openmausbot 0.1.78 → 0.1.79

package/dist-server/server/index.js

@@ -11,6 +11,7 @@ import { SharedComputerControl } from "./shared-computer-control.js";
 import { RoomHandoffs } from "./room-handoffs.js";
 import { botAvatarUrlFromStoredPath } from "../shared/bot-avatar.js";
 import { BOT_PROFILE_LIMITS } from "../shared/bot-profile.js";
+import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
 import { approvalModeFor, supportsApprovalMode, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
@@ -38,7 +39,6 @@ import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
 import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
 import { ComputerControl } from "./computer-control.js";
-import { MAX_REMOTE_COMMAND_LENGTH } from "./remote-computer.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
 import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAGE_GROUPINGS, flushUsageLedger } from "./usage-ledger.js";
@@ -80,7 +80,7 @@ import { buildRecoveryText, buildTurnContext, engineIsFresh } from "./turn-conte
 import { extractTurnImages } from "./turn-images.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
 import { TurnResources, workspaceResource } from "./turn-resources.js";
-import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, updateMemory, appendMemoryLog, isMemoryTopicName, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
+import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, supportsWorkspaceFiles, updateMemory, appendMemoryLog, isMemoryTopicName, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
 import { readMemoryTopic } from "./workspace.js";
 import { MEMORY_INDEX, MemoryStoreError, memoryCapacity, memoryOverview, openMemoryLocation, readMemoryDoc, } from "./memory-store.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, flushMemoryJournal, journalMemoryDelete, journalMemoryWrite, readMemoryJournal, revertMemoryChange, } from "./memory-journal.js";
@@ -613,7 +613,7 @@ async function interruptDirectThread(botId, threadId) {
     const owner = botForThread(botId, threadId);
     cancelDirectTurnDispatch(botId, threadId);
     revokeInternalCapabilitiesForThread(threadId);
-    await (owner ? registry.get(owner.modelSelection.instanceId) : undefined)?.adapter.interruptTurn(threadId);
+    await (owner ? runningTurnInstance(owner, threadId) : null)?.adapter.interruptTurn(threadId);
     closeOpenApprovals(threadId);
 }
 /** Stop left teammates mid-turn: say so in the transcript, name them, and
@@ -1222,7 +1222,7 @@ function previewSystemPrompt(bot) {
         destination: previewComputer,
         browserOn: caps?.browserMcp === true && builtInBrowserEnabled(cfg) && bot.browser !== false,
     });
-    const privateWorkspace = instance && !["grok", "boxAgent"].includes(instance.driverKind);
+    const privateWorkspace = instance && supportsWorkspaceFiles(instance.driverKind);
     const built = buildSystemPrompt(persona, bot.soul ?? "", [
         {
             id: "setup",
@@ -1243,7 +1243,7 @@ function previewSystemPrompt(bot) {
         { id: "routine", label: "Routines", text: agentsMounted ? ROUTINE_PROMPT : "" },
         { id: "profile", label: "Profile changes", text: agentsMounted ? PROFILE_PROMPT : "" },
         { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
-        { id: "memory", label: "Memory", text: privateWorkspace ? memorySystemPrompt(bot.id) : "" },
+        { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace) }) },
         { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
     ]);
     const totalBytes = built.sections.reduce((n, s) => n + s.bytes, 0);
@@ -2794,9 +2794,9 @@ const watchdog = new TurnWatchdog({
         repeats.settle(turn.threadId);
         const bot = botForThread(turn.botId, turn.threadId);
         const routineRun = activeRoutineRunForThread(turn.threadId);
-        const instance = routineRun?.runOn === "cloud"
-            ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent")
-            : bot ? registry.get(bot.modelSelection.instanceId) : null;
+        const instance = bot
+            ? runningTurnInstance(bot, turn.threadId, routineRun?.runOn)
+            : routineRun?.runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") : null;
         void instance?.adapter.interruptTurn(turn.threadId).catch(() => { });
         const minutes = Math.round(TURN_STALL_MS / 60_000);
         if (routineRun?.target === "bot") {
@@ -2898,8 +2898,10 @@ bus.subscribe((event) => {
 bus.subscribe((event) => {
     if (shouldIgnoreProviderEvent(event))
         return;
-    if (event.type === "turn.completed" || event.type === "session.exited")
