openmausbot 0.1.80 → 0.1.82

package/dist-server/server/index.js

@@ -3,6 +3,7 @@
 // folds one SSE event stream; every provider process runs here.
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { existsSync, readFileSync, rmSync, unlinkSync } from "node:fs";
+import { rm as removeDirectory } from "node:fs/promises";
 import { createServer } from "node:http";
 import { extname, join } from "node:path";
 import { z } from "zod";
@@ -31,13 +32,14 @@ import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from
 import * as box from "./box.js";
 import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
 import { boxCreateRecoverySnapshot, retireDeletedBoxCreate } from "./box-create-idempotency.js";
+import { boxDeletionSnapshot } from "./box-delete-journal.js";
 import { boxAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
 import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, roomPeerRosterSystemPrompt, roomRosterLine } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, saveConfig, showToolCallsEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, maxConcurrentBotThreads, threadEventLogMaxBytes, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, } from "./config.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
@@ -49,7 +51,7 @@ import { entitled } from "./enterprise.js";
 import { HOSTED_CONTRACT_HEADER, HOSTED_CONTRACT_METADATA, HOSTED_CONTRACT_VERSION } from "./hosted-contract.js";
 import { describeSpawnFailure, execCli } from "./procs.js";
 import { blockedTarget, buildNotification } from "./notify.js";
-import { isEffortLevel, newId, } from "./contracts.js";
+import { isEffortLevel, isModelVariant, newId, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { decodeGeneratedImage } from "./generated-image.js";
 import { MAX_MCP_SERVERS, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
@@ -57,8 +59,9 @@ import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
 import { getOrCreateChannel, mirrorActivity, mirrorExchange, mirrorReply } from "./comms-visibility.js";
-import { readMessageText, recallMessages, searchMessages, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups } from "./message-db.js";
-import { claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
+import { readMessageText, recallMessages, recentMessages, searchMessages, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups } from "./message-db.js";
+import { briefCrossingLabel, claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
+import { parseSince, recentWork, recentWorkPrompt, turnOutcomeLine } from "./recent-work.js";
 /** A session_read answer competes with the transcript for the context
  * window; a computer-use turn's output can run to hundreds of KB. */
 const SESSION_READ_MAX_CHARS = 8_000;
@@ -120,8 +123,9 @@ import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageAgentAsMember, parseBotPac
 import { createTeamManifest, importedMemberProfile, parseTeamManifest } from "./team-manifest.js";
 import { takeImportName } from "../shared/import-name.js";
 import { readThreadEvents } from "./thread-events.js";
+import { bindThreadLogCapProvider } from "./thread-log-rotation.js";
 import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
-import { memberTurnSelection } from "./member-turn.js";
+import { assertModelVariantSupported, memberTurnSelection } from "./member-turn.js";
 import { WebhookManager } from "./webhooks.js";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
 import { loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, selectBundledSkills } from "./skill-library.js";
@@ -130,8 +134,9 @@ import { createBotPackageExport } from "./package-export.js";
 import { createTeamBackup, importTeamBackup } from "./team-backup.js";
 import { MAX_TEAM_BACKUP_BYTES } from "../shared/team-backup.js";
 import { shouldMountLocalComputer } from "./local-routing.js";
+import { autoLocalVmAttachable } from "./container-computer.js";
 import { modelContextWindow } from "./model-context-window.js";
-import { resolveSurface } from "./surface.js";
+import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
 import { createGracefulShutdown } from "./graceful-shutdown.js";
 import { acquireDataDirLeaseForProcess } from "./data-dir-lease.js";
@@ -222,6 +227,10 @@ let companionMutationToken = DESKTOP_MANAGED ? "" : undefined;
 // Where remote clients reach this server (a proxy's public address); pairing URLs use it.
 const FALLBACK_PUBLIC_URL = process.env.OMB_PUBLIC_URL?.trim().replace(/\/+$/, "") || null;
 const cfg = loadConfig();
+// The per-thread event log cap is checked after every NDJSON append.
+// config.json is read once per process (a change restarts the server, like
+// every other hand-edited knob), so a binding made here never goes stale.
