openmausbot 0.1.77 → 0.1.78

package/dist-server/server/profile-requests.js

@@ -1,5 +1,6 @@
 // propose_profile: a bot proposes changes to its own name, title, description,
-// SOUL.md, or working folder; the change lands only when the user confirms the card. Same
+// SOUL.md, or working folder; confirmed cards and Full Access submissions share
+// the same validated commit path. Same
 // shape as routine-requests.ts, much smaller: the profile commits in one
 // store call, and staleness is a hash of the five fields instead of a
 // scheduler revision. Everything here is re-validated at confirm time —
@@ -163,6 +164,7 @@ export class ProfileRequestService {
     store;
     now;
     canPersist;
+    autoApply;
     /** Public: a caller's section membership can change between propose and
      * confirm, and tests flip this mid-scenario to model that. */
     validateTarget;
@@ -170,9 +172,17 @@ export class ProfileRequestService {
         this.store = options.store;
         this.now = options.now ?? Date.now;
         this.canPersist = options.canPersist;
+        this.autoApply = options.autoApply;
         this.validateTarget = options.validateTarget;
     }
     propose(args) {
+        return this.prepare(args);
+    }
+    submit(args) {
+        const proposal = this.prepare(args, true);
+        return { ...proposal, state: proposal.result ? "applied" : "pending" };
+    }
+    prepare(args, submitted = false) {
         const reason = reasonText(args.reason);
         const changes = parseChanges(args.changes);
         const targetBotId = args.targetBotId ?? args.botId;
@@ -220,13 +230,15 @@ export class ProfileRequestService {
         if (persistence && !persistence.ok) {
             throw new ProfileRequestError(persistence.error, persistence.status);
         }
+        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
         const messageInput = {
             role: "bot",
             kind: "options",
             card: {
                 title: copy.title,
                 subtitle: copy.detail,
-                options: ["Confirm", "Cancel"],
+                options: automatic ? [] : ["Confirm", "Cancel"],
+                ...(automatic ? { dismissed: true } : {}),
                 requestId,
                 tool: "update_profile",
                 profileRequest: payload,
@@ -235,7 +247,15 @@ export class ProfileRequestService {
         if (args.from)
             messageInput.from = args.from;
         const message = this.store.appendMessage(args.threadId, messageInput);
-        return { requestId, messageId: message.id, title: copy.title, summary: copy.summary, detail: copy.detail };
+        const proposal = { requestId, messageId: message.id, title: copy.title, summary: copy.summary, detail: copy.detail };
+        if (!automatic)
+            return proposal;
+        // The hidden receipt is persisted before the profile changes. The same
+        // validation and durable commit marker serve both automatic and human decisions.
+        const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
+        if (result.state === "applied")
+            return { ...proposal, result };
+        throw new ProfileRequestError(result.state === "invalid" ? result.error : "The profile change could not be applied", result.state === "invalid" ? result.status : 409);
     }
     /** Claims a profile card even after it was settled, so a duplicate click
      * never re-applies an already-applied change. */
@@ -313,7 +333,9 @@ export class ProfileRequestService {
             const status = error instanceof ProfileRequestError ? error.status : 400;
             const detail = error instanceof Error ? error.message : String(error);
             const saved = this.store.bot(payload.targetBotId)?.lastProfileRequestId === payload.requestId;
-            const notice = "Profile saved. Confirm again to finish recording this decision; the changes will not be applied again.";
+            const notice = card.dismissed && card.options.length === 0
+                ? "Profile saved. Recording the operation receipt could not finish; the changes will not be applied again."
+                : "Profile saved. Confirm again to finish recording this decision; the changes will not be applied again.";
             try {
                 this.store.patchMessage(args.threadId, message.id, {
                     card: { ...card, held: saved ? notice : redactSecretsInText(detail).slice(0, 500) },