+    if (event.type === "turn.completed" || event.type === "session.exited") {
+        runningTurnEngines.delete(event.threadId);
         endMemoryTurn(event.threadId);
+    }
 });
 // Bots currently working with nobody at the keyboard — a webhook turn, or a
 // turn a webhook-driven bot handed to a teammate. Auto mode is a decision
@@ -3157,6 +3159,23 @@ function turnProvider(bot, runOn) {
         return null;
     return bot.cloudBackend === "vps" ? "vps" : "box";
 }
+/** A turn on the cloud computer runs ON the cloud computer: the Box runs the
+ * bot's own harness there with the computer tools built in, so nothing on this
+ * machine relays clicks and screenshots. Every start/interrupt of a turn asks
+ * here which engine owns it. */
+function turnInstance(bot, runOn) {
+    const onBox = runOn === "cloud"
+        || turnProvider(bot, runOn) === "box" && (bot.computer === "cloud" || inheritedTeamComputer(bot) !== undefined);
+    return onBox
+        ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
+        : registry.get(bot.modelSelection.instanceId);
+}
+/** The engine that dispatched each live turn. A bot's settings may change
+ * mid-turn; an interrupt or steer must reach the engine actually running. */
+const runningTurnEngines = new Map();
+function runningTurnInstance(bot, threadId, runOn) {
+    return runningTurnEngines.get(threadId) ?? turnInstance(bot, runOn);
+}
 function providerTransitionForTurn(bot, runOn) {
     const provider = turnProvider(bot, runOn);
     return provider && computerProviderConfigTransitions.has(provider)
@@ -3648,7 +3667,7 @@ bus.subscribe((event) => {
             pushMessage({
                 role: "bot",
                 kind: "activity",
-                tool: { name: `error: ${event.message.slice(0, 160)}`, ok: false, setup: event.setup },
+                tool: { name: `error: ${event.message.slice(0, 160)}`, ok: false, setup: event.setup, ...(event.terminal ? { terminal: true } : {}) },
             });
             // a setup error means the engine could not even start: the bot is
             // dead until something changes, not merely idle. The next successful
@@ -4576,11 +4595,9 @@ async function startTurn(botId, text, opts) {
     const task = store.taskByThread(bot.id, threadId);
     if (!task)
         throw Object.assign(new Error("no such task"), { status: 404 });
-    const instance = opts?.runOn === "cloud"
-        ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
-        : registry.get(bot.modelSelection.instanceId);
+    const instance = turnInstance(bot, opts?.runOn);
     if (!instance) {
-        throw Object.assign(new Error(opts?.runOn === "cloud"
+        throw Object.assign(new Error(opts?.runOn === "cloud" || bot.computer === "cloud" || inheritedTeamComputer(bot)
             ? "the Cloud VM runner is unavailable — configure Box in App Settings"
             : `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
     }
@@ -4791,7 +4808,7 @@ async function startTurn(botId, text, opts) {
             // than the user's home: a bot with file tools and acceptEdits gets a
             // desk, not the whole house — and the workspace is where its
             // MEMORY.md lives. API/box engines have no local filesystem story.
-            const worksInWorkspace = instance.driverKind !== "grok" && instance.driverKind !== "boxAgent";
+            const worksInWorkspace = supportsWorkspaceFiles(instance.driverKind);
             if (worksInWorkspace) {
                 ensureWorkspace(bot.id);
                 // baseline for the journal's turn-boundary diff (see the bus hook)
@@ -5175,13 +5192,14 @@ async function startTurn(botId, text, opts) {
                 { id: "profile", label: "Profile changes", text: profilePrompt },
                 { id: "learn", label: "Skill authoring", text: learnPrompt },
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
-                { id: "memory", label: "Memory", text: privateWorkspace ? memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents) }) : "" },
+                { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace }) },
                 { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
                 { id: "skill-instructions", label: "Skill instructions", text: skillInstructions },
                 { id: "playbooks", label: "Playbooks", text: packagePlaybooks },
                 { id: "webhook", label: "Webhook provenance", text: opts?.automationSource === "webhook" ? WEBHOOK_PROMPT : "" },
