opts?.runOn === "cloud" ? "cloud" : bot.computer, // cloud routine overrides the MAUS default
+                destination: teamComputer || opts?.runOn === "cloud" ? "cloud" : bot.computer, // cloud routine overrides the MAUS default
                 browserOn,
             });
             if (bot.computer === "browser" && plan.computer === "off" && instance.driverKind === "boxAgent") {
@@ -4699,7 +4901,13 @@ async function startTurn(botId, text, opts) {
             }
             // Cloud is also strict when explicitly selected. Auto (unset) reuses an
             // existing cloud box, then falls back to host CUA without provisioning.
-            if ((wants === "cloud" || wants === undefined) && cloudBackend === "box" && box.boxConfigured(cfg)) {
+            if (teamComputer) {
+                const attached = await attachTeamBox(teamComputer, bot.id, resourceOwner, mountsCloudComputer, instance.driverKind === "boxAgent");
+                integrations.computer = attached.integration;
+                previewCapture = attached.capture;
+                computerKind = "box";
+            }
+            if (!teamComputer && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && box.boxConfigured(cfg)) {
                 // Explicit cloud turns can provision/wake the same bot's Box. Claim
                 // before any network await so setup itself cannot race another turn.
                 if (wants === "cloud")
@@ -4795,7 +5003,14 @@ async function startTurn(botId, text, opts) {
             // that ask_bot and delegate_bot would then refuse.
             const sectionPeers = reachablePeers(store.bots, bot);
             if (agentsMounted) {
-                integrations.agents = agentsIntegration(bot.id, threadId, commsDepth, skillAuthoring, dispatchClaimId, opts?.coordination?.id, boundedCoordination);
+                // Only a direct human request can create separate self-owned jobs.
+                // Coordinated children and self-opened jobs stay inside their scope;
+                // a later real user message on the same task is a fresh request.
+                const origin = opts?.cardContinuation
+                    ? store.activePath(threadId).findLast(message => message.role === "user" && message.kind === "text")
+                    : userMessage;
+                const ownThreadCreation = boundedCoordination && !opts?.coordination && Boolean(origin && !origin.peerAsk);
+                integrations.agents = agentsIntegration(bot.id, threadId, commsDepth, skillAuthoring, dispatchClaimId, opts?.coordination?.id, boundedCoordination, ownThreadCreation);
             }
             // @mentions in the user's message (the composer's tagging UI) become
             // an explicit coordination nudge. The agent still chooses the matching
@@ -4891,6 +5106,7 @@ async function startTurn(botId, text, opts) {
                 { id: "setup", label: "Setup", text: setupSystemPrompt(setupMode, { skills: skillAuthoring, cwd: liveBot?.cwd ?? bot.cwd }) },
                 { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
+                { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
                 { id: "plan", label: "Surface", text: plan.note },
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
@@ -5733,6 +5949,15 @@ async function resolveAndSendTeamSetup(res, args, ownerReview) {
         json(res, 403, { error: "Approve team setup or deletion from the desktop app or a paired owner device. In a local browser, wait until every bot is idle." });
         return true;
     }
+    if (args.behavior === "allow" && !card.answered && !card.dismissed) {
+        // Confirmed Chief setup can move bots without the ordinary PATCH route.
+        // Keep that atomic Store operation behind the same shared-machine fence.
+        for (const operation of card.teamSetupRequest.operations) {
+            const before = store.bot(operation.botId);
+            if (before && operation.action === "update")
+                assertTeamComputerChangeIdle(before, { ...before, ...operation.fields });
+        }
+    }
     const resumeGeneration = teamSetupResumeGenerations.get(args.threadId) ?? 0;
     const resolved = await teamSetupRequests.resolve(args);
     if (!resolved)
@@ -6242,8 +6467,9 @@ setupRetry = 0) {
         // "Works on" decides here exactly as it decides a 1:1 turn: the same
         // shared policy, so a room cannot become the loophole that hands a bot
         // set to Off the browser its own settings withhold everywhere else.
+        const roomTeamComputer = inheritedTeamComputer(readyBot);
         const roomPlan = resolveSurface({
-            destination: readyBot.computer,
+            destination: roomTeamComputer ? "cloud" : readyBot.computer,
             browserOn: builtInBrowserEnabled(cfg) &&
                 readyBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true,
@@ -6263,6 +6489,14 @@ setupRetry = 0) {
             activeInternalGenerationByThread.get(threadId) !== internalGeneration) {
             return false;
         }
+        if (roomTeamComputer) {
+            const attached = await attachTeamBox(roomTeamComputer, readyBot.id, resourceOwner, instance.adapter.capabilities.computerMcp === true || instance.driverKind === "boxAgent", instance.driverKind === "boxAgent");
+            if (isCancelled?.() || groupSpeakers.get(threadId) !== roomSpeaker ||
+                activeInternalGenerationByThread.get(threadId) !== internalGeneration)
+                return false;
+            integrations.computer = attached.integration;
+            startScreenPoller(readyBot.id, threadId, { computer: attached.capture }, { screenIsTheWork: instance.driverKind === "boxAgent" });
+        }
         // Room and Goal turns use the speaker's desktop, never the coordinator's.
