openmausbot 0.1.76 → 0.1.78

package/dist-server/server/sessions.js

@@ -9,9 +9,10 @@
 // endpoint, because EventSource cannot set headers. Failed exchanges are
 // counted per source: five in a minute lock that source out for ten.
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, unlinkSync } from "node:fs";
 import { dirname } from "node:path";
 import { z } from "zod";
+import { writeFileAtomic } from "./atomic.js";
 export const SCOPES = ["admin", "client"];
 export const PAIRING_CODE_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 export const PAIRING_CODE_LENGTH = 12;
@@ -69,6 +70,8 @@ const sessionSchema = z.object({
     /** Set when the session came from an account sign-in rather than a code. */
     userId: z.string().max(256).optional(),
     email: z.string().max(320).optional(),
+    /** Set only by the internal verified-portal issuance path, never by email or pairing input. */
+    membershipAuthority: z.literal("portal").optional(),
 });
 const fileSchema = z.object({ version: z.literal(1), sessions: z.array(sessionSchema) });
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
@@ -127,14 +130,29 @@ export class SessionRegistry {
     lastSeenWrites = new Map();
     now;
     options;
+    openMarker;
+    closed = false;
     // No parameter properties: the server runs this file under Node's
     // strip-only TypeScript mode, which only erases types.
     constructor(options) {
         this.options = options;
         this.now = options.now ?? Date.now;
-        this.load();
+        this.openMarker = `${options.file}.open`;
+        const unclean = existsSync(this.openMarker);
+        try {
+            mkdirSync(dirname(options.file), { recursive: true, mode: 0o700 });
+            // Establish the guard before accepting any persisted bearer. Even if
+            // every subsequent write fails, an unclean restart will see this marker.
+            writeFileAtomic(this.openMarker, "Session registry is open.\n", { mode: 0o600 });
+            this.syncDirectory();
+        }
+        catch {
+            throw new Error("Could not establish safe session storage.");
+        }
+        this.load(!unclean);
+        this.revalidateEmailSessions();
     }
-    load() {
+    load(restoreAccounts) {
         if (!existsSync(this.options.file))
             return;
         let raw;
@@ -146,18 +164,50 @@ export class SessionRegistry {
         }
         const parsed = fileSchema.safeParse(raw);
         if (parsed.success)
-            this.sessions = parsed.data.sessions;
+            this.sessions = parsed.data.sessions.filter(session => restoreAccounts || (session.email === undefined && session.userId === undefined));
+    }
+    syncDirectory() {
+        // Windows does not expose directory fsync. The open marker still guards
+        // normal process crashes; no stronger power-loss guarantee is claimed.
+        if (process.platform === "win32")
+            return;
+        const fd = openSync(dirname(this.options.file), "r");
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
     }
     /** Atomic write, owner-only, directory owner-only. */
     persist() {
+        if (this.closed)
+            throw new Error("Session registry is closed.");
         const dir = dirname(this.options.file);
         mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const tmp = `${this.options.file}.${process.pid}.tmp`;
-        writeFileSync(tmp, JSON.stringify({ version: 1, sessions: this.sessions }, null, 2) + "\n", { mode: 0o600 });
-        chmodSync(tmp, 0o600);
-        renameSync(tmp, this.options.file);
+        writeFileAtomic(this.options.file, JSON.stringify({ version: 1, sessions: this.sessions }, null, 2) + "\n", { mode: 0o600 });
+        this.syncDirectory();
+    }
+    /** Call after HTTP/stream shutdown. A failed close leaves the open marker,
+     * so account sessions require fresh sign-in after restart. Paired devices
+     * remain durable. Never remove the marker before the reduced set is saved. */
+    close() {
+        if (this.closed)
+            return;
+        try {
+            this.revalidateEmailSessions();
+            this.persist();
+            unlinkSync(this.openMarker);
+            this.closed = true;
+            // A marker deletion lost on power failure causes extra sign-in only;
+            // the session file and its rename were fsynced before removal.
+        }
+        catch {
+            throw new Error("Could not safely close session storage.");