+bindThreadLogCapProvider(() => threadEventLogMaxBytes(cfg));
 const customDomainVerifier = createCustomDomainVerifier({ environmentId: ENVIRONMENT_ID });
 // "Sign in with your email" on /pair: the allow-list is read per call so a
 // Settings change or an env bootstrap applies without a restart.
@@ -388,6 +397,7 @@ const INTERNAL_CAPABILITY_ORPHAN_MS = 30 * 24 * 60 * 60_000;
 const internalCapabilities = new Map();
 const activeInternalGenerationByThread = new Map();
 const internalGenerationByProviderTurn = new ProviderTurnGenerationRegistry();
+const computerSelectionTurns = new Map();
 function beginInternalCapabilityGeneration(threadId, generation = randomUUID()) {
     const previous = activeInternalGenerationByThread.get(threadId);
     if (previous)
@@ -418,6 +428,7 @@ function revokeInternalCapabilityGeneration(threadId, generation) {
     internalGenerationByProviderTurn.deleteGeneration(threadId, generation);
 }
 function revokeInternalCapabilitiesForThread(threadId) {
+    computerSelectionTurns.delete(threadId);
     const generation = activeInternalGenerationByThread.get(threadId);
     if (generation)
         revokeInternalCapabilityGeneration(threadId, generation);
@@ -430,6 +441,7 @@ function revokeInternalCapabilitiesForThread(threadId) {
     }
 }
 function revokeAllInternalCapabilities() {
+    computerSelectionTurns.clear();
     internalCapabilities.clear();
     activeInternalGenerationByThread.clear();
     internalGenerationByProviderTurn.clear();
@@ -464,6 +476,10 @@ function authorizedInternalCapability(header) {
     return null;
 }
 function internalCapabilityIsActive(capability) {
+    const switching = computerSelectionTurns.get(capability.threadId);
+    if ((capability.kind === "computer" || capability.kind === "browser") &&
+        switching?.generation === capability.generation && switching.selected)
+        return false;
     if (capability.teamComputerId) {
         const pinned = teamComputerTurns.get(capability.threadId);
         if (pinned?.computerId !== capability.teamComputerId || pinned.owner.generation !== capability.generation ||
@@ -600,9 +616,39 @@ function releaseTurnResources(owner) {
         teamComputerTurns.delete(owner.threadId);
     }
 }
-function bindTurnComputer(owner, resource, exclusive = false) {
-    if (exclusive && !claimTurnResource(owner, resource)) {
-        throw Object.assign(new Error("another thread is using this computer — wait for it to finish"), { status: 409, code: "computer_busy" });
+async function bindTurnComputer(owner, resource, exclusive = false) {
+    const active = () => activeInternalGenerationByThread.get(owner.threadId) === owner.generation &&
+        turnResourceOwners.get(owner.threadId)?.generation === owner.generation;
+    let waitingMessage;
+    const deadline = Date.now() + GROUP_GOAL_WAIT_MAX_MS;
+    try {
+        while (true) {
+            if (!active())
+                throw new DirectTurnSetupCancelled("Computer wait cancelled");
+            if (!exclusive || claimTurnResource(owner, resource))
+                break;
+            if (!waitingMessage) {
+                const blocker = turnResources.blocker(resource, owner);
+                const holderBot = blocker && store.botByThread(blocker.threadId);
+                const holderTask = holderBot && blocker && store.taskByThread(holderBot.id, blocker.threadId);
+                const holder = holderBot ? `${holderBot.name}${holderTask?.title ? ` / ${holderTask.title}` : ""}`
+                    : blocker && store.groupByThread(blocker.threadId)?.name;
+                waitingMessage = store.appendMessage(owner.threadId, {
+                    role: "bot", kind: "activity",
+                    tool: { name: `Waiting for computer${holder ? ` — ${holder} is using it` : ""}; will continue automatically` },
+                    ...(holderBot && holderTask ? { threadRef: { botId: holderBot.id, threadId: holderTask.threadId, title: holderTask.title } } : {}),
+                });
+            }
+            if (Date.now() >= deadline)