         // Claim the same lease as direct turns before asynchronous VM setup.
         if (readyBot.computer === "vm") {
@@ -6356,7 +6590,8 @@ setupRetry = 0) {
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
             { id: "files", label: "File locations", text: workspace ? workspaceLocationsPrompt(bot.id, cwd, readyBot.cwd) : "" },
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
-            { id: "computer", label: "Computer", text: computerPrompt(roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
+            { id: "computer", label: "Computer", text: computerPrompt(roomTeamComputer ? instance.driverKind === "boxAgent" ? "box-agent" : "box" : roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
+            { id: "team-computer", label: "Team computer", text: teamComputerPrompt(roomTeamComputer) },
             { id: "plan", label: "Surface", text: roomPlan.note },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
@@ -8061,6 +8296,10 @@ function configStatus() {
             skillAuthoring: skillAuthoringEnabled(cfg),
             showToolCalls: showToolCallsEnabled(cfg),
             browser: builtInBrowserEnabled(cfg),
+            // Maintainer-only escape hatch, not a Settings toggle: the desktop
+            // shell and the Settings UI read it so they offer nothing this server
+            // would refuse.
+            sharedComputers: sharedComputersEnabled(cfg),
         },
         // first-run progress — not a secret; the app decides whether to show
         // the welcome tour from this, never from browser storage
@@ -8338,13 +8577,21 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
         return Boolean(current?.scopes.includes("admin") && current.kind === original.kind &&
             (current.kind !== "session" || (original.kind === "session" && current.session.id === original.session.id)));
     },
-    exclusive: (work, keepLocked) => workspaceMaintenance.run(work, {
+    exclusive: (work, keepLocked) => workspaceMaintenance.run(async () => {
+        // Recheck inside the exclusive gate: the restore body can arrive slowly
+        // while another client assigns a computer after the initial route check.
+        if (keepLocked && teamComputers.list().some(computer => computer.section !== null)) {
+            throw Object.assign(new Error("Unassign team computers before restoring this workspace"), { status: 409 });
+        }
+        return work();
+    }, {
         idle: () => !providerFleetReloading && !providerAuthSessions.active && !browserEngineInstall &&
             !routines?.isTicking && !calendarCalls?.isTicking &&
             !localVmImageBusy && !localVmProvisionBusy && !localVmModeChangeBusy &&
             !localVmLifecycleBusy.size && !boxLifecycleBusyBots.size && !vpsPreviewRequests.size && !orphanBoxLifecycleBusyIds.size &&
             !computerProviderConfigTransitions.size && !checkpointRestoreLeases.size &&
-            store.bots.every((bot) => !botHasActiveTurn(bot.id) && !routines?.activeRunForBot(bot.id) && !computerControl.snapshot(bot.id).held) &&
+            teamComputers.list().every(computer => !teamComputerInUse(computer)) &&
+            store.bots.every((bot) => !botHasActiveTurn(bot.id) && !routines?.activeRunForBot(bot.id) && !botComputerControlSnapshot(bot.id).held) &&
             store.groups.every((group) => !groupIsWorking(group)),
         pause: () => { routines?.stop(); calendarCalls?.stop(); watchdog.stop(); },
         resume: () => { routines?.start(); calendarCalls?.start(); watchdog.start(); },
@@ -8370,6 +8617,31 @@ const handleRequest = async (req, res) => {
     let m = null;
     let releaseWorkspaceRequest;
     try {
+        // Unlike the legacy reachability probe, this attests the running
+        // server's portal-membership capability, including live entitlement.
+        if (method === "GET" && path === "/api/health/hosted") {
+            res.setHeader("cache-control", "no-store");
+            const hosted = hostedWorkspaceConfiguration();
+            if (!hosted?.portalMembership || !workspaceAccess || !entitled("admin")) {
+                return json(res, 503, { error: "Hosted workspace readiness is unavailable." });
+            }
+            res.setHeader(HOSTED_CONTRACT_HEADER, String(HOSTED_CONTRACT_VERSION));
+            return json(res, 200, { ok: true, service: "openmausbot", membershipAuthority: "portal", workspace: hosted.workspace, ...HOSTED_CONTRACT_METADATA });
+        }
+        // Hosted workspaces have one sign-in authority. A missing optional layer
+        // must not accidentally reactivate legacy email/QR credential minting.