package/dist-server/server/room-handoffs.js

@@ -172,6 +172,41 @@ export class RoomHandoffs {
     activeDirect(threadId) {
         return [...this.nodes.values()].some(n => !n.groupId && n.threadId === threadId && !terminal(n));
     }
+    /** Work this conversation handed out that has not settled yet. The
+     * conversation's own node is not outstanding — only what it waits on. */
+    outstandingDirect(threadId) {
+        return [...this.nodes.values()].filter(node => {
+            if (terminal(node) || !node.parentId)
+                return false;
+            const parent = this.nodes.get(node.parentId);
+            return Boolean(parent && !parent.groupId && parent.threadId === threadId);
+        });
+    }
+    /** Stop this conversation without reaching into a teammate that is already
+     * working. Its provider process is left alone: it finishes and its result
+     * is still reported here. Work that never started is cancelled, because
+     * nothing is lost. This conversation stops being awaited either way, so no
+     * teammate result resumes a stopped chat. Returns what was left running. */
+    stopAwaitingDirect(threadId, reason = "Stopped by user") {
+        const left = [];
+        for (const node of this.nodes.values()) {
+            if (node.groupId || node.threadId !== threadId || terminal(node))
+                continue;
+            for (const child of this.children(node.id)) {
+                if (terminal(child))
+                    continue;
+                if (child.status === "queued")
+                    this.cancelTree(child, "Stopped before it started");
+                else
+                    left.push(child);
+            }
+            node.status = "cancelled";
+            node.result = reason;
+            this.controllers.get(node.id)?.abort();
+            this.publish(node);
+        }
+        return left;
+    }
     tick() {
         if (this.loadError)
             return;
@@ -200,7 +235,9 @@ export class RoomHandoffs {
             // A newly queued child starts only after its author has settled.
             if (parent && (parent.status === "source" || parent.status === "running"))
                 continue;
-            if (parent && terminal(parent)) {
+            // A stopped source stops waiting; only work that never started is
+            // dropped with it. A teammate mid-turn keeps its process and reports.
+            if (parent && terminal(parent) && n.status === "queued") {
                 this.cancelTree(n, "Originating request has ended");
                 continue;
             }