+        }
     }
     prune() {
+        this.revalidateEmailSessions();
         const now = this.now();
         this.pairings = this.pairings.filter((p) => p.expiresAt > now);
         this.replays = this.replays.filter((r) => r.expiresAt > now);
@@ -293,6 +343,16 @@ export class SessionRegistry {
     /** A session from a verified account sign-in (server/account-signin.ts)
      * rather than a pairing code: same token, same term, same gates. */
     issue(input) {
+        return this.issueAccount(input);
+    }
+    /** Internal hosted-bridge seam: call only after consuming a verified,
+     * workspace-bound PKCE grant. No HTTP route accepts this marker as input. */
+    issuePortal(input) {
+        if (!/^[A-Za-z0-9_-]{43}$/.test(input.grant) || !input.email)
+            throw new Error("A verified portal identity is required");
+        return this.issueAccount({ label: "Hosted workspace", email: input.email, userId: `portal:${input.grant}`, scopes: input.scopes }, "portal");
+    }
+    issueAccount(input, membershipAuthority) {
         this.prune();
         const now = this.now();
         const token = `omb_sess_${randomBytes(32).toString("base64url")}`;
@@ -309,6 +369,8 @@ export class SessionRegistry {
             record.userId = input.userId;
         if (input.email)
             record.email = input.email;
+        if (membershipAuthority)
+            record.membershipAuthority = membershipAuthority;
         this.sessions.push(record);
         this.lastSeenWrites.set(record.id, now);
         this.persist();
@@ -326,9 +388,53 @@ export class SessionRegistry {
         this.failures.delete(source);
     }
     // ── sessions ───────────────────────────────────────────────────────────
+    /** Email membership is live, not a thirty-day grant. Losing any issued
+     * scope revokes the token and its streams; signing in again obtains the
+     * new role. Promotions never widen existing credentials. Pairing sessions
+     * have no email and remain independent of the hosted sign-in list. */
+    revalidateEmailSessions() {
+        if (this.closed)
+            throw new Error("Session registry is closed.");
+        const eligible = this.sessions.filter(session => session.email !== undefined && !(this.options.portalMembership && session.membershipAuthority === "portal"));
+        if (!eligible.length)
+            return;
+        let resolveScopes = this.options.emailScopes;
+        try {
+            if (this.options.emailScopesSnapshot)
+                resolveScopes = this.options.emailScopesSnapshot();
+        }
+        catch {
+            resolveScopes = undefined; // Never fall back to stale membership after a failed snapshot.
+        }
+        const revoked = eligible.filter((session) => {
+            try {
+                const allowed = resolveScopes?.(session.email);
+                return !allowed || session.scopes.some((scope) => !allowed.includes(scope));
+            }
+            catch {
+                return true; // missing or unreadable membership must fail closed
+            }
+        });
+        if (!revoked.length)
+            return;
+        const ids = new Set(revoked.map((session) => session.id));
+        this.sessions = this.sessions.filter((session) => !ids.has(session.id));
+        for (const session of revoked)
+            this.forget(session.id);
+        try {
+            this.persist();
+        }
+        catch {
+            // Revocation stays effective in memory and streams close. The boot
+            // marker prevents old account bearers from reviving after an unclean
+            // restart, even if membership is later restored and all writes failed.
+            console.error("Could not persist email session revocation.");
+        }
+    }
     authenticate(token) {
         if (!token)
             return null;
+        this.revalidateEmailSessions();
         const hash = sha256(token);
         const now = this.now();
         const record = this.sessions.find((s) => sameDigest(s.tokenHash, hash));
@@ -349,6 +455,7 @@ export class SessionRegistry {
      * Nothing expired is revived. Writes at most once per half-term, so it
      * adds nothing to the last-seen traffic. Returns whether it renewed. */
     renew(sessionId) {
+        this.revalidateEmailSessions();
         const record = this.sessions.find((s) => s.id === sessionId);
         const now = this.now();
         if (!record || record.expiresAt <= now)