+        if (HOSTED_WORKSPACE) {
+            if (method === "POST" && ["/api/auth/pair", "/api/auth/pairing", "/api/auth/email/start", "/api/auth/email/verify"].includes(path)) {
+                return json(res, 403, { error: "Sign in through the workspace portal." });
+            }
+            if (workspaceAccess) {
+                if (await workspaceAccess.handlePublic(req, res, url))
+                    return;
+            }
+            else if (path.startsWith("/api/auth/hosted/") || path === "/pair" || (path === "/" && (!isLoopbackHost(req.headers.host) || isProxied(req)))) {
+                return json(res, 503, { error: "Workspace sign-in is unavailable." });
+            }
+        }
         // ── who is asking (server/request-auth.ts) ──────────────────────────
         // Two public routes come first: what this server is, and turning a pairing
         // code into a session. Everything else needs the loopback owner or a
@@ -8377,7 +8649,7 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && !path.startsWith("/api/") && !path.startsWith("/.well-known/") && serveStatic(res, path))
             return;
         if (method === "GET" && path === "/.well-known/openmausbot/environment") {
-            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: emailSignIn.enabled() }));
+            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && emailSignIn.enabled(), sharedComputers: sharedComputersEnabled(cfg) }));
         }
         const domainCheck = /^\/\.well-known\/openmausbot\/domain-check\/([a-f0-9]{64})$/.exec(path);
         if (method === "GET" && domainCheck) {
@@ -8420,7 +8692,7 @@ const handleRequest = async (req, res) => {
             }
             sessions.clearFailures(source);
             const issued = sessions.issue({ label: label.trim() || labelFromUserAgent(req.headers["user-agent"]), scopes: verified.scopes, userId: verified.userId, email: verified.email });
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: true });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: true, sharedComputers: sharedComputersEnabled(cfg) });
             const secure = requestOrigin(req)?.startsWith("https://") === true;
             res.setHeader("set-cookie", serializeSessionCookie(SESSION_COOKIE, issued.token, { secure, maxAgeSeconds: cookieMaxAgeSeconds(issued.session) }));
             return json(res, 200, { session: issued.session, environment });
@@ -8442,7 +8714,7 @@ const handleRequest = async (req, res) => {
                 console.warn(`pairing refused from ${requestSource(req)}: ${result.error}`);
                 return json(res, result.status, { error: result.error });
             }
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: emailSignIn.enabled() });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: emailSignIn.enabled(), sharedComputers: sharedComputersEnabled(cfg) });
             if (wantsCookie) {
                 const secure = requestOrigin(req)?.startsWith("https://") === true;
                 res.setHeader("set-cookie", serializeSessionCookie(SESSION_COOKIE, result.token, { secure, maxAgeSeconds: cookieMaxAgeSeconds(result.session) }));
@@ -8457,6 +8729,7 @@ const handleRequest = async (req, res) => {
             url,
             loopbackMutationToken: desktopMutationToken,
             companionMutationToken,
+            features: { sharedComputers: sharedComputersEnabled(cfg) },
         });
         // The browser's cookie carries the term it was set with, and the
         // session's term slides on use (sessions.ts `renew`), so re-issue the
@@ -8467,7 +8740,7 @@ const handleRequest = async (req, res) => {
         if (gate.auth?.kind === "session" && gate.auth.via === "cookie") {
             const presented = parseCookies(req.headers.cookie).get(SESSION_COOKIE);
             if (presented) {
-                const secure = requestOrigin(req)?.startsWith("https://") === true;
+                const secure = HOSTED_WORKSPACE || requestOrigin(req)?.startsWith("https://") === true;
                 res.setHeader("set-cookie", serializeSessionCookie(SESSION_COOKIE, presented, { secure, maxAgeSeconds: cookieMaxAgeSeconds(gate.auth.session) }));
             }
         }
@@ -8486,11 +8759,21 @@ const handleRequest = async (req, res) => {
         if (!gate.auth)
             return json(res, gate.status, { error: gate.error });
         const auth = gate.auth;
+        if (HOSTED_WORKSPACE && auth.kind === "session") {
+            const failure = workspaceAccess
+                ? await workspaceAccess.authorize(req, auth)
+                : { status: 503, error: "Workspace sign-in is unavailable." };
+            if (failure)
+                return json(res, failure.status, { error: failure.error });
+        }
+        if (method === "POST" && path === "/api/workspace-backup/restore" && teamComputers.list().some(computer => computer.section !== null)) {
+            return json(res, 409, { error: "Unassign team computers before restoring a workspace; restored team names must not gain access to existing desktops" });
+        }
         if (await workspaceBackupRoutes(req, res, path, auth))
             return;
         // Count ordinary requests until their asynchronous handler returns, not
         // merely until the browser disconnects. A cancelled upload can still write.
-        if (path.startsWith("/api/") && path !== "/api/events" && path !== "/api/health" && !isWorkspaceBackupSessionControl(method, path)) {
+        if (path.startsWith("/api/") && path !== "/api/events" && path !== "/api/health" && !path.startsWith("/api/shared-computers/") && !isWorkspaceBackupSessionControl(method, path)) {
             releaseWorkspaceRequest = workspaceMaintenance.request();
         }
         // ── sessions: who am I, tickets, pairing and revocation ─────────────
@@ -8586,6 +8869,60 @@ const handleRequest = async (req, res) => {
             const cancelled = sessions.cancelPairing(m[1]);
             return json(res, cancelled ? 200 : 404, cancelled ? { ok: true } : { error: "no such pairing code" });
         }
+        if (method === "POST" && path === "/api/desktop/shared-computer-control" && sharedComputersEnabled(cfg)) {
+            if (auth.kind !== "loopback")
+                return json(res, 403, { error: "Local desktop only" });
+            const body = await readBody(req, 1024);
+            if (!sharedComputersEnabled(cfg))
+                return json(res, 404, { error: `no route: ${method} ${path}` });
+            if (!z.string().uuid().safeParse(body?.id).success || !["acquire", "release"].includes(body?.action))
+                return json(res, 400, { error: "Invalid computer lease" });
+            if (body.action === "release")
+                sharedComputerControl.release(body.id);
+            else
+                sharedComputerControl.acquire(body.id);
+            return json(res, 200, { ok: true });
+        }
+        // A paired desktop registers only its own outbound connector. A second,
+        // main-process-only secret binds poll/results to that exact desktop.
+        // With features.sharedComputers off the whole family falls through to the
+        // generic "no route" 404, so a probe cannot tell a disabled feature from
+        // a build that never had one.