package/dist-server/server/routine-requests.js

@@ -1,5 +1,7 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
+import { cronScheduleLabel } from "../shared/cron-label.js";
+import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
 import { newId } from "./contracts.js";
 import { redactSecretsInText } from "./redact.js";
 import { parseJson, schemaIssue } from "./schema.js";
@@ -33,6 +35,7 @@ const toolIntervalWindowSchema = z.object({
     end: z.string().max(5),
 }).strict();
 const routineToolScheduleSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("cron"), expression: z.string().max(256), timeZone: z.string().max(128) }).strict(),
     z.object({ type: z.literal("once"), at: z.string().max(64) }).strict(),
     z.object({
         type: z.literal("weekly"),
@@ -82,7 +85,18 @@ const storedIntervalWindowSchema = z.object({
     start: z.string().regex(TIME),
     end: z.string().regex(TIME),
 }).strict().refine(({ start, end }) => start < end, "Stored interval window must end later on the same day");
+const storedCronScheduleSchema = z.object({
+    type: z.literal("cron"), expression: z.string().max(256), timeZone: z.string().max(128),
+}).strict().superRefine((schedule, context) => {
+    try {
+        normalizeCronSchedule(schedule);
+    }
+    catch (error) {
+        context.addIssue({ code: "custom", message: error instanceof Error ? error.message : "Invalid stored cron schedule" });
+    }
+});
 const storedScheduleSchema = z.discriminatedUnion("type", [
+    storedCronScheduleSchema,
     z.object({ type: z.literal("once"), at: z.number().int().nonnegative() }).strict(),
     z.object({
         type: z.literal("daily"),
@@ -116,6 +130,7 @@ const storedScheduleSchema = z.discriminatedUnion("type", [
     }
 });
 const storedScheduleChangesSchema = z.discriminatedUnion("type", [
+    storedCronScheduleSchema,
     z.object({ type: z.literal("once"), at: z.number().int().nonnegative() }).strict(),
     z.object({
         type: z.literal("daily"),
@@ -287,6 +302,14 @@ function rfc3339Instant(value, offsetMessage) {
     return at;
 }
 function normalizeSchedule(schedule, now) {
+    if (schedule.type === "cron") {
+        try {
+            return normalizeCronSchedule(schedule, now);
+        }
+        catch (error) {
+            throw new RoutineRequestError(error instanceof Error ? error.message : "Invalid cron schedule");
+        }
+    }
     if (schedule.type === "once") {
         const at = rfc3339Instant(schedule.at, "One-time schedules need an RFC3339 date-time with an explicit timezone offset");
         if (at <= now)
@@ -424,6 +447,8 @@ function normalizedOperation(manager, botId, validated, now) {
     return { action: validated.action, routineId: id, expectedUpdatedAt: current.updatedAt };
 }
 function asSchedule(schedule, now) {
+    if (schedule.type === "cron")
+        return { ...schedule };
     if (schedule.type === "once")
         return { type: "once", at: schedule.at };
     if (schedule.type === "interval") {
@@ -455,6 +480,8 @@ function schedulePatch(schedule, now, current) {
     };
 }
 function effectiveSchedule(current, incoming) {
+    if (incoming.type === "cron")
+        return { ...incoming };
     if (incoming.type !== "interval") {
         return incoming.type === "once"
             ? { type: "once", at: incoming.at }
@@ -524,6 +551,8 @@ function intervalHasRestrictions(schedule) {
     return schedule.weekdays !== undefined || schedule.window !== undefined || schedule.endsAt !== undefined;
 }
 export function scheduleText(schedule, timeZone) {
+    if (schedule.type === "cron")
+        return `${cronScheduleLabel(schedule)} · Cron: ${schedule.expression}`;
     if (schedule.type === "once")
         return `${formatInstant(schedule.at, timeZone)} (${timeZone})`;
     if (schedule.type === "interval") {
@@ -552,6 +581,8 @@ export function consequenceLine(schedule, continuity = false) {
     // over is the previous run's report, so say that rather than contradict
     // the Continuity line above it.
     const session = continuity ? "each run starts a fresh session with the previous run's report" : "each run starts a fresh session";
+    if (schedule.type === "cron")
+        return `Will run at matching calendar times in ${schedule.timeZone}; ${session}.`;
     if (schedule.type === "once")
         return "Will run once; that run starts a fresh session.";
     if (schedule.type === "interval") {
@@ -621,6 +652,7 @@ function cardCopy(operation, manager, timeZone, now) {
         };
     }
     const nextRunAt = nextForOperation(operation, manager, now);
+    const scheduleTimeZone = definition.schedule.type === "cron" ? definition.schedule.timeZone : timeZone;
     const when = operation.action === "run_now" ? "Now" : scheduleText(definition.schedule, timeZone);
     const destination = definition.runOn === "cloud" ? "Cloud VM" : "This OpenMausBot setup";
     const current = operation.action === "create"
@@ -638,7 +670,7 @@ function cardCopy(operation, manager, timeZone, now) {
                 ? `Next allowed time after confirmation (${timeZone})`
                 : "One interval after confirmation"
             : nextRunAt !== null
-                ? formatInstant(nextRunAt, timeZone)
+                ? formatInstant(nextRunAt, scheduleTimeZone)
                 : operation.action === "pause"
                     ? "None — this routine will be paused"
                     : operation.action === "delete"
@@ -661,6 +693,9 @@ function cardCopy(operation, manager, timeZone, now) {