package/dist-server/server/setup-mode.js

@@ -1,15 +1,13 @@
 // Setup mode: optional coaching when the user asks for it with /setup.
 // An empty profile is not a request to interview the user. The bot says
-// what it intends, and then configures itself only through proposal cards
-// (propose_profile, propose_routine, skill_manage, request_credential) — so
-// nothing changes without the user's approval. Mirrors skill-learn.ts:
+// what it intends, and then configures itself through the harness tools
+// (propose_profile, propose_routine, skill_manage, request_credential), which
+// enforce the granted approval level. Mirrors skill-learn.ts:
 // /setup is a turn-text rewrite plus a prompt block, never a hidden mode.
 //
-// Setup mode is card-gated, not provenance-gated: it doesn't matter who sent
-// the message that entered it — a peer message or a routine trigger that
-// happens to begin with /setup enters it exactly like a message the user
-// typed, and nothing about the bot actually changes until a card is
-// confirmed. And like /learn, only the current turn's text is rewritten —
+// This coaching block grants no additional authority: the services still
+// check the actual caller, target and effective conversation permissions.
+// Like /learn, only the current turn's text is rewritten —
 // the transcript keeps the raw "/setup …" user message verbatim, so replay
 // and history read the same thing the user sent.
 const SETUP_COMMAND = /^\/setup(?:\s+|$)([\s\S]*)$/i;
@@ -47,11 +45,11 @@ function folderClause(cwd) {
 function buildSetupPrompt(profileAside, cwd) {
     return ("\n\nThe user explicitly asked you to set yourself up. For this setup request, help configure the bot from what the user tells you." +
         ` First ask at most four questions that change what you would build: what the job is, when it should happen (on demand, on a schedule, or when something arrives), which apps or accounts it touches, and ${folderClause(cwd)}.` +
-        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Wait for a yes." +
-        " When they say yes, first send one message that lists the cards you are about to raise, then make the tool calls — the cards must appear after that message, never before it. After the tool calls add at most one short line and do not repeat the list." +
-        ` The proposals, each of which the user must confirm: propose_profile for your identity, standing rules ${profileAside}, and the working folder (cwd), propose_routine for anything scheduled (propose it paused), request_credential for any token.` +
-        " Never claim something is set up until its card is confirmed." +
-        " Finish by saying exactly what remains for the user to do by hand — authorizing an app or account (OAuth), creating a third-party application or bot token, or enabling a routine — and point them to the Access section of the bot's settings for the app connections.");
+        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Ask for missing choices, not an extra yes for already-requested actions under granted Full Access." +
+        " First send one message describing the changes you are about to request, then make the tool calls. Follow each result: if applied, continue without another confirmation; if pending, end the turn and wait for its in-app decision. Do not repeat the list or claim success from the permission mode alone." +
+        ` Use propose_profile for your identity, standing rules ${profileAside}, and the working folder (cwd), propose_routine only for a schedule the user requested, and request_credential for any missing token.` +
+        " Full Access does not supply answers, credentials, or broader permissions for another bot. A credential request still needs the user's secure entry. Report failed or cancelled changes honestly." +
+        " Finish by saying exactly what remains for the user to do by hand — authorizing an app or account (OAuth), creating a third-party application or bot token, or deciding a pending review — and point them to the Access section of the bot's settings for the app connections.");
 }
 /** The setup block naming skill_manage, for a turn with skill authoring on. */
 export const SETUP_PROMPT = buildSetupPrompt(SKILL_MANAGE_ASIDE);