+        if (method === "POST" && path.startsWith("/api/shared-computers/") && sharedComputersEnabled(cfg)) {
+            if (auth.kind !== "session")
+                return json(res, 403, { error: "Pair this desktop first" });
+            if (!/^application\/json\b/i.test(String(req.headers["content-type"] ?? "")))
+                return json(res, 415, { error: "JSON required" });
+            const body = await readBody(req, 4_000_000);
+            if (!sharedComputersEnabled(cfg))
+                return json(res, 404, { error: `no route: ${method} ${path}` });
+            if (!sessions.isLive(auth.session.id))
+                return json(res, 401, { error: "Session ended" });
+            const secret = String(req.headers["x-omb-computer-secret"] ?? "");
+            if (path === "/api/shared-computers/connect") {
+                const parsed = sharedComputerRegistration.safeParse(body);
+                if (!parsed.success)
+                    return json(res, 400, { error: "Invalid computer registration" });
+                const registration = parsed.data;
+                if (registration.environmentId !== ENVIRONMENT_ID)
+                    return json(res, 409, { error: "Workspace identity changed. Pair again before sharing this computer." });
+                sharedComputers.register(registration, auth.session.id, secret);
+                return json(res, 200, { ok: true });
+            }
+            const route = /^\/api\/shared-computers\/([\w-]+)\/(poll|lease|result|disconnect)$/.exec(path);
+            if (!route)
+                return json(res, 404, { error: "not found" });
+            const [, id, action] = route;
+            if (action === "poll")
+                return json(res, 200, { job: await sharedComputers.poll(id, auth.session.id, secret) });
+            if (action === "lease")
+                return json(res, 200, { active: sharedComputers.liveJob(id, auth.session.id, secret, String(body?.jobId)) });
+            if (action === "result")
+                sharedComputers.complete(id, auth.session.id, secret, String(body?.jobId), body?.result);
+            if (action === "disconnect")
+                sharedComputers.disconnect(id, auth.session.id, secret);
+            return json(res, 200, { ok: true });
+        }
         if (method === "GET" && path === "/api/auth/sessions") {
             return json(res, 200, { sessions: sessions.list(), current: auth.kind === "session" ? auth.session.id : null });
         }
@@ -8653,7 +8990,7 @@ const handleRequest = async (req, res) => {
             if (internalCapability.kind !== requiredCapabilityKind) {
                 return json(res, 403, { error: "this internal capability cannot access that service" });
             }
-            if (internalCapability.roomCoordination && method === "POST" && ["/api/internal/ask-bot", "/api/internal/delegate-bot", "/api/internal/threads"].includes(path)) {
+            if (internalCapability.roomCoordination && method === "POST" && ["/api/internal/ask-bot", "/api/internal/delegate-bot"].includes(path)) {
                 return json(res, 409, { error: "Use coordinate_bots for teamwork; it queues actual teammates and resumes you automatically." });
             }
             // Query/body sender ids remain on the wire for proxy compatibility,
@@ -8741,6 +9078,18 @@ const handleRequest = async (req, res) => {
                 requireActiveInternalCapability();
                 return json(res, 200, { result });
             }
+            // Off by default: both fall through to the same "unknown internal
+            // endpoint" 404 a never-implemented route returns.
+            if (method === "GET" && path === "/api/internal/shared-computers" && sharedComputersEnabled(cfg))
+                return json(res, 200, { computers: sharedComputers.list() });
+            if (method === "POST" && path === "/api/internal/shared-computers" && sharedComputersEnabled(cfg)) {
+                const parsed = sharedComputerOperation.safeParse(await readInternalBody());
+                if (!sharedComputersEnabled(cfg))
+                    return json(res, 404, { error: "unknown internal endpoint" });
+                if (!parsed.success)
+                    return json(res, 400, { error: "Invalid shared computer operation" });
+                return json(res, 200, { result: await sharedComputers.request(parsed.data, () => sharedComputersEnabled(cfg) && internalCapabilityIsActive(internalCapability)) });
+            }
             if (method === "GET" && path === "/api/internal/agents") {
                 const sender = internalSender;
                 // title/description included so the caller can judge the team (who
@@ -8790,6 +9139,8 @@ const handleRequest = async (req, res) => {
                         return "running";
                     if (queuedThreadPosition(bot.id, task.threadId) !== null)
                         return "queued";
+                    if (roomHandoffs.activeDirect(task.threadId))
+                        return "queued";
                     if (task.closedBy)
                         return "closed";
                     return "idle";
@@ -8836,7 +9187,7 @@ const handleRequest = async (req, res) => {
                 }
                 if (threadId === fromThreadId)
                     return json(res, 400, { error: "you cannot close the thread you are speaking in — finish your turn instead" });
-                if (threadBusy(owner.id, threadId)) {
+                if (threadBusy(owner.id, threadId) || queuedThreadPosition(owner.id, threadId) !== null || roomHandoffs.activeDirect(threadId)) {
                     return json(res, 409, { error: `#${task.title} is still running — wait for it to finish (list_threads), or the person can stop it from the app` });
                 }
                 // Closing twice is not an error and leaves no second chip: the
@@ -9540,7 +9891,7 @@ const handleRequest = async (req, res) => {
                                 if (existing)
                                     target.threadId = existing.threadId;
                                 else {
-                                    const task = store.createTask(target.botId, parsed.data.message, false);
+                                    const task = store.createTask(target.botId, parsed.data.message, false, undefined, { botId: internalSender.id, name: internalSender.name, at: Date.now() });
                                     if (!task)
                                         throw new Error("The recipient no longer exists");
                                     target.threadId = createdThread = task.threadId;
@@ -9741,6 +10092,14 @@ const handleRequest = async (req, res) => {
                 const target = store.bot(toBotId);
                 if (!target)
                     return json(res, 404, { error: "no such bot" });
+                if (internalCapability.roomCoordination) {
+                    if (target.id !== from.id) {
+                        return json(res, 409, { error: "Use coordinate_bots for teamwork; it queues actual teammates and resumes you automatically." });
+                    }
+                    if (!internalCapability.ownThreadCreation) {
+                        return json(res, 409, { error: "Only a direct user request can open separate self-owned threads. Finish this assigned work here; use coordinate_bots for teammates." });
+                    }
+                }
                 // A folder is the target's own organisation; a name is what the
                 // model has, an id is what the sidebar has, so accept either.