+                throw new Error("Computer is still busy. Stop the turn using it, then retry.");
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+    }
+    finally {
+        if (waitingMessage)
+            store.patchMessage(owner.threadId, waitingMessage.id, {
+                tool: { name: active() && turnResources.owns(resource, owner) ? "Computer available — continuing" : "Computer wait ended", ok: true },
+            });
     }
     turnResourceOwners.set(owner.threadId, owner);
     turnComputerResources.set(owner.threadId, { owner, resource });
@@ -1019,9 +1065,19 @@ function checkedModelSelection(raw, current, requireAvailableModel = false) {
         }
         selection.effort = value.effort;
     }
+    if (value.variant !== undefined) {
+        if (!isModelVariant(value.variant)) {
+            return { ok: false, status: 400, error: "variant must be a non-empty model variant ID" };
+        }
+        if (value.effort !== undefined) {
+            return { ok: false, status: 400, error: "choose either a model variant or an effort level" };
+        }
+        selection.variant = value.variant;
+    }
     const changed = current && (selection.instanceId !== current.selection.instanceId ||
         selection.model !== current.selection.model ||
-        selection.effort !== current.selection.effort);
+        selection.effort !== current.selection.effort ||
+        selection.variant !== current.selection.variant);
     if (current?.busy && changed) {
         return { ok: false, status: 409, error: "the bot is working — stop it before changing models" };
     }
@@ -1051,6 +1107,9 @@ function checkedModelSelection(raw, current, requireAvailableModel = false) {
     if (target && selection.effort !== undefined && !allowed.includes(selection.effort)) {
         return { ok: false, status: 400, error: `effort "${selection.effort}" is not offered by this bot's engine` };
     }
+    if (target && selection.variant !== undefined && !target.adapter.capabilities.modelVariants) {
+        return { ok: false, status: 400, error: "model variants are not offered by this bot's engine" };
+    }
     return { ok: true, selection };
 }
 function checkedTaskModelSwitch(current, raw, updateBotDefault, resetApprovalToAsk, requireAvailableModel = false, trusted = false) {
@@ -1237,7 +1296,7 @@ function previewSystemPrompt(bot) {
     ]
         .filter(Boolean)
         .join(" ");
-    const instance = registry.get(bot.modelSelection.instanceId);
+    const instance = turnInstance(bot);
     const caps = instance?.adapter.capabilities;
     const teamComputer = inheritedTeamComputer(bot);
     const previewComputer = teamComputer ? "cloud" : bot.computer;
@@ -1278,7 +1337,12 @@ function previewSystemPrompt(bot) {
         },
         { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
         { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
-        { id: "plan", label: "Surface", text: previewPlan.note },
+        // Auto cannot know its place until dispatch, so the preview stays silent
+        // there and only carries the note; explicit settings preview the paragraph.
+        { id: "plan", label: "Surface", text: previewPlan.computer === undefined ? "" : surfacePrompt({
+                computer: previewPlan.computer && previewPlan.computer !== "off" && computerPromptKind ? previewPlan.computer : null,
+                browser: previewPlan.computer === undefined ? false : previewPlan.browser,
+            }, { note: previewPlan.note }) },
         { id: "composio", label: "Connected apps", text: caps?.composioMcp && bot.composio !== false && composio.configured(cfg) ? COMPOSIO_PROMPT : "" },
         { id: "mcp", label: "MCP servers", text: caps?.customMcp ? customMcpPrompt(Object.keys(customMcpServers(cfg, bot.mcpServers))) : "" },
         { id: "browser", label: "Browser", text: previewPlan.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
@@ -2051,7 +2115,16 @@ function outstandingAssignmentsPrompt(threadId) {
 const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     validate: (node, parent) => roomHandoffProblem(node, parent) ??