             ...(forBot ? [`For: @${redactSecretsInText(forBot.name)} — each run uses that bot's engine and permissions`] : []),
             `Schedule: ${when}`,
             `Next run: ${nextDescription}`,
+            ...(definition.schedule.type === "cron" && nextRunAt !== null && operation.action !== "run_now"
+                ? [`Next 3 runs (${scheduleTimeZone}): ${nextCronRuns(definition.schedule, now, 3).map((at) => formatInstant(at, scheduleTimeZone)).join(" · ")}`]
+                : []),
             `Runs on: ${destination}`,
             `Run limit: ${definition.timeoutMinutes === undefined ? "No limit" : `${definition.timeoutMinutes} minutes`}`,
             `Continuity: ${definition.continuity ? "Carries the previous run's report into the next run" : "Each run starts fresh"}`,
@@ -766,6 +801,14 @@ function revalidateOperation(operation, manager, botId, now) {
         : operation.action === "update"
             ? operation.changes.schedule
             : undefined;
+    if (schedule?.type === "cron") {
+        try {
+            normalizeCronSchedule(schedule, now);
+        }
+        catch (error) {
+            throw new RoutineRequestError(error instanceof Error ? error.message : "Invalid cron schedule", 409);
+        }
+    }
     if (schedule?.type === "once" && schedule.at <= now) {
         throw new RoutineRequestError("That one-time schedule is now in the past. Ask the bot to propose a new time.", 409);
     }
@@ -810,6 +853,7 @@ export class RoutineRequestService {
     cloudReady;
     canPersist;
     validateTarget;
+    autoApply;
     constructor(options) {
         this.store = options.store;
         this.routines = options.routines;
@@ -818,8 +862,16 @@ export class RoutineRequestService {
         this.cloudReady = options.cloudReady;
         this.canPersist = options.canPersist;
         this.validateTarget = options.validateTarget;
+        this.autoApply = options.autoApply;
     }
     async propose(args) {
+        return this.prepare(args);
+    }
+    async submit(args) {
+        const proposal = await this.prepare(args, true);
+        return { ...proposal, state: proposal.result ? "applied" : "pending" };
+    }
+    async prepare(args, submitted = false) {
         const botId = text(args.botId, "botId", 128);
         const threadId = text(args.threadId, "threadId", 128);
         const at = this.now();
@@ -848,7 +900,8 @@ export class RoutineRequestService {
             createdAt: cardAt,
             operation,
         };
-        const timeZone = this.timeZone();
+        const definition = effectiveDefinition(operation, this.routines);
+        const timeZone = definition?.schedule.type === "cron" ? definition.schedule.timeZone : this.timeZone();
         const copy = cardCopy(operation, this.routines, timeZone, cardAt);
         const messageInput = {
             role: "bot",
@@ -874,8 +927,14 @@ export class RoutineRequestService {
         if (args.canCommit && !args.canCommit()) {
             throw new RoutineRequestError("The requesting turn ended before this proposal could be saved", 401);
         }
+        // Resolve the current source-thread grant after the asynchronous probe.
+        const automatic = submitted && this.autoApply?.(botId, threadId) === true;
+        if (automatic) {
+            messageInput.card.options = [];
+            messageInput.card.dismissed = true;
+        }
         const message = this.store.appendMessage(threadId, messageInput);
-        return {
+        const proposal = {
             requestId,
             messageId: message.id,
             title: copy.title,
@@ -884,6 +943,30 @@ export class RoutineRequestService {
             nextRunAt: copy.nextRunAt,
             timeZone,
         };
+        if (!automatic)
+            return proposal;
+        // Persist a hidden receipt first, then use the existing validated,
+        // idempotent commit path without exposing a pending confirmation.
+        let result;
+        try {
+            result = this.resolve({ botId, threadId, requestId, behavior: "allow" });
+        }
+        catch (error) {
+            result = { claimed: true, state: "invalid", error: error instanceof Error ? error.message : String(error), status: error instanceof RoutineRequestError ? error.status : 400 };
+        }
+        if (result.state === "applied")
+            return { ...proposal, result };
+        // The scheduler commit can succeed even if settling its transcript
+        // fails. Report that exact result; a retry only finishes the receipt.
+        const receipt = this.routines.routineRequestReceipt(requestId);
+        if (receipt && receipt.botId === botId && receipt.threadId === threadId && receipt.messageId === message.id &&
+            receipt.fingerprintVersion === ROUTINE_REQUEST_FINGERPRINT_VERSION && receipt.fingerprint === routineRequestFingerprint(payload, message.id)) {
+            return { ...proposal, result: {
+                    claimed: true, state: "applied", action: receipt.action, resultId: receipt.resultId,
+                    settlementPending: true, message: "Routine change applied. Recording the operation receipt could not finish; the change will not be applied again.",
+                } };
+        }
+        throw new RoutineRequestError(result.state === "invalid" ? result.error : "The routine change could not be applied", result.state === "invalid" ? result.status : 409);
     }
     async requireCloudReadiness(operation) {
         if (!this.cloudReady || operation.action === "pause" || operation.action === "delete")