                 const folder = typeof body.folder === "string" ? body.folder.trim() : "";
@@ -10044,7 +10403,7 @@ const handleRequest = async (req, res) => {
                 if (!bot)
                     return json(res, 404, { error: "no such bot" });
                 if (method === "GET") {
-                    const snapshot = computerControl.snapshot(botId);
+                    const snapshot = botComputerControlSnapshot(botId, internalCapability.teamComputerId);
                     const computer = turnComputerResources.get(internalCapability.threadId);
                     if (!snapshot.held && computer && computer.owner.generation === internalCapability.generation &&
                         !claimTurnResource(computer.owner, computer.resource)) {
@@ -10057,7 +10416,8 @@ const handleRequest = async (req, res) => {
                 }
                 if (method === "POST") {
                     const body = await readInternalBody();
-                    const { snapshot, requestId } = computerControl.requestHelpLease(botId, body.reason);
+                    const controlKey = internalCapability.teamComputerId ? teamComputerOwner(internalCapability.teamComputerId) : botId;
+                    const { snapshot, requestId } = computerControl.requestHelpLease(controlKey, body.reason);
                     // worth a buzz: the bot is blocked on the person's hands, which
                     // is exactly the "blocked on you" rule notify.ts encodes.
                     // A bot stuck mid-room is not in its 1:1 thread — the turn and the
@@ -10072,7 +10432,7 @@ const handleRequest = async (req, res) => {
                 }
                 if (method === "DELETE") {
                     const body = await readInternalBody();
-                    const snapshot = computerControl.expireHelp(botId, body.requestId);
+                    const snapshot = computerControl.expireHelp(internalCapability.teamComputerId ? teamComputerOwner(internalCapability.teamComputerId) : botId, body.requestId);
                     return json(res, 200, { held: snapshot.held, helpOpen: snapshot.helpReason !== null });
                 }
                 return json(res, 405, { error: "method not allowed" });
@@ -10312,6 +10672,16 @@ const handleRequest = async (req, res) => {
             const browser = await browserIntegration(bot.id, bot.browserProfile);
             if (!browser)
                 return json(res, 503, { error: "Install the browser engine first." });
+            // Browser discovery may have awaited while the portal became unavailable
+            // and closed this owner's streams. Do not open a late replacement on
+            // the earlier authorization; once registered, exact-owner close covers it.
+            if (HOSTED_WORKSPACE && auth.kind === "session") {
+                const failure = workspaceAccess
+                    ? await workspaceAccess.authorize(req, auth)
+                    : { status: 503, error: "Workspace sign-in is unavailable." };
+                if (failure)
+                    return json(res, failure.status, { error: failure.error });
+            }
             const owner = auth.kind === "session" ? auth.session.id : "local-owner";
             const isCurrent = () => {
                 const current = store.bot(bot.id);
@@ -10439,7 +10809,7 @@ const handleRequest = async (req, res) => {
                 sections: store.sections,
                 groups: store.groups.map((g) => ({ ...publicGroupState(g), ...messagePage(g.threadId, limit) })),
                 computerControl: Object.fromEntries(store.bots.map((bot) => {
-                    const snapshot = computerControl.snapshot(bot.id);
+                    const snapshot = botComputerControlSnapshot(bot.id);
                     return [bot.id, { held: snapshot.held, helpReason: snapshot.helpReason }];
                 })),
             });
@@ -11531,6 +11901,8 @@ const handleRequest = async (req, res) => {
             const section = url.searchParams.get("section")?.trim();
             if (!section)
                 return json(res, 400, { error: "Choose a named team" });
+            if (teamComputers.forSection(section))
+                return json(res, 409, { error: "Unassign this team's computer before renaming or deleting the team" });
             let nextName = null;
             if (method === "PATCH") {
                 const parsed = z.object({ name: z.string().trim().min(1).max(60) }).strict().safeParse(await readBody(req));
@@ -11555,6 +11927,11 @@ const handleRequest = async (req, res) => {
             const botIds = [...new Set(parsed.data.botIds)];
             if (!name && !botIds.length)
                 return json(res, 400, { error: "Team name is required" });
+            for (const botId of botIds) {
+                const bot = store.bot(botId);
+                if (bot)
+                    assertTeamComputerChangeIdle(bot, { ...bot, section: name || undefined });
+            }
             const result = store.setBotsSection(botIds, name);
             if (!result.ok) {
                 if (result.reason === "chief-conflict") {
@@ -12206,6 +12583,8 @@ const handleRequest = async (req, res) => {
                 return json(res, 409, { error: "Stop the bot and release browser control before changing its profile." });
             }
             if (profile.patch.soul !== undefined) {
+                if (freshBrowserBot)
+                    assertTeamComputerChangeIdle(freshBrowserBot, { ...freshBrowserBot, ...patch });
                 // A mixed settings request must not turn a runtime revocation into
                 // a persist-first edit. Apply runtime fields with their existing
                 // fail-closed semantics; atomically commit only the profile fields.