                 { id: "mentions", label: "Mentions", text: boundedCoordination && tagged.length ? `The user named these existing teammates: ${tagged.map(b => `${peerName(b.name)} (${b.id})`).join(", ")}. Use coordinate_bots when their contribution is needed; do not substitute native helper agents for these bots.` : mentionPrompt(tagged) },
             ]);
+            runningTurnEngines.set(threadId, instance);
             const dispatch = await guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
                 botId: bot.id,
@@ -5458,7 +5476,7 @@ async function interruptRoutineGroupGoal(groupId, threadId, outcome) {
     const bot = speaker ? store.bot(speaker.botId) : undefined;
     cancelGroupTurnOperations(groupId, threadId, outcome);
     revokeInternalCapabilitiesForThread(threadId);
-    await (bot ? registry.get(bot.modelSelection.instanceId) : undefined)
+    await (bot ? runningTurnInstance(bot, threadId) : null)
         ?.adapter.interruptTurn(threadId)
         .catch(() => { });
     closeOpenApprovals(threadId);
@@ -5494,7 +5512,7 @@ async function stopBotForEmergencyApprovalDowngrade(botId) {
         cancelGroupTurnOperations(groupTurn.group.id, groupTurn.threadId);
         const results = await Promise.allSettled([
             directStop,
-            registry.get(bot.modelSelection.instanceId)?.adapter.interruptTurn(groupTurn.threadId),
+            runningTurnInstance(bot, groupTurn.threadId)?.adapter.interruptTurn(groupTurn.threadId),
         ]);
         closeOpenApprovals(groupTurn.threadId);
         const failure = results.find((result) => result.status === "rejected");
@@ -5573,11 +5591,9 @@ routines = new RoutineManager({
         discardDelegations(commsBus, threadId);
         cancelDirectTurnDispatch(botId, threadId);
         revokeInternalCapabilitiesForThread(threadId);
-        const instance = runOn === "cloud"
-            ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
-            : bot
-                ? registry.get(bot.modelSelection.instanceId)
-                : null;
+        const instance = bot
+            ? runningTurnInstance(bot, threadId, runOn)
+            : runOn === "cloud" ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null : null;
         try {
             await instance?.adapter.interruptTurn(threadId);
         }
@@ -6323,7 +6339,7 @@ setupRetry = 0) {
     const preparedApprovalMode = approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId));
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
-    const instance = registry.get(bot.modelSelection.instanceId);
+    const instance = turnInstance(bot);
     const userName = cfg.profile?.name?.trim() || "User";
     if (providerInstancesChanging.has(bot.modelSelection.instanceId)) {
         onDispatchError?.(`${bot.name}'s provider account is being updated — try again shortly`);
@@ -6446,7 +6462,7 @@ setupRetry = 0) {
             : Boolean(readyGroup && store.groupTaskByThread(readyGroup.id, threadId));
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
-        const setupChanged = registry.get(preparedSelection.instanceId) !== instance ||
+        const setupChanged = turnInstance(readyBot) !== instance ||
             approvalModeForTurn(readyBot, Boolean(orchestration?.roomHandoffId)) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
@@ -6637,7 +6653,7 @@ setupRetry = 0) {
         const text = `${roomContext}\n\n(Reply to the conversation above as ${bot.name}.)${learnBlock}${cardContinuation ? `\n\n${cardContinuation}` : ""}`;
         // same workspace + memory as a 1:1 turn — the room is a different
         // conversation, not a different bot
-        const worksInWorkspace = instance.driverKind !== "grok" && instance.driverKind !== "boxAgent";
+        const worksInWorkspace = supportsWorkspaceFiles(instance.driverKind);
         const workspace = worksInWorkspace ? ensureWorkspace(bot.id) : undefined;
         // a room member's memory writes are journaled the same as a 1:1 turn's
         if (workspace)
@@ -6654,6 +6670,7 @@ setupRetry = 0) {
             if (drift.drift !== Boolean(bot.soulDrift))
                 store.patchBot(bot.id, { soulDrift: drift.drift });
         }
+        const roomMemory = memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace });
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
             { id: "files", label: "File locations", text: workspace ? workspaceLocationsPrompt(bot.id, cwd, readyBot.cwd) : "" },
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
@@ -6668,7 +6685,7 @@ setupRetry = 0) {
             // byte-identical. The write guidance follows the tools actually
             // mounted, exactly as the 1:1 path decides it: memory_update is on the
             // agents server, so a room turn with it must be told to use it too.