         (parent && store.bot(parent.botId)?.approvePeerComms && !fullAccessForSource(parent.botId, parent.threadId) && !node.approvalGranted ? "Sender now requires peer approval; submit a new approved request" : undefined),
-    busy: n => Boolean(store.bot(n.botId)?.busy || (n.groupId && store.group(n.groupId) && groupIsWorking(store.group(n.groupId)))),
+    // A direct follow-up is owed to one conversation, so it waits for that
+    // conversation, not for the whole bot. Bot-level busy aggregates every
+    // thread — including cards still waiting on the person — so one busy
+    // sibling thread would otherwise starve the owed resume forever while the
+    // UI keeps showing this thread working. Fresh work still queues behind a
+    // busy teammate's whole bot (#1238); an owed resume only needs its own
+    // thread free and a thread slot to admit it.
+    busy: n => !n.groupId && n.status === "resume"
+        ? threadBusy(n.botId, n.threadId) || botAtThreadCapacity(n.botId)
+        : Boolean(store.bot(n.botId)?.busy || (n.groupId && store.group(n.groupId) && groupIsWorking(store.group(n.groupId)))),
     changed: (groupIds, directThreadIds) => {
         for (const id of groupIds) {
             const group = store.group(id);
@@ -2900,10 +2973,12 @@ const watchdog = new TurnWatchdog({
                 groupSpeakers.delete(turn.threadId);
                 store.patchGroup(group.id, { busyBotId: null, unread: true });
             }
+            // A cleared UI busy flag must not strand this finished generation's
+            // computer claim. The generation checks above protect replacements.
+            releaseTurnResources(stalledResourceOwner);
             const currentBot = store.bot(turn.botId);
             if (currentBot?.busy) {
                 stopScreenPoller(currentBot.id, turn.threadId);
-                releaseTurnResources(stalledResourceOwner);
                 if (activeVpsThreads.get(currentBot.id) === turn.threadId)
                     activeVpsThreads.delete(currentBot.id);
                 if (store.taskByThread(currentBot.id, turn.threadId))
@@ -2963,6 +3038,41 @@ bus.subscribe((event) => {
         endMemoryTurn(event.threadId);
     }
 });
+// One line per finished turn in the bot's daily log (server/recent-work.ts):
+// what it said last, the tools it used, whether the turn failed. What a bot
+// did in one conversation was invisible from every other; the log is where
+// session_search finds it later, and it is never loaded whole into a
+// prompt. In a room the reply names its speaker; a room turn that never
+// replied has no one to credit and leaves no line.
+bus.subscribe((event) => {
+    if (shouldIgnoreProviderEvent(event))
+        return;
+    if (event.type !== "turn.completed" || !event.turnId)
+        return;
+    try {
+        const messages = store.messagesFor(event.threadId);
+        const reply = messages.findLast((message) => message.role === "bot" && message.kind === "text" && message.turnId === event.turnId);
+        const bot = store.botByThread(event.threadId) ?? (reply?.from ? store.bot(reply.from.botId) : undefined);
+        if (!bot)
+            return;
+        const tools = messages
+            .filter((message) => message.kind === "activity" && message.turnId === event.turnId && message.tool?.name)
+            .map((message) => message.tool.name);
+        const line = turnOutcomeLine({ ok: event.ok, reply: reply?.text, stopReason: event.stopReason, tools });
+        if (!line)
+            return;
+        appendMemoryLog(bot.id, line, {
+            source: memorySourceLabel({
+                room: store.groupByThread(event.threadId),
+                task: store.taskByThread(bot.id, event.threadId),
+                threadId: event.threadId,
+            }),
+        });
+    }
+    catch {
+        // a missing note never fails a turn
+    }
+});
 // Bots currently working with nobody at the keyboard — a webhook turn, or a
 // turn a webhook-driven bot handed to a teammate. Auto mode is a decision
 // someone made for turns they were present for, so these don't inherit it:
@@ -3042,6 +3152,15 @@ const localVmLeases = new LocalVmLeasePool(30 * 60_000);
 const localVmLifecycleBusy = new Set();
 const localVmThreadTargets = new Map();