package/dist-server/server/routines.js

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { DATA_DIR } from "./config.js";
 import { writeFileAtomic } from "./atomic.js";
 import { redactSecretsInText } from "./redact.js";
+import { normalizeCronSchedule, nextCronRuns } from "../shared/routine-schedule.js";
 const persistedSourceThreadId = z.string().trim().min(1).optional().catch(undefined);
 const webhookRunReceiptSchema = z.object({
     webhookId: z.string().min(1).max(200),
@@ -96,6 +97,8 @@ function loadAttachments(value) {
 function cloneSchedule(schedule) {
     if (schedule.type === "once")
         return { type: "once", at: schedule.at };
+    if (schedule.type === "cron")
+        return { ...schedule };
     if (schedule.type === "interval") {
         return {
             type: "interval",
@@ -236,7 +239,12 @@ function cleanIntervalEndsAt(value, anchorAt) {
 function finishedOrder(run) {
     return run.finishedAt ?? run.createdAt;
 }
-function cleanSchedule(schedule) {
+export class RoutineScheduleError extends Error {
+    status = 400;
+}
+function parseSchedule(schedule, after) {
+    if (schedule?.type === "cron")
+        return normalizeCronSchedule(schedule, after);
     if (schedule?.type === "once") {
         const at = Number(schedule.at);
         if (!Number.isFinite(at))
@@ -274,9 +282,17 @@ function cleanSchedule(schedule) {
     }
     throw new Error("Choose a supported schedule");
 }
-function loadSchedule(value) {
+function cleanSchedule(schedule, after) {
+    try {
+        return parseSchedule(schedule, after);
+    }
+    catch (error) {
+        throw new RoutineScheduleError(error.message);
+    }
+}
+function loadSchedule(value, after) {
     try {
-        return cleanSchedule(value);
+        return cleanSchedule(value, after);
     }
     catch {
         return null;
@@ -313,10 +329,12 @@ function nextAlignedInterval(schedule, after) {
     const candidate = schedule.anchorAt + (intervalsElapsed + 1) * intervalMs;
     return Number.isSafeInteger(candidate) && candidate <= MAX_DATE_MS ? candidate : null;
 }
-/** Next wall-clock occurrence in this computer's timezone, strictly after `after`. */
+/** Next occurrence strictly after `after`: cron uses its saved zone, daily uses the host zone. */
 export function nextOccurrence(schedule, after) {
     if (schedule.type === "once")
         return schedule.at > after ? schedule.at : null;
+    if (schedule.type === "cron")
+        return nextCronRuns(schedule, after, 1)[0] ?? null;
     if (schedule.type === "interval") {
         const intervalMs = schedule.everyMinutes * 60_000;
         let candidate = nextAlignedInterval(schedule, after);
@@ -378,7 +396,7 @@ function mergeScheduleUpdate(current, incoming) {
     }
     return merged;
 }
-function sanitizeInput(input) {
+function sanitizeInput(input, after) {
     const name = String(input.name ?? "").trim().slice(0, 80);
     const prompt = String(input.prompt ?? "").trim().slice(0, 20_000);
     const botId = String(input.botId ?? "").trim();
@@ -420,7 +438,7 @@ function sanitizeInput(input) {
         groupId: target === "room-goal" ? groupId : undefined,
         runOn,
         enabled: input.enabled !== false,
-        schedule: cleanSchedule(input.schedule),
+        schedule: cleanSchedule(input.schedule, after),
         durationMinutes: Math.min(240, Math.max(5, Math.round(Number(input.durationMinutes) || 30))),
         ...(timeoutMinutes === undefined ? {} : { timeoutMinutes }),
         attachments,
@@ -445,7 +463,7 @@ export class RoutineManager {
             const disk = JSON.parse(readFileSync(this.file, "utf8"));
             this.routines = Array.isArray(disk.routines)
                 ? disk.routines.flatMap((routine) => {
-                    const schedule = loadSchedule(routine.schedule);
+                    const schedule = loadSchedule(routine.schedule, this.now());
                     if (!schedule)
                         return [];
                     const target = loadTarget(routine.target);
@@ -630,10 +648,10 @@ export class RoutineManager {
                 throw new Error("This routine request was already applied");
             }
         }
-        const clean = sanitizeInput(input);
+        const at = this.now();
+        const clean = sanitizeInput(input, at);
         if (this.targetState(clean) === "missing")
             throw new Error(this.missingTargetMessage(clean.target));
-        const at = this.now();
         const nextRunAt = clean.enabled ? this.initialOccurrence(clean.schedule, at) : null;
         if (clean.schedule.type === "interval" && clean.enabled && nextRunAt === null) {
             throw new Error("This interval has no future runs. Choose a later end date or turn it off.");
@@ -682,7 +700,7 @@ export class RoutineManager {
             timeoutMinutes: Object.hasOwn(patch, "timeoutMinutes") ? patch.timeoutMinutes : routine.timeoutMinutes,
             attachments: patch.attachments ?? routine.attachments,
             continuity: patch.continuity ?? routine.continuity,
-        });
+        }, now);
         if (this.targetState(clean) === "missing")
             throw new Error(this.missingTargetMessage(clean.target));
         const scheduleChanged = JSON.stringify(clean.schedule) !== JSON.stringify(routine.schedule);
@@ -1058,9 +1076,9 @@ export class RoutineManager {
                         const scheduledFor = routine.schedule.type === "interval" && late <= CATCH_UP_MS
                             ? latestIntervalOccurrence(routine.schedule, now) ?? pendingAt
                             : pendingAt;
-                        // One slow interval run must not build an unbounded queue of stale
-                        // copies behind it. The series still advances on its original phase.
-                        const overlapping = routine.schedule.type === "interval" && this.runs.some((run) => run.routineId === routine.id && ["queued", "running", "waiting"].includes(run.status));
+                        // Frequent recurring work must not build an unbounded queue of stale
+                        // copies. Elapsed intervals keep their phase; cron keeps its calendar.
+                        const overlapping = (routine.schedule.type === "interval" || routine.schedule.type === "cron") && this.runs.some((run) => run.routineId === routine.id && ["queued", "running", "waiting"].includes(run.status));
                         if (!overlapping) {
                             const run = this.newRun(routine, scheduledFor, false, allocations);
                             if (late > CATCH_UP_MS) {