-            { id: "memory", label: "Memory", text: workspace ? `\n${memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents) }).trim()}` : "" },
+            { id: "memory", label: "Memory", text: roomMemory ? `\n${roomMemory.trim()}` : "" },
             { id: "skills", label: "Skills index", text: workspace ? skillsSystemPrompt(bot.id) : "" },
             { id: "skill-instructions", label: "Skill instructions", text: renderSkillInstructions(selectedSkills, { includeRoot: Boolean(workspace) }) },
             { id: "playbooks", label: "Playbooks", text: installedPlaybookInstructions(text, bot.playbooks) },
@@ -6770,6 +6787,7 @@ setupRetry = 0) {
             watchdog.watch(threadId, bot.id);
             onProviderHandshakeStarted?.();
             providerDispatched = true;
+            runningTurnEngines.set(threadId, instance);
             guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
                 botId: readyBot.id,
@@ -11976,7 +11994,7 @@ const handleRequest = async (req, res) => {
                         : undefined;
                 return {
                     threadId,
-                    instance: busy ? registry.get(busy.modelSelection.instanceId) : undefined,
+                    instance: busy ? runningTurnInstance(busy, threadId) : undefined,
                 };
             });
             // Abort every queued operation before the first provider round trip;
@@ -12646,7 +12664,7 @@ const handleRequest = async (req, res) => {
                 if (groupTurn) {
                     cancelGroupTurnOperations(groupTurn.group.id, groupTurn.threadId);
                     revokeInternalCapabilitiesForThread(groupTurn.threadId);
-                    await registry.get(existingBot.modelSelection.instanceId)?.adapter.interruptTurn(groupTurn.threadId).catch(() => { });
+                    await runningTurnInstance(existingBot, groupTurn.threadId)?.adapter.interruptTurn(groupTurn.threadId).catch(() => { });
                     closeOpenApprovals(groupTurn.threadId);
                 }
             }
@@ -12746,12 +12764,11 @@ const handleRequest = async (req, res) => {
                     }
                     await routines.cancelRun(routineRun.id);
                 }
-                const instance = registry.get(bot.modelSelection.instanceId);
                 const groupTurn = activeGroupTurnForBot(bot.id);
                 if (groupTurn) {
                     cancelGroupTurnOperations(groupTurn.group.id, groupTurn.threadId);
                     revokeInternalCapabilitiesForThread(groupTurn.threadId);
-                    await instance?.adapter.interruptTurn(groupTurn.threadId).catch(() => { });
+                    await runningTurnInstance(bot, groupTurn.threadId)?.adapter.interruptTurn(groupTurn.threadId).catch(() => { });
                     closeOpenApprovals(groupTurn.threadId);
                 }
             }));
@@ -13296,7 +13313,7 @@ const handleRequest = async (req, res) => {
                 // loses a race with turn settlement, or the engine cannot steer, the
                 // existing server-side queue records it atomically for the next turn.
                 if (currentAtStart.busy) {
-                    const instance = registry.get(currentAtStart.modelSelection.instanceId);
+                    const instance = runningTurnInstance(currentAtStart, threadId);
                     let steered = false;
                     // A live text steer has no image side channel. Keep an attachment
                     // message intact for the next ordinary turn, where central image
@@ -14492,7 +14509,7 @@ const handleRequest = async (req, res) => {
                 claudeUpdatesInFlight.delete(target.cli);
             }
         }
-        // ── per-instance CLI path override (custom builds / versioned bins) ──
+        // ── per-instance settings (CLI/account or API tool support) ──
         // PATCH /api/instances/:id {cli: "/path/to/cli" | ""} — "" reverts to the
         // driver default. Only this idle instance is replaced; siblings keep running.