@@ -12217,6 +12596,8 @@ const handleRequest = async (req, res) => {
                 bot = store.patchBotProfile(m[1], profile.patch);
             }
             else {
+                if (freshBrowserBot)
+                    assertTeamComputerChangeIdle(freshBrowserBot, { ...freshBrowserBot, ...patch });
                 bot = store.patchBot(m[1], patch);
             }
             if (!bot)
@@ -13349,6 +13730,135 @@ const handleRequest = async (req, res) => {
             broadcast({ kind: "bot", bot: fresh });
             return json(res, 200, { bot: fresh });
         }
+        // Named team Boxes use real independent ownership, never a hidden bot or
+        // an arbitrary provider id. These new routes remain admin-only by default.
+        if (path === "/api/team-computers" && method === "GET") {
+            res.setHeader("cache-control", "private, no-store");
+            return json(res, 200, await teamComputersPayload());
+        }
+        m = path.match(/^\/api\/team-computers(?:\/([\w-]+)(?:\/(provision|join|sleep|control))?)?$/);
+        if (m) {
+            const computerId = m[1];
+            const action = m[2];
+            let found = computerId ? teamComputers.get(computerId) : undefined;
+            if (computerId && !found)
+                return json(res, 404, { error: "No such team computer" });
+            if (method === "GET" && action === "control" && found) {
+                return json(res, 200, computerControl.snapshot(teamComputerOwner(found.id)));
+            }
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json"))
+                return json(res, 415, { error: "content-type must be application/json" });
+            const body = await readBody(req);
+            found = computerId ? teamComputers.get(computerId) : undefined;
+            const assertCurrentOwner = () => {
+                if (auth.kind === "session" && !sessions.isLive(auth.session.id))
+                    throw Object.assign(new Error("Your session ended; sign in again"), { status: 401 });
+                if (computerProviderConfigTransitions.has("box"))
+                    throw Object.assign(new Error(providerTransitionMessage("box")), { status: 409 });
+            };
+            assertCurrentOwner();
+            if (action === "control" && method === "POST" && found) {
+                const parsed = z.object({ action: z.enum(["take", "release"]), controlLeaseId: controlLeaseIdSchema.optional() }).strict().safeParse(body);
+                if (!parsed.success)
+                    return json(res, 400, { error: "Choose take or release with a valid optional controlLeaseId" });
+                const key = teamComputerOwner(found.id);
+                if (parsed.data.action === "take" && boxLifecycleBusyBots.has(key))
+                    return json(res, 409, { error: "Wait for this computer's action to finish before taking control" });
+                if (parsed.data.action === "take")
+                    assertTeamControlCanBeTaken(found.id);
+                if (parsed.data.controlLeaseId) {
+                    const result = parsed.data.action === "take"
+                        ? computerControl.acquireLease(key, parsed.data.controlLeaseId)
+                        : computerControl.releaseLease(key, parsed.data.controlLeaseId);
+                    return json(res, 200, { ...result.snapshot, ...result });
+                }
+                return json(res, 200, parsed.data.action === "take" ? computerControl.take(key) : computerControl.release(key));
+            }
+            if (method === "PATCH" && found && !action) {
+                const parsed = teamComputerAssignment.safeParse(body);
+                if (!parsed.success)
+                    return json(res, 400, { error: "Confirm shared desktop access with section and acknowledgeSharedAccess: true" });
+                const section = parsed.data.section;
+                const checkAssignment = () => {
+                    assertCurrentOwner();
+                    if (section !== null && section !== "" && !store.sections.includes(section))
+                        throw Object.assign(new Error("Create the team before assigning a computer"), { status: 404 });
+                    if (section !== null && store.bots.some(bot => sectionKey(bot.section) === section && (botHasActiveTurn(bot.id) || routines?.activeRunForBot(bot.id) || botComputerControlSnapshot(bot.id).held || boxLifecycleBusyBots.has(bot.id))))
+                        throw Object.assign(new Error("Stop the target team's work and release computer control before assigning this computer"), { status: 409 });
+                };
+                checkAssignment();
+                const release = claimTeamComputerLifecycle(found);
+                try {
+                    if (section !== null && !(await box.findBox(cfg, teamComputerOwner(found.id))))
+                        return json(res, 409, { error: "Create or retry this computer before assigning it to a team" });
+                    checkAssignment();
+                    if (teamComputerInUse(found))
+                        return json(res, 409, { error: "This team computer became busy; stop its work before assigning it" });
+                    teamComputers.assign(found.id, section);
+                    return json(res, 200, { ok: true });
+                }
+                finally {
+                    release();
+                }
+            }
+            if (method === "POST" && !computerId) {
+                const parsed = teamComputerCreate.safeParse(body);
+                if (!parsed.success)
+                    return json(res, 400, { error: "Provide requestId (UUID), a name, and acknowledgeCost: true to create a paid Box" });
+                if (!box.boxConfigured(cfg))
+                    return json(res, 409, { error: "Configure Box in Settings before creating a cloud computer" });
+                const computer = teamComputers.create(parsed.data.name, parsed.data.requestId);
+                const release = claimTeamComputerLifecycle(computer);
+                try {
+                    await box.provisionBox(cfg, teamComputerOwner(computer.id), computer.name);
+                    teamComputers.setProblem(computer.id);
+                    return json(res, 201, { id: computer.id });
+                }
+                catch (error) {
+                    teamComputers.setProblem(computer.id, redactSecretsInText(error instanceof Error ? error.message : String(error)));
+                    throw error;
+                }
+                finally {
+                    release();
+                }
+            }
+            if (method === "POST" && found && action && action !== "control") {
+                if (action === "provision" && body?.acknowledgeCost !== true)
+                    return json(res, 400, { error: "Confirm Box creation or wake costs with acknowledgeCost: true" });
+                // A ready-only join never wakes, provisions or steals an agent's turn.