package/dist-server/server/setup-mode.js

@@ -1,15 +1,13 @@
 // Setup mode: optional coaching when the user asks for it with /setup.
 // An empty profile is not a request to interview the user. The bot says
-// what it intends, and then configures itself only through proposal cards
-// (propose_profile, propose_routine, skill_manage, request_credential) — so
-// nothing changes without the user's approval. Mirrors skill-learn.ts:
+// what it intends, and then configures itself through the harness tools
+// (propose_profile, propose_routine, skill_manage, request_credential), which
+// enforce the granted approval level. Mirrors skill-learn.ts:
 // /setup is a turn-text rewrite plus a prompt block, never a hidden mode.
 //
-// Setup mode is card-gated, not provenance-gated: it doesn't matter who sent
-// the message that entered it — a peer message or a routine trigger that
-// happens to begin with /setup enters it exactly like a message the user
-// typed, and nothing about the bot actually changes until a card is
-// confirmed. And like /learn, only the current turn's text is rewritten —
+// This coaching block grants no additional authority: the services still
+// check the actual caller, target and effective conversation permissions.
+// Like /learn, only the current turn's text is rewritten —
 // the transcript keeps the raw "/setup …" user message verbatim, so replay
 // and history read the same thing the user sent.
 const SETUP_COMMAND = /^\/setup(?:\s+|$)([\s\S]*)$/i;
@@ -47,11 +45,11 @@ function folderClause(cwd) {
 function buildSetupPrompt(profileAside, cwd) {
     return ("\n\nThe user explicitly asked you to set yourself up. For this setup request, help configure the bot from what the user tells you." +
         ` First ask at most four questions that change what you would build: what the job is, when it should happen (on demand, on a schedule, or when something arrives), which apps or accounts it touches, and ${folderClause(cwd)}.` +
-        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Wait for a yes." +
-        " When they say yes, first send one message that lists the cards you are about to raise, then make the tool calls — the cards must appear after that message, never before it. After the tool calls add at most one short line and do not repeat the list." +
-        ` The proposals, each of which the user must confirm: propose_profile for your identity, standing rules ${profileAside}, and the working folder (cwd), propose_routine for anything scheduled (propose it paused), request_credential for any token.` +
-        " Never claim something is set up until its card is confirmed." +
-        " Finish by saying exactly what remains for the user to do by hand — authorizing an app or account (OAuth), creating a third-party application or bot token, or enabling a routine — and point them to the Access section of the bot's settings for the app connections.");
+        " Then, before any tool call, tell the user in plain language what you intend: who you will be, what you will do and when, where you will work, what you will need from them, and what you will not do. Ask for missing choices, not an extra yes for already-requested actions under granted Full Access." +
+        " First send one message describing the changes you are about to request, then make the tool calls. Follow each result: if applied, continue without another confirmation; if pending, end the turn and wait for its in-app decision. Do not repeat the list or claim success from the permission mode alone." +
+        ` Use propose_profile for your identity, standing rules ${profileAside}, and the working folder (cwd), propose_routine only for a schedule the user requested, and request_credential for any missing token.` +
+        " Full Access does not supply answers, credentials, or broader permissions for another bot. A credential request still needs the user's secure entry. Report failed or cancelled changes honestly." +
+        " Finish by saying exactly what remains for the user to do by hand — authorizing an app or account (OAuth), creating a third-party application or bot token, or deciding a pending review — and point them to the Access section of the bot's settings for the app connections.");
 }
 /** The setup block naming skill_manage, for a turn with skill authoring on. */
 export const SETUP_PROMPT = buildSetupPrompt(SKILL_MANAGE_ASIDE);