         const instancePatch = /^\/api\/instances\/([\w.-]+)$/.exec(path);
@@ -14503,7 +14520,7 @@ const handleRequest = async (req, res) => {
             }
             const parsed = instanceSettingsSchema.safeParse(await readBody(req, 16384));
             if (!parsed.success)
-                return json(res, 400, { error: "Supply a valid CLI path, account name or configuration directory." });
+                return json(res, 400, { error: "Supply a valid CLI path, account name, configuration directory or boolean tools setting." });
             const body = parsed.data;
             const instanceId = instancePatch[1];
             if (providerConfigBusy)
@@ -14522,6 +14539,12 @@ const handleRequest = async (req, res) => {
                 if ((body.displayName !== undefined || body.configDir !== undefined) && entry.driver !== "claudeAgent") {
                     return json(res, 400, { error: "Account settings are currently available for Claude only." });
                 }
+                if (body.tools !== undefined) {
+                    if (!["openai-compat", "grok", "minimax"].includes(entry.driver)) {
+                        return json(res, 400, { error: "The tools setting is available for OpenAI-compatible, Grok API and MiniMax API instances only." });
+                    }
+                    entry.config = { ...entry.config, tools: body.tools };
+                }
                 if (body.displayName !== undefined)
                     entry.displayName = body.displayName;
                 if (body.configDir !== undefined) {
@@ -14939,7 +14962,10 @@ const handleRequest = async (req, res) => {
                 // patch SELECTS, not the one already saved, or pasting a Cartesia key
                 // while switching from ElevenLabs validates against the wrong service
                 const newTts = patch.tts;
-                if (newTts?.key?.trim()) {
+                // Chatterbox has no key at all — its credential is a local server
+                // address, and an ElevenLabs round trip would be the wrong test
+                const selectedVoiceProvider = newTts?.provider ?? cfg.tts?.provider ?? "elevenlabs";
+                if (newTts?.key?.trim() && selectedVoiceProvider !== "chatterbox") {
                     const check = await tts.verifyKey(newTts.key.trim());
                     if (!check.ok)
                         return json(res, 400, { error: check.message });
@@ -15525,7 +15551,7 @@ const handleRequest = async (req, res) => {
             const activeBoxTurn = botHasActiveTurn(botId);
             if (["provision", "sleep"].includes(m[2]) && activeBoxTurn) {
                 return json(res, 409, {
-                    error: "this bot's cloud computer is being used by an active turn — interrupt it first",
+                    error: CLOUD_COMPUTER_BUSY_ERROR,
                 });
             }
             // Input validity is independent of destination authorization. Preserve
@@ -15535,9 +15561,9 @@ const handleRequest = async (req, res) => {
             if (m[2] === "exec") {
                 const body = await readBody(req);
                 boxCommand = String(body?.command ?? "");
-                if (boxCommand.length > MAX_REMOTE_COMMAND_LENGTH) {
+                if (boxCommand.length > box.MAX_REMOTE_COMMAND_LENGTH) {
                     return json(res, 400, {
-                        error: `command is too long (maximum ${MAX_REMOTE_COMMAND_LENGTH} characters)`,
+                        error: `command is too long (maximum ${box.MAX_REMOTE_COMMAND_LENGTH} characters)`,
                     });
                 }
             }

package/dist-server/server/proxy-paths.js

@@ -32,7 +32,6 @@ export function resolveProxy(relative) {
  * the check that would have caught the 0.1.24 breakage. */
 export const SPAWNED_PROXIES = {
     browser: resolveProxy("browser-proxy"),
-    computer: resolveProxy("computer-proxy"),
     localComputer: resolveProxy("local-computer-proxy"),
     permission: resolveProxy("permission-proxy"),
     containerMcp: resolveProxy("container-mcp"),

package/dist-server/server/room-handoffs.js

@@ -8,11 +8,13 @@ const nodeSchema = z.object({
     key: z.string(), text: z.string(), createdAt: z.number(),
     status: z.enum(["source", "queued", "running", "waiting", "resume", "completed", "failed", "cancelled"]),
     result: z.string().default(""), reported: z.boolean().default(false),
-    executions: z.number().int().nonnegative().default(0),
+    executions: z.number().int().nonnegative().default(0), startedAt: z.number().optional(),
     approvalGranted: z.boolean().default(false),
     kind: z.enum(["work", "assignment"]).default("work"),
 });
-export const ROOM_HANDOFF_LIMITS = { depth: 4, requests: 24, executions: 48, lifetimeMs: 30 * 60_000 };
+export const ROOM_HANDOFF_LIMITS = { depth: 4, requests: 24, executions: 48, lifetimeMs: 30 * 60_000, minRunwayMs: 10 * 60_000 };
+/** Renders elapsed milliseconds as whole minutes, or seconds under one minute. */
+const duration = (ms) => ms >= 60_000 ? `${Math.floor(ms / 60_000)}m` : `${Math.floor(ms / 1000)}s`;
 const terminal = (n) => ["completed", "failed", "cancelled"].includes(n.status);
 /** A bounded tree of addressed room turns. Waiting for children never holds a
  * room/provider queue; reporting is data, and only the named parent is resumed.