 const localVmActiveThreads = new Map();
+/** Local VM targets this process has seen ready or recreatable — at boot, in
+ * the inventory, or in a turn. Auto probes the container runtime for a VM
+ * only when one of these exists, so an ordinary Auto turn on a machine with
+ * no VM never pays for a docker or podman call. */
+const localVmSeen = new Set();
+function noteLocalVmSeen(target, status) {
+    if (status && autoLocalVmAttachable(status))
+        localVmSeen.add(target.key);
+}
 let localVmImageBusy = false;
 let localVmProvisionBusy = false;
 let localVmModeChangeBusy = false;
@@ -3136,12 +3255,12 @@ async function attachTeamBox(computer, botId, owner, canMount, remoteAgent) {
         throw new Error("The team computer is being changed; wait for it to finish");
     if (computerControl.snapshot(ownerId).held)
         throw new Error("Release human control of the team computer before starting another turn");
-    bindTurnComputer(owner, `computer:box-bot:${ownerId}`, true);
+    await bindTurnComputer(owner, `computer:box-bot:${ownerId}`, true);
     teamComputerTurns.set(owner.threadId, { owner, computerId: computer.id, botId, remoteAgent });
     let machine = await box.findBox(cfg, ownerId);
     if (!machine)
         throw new Error("The team's Box computer is missing; explicitly create or retry it from the Team map");
-    bindTurnComputer(owner, `computer:box:${machine.id}`, true);
+    await bindTurnComputer(owner, `computer:box:${machine.id}`, true);
     const action = box.boxTurnLifecycleAction({ explicitCloud: true, canMount: true, state: typeof machine.state === "string" ? machine.state : null });
     if (action === "wake")
         machine = await box.readyBox(cfg, ownerId);
@@ -3201,7 +3320,8 @@ function providerOperationConflict(provider) {
         if (boxInventoryRequestsBusyIds.size > 0 || orphanBoxLifecycleBusyIds.size > 0) {
             return "wait for cloud computer actions to finish before changing the Box account";
         }
-        if (boxCreateRecoverySnapshot().some((entry) => !entry.resolved)) {
+        const deletingBoxIds = new Set(boxDeletionSnapshot().map((entry) => entry.boxId));
+        if (boxCreateRecoverySnapshot().some((entry) => !entry.resolved && (!entry.boxId || !deletingBoxIds.has(entry.boxId)))) {
             return "finish reconciling pending cloud computer creation before changing the Box account";
         }
     }
@@ -3210,34 +3330,168 @@ function providerOperationConflict(provider) {
     }
     return null;
 }
-function turnProvider(bot, runOn) {
-    if (runOn === "cloud" || registry.get(bot.modelSelection.instanceId)?.driverKind === "boxAgent")
-        return "box";
-    if (inheritedTeamComputer(bot))
+function turnSurfacePlan(bot, runOn, threadId) {
+    const instance = registry.get(bot.modelSelection.instanceId);
+    const forcedBox = runOn === "cloud" || Boolean(inheritedTeamComputer(bot));
+    return resolveSurface({
+        destination: forcedBox ? "cloud" : bot.computer,
+        pinnedSurface: forcedBox || !threadId ? null : store.taskByThread(bot.id, threadId)?.surface,
+        browserOn: builtInBrowserEnabled(cfg) && bot.browser !== false && instance?.adapter.capabilities.browserMcp === true,
+    });
+}
+function turnProvider(bot, runOn, threadId) {
+    if (runOn === "cloud" || inheritedTeamComputer(bot))
         return "box";
-    if (bot.computer !== undefined && bot.computer !== "cloud")
+    const wants = turnSurfacePlan(bot, runOn, threadId).computer;
+    if (wants !== undefined && wants !== "cloud")
         return null;
-    return bot.cloudBackend === "vps" ? "vps" : "box";
+    if (registry.get(bot.modelSelection.instanceId)?.driverKind === "boxAgent")
+        return "box";
+    return bot.cloudBackend === "vps" ? "vps" : wants === "cloud" ? "box" : null;
 }
 /** A turn on the cloud computer runs ON the cloud computer: the Box runs the
  * bot's own harness there with the computer tools built in, so nothing on this
  * machine relays clicks and screenshots. Every start/interrupt of a turn asks
  * here which engine owns it. */
-function turnInstance(bot, runOn) {
-    const onBox = runOn === "cloud"
-        || turnProvider(bot, runOn) === "box" && (bot.computer === "cloud" || inheritedTeamComputer(bot) !== undefined);