+                // The caller takes a separate explicit human-control lease first.
+                if (action === "join") {
+                    const key = teamComputerOwner(found.id);
+                    if (boxLifecycleBusyBots.has(key))
+                        return json(res, 409, { error: "Wait for this computer's action to finish" });
+                    if (!computerControl.snapshot(key).held)
+                        return json(res, 409, { error: "Take control before opening this shared desktop" });
+                    const release = claimBotComputerLifecycle(key);
+                    try {
+                        return json(res, 200, await box.joinReadyBox(cfg, key));
+                    }
+                    finally {
+                        release();
+                    }
+                }
+                const release = claimTeamComputerLifecycle(found);
+                try {
+                    const result = action === "provision"
+                        ? await box.provisionBox(cfg, teamComputerOwner(found.id), found.name)
+                        : await box.sleepBox(cfg, teamComputerOwner(found.id));
+                    teamComputers.setProblem(found.id);
+                    return json(res, 200, result);
+                }
+                catch (error) {
+                    teamComputers.setProblem(found.id, redactSecretsInText(error instanceof Error ? error.message : String(error)));
+                    throw error;
+                }
+                finally {
+                    release();
+                }
+            }
+            return json(res, 405, { error: "method not allowed" });
+        }
         // Account-wide Box inventory is a Settings surface, never a provisioning
         // path. Listing remains read-only; lifecycle changes require explicit
         // JSON actions and are revalidated against a fresh provider listing.
@@ -13680,8 +14190,10 @@ const handleRequest = async (req, res) => {
             }
             const kind = provider;
             const saved = kind === "anthropic" ? cfg.anthropic : kind === "openaiCompat" ? cfg.openaiCompat : cfg.xai;
-            const pasted = typeof body?.key === "string" ? body.key.trim() : "";
-            const key = pasted || saved?.key || "";
+            if (body?.key !== undefined && typeof body.key !== "string") {
+                return json(res, 400, { error: "key must be a string" });
+            }
+            const key = typeof body?.key === "string" ? body.key.trim() : saved?.key?.trim() || "";
             if (!key)
                 return json(res, 400, { error: "No key to test. Paste one or save one first." });
             if (key.length > 512)
@@ -14414,6 +14926,12 @@ const handleRequest = async (req, res) => {
                     throw error;
                 }
                 let browserReferenceCleanupError = null;
+                if (patch.signIn !== undefined)
+                    sessions.revalidateEmailSessions();
+                if (!sharedComputersEnabled(cfg)) {
+                    sharedComputers.close();
+                    sharedComputerControl.close();
+                }
                 if (disablingBuiltInBrowser)
                     browserLive.closeAll();
                 for (const request of browserCleanupRequests) {
@@ -14743,6 +15261,9 @@ const handleRequest = async (req, res) => {
             const bot = store.bot(m[1]);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            const teamComputer = inheritedTeamComputer(bot);
+            if (teamComputer)
+                return json(res, 200, { backend: "box", teamComputer: { id: teamComputer.id, name: teamComputer.name }, ...(await box.boxStatus(cfg, teamComputerOwner(teamComputer.id))) });
             return bot.cloudBackend === "vps"
                 ? json(res, 200, { backend: "vps", ...(await vps.vpsComputerStatus(cfg, bot.id)) })
                 : json(res, 200, { backend: "box", ...(await box.boxStatus(cfg, bot.id)) });
@@ -14756,7 +15277,7 @@ const handleRequest = async (req, res) => {
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
             if (method === "GET")
-                return json(res, 200, computerControl.snapshot(bot.id));
+                return json(res, 200, botComputerControlSnapshot(bot.id));
             if (method === "POST") {
                 // JSON-only for the same anti-form-POST reason as every other
                 // computer mutation below.