@@ -65,6 +67,31 @@ export class RoomHandoffs {
         }
         return path;
     }
+    /** The earliest moment this node may be failed for lifetime: the tree
+     * ceiling or, for a running node, its own start plus a minimum runway. */
+    deadline(n) {
+        const anchor = n.status === "running" ? n.startedAt ?? n.createdAt : n.createdAt;
+        return Math.max(this.root(n).createdAt + ROOM_HANDOFF_LIMITS.lifetimeMs, anchor + ROOM_HANDOFF_LIMITS.minRunwayMs);
+    }
+    /** An ancestor past its ceiling is not failed while a descendant is still
+     * running inside its own runway; cancelling would cascade into that work. */
+    protectsRunner(n) {
+        return this.children(n.id).some(c => !terminal(c) && ((c.status === "running" && this.now() <= this.deadline(c)) || this.protectsRunner(c)));
+    }
+    /** A parent still owes the follow-up execution that decides on its
+     * children's results; the ceiling defers to that execution's own runway. */
+    owesFollowUp(n) {
+        if (n.status === "resume")
+            return true;
+        if (n.status !== "waiting")
+            return false;
+        const children = this.children(n.id);
+        return (children.length > 0 && children.every(c => terminal(c))) || children.some(c => this.owesFollowUp(c));
+    }
+    /** Names the budget, the node's status, and the elapsed tree time. */
+    lifetimeError(n) {
+        return `Room handoff lifetime budget exhausted: node was ${n.status} after ${duration(this.now() - this.root(n).createdAt)} of the ${duration(ROOM_HANDOFF_LIMITS.lifetimeMs)} tree lifetime`;
+    }
     enqueue(source, generation, parentId, target, key, text, approvalGranted = false, rework = false, sourceText = "") {
         if (this.loadError)
             throw new Error(this.loadError);
@@ -100,8 +127,14 @@ export class RoomHandoffs {
             throw new Error("Room handoff depth limit reached");
         const root = fresh ? parent : this.root(parent);
         const count = [...this.nodes.values()].filter(n => n.rootId === parent.rootId && n.parentId).length;
-        if (count >= ROOM_HANDOFF_LIMITS.requests || this.now() - root.createdAt > ROOM_HANDOFF_LIMITS.lifetimeMs)
+        if (count >= ROOM_HANDOFF_LIMITS.requests)
             throw new Error("Room handoff budget exhausted");
+        // Refuse work the tree's lifetime budget cannot honestly serve: a node
+        // accepted in the root's last minutes would be doomed at enqueue time.
+        const remaining = ROOM_HANDOFF_LIMITS.lifetimeMs - (this.now() - root.createdAt);
+        if (remaining < ROOM_HANDOFF_LIMITS.minRunwayMs) {
+            throw new Error(`Room handoff budget exhausted: only ${duration(Math.max(remaining, 0))} of the ${duration(ROOM_HANDOFF_LIMITS.lifetimeMs)} tree lifetime remains`);
+        }
         // Retain a bounded audit history without evicting active requests.
         if (this.nodes.size >= 1000) {
             const oldRoots = [...this.nodes.values()].filter(n => !n.parentId && terminal(n)).sort((a, b) => a.createdAt - b.createdAt);
@@ -210,14 +243,18 @@ export class RoomHandoffs {
     tick() {
         if (this.loadError)
             return;
+        // Validate and expire deepest nodes first so each one is failed with its
+        // own status; an ancestor's cancellation then only sweeps what is left.
+        for (const n of [...this.nodes.values()].reverse()) {
+            if (terminal(n))
+                continue;
+            const error = this.hooks.validate(n, n.parentId ? this.nodes.get(n.parentId) : undefined);
+            if (error || (this.now() > this.deadline(n) && !this.protectsRunner(n) && !this.owesFollowUp(n))) {
+                this.cancelTree(n, error ?? this.lifetimeError(n), "failed");
+            }
+        }
         for (const n of this.nodes.values()) {
             const parent = n.parentId ? this.nodes.get(n.parentId) : undefined;
-            if (!terminal(n)) {
-                const error = this.hooks.validate(n, parent);
-                if (error || this.now() - this.root(n).createdAt > ROOM_HANDOFF_LIMITS.lifetimeMs) {
-                    this.cancelTree(n, error ?? "Room request timed out", "failed");
-                }
-            }
             if (terminal(n) && parent && !n.reported) {
                 this.hooks.report(n, parent);
                 n.reported = true;
@@ -253,6 +290,7 @@ export class RoomHandoffs {
             const childCount = this.children(n.id).length;
             root.executions += executionCost;
             n.status = "running";
+            n.startedAt = this.now();
             this.publish(n, root);
             const controller = new AbortController();