package/dist-server/server/shared-computer-control.js

@@ -0,0 +1,24 @@
+/** A local desktop call competes with ordinary bot turns for the same screen.
+ * Leases expire if Electron crashes; human takeover always wins renewal. */
+export class SharedComputerControl {
+    leases = new Map();
+    resources;
+    held;
+    constructor(resources, held) { this.resources = resources; this.held = held; }
+    acquire(id) {
+        const owner = { threadId: `shared:${id}`, generation: id };
+        if (this.held() || !this.resources.claim("computer:host", owner)) {
+            this.release(id);
+            throw Object.assign(new Error("This computer is in use locally or held by a person. Wait, then observe it again before acting."), { status: 409 });
+        }
+        clearTimeout(this.leases.get(id));
+        this.leases.set(id, setTimeout(() => this.release(id), 40_000));
+    }
+    release(id) {
+        clearTimeout(this.leases.get(id));
+        this.leases.delete(id);
+        this.resources.release({ threadId: `shared:${id}`, generation: id });
+    }
+    close() { for (const id of this.leases.keys())
+        this.release(id); }
+}

package/dist-server/server/shared-computers.js

@@ -0,0 +1,131 @@
+import { randomUUID, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+const folder = z.object({ id: z.string().uuid(), name: z.string().min(1).max(120), write: z.boolean() }).strict();
+export const sharedComputerRegistration = z.object({
+    id: z.string().uuid(), name: z.string().min(1).max(120), environmentId: z.string().uuid(),
+    folders: z.array(folder).max(20), terminal: z.boolean(), computer: z.boolean(),
+}).strict();
+export const sharedComputerOperation = z.object({
+    computer_id: z.string().uuid(),
+    action: z.enum(["list_files", "read_file", "write_file", "run_command", "computer_tools", "computer_call"]),
+    folder_id: z.string().uuid().optional(), path: z.string().max(2048).optional(),
+    content: z.string().max(350_000).optional(), encoding: z.enum(["utf8", "base64"]).optional(),
+    expected_sha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    command: z.string().max(8000).optional(), tool_name: z.string().max(100).optional(),
+    arguments: z.record(z.string(), z.unknown()).optional(),
+}).strict();
+const failure = (message, status = 409) => Object.assign(new Error(message), { status });
+/** In-memory rendezvous only. Authority over local resources stays on the
+ * desktop. Restart/disconnect NEVER replays an operation with an unknown outcome. */
+export class SharedComputers {
+    computers = new Map();
+    sessionLive;
+    constructor(sessionLive) { this.sessionLive = sessionLive; }
+    register(registration, owner, secret) {
+        if (!/^[a-f0-9]{64}$/.test(secret))
+            throw failure("Invalid computer credential", 400);
+        const old = this.computers.get(registration.id);
+        if (old) {
+            this.authorize(registration.id, owner, secret);
+            old.registration = registration;
+            old.seen = Date.now();
+        }
+        else {
+            // Reap dead devices before applying the bounded registration limit.
+            for (const [id, entry] of this.computers)
+                if (!this.online(entry) && entry.jobs.size === 0)
+                    this.computers.delete(id);
+            if (this.computers.size >= 20)
+                throw failure("Too many shared computers");
+            this.computers.set(registration.id, { registration, owner, secret, seen: Date.now(), jobs: new Map() });
+        }
+    }
+    online(entry) { return this.sessionLive(entry.owner) && Date.now() - entry.seen < 40_000; }
+    authorize(id, owner, secret) {
+        const entry = this.computers.get(id);
+        if (!entry || entry.owner !== owner || !this.sessionLive(owner) || !/^[a-f0-9]{64}$/.test(secret) || !timingSafeEqual(Buffer.from(secret), Buffer.from(entry.secret)))