@@ -14765,6 +15286,13 @@ const handleRequest = async (req, res) => {
                 }
                 const body = await readBody(req);
                 const action = String(body.action ?? "");
+                const currentBot = store.bot(bot.id);
+                if (!currentBot)
+                    return json(res, 404, { error: "no such bot" });
+                const controlKey = botComputerControlKey(currentBot);
+                const teamComputer = inheritedTeamComputer(currentBot);
+                if (action === "take" && teamComputer)
+                    assertTeamControlCanBeTaken(teamComputer.id);
                 const leaseResult = body.controlLeaseId === undefined
                     ? null
                     : controlLeaseIdSchema.safeParse(body.controlLeaseId);
@@ -14772,11 +15300,11 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "controlLeaseId is invalid" });
                 }
                 const controlLeaseId = leaseResult?.data;
-                if (action === "take" && boxLifecycleBusyBots.has(bot.id)) {
+                if (action === "take" && (boxLifecycleBusyBots.has(bot.id) || boxLifecycleBusyBots.has(controlKey))) {
                     return json(res, 409, { error: "this bot's cloud computer is being changed — wait before taking control" });
                 }
                 if (action === "take" && controlLeaseId) {
-                    const result = computerControl.acquireLease(bot.id, controlLeaseId);
+                    const result = computerControl.acquireLease(controlKey, controlLeaseId);
                     return json(res, 200, {
                         ...result.snapshot,
                         owned: result.owned,
@@ -14784,15 +15312,15 @@ const handleRequest = async (req, res) => {
                     });
                 }
                 if (action === "release" && controlLeaseId) {
-                    const result = computerControl.releaseLease(bot.id, controlLeaseId);
+                    const result = computerControl.releaseLease(controlKey, controlLeaseId);
                     return json(res, 200, { ...result.snapshot, released: result.released });
                 }
                 if (action === "take")
-                    return json(res, 200, computerControl.take(bot.id));
+                    return json(res, 200, computerControl.take(controlKey));
                 if (action === "release")
-                    return json(res, 200, computerControl.release(bot.id));
+                    return json(res, 200, computerControl.release(controlKey));
                 if (action === "dismiss-help")
-                    return json(res, 200, computerControl.dismissHelp(bot.id));
+                    return json(res, 200, computerControl.dismissHelp(controlKey));
                 return json(res, 400, { error: "action must be take, release, or dismiss-help" });
             }
             return json(res, 405, { error: "method not allowed" });
@@ -14828,6 +15356,29 @@ const handleRequest = async (req, res) => {
             if (boxLifecycleBusyBots.has(botId)) {
                 return json(res, 409, { error: "this bot's cloud computer is being changed — wait for it to finish" });
             }
+            const teamComputer = inheritedTeamComputer(bot);
+            if (teamComputer) {
+                const key = teamComputerOwner(teamComputer.id);
+                if (boxLifecycleBusyBots.has(key))
+                    return json(res, 409, { error: "This team computer is being changed; wait for it to finish" });
+                if (m[2] === "provision" || m[2] === "remove")
+                    return json(res, 409, { error: "Manage this shared computer from the Team map" });
+                if (m[2] === "exec")
+                    return json(res, 409, { error: "Use the bot's scoped computer tools for this shared desktop" });
+                if (m[2] === "join" && !computerControl.snapshot(key).held)
+                    return json(res, 409, { error: "Take control before opening this shared desktop" });
+                const release = m[2] === "sleep" ? claimTeamComputerLifecycle(teamComputer) : claimBotComputerLifecycle(key);
+                try {
+                    if (m[2] === "join")
+                        return json(res, 200, await box.joinReadyBox(cfg, key));
+                    if (m[2] === "screenshot")
+                        return json(res, 200, await box.screenshotBox(cfg, key));
+                    return json(res, 200, await box.sleepBox(cfg, key));
+                }
+                finally {
+                    release();
+                }
+            }
             if (bot.cloudBackend === "vps") {
                 if (m[2] === "screenshot") {
                     let preview = vpsPreviewRequests.get(botId);
@@ -14923,6 +15474,13 @@ const server = createServer(handleRequest);
 calendarCalls.start();
 // Resolve the edition before accepting requests so /api/edition is never a guess.
 console.log(describeEdition(await loadEnterpriseLayer()));
+workspaceAccess = createWorkspaceAccess({ sessions, cookieName: SESSION_COOKIE, closeSessionStreams });
+// Ten-second cadence plus the bridge's five-second backchannel deadline bounds
+// stale portal access on quiet event/browser streams to fifteen seconds.
+const workspaceAccessTimer = workspaceAccess ? setInterval(() => {
+    void workspaceAccess.revalidate().catch((error) => console.warn("workspace access revalidation failed", error));
+}, 10_000) : null;
+workspaceAccessTimer?.unref();
 console.log(describeBrand(loadBrand()));
 // Reclaim upload partials a previous run crashed out of, and warm the
 // attachment quota cache off the same scan. This used to happen implicitly on
@@ -15020,10 +15578,14 @@ const gracefulShutdown = createGracefulShutdown({
     cleanup: [
         () => {
             followupsReady = false;
+            if (workspaceAccessTimer)
+                clearInterval(workspaceAccessTimer);
             // Child MCP processes and the HTTP listener can remain alive while the
             // asynchronous shutdown jobs drain. Invalidate their turn bearers before
             // any cleanup function reaches an await.
             revokeAllInternalCapabilities();
+            sharedComputers.close();
+            sharedComputerControl.close();
             browserLive.closeAll();
             for (const idle of localVmIdles.values())
                 idle.cancel();
@@ -15048,6 +15610,15 @@ const gracefulShutdown = createGracefulShutdown({
     // the shutdown deadline), immediately before the process exits, so no new
     // server can overlap with a still-mutating old one.
     exit: (code) => {
+        try {
+            sessions.close();
+        }
+        catch {
+            // An uncleared marker makes saved account sessions require sign-in on
+            // the next boot; never label failed persistence a clean shutdown.
+            console.error("Session persistence failed during shutdown; account sign-in will be required again.");
+            code = 1;
+        }
         closeMessageDb();
         releaseDataDirLeaseAtExit();
         process.exit(code);