             this.controllers.set(n.id, controller);

package/dist-server/server/tts/chatterbox.js

@@ -0,0 +1,83 @@
+export const DEFAULT_MODEL = "chatterbox-turbo";
+/** What the picker falls back to when the server has no /v1/models. Most
+ * Chatterbox servers speak with one built-in voice unless told otherwise,
+ * so one honest entry beats a list of names the server may reject. */
+export const FALLBACK_VOICES = [
+    { id: "default", label: "Default", description: "the server's built-in Chatterbox voice" },
+];
+/** Accept "http://127.0.0.1:4123", the same with a trailing slash, and a
+ * base that already ends in /v1 — the address is typed by hand, so meet
+ * it halfway rather than 404ing over a slash. */
+export function apiRoot(baseUrl) {
+    const trimmed = baseUrl.trim().replace(/\/+$/, "");
+    return /\/v1$/i.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+async function safeJson(res) {
+    try {
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
+/** Prefer the server's own words over anything we can invent — wrapper
+ * services vary, and their "model not loaded" says more than a 500. */
+function message(status, what, body) {
+    const theirs = (typeof body?.error === "string" && body.error.trim()) ||
+        (typeof body?.detail === "string" && body.detail.trim()) ||
+        (typeof body?.message === "string" && body.message.trim()) ||
+        "";
+    return theirs ? `${what} failed: ${theirs}` : `${what} failed (${status})`;
+}
+/** One bounded request shape for both calls: a dead server is the common
+ * failure, and it must be named in the user's words, quickly. */
+async function request(url, init, what, baseUrl) {
+    try {
+        return await fetch(url, init);
+    }
+    catch (e) {
+        if (e instanceof Error && (e.name === "TimeoutError" || e.name === "AbortError")) {
+            throw new Error(`${what} timed out — the Chatterbox server at ${baseUrl.trim()} did not answer`);
+        }
+        throw new Error(`couldn't reach the Chatterbox server at ${baseUrl.trim()} — check that it is running`);
+    }
+}
+export async function listChatterboxVoices(baseUrl) {
+    try {
+        const res = await request(`${apiRoot(baseUrl)}/models`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) }, "listing voices", baseUrl);
+        if (res.ok) {
+            const body = await safeJson(res);
+            const voices = (body?.data ?? [])
+                .map((m) => ({ id: String(m?.id ?? ""), label: String(m?.id ?? "") }))
+                .filter((v) => v.id);
+            if (voices.length)
+                return voices;
+        }
+    }
+    catch {
+        // fall through: the built-in entry below beats an empty picker
+    }
+    return FALLBACK_VOICES;
+}
+/** Ask for wav because every browser plays it and every OpenAI-compatible
+ * server can produce it; the server's own content-type wins when it says
+ * something else, so returned bytes are never mislabeled. */
+export async function synthesizeChatterbox(text, voiceId, baseUrl, model) {
+    const res = await request(`${apiRoot(baseUrl)}/audio/speech`, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "audio/wav" },
+        body: JSON.stringify({ model: model?.trim() || DEFAULT_MODEL, input: text, voice: voiceId, response_format: "wav" }),
+        signal: AbortSignal.timeout(60_000),
+    }, "speaking", baseUrl);
+    if (!res.ok)
+        throw new Error(message(res.status, "speaking", await safeJson(res)));
+    const header = (res.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    const mime = header === "audio/mpeg" || header === "audio/mp3"
+        ? "audio/mpeg"
+        : header === "audio/x-wav"
+            ? "audio/wav"
+            : header.startsWith("audio/")
+                ? header
+                : "audio/wav";
+    return { bytes: new Uint8Array(await res.arrayBuffer()), mime };
+}

package/dist-server/server/tts/index.js

@@ -1,3 +1,4 @@
+import * as chatterbox from "./chatterbox.js";
 import * as elevenlabs from "./elevenlabs.js";
 import * as systemVoices from "./system-voices.js";
 export class NoVoiceConfigured extends Error {
@@ -5,52 +6,73 @@ export class NoVoiceConfigured extends Error {
     // runs under `node --experimental-strip-types`, which is strip-ONLY, so a
     // parameter property is rejected at load time even though it typechecks
     reason;
-    constructor(reason) {
-        super(reason === "key"
-            ? "Add an ElevenLabs key in Settings on the computer to turn on voice."
-            : "Pick a voice in the agent profile.");
+    constructor(reason, hint) {
+        super(hint ??
+            (reason === "key"
+                ? "Add an ElevenLabs key in Settings on the computer to turn on voice."