+            throw failure("Shared computer is disconnected or not authorized", 403);
+        return entry;
+    }
+    list() { return [...this.computers.values()].filter(entry => this.online(entry)).map(entry => entry.registration); }
+    async poll(id, owner, secret) {
+        const entry = this.authorize(id, owner, secret);
+        if (entry.wake)
+            throw failure("A computer poll is already running");
+        entry.seen = Date.now();
+        const next = () => {
+            for (const job of entry.jobs.values()) {
+                if (!job.active()) {
+                    this.finish(entry, job, failure("The requesting turn ended"));
+                    continue;
+                }
+                if (!job.sent) {
+                    job.sent = true;
+                    return { id: job.id, operation: job.operation };
+                }
+            }
+            return null;
+        };
+        const queued = next();
+        if (queued)
+            return queued;
+        await new Promise(resolve => {
+            const timer = setTimeout(() => { entry.wake = undefined; resolve(); }, 20_000);
+            entry.wake = () => { clearTimeout(timer); entry.wake = undefined; resolve(); };
+        });
+        this.authorize(id, owner, secret);
+        entry.seen = Date.now();
+        return next();
+    }
+    liveJob(id, owner, secret, jobId) {
+        const entry = this.authorize(id, owner, secret);
+        entry.seen = Date.now();
+        const job = entry.jobs.get(jobId);
+        return job?.sent === true && job.active();
+    }
+    complete(id, owner, secret, jobId, result) {
+        const entry = this.authorize(id, owner, secret);
+        const job = entry.jobs.get(jobId);
+        if (!job || !job.sent)
+            throw failure("This computer operation expired; it will not be replayed");
+        this.finish(entry, job, job.active() ? null : failure("The requesting turn ended"), result);
+    }
+    disconnect(id, owner, secret) {
+        const entry = this.authorize(id, owner, secret);
+        this.computers.delete(id);
+        entry.wake?.();
+        for (const job of entry.jobs.values())
+            this.finish(entry, job, failure("Computer disconnected. An in-flight action may have completed; inspect before retrying."));
+    }
+    request(operation, active) {
+        const entry = this.computers.get(operation.computer_id);
+        if (!entry || !this.online(entry))
+            return Promise.reject(failure("This shared computer is offline. Keep its desktop app open; do not substitute files on the server."));
+        if (entry.jobs.size >= 1)
+            return Promise.reject(failure("This shared computer is busy. Wait for its current action to finish."));
+        if (!active())
+            return Promise.reject(failure("The requesting turn ended", 401));
+        return new Promise((resolve, reject) => {
+            const id = randomUUID();
+            const job = { id, operation, active, sent: false, resolve, reject, timer: setTimeout(() => this.finish(entry, job, failure("Computer action timed out. Its outcome is unknown; inspect before retrying.")), 45_000) };
+            entry.jobs.set(id, job);
+            entry.wake?.();
+        });
+    }
+    close() {
+        for (const entry of this.computers.values()) {
+            entry.wake?.();
+            for (const job of entry.jobs.values())
+                this.finish(entry, job, failure("Workspace stopped. Inspect any in-flight action before retrying."));
+        }
+        this.computers.clear();
+    }
+    finish(entry, job, error, result) {
+        clearTimeout(job.timer);
+        entry.jobs.delete(job.id);
+        if (error)
+            job.reject(error);
+        else
+            job.resolve(result);
+    }
+}

package/dist-server/server/skill-learn.js

@@ -1,6 +1,6 @@
 // `/learn` — turn a described workflow, URL, folder, or "what we just did"
-// into a staged SKILL.md. The live agent authors the skill with skill_manage;
-// the harness lands it DISABLED until a person confirms the in-app card.
+// into a reusable SKILL.md. The live agent authors the skill with skill_manage;
+// the harness applies it under granted Full Access or stages a pending review.
 //
 // There is no separate distillation engine. This module only builds the
 // prompt and recognises the slash command, so it works on every engine
@@ -56,13 +56,13 @@ Quality bar:
 export function buildLearnPrompt(userRequest) {
     const req = userRequest.trim() ||
         "the workflow we just went through in this conversation — review the steps taken and distill them into a reusable skill";
-    return (`${LEARN_PROMPT_MARKER} The user wants you to learn a reusable skill from the request below, and stage it for their review.\n\n` +
+    return (`${LEARN_PROMPT_MARKER} The user wants you to learn a reusable skill from the request below, using the granted access level.\n\n` +
         `THE REQUEST:\n${req}\n\n` +
         "Do this:\n" +
         "1. Inventory every source the user named, using the tools you already have — file tools for local paths, web fetch for URLs, and this conversation if they referred to something you just did. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.\n" +
         "2. Check existing skills with skills_list. If one already covers this topic, leave it alone unless the user explicitly asked to revise that named learned/editable skill. For an explicit revision, read only the exact SKILL.md path listed for that skill in your system prompt (the native .agents/skills/<exact-name>/SKILL.md link is a fallback), preserve every still-valid step, re-verify what changed, then call skill_manage with action=\"update\" and skill_name set to that exact name. If you cannot read or verify the current skill, stop instead of replacing it from memory. For a genuinely new skill, use action=\"create\".\n" +
         "3. Pass source as the exact URL or folder you used, or \"conversation\" when the conversation is the source.\n" +
-        "4. skill_manage only STAGES the change. A create stays inactive and an update leaves the current version untouched until the user approves the review card.\n\n" +
+        "4. Follow the skill_manage result: with granted Full Access it may apply immediately. After an applied result, continue the requested work without another confirmation. If review is pending, a create stays inactive and an update leaves the current version untouched; end the turn and wait for the in-app decision. Never claim success from the permission mode alone, and report failed or cancelled changes honestly.\n\n" +
         AUTHORING_STANDARDS +
         "\n\nWhen done, tell the user the skill name and a one-line summary of what it captured.");
 }

package/dist-server/server/skills.js

@@ -1191,6 +1191,27 @@ export function applyStagedSkillWrite(botId, id, options = {}) {
     writeStaged(botId, store);
     return installed;
 }
+/** Full Access uses the same exact-content apply path. Once installed, a
+ * receipt or staging-cleanup failure must not tell the caller to apply again. */
+export function applySkillWriteWithReceipt(botId, staged, recordApplied) {
+    let installed;
+    try {
+        const result = applyStagedSkillWrite(botId, staged.id, {
+            expectedSha256: staged.sha256,
+            onApplied: (skill) => {
+                installed = skill;
+                recordApplied(skill);
+            },
+        });
+        return "error" in result ? result : { result };
+    }
+    catch (error) {
+        if (!installed)
+            throw error;
+        return { result: installed, settlementPending: true,
+            message: "Skill change applied. Recording its receipt or cleaning up staging could not finish; do not apply it again." };
+    }
+}
 /** The skills block appended to a bot's system prompt: enabled skills only,
  * index lines only — the same progressive-disclosure shape the spec asks
  * agents for. Bodies never ride the prompt; the bot reads the file when a

package/dist-server/server/steer-queue.js

@@ -71,6 +71,7 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         sendId: options.sendId,
         reason: options.reason,
         unattended: options.unattended,
+        peerAsk: options.peerAsk,
     };
     saveChatFollowup({ id, kind: "bot", ownerId: botId, threadId, payload: item });
     entry.items.push(item);
@@ -132,6 +133,7 @@ export function drainSteeredMessages(store, run, isBlocked) {
                 replyToId: item.replyToId,
                 sendId: item.sendId,
                 queueId: item.messageId,
+                peerAsk: item.peerAsk,
             }));
         }
         const last = appended.at(-1);

package/dist-server/server/store.js

@@ -199,6 +199,14 @@ export const ACTIVITY_BUSY = new Set(["working", "waiting-on-you", "no-signal"])
 /** What a task is called before its first message names it. */
 export const UNTITLED_TASK = "New task";
 export const UNTITLED_THREAD = "New thread";
+/** How a thread title is stored: one trim, one cut. Every title arrives
+ * through this — the name a bot passes to createTask and the name a person
+ * types in the sidebar alike — which is what makes "is this title still
+ * the one the machine made?" a question you can answer by comparing. */
+const TASK_TITLE_MAX = 80;
+export function threadTitleFrom(title) {
+    return title?.trim().slice(0, TASK_TITLE_MAX) || UNTITLED_THREAD;
+}
 /** A task's name, taken from the first thing you asked it to do. */
 export function titleFromMessage(text) {
     const line = text.trim().split("\n")[0].trim();
@@ -378,15 +386,27 @@ export class Store {
             // bots.json write. Revoke it before schedulers, listeners, or HTTP can
             // start any new work.
             if (b.approvalGrant !== undefined) {
-                b.approvalMode = "ask";
-                b.autoApprove = false;
-                delete b.approvalGrant;
-                for (const task of b.tasks ?? []) {
-                    if (task.approvalMode === "full" || task.approvalMode === "custom") {
-                        task.approvalMode = "ask";
-                        task.autoApprove = false;
+                const threadOnly = b.approvalGrant.threadOnly === true;
+                if (threadOnly) {
+                    // A crash may land between saving the target and clearing its
+                    // journal. Revoke that target only, never unrelated threads.
+                    const target = b.tasks?.find(task => task.threadId === b.approvalGrant?.threadId);
+                    if (target) {
+                        target.approvalMode = "ask";
+                        target.autoApprove = false;
+                    }
+                }
+                if (!threadOnly) {
+                    b.approvalMode = "ask";
+                    b.autoApprove = false;
+                    for (const task of b.tasks ?? []) {
+                        if (task.approvalMode === "full" || task.approvalMode === "custom") {
+                            task.approvalMode = "ask";
+                            task.autoApprove = false;
+                        }
                     }
                 }
+                delete b.approvalGrant;
                 botsMigrated = true;
             }
             const avatar = botAvatarProfile(b);
@@ -1617,6 +1637,7 @@ export class Store {
         return {
             ...bot,
             threadId: task.threadId,
+            approvalGrant: bot.approvalGrant?.threadOnly && bot.approvalGrant.threadId !== threadId ? undefined : bot.approvalGrant,
             modelSelection: structuredClone(task.modelSelection ?? bot.modelSelection),
             resumeCursors: structuredClone(task.resumeCursors),
             approvalMode: task.approvalMode ?? (task.autoApprove === undefined ? bot.approvalMode : undefined),
@@ -1697,7 +1718,7 @@ export class Store {
             return null;
         const task = {
             threadId: newId(),
-            title: title?.trim().slice(0, 80) || UNTITLED_THREAD,
+            title: threadTitleFrom(title),
             createdAt: Date.now(),
             ...(projectId ? { projectId } : {}),
             ...(openedBy ? { openedBy: structuredClone(openedBy) } : {}),
@@ -1750,6 +1771,87 @@ export class Store {
         this.emit({ type: "bot", botId });
         return task;
     }
+    /** Where a bot-to-bot send outside a room lands: the PAIR CONVERSATION
+     * for (sender, recipient) — the recipient's task stamped `openedBy` this
+     * sender with kind "pair".
+     *
+     * Its scope is global for those two bots: deliberately not per source
+     * thread and not per assignment, so a teammate you work with all day is
+     * one readable row in the recipient's sidebar that remembers what was
+     * asked last time, instead of one row per message. Nothing about the
+     * caller's current turn takes part in choosing it — no dispatch
+     * generation, no request key — and never the recipient's selected
+     * thread, which belongs to the person.
+     *
+     * Two things bend that rule, both deliberately:
+     *
+     *   adoption — a recipient still carrying threads this sender opened
+     *   before pair conversations existed (one per assignment, each titled
+     *   with a sliced brief) has its most recently active one stamped as the
+     *   pair conversation instead of gaining yet another row, so the sprawl
+     *   stops on upgrade day. Nothing is deleted or closed. A start_thread
+     *   handoff is left alone: the sender named that job itself and tracks
+     *   it by its own delegation id.
+     *
+     *   concurrency — a second assignment arriving while the pair
+     *   conversation is still working (`working`, which the caller answers
+     *   from live turn state) gets its own work thread, so two jobs never
+     *   interleave in one transcript. `label` names that thread; the caller
+     *   closes it once its result has been reported. A pair conversation
+     *   never auto-closes. */
+    resolvePairConversation(sender, recipientId, options) {
+        if (!this.bot(recipientId))
+            return null;
+        const title = `@${sender.name}`;
+        const opener = (kind, at = Date.now()) => ({ botId: sender.id, name: sender.name, kind, at });
+        const fromSender = this.tasks(recipientId).filter((task) => task.openedBy?.botId === sender.id);
+        let pair = fromSender.find((task) => task.openedBy?.kind === "pair");
+        if (!pair) {
+            const lastActivity = (task) => this.messagesTail(task.threadId, 1).messages.at(-1)?.at ?? task.openedBy?.at ?? task.createdAt;
+            const adopted = fromSender
+                .filter((task) => !task.openedBy?.kind && !task.openedBy?.delegationId && !task.closedBy)
+                .sort((a, b) => lastActivity(b) - lastActivity(a))[0];
+            if (adopted) {
+                // Keep the hour it was really opened: list_threads and the sidebar
+                // order by it, and adoption is not a new conversation.
+                this.setTaskOpenedBy(recipientId, adopted.threadId, opener("pair", adopted.openedBy?.at ?? adopted.createdAt));
+                // The title changes only when nobody typed it. The rule: rename it
+                // when it still equals what createTask made of the assignment that
+                // opened the thread — and that assignment is still the thread's
+                // first message, "@Recipient <brief>" — so the comparison is
+                // threadTitleFrom(that brief). Anything else is a name a person
+                // chose, and a thread with no request to read (its handoff never
+                // ran) cannot be checked, so both keep the title they have.
+                if (adopted.title === this.openingRequestTitle(recipientId, adopted.threadId)) {
+                    this.renameTask(recipientId, adopted.threadId, title);
+                }
+                pair = adopted;
+            }
+        }
+        if (pair && !options.working(pair.threadId)) {
+            // A conversation the sender closed after reading a result is picked
+            // back up, never replaced: closing is only the sidebar's idle state.
+            if (pair.closedBy)
+                this.setTaskClosedBy(recipientId, pair.threadId, null);
+            return { task: pair, created: false };
+        }
+        // The brief is never a title. An 80-character slice of an assignment
+        // is the row nobody can read, and a durable conversation outlives the
+        // one brief that opened it.
+        const task = this.createTask(recipientId, pair ? `${title} · ${options.label || "parallel work"}` : title, false, undefined, opener(pair ? "work" : "pair"));
+        return task ? { task, created: true } : null;
+    }
+    /** The title a peer-opened thread was born with: what createTask made of
+     * the request that opened it, which is still the first message in it,
+     * addressed "@Recipient <brief>". null when there is no such message to
+     * read — an unrun handoff proves nothing about who named the row. */
+    openingRequestTitle(recipientId, threadId) {
+        const first = this.messagesFor(threadId)[0]?.text?.trim();
+        if (!first)
+            return null;
+        const addressed = `@${this.bot(recipientId)?.name ?? ""} `;
+        return threadTitleFrom(first.startsWith(addressed) ? first.slice(addressed.length) : first);
+    }
     switchTask(botId, threadId) {
         const bot = this.bot(botId);
         const task = bot?.tasks?.find((t) => t.threadId === threadId);