+function turnInstance(bot, runOn, threadId) {
+    const onBox = turnProvider(bot, runOn, threadId) === "box";
     return onBox
         ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
         : registry.get(bot.modelSelection.instanceId);
 }
+/** Preview requests carry the selected conversation, not whichever thread
+ * happens to be the bot's default. A query never grants lifecycle authority. */
+function computerPreviewBot(botId, url) {
+    const threadId = url.searchParams.get("threadId");
+    if (!threadId)
+        return store.bot(botId);
+    const bot = store.projectBotForTask(botId, threadId);
+    if (!bot)
+        throw Object.assign(new Error("no such task"), { status: 404 });
+    return directTurnBots.get(threadId) ?? bot;
+}
+async function computerPreviewSurface(bot, threadId) {
+    const plan = turnSurfacePlan(bot, undefined, threadId);
+    if (plan.computer !== undefined)
+        return plan.computer === "off" && plan.browser ? "browser" : plan.computer;
+    const instance = registry.get(bot.modelSelection.instanceId);
+    if (instance?.driverKind === "boxAgent")
+        return "cloud";
+    if (bot.cloudBackend === "vps") {
+        const remote = await vps.vpsComputerStatus(cfg, bot.id);
+        if (remote.ready)
+            return "cloud";
+    }
+    const target = localVmTargetForBot(bot.id);
+    if (instance?.adapter.capabilities.computerMcp && localVmSeen.has(target.key)) {
+        const vm = await containerComputerStatus(undefined, undefined, target).catch(() => null);
+        if (vm && autoLocalVmAttachable(vm))
+            return "vm";
+    }
+    if (shouldMountLocalComputer({ requested: undefined, hostPlatform: process.platform,
+        providerSupportsLocal: instance?.adapter.capabilities.localComputerMcp === true }) && readCuaConnection())
+        return "local";
+    if (bot.cloudBackend === "vps")
+        return "cloud"; // show its unavailable reason
+    return plan.browser ? "browser" : "off";
+}
+/** Discovery is read-only. Starting or creating a configured computer is
+ * deferred until a chat tool selects it and the old turn releases its tools. */
+async function selectableComputers(bot) {
+    const caps = registry.get(bot.modelSelection.instanceId)?.adapter.capabilities;
+    const off = bot.computer === "off";
+    const localEngine = registry.get(bot.modelSelection.instanceId)?.driverKind !== "boxAgent";
+    return Promise.all(["cloud", "vm", "local", "browser"].map(async (surface) => {
+        let ready = false;
+        let canStart = false;
+        let canCreate = false;
+        let reason = "This computer is not configured or running. Open the Computer panel to set it up.";
+        try {
+            if (off)
+                reason = "Computer access is Off in this bot's settings.";
+            else if (surface === "cloud") {
+                if (bot.cloudBackend === "vps") {
+                    const status = localEngine && caps?.computerMcp ? await vps.vpsComputerStatus(cfg, bot.id) : null;
+                    ready = status?.ready === true;
+                    canStart = Boolean(status?.daemonUp && status.managed && status.container === "stopped" &&
+                        status.image && status.imageMatches && status.network === "private" && status.mounts === "none" && status.security === "hardened");
+                    canCreate = Boolean(status?.configured && status.daemonUp && status.container === "missing");
+                    reason = status?.problem ?? reason;
+                }
+                else if (box.boxConfigured(cfg) && registry.instances().some(instance => instance.driverKind === "boxAgent")) {
+                    const status = await box.boxStatus(cfg, bot.id);
+                    const lifecycle = box.boxTurnLifecycleAction({ explicitCloud: true, canMount: true, state: status.box?.state ?? null });
+                    ready = lifecycle === "attach";
+                    canStart = lifecycle === "wake";
+                    canCreate = lifecycle === "provision";
+                }
+            }
+            else if (surface === "vm" && localEngine && caps?.computerMcp) {
+                const target = localVmTargetForBot(bot.id);
+                const status = await containerComputerStatus