+                : "Pick a voice in the agent profile."));
         this.reason = reason;
     }
 }
 export function voiceProvider(cfg) {
-    return cfg.tts?.provider === "system" ? "system" : "elevenlabs";
+    return cfg.tts?.provider === "system" || cfg.tts?.provider === "chatterbox" ? cfg.tts.provider : "elevenlabs";
 }
 /** The system provider needs no credential — it is only ever offered where
  * the platform actually has it, so "configured" means "this engine can
  * speak", not "a key is on file". */
 export function providerConfigured(cfg) {
-    return voiceProvider(cfg) === "system" ? systemVoices.systemVoicesAvailable() : Boolean(cfg.tts?.key);
+    const provider = voiceProvider(cfg);
+    if (provider === "system")
+        return systemVoices.systemVoicesAvailable();
+    if (provider === "chatterbox")
+        return Boolean(cfg.tts?.baseUrl?.trim());
+    return Boolean(cfg.tts?.key);
 }
 export function voiceConfigured(cfg) {
-    if (voiceProvider(cfg) === "system") {
+    const provider = voiceProvider(cfg);
+    if (provider === "system") {
         return systemVoices.systemVoicesAvailable() && Boolean(cfg.tts?.voice);
     }
+    if (provider === "chatterbox")
+        return Boolean(cfg.tts?.baseUrl?.trim() && cfg.tts?.voice);
     return Boolean(cfg.tts?.key && cfg.tts?.voice);
 }
 /** A per-bot voice is a complete choice too; it should not be blocked just
  * because the app-wide fallback has not been selected yet. */
 export function voiceReady(cfg, voiceId) {
-    if (voiceProvider(cfg) === "system") {
+    const provider = voiceProvider(cfg);
+    if (provider === "system") {
         return systemVoices.systemVoicesAvailable() && Boolean(voiceId || cfg.tts?.voice);
     }
+    if (provider === "chatterbox")
+        return Boolean(cfg.tts?.baseUrl?.trim() && (voiceId || cfg.tts?.voice));
     return Boolean(cfg.tts?.key && (voiceId || cfg.tts?.voice));
 }
 /** What the settings panel needs. Never includes the key — same write-only
- * rule as every other credential. */
+ * rule as every other credential. baseUrl and model are Chatterbox
+ * settings, not credentials, so they come back in full. */
 export function describeVoice(cfg) {
+    const provider = voiceProvider(cfg);
     return {
         configured: providerConfigured(cfg),
         ready: voiceConfigured(cfg),
         voice: cfg.tts?.voice ?? "",
-        provider: voiceProvider(cfg),
+        provider,
+        baseUrl: provider === "chatterbox" ? (cfg.tts?.baseUrl ?? "") : "",
+        model: provider === "chatterbox" ? (cfg.tts?.model ?? "") : "",
     };
 }
 export function verifyKey(key) {
     return elevenlabs.verifyKey(key);
 }
 export async function listVoices(cfg, run) {
-    if (voiceProvider(cfg) === "system")
+    const provider = voiceProvider(cfg);
+    if (provider === "system")
         return systemVoices.listSystemVoices(run);
+    if (provider === "chatterbox") {
+        const baseUrl = cfg.tts?.baseUrl?.trim();
+        return baseUrl ? chatterbox.listChatterboxVoices(baseUrl) : [];
+    }
     const key = cfg.tts?.key;
     if (!key)
         return [];
@@ -59,7 +81,8 @@ export async function listVoices(cfg, run) {
 /** Synthesize one utterance. Throws NoVoiceConfigured when there is nothing
  * to speak with, which the route turns into a 409 the client can explain. */
 export function speak(cfg, text, voiceId, run) {
-    if (voiceProvider(cfg) === "system") {
+    const provider = voiceProvider(cfg);
+    if (provider === "system") {
         const voice = voiceId || cfg.tts?.voice;
         // An injected runner is the cross-platform test seam for `/usr/bin/say`;
         // production calls omit it and remain strictly Darwin-gated.
@@ -69,6 +92,16 @@ export function speak(cfg, text, voiceId, run) {
             throw new NoVoiceConfigured("voice");
         return systemVoices.synthesizeSystem(text, voice, run);
     }
+    if (provider === "chatterbox") {
+        const baseUrl = cfg.tts?.baseUrl?.trim();
+        if (!baseUrl) {
+            throw new NoVoiceConfigured("key", "Add the address of your Chatterbox server in Settings on the computer to turn on voice.");
+        }
+        const voice = voiceId || cfg.tts?.voice;
+        if (!voice)
+            throw new NoVoiceConfigured("voice");
+        return chatterbox.synthesizeChatterbox(text, voice, baseUrl, cfg.tts?.model);
+    }
     const key = cfg.tts?.key;
     if (!key)
         throw new NoVoiceConfigured("key");