package/dist-server/server/skill-learn.js

@@ -1,6 +1,6 @@
 // `/learn` — turn a described workflow, URL, folder, or "what we just did"
-// into a staged SKILL.md. The live agent authors the skill with skill_manage;
-// the harness lands it DISABLED until a person confirms the in-app card.
+// into a reusable SKILL.md. The live agent authors the skill with skill_manage;
+// the harness applies it under granted Full Access or stages a pending review.
 //
 // There is no separate distillation engine. This module only builds the
 // prompt and recognises the slash command, so it works on every engine
@@ -56,13 +56,13 @@ Quality bar:
 export function buildLearnPrompt(userRequest) {
     const req = userRequest.trim() ||
         "the workflow we just went through in this conversation — review the steps taken and distill them into a reusable skill";
-    return (`${LEARN_PROMPT_MARKER} The user wants you to learn a reusable skill from the request below, and stage it for their review.\n\n` +
+    return (`${LEARN_PROMPT_MARKER} The user wants you to learn a reusable skill from the request below, using the granted access level.\n\n` +
         `THE REQUEST:\n${req}\n\n` +
         "Do this:\n" +
         "1. Inventory every source the user named, using the tools you already have — file tools for local paths, web fetch for URLs, and this conversation if they referred to something you just did. If the request is ambiguous about scope, make a reasonable choice and note it; do not stall.\n" +
         "2. Check existing skills with skills_list. If one already covers this topic, leave it alone unless the user explicitly asked to revise that named learned/editable skill. For an explicit revision, read only the exact SKILL.md path listed for that skill in your system prompt (the native .agents/skills/<exact-name>/SKILL.md link is a fallback), preserve every still-valid step, re-verify what changed, then call skill_manage with action=\"update\" and skill_name set to that exact name. If you cannot read or verify the current skill, stop instead of replacing it from memory. For a genuinely new skill, use action=\"create\".\n" +
         "3. Pass source as the exact URL or folder you used, or \"conversation\" when the conversation is the source.\n" +
-        "4. skill_manage only STAGES the change. A create stays inactive and an update leaves the current version untouched until the user approves the review card.\n\n" +
+        "4. Follow the skill_manage result: with granted Full Access it may apply immediately. After an applied result, continue the requested work without another confirmation. If review is pending, a create stays inactive and an update leaves the current version untouched; end the turn and wait for the in-app decision. Never claim success from the permission mode alone, and report failed or cancelled changes honestly.\n\n" +
         AUTHORING_STANDARDS +
         "\n\nWhen done, tell the user the skill name and a one-line summary of what it captured.");
 }

package/dist-server/server/skills.js

@@ -1191,6 +1191,27 @@ export function applyStagedSkillWrite(botId, id, options = {}) {
     writeStaged(botId, store);
     return installed;
 }
+/** Full Access uses the same exact-content apply path. Once installed, a
+ * receipt or staging-cleanup failure must not tell the caller to apply again. */
+export function applySkillWriteWithReceipt(botId, staged, recordApplied) {
+    let installed;
+    try {
+        const result = applyStagedSkillWrite(botId, staged.id, {
+            expectedSha256: staged.sha256,
+            onApplied: (skill) => {
+                installed = skill;
+                recordApplied(skill);
+            },
+        });
+        return "error" in result ? result : { result };
+    }
+    catch (error) {
+        if (!installed)
+            throw error;
+        return { result: installed, settlementPending: true,
+            message: "Skill change applied. Recording its receipt or cleaning up staging could not finish; do not apply it again." };
+    }
+}
 /** The skills block appended to a bot's system prompt: enabled skills only,
  * index lines only — the same progressive-disclosure shape the spec asks
  * agents for. Bodies never ride the prompt; the bot reads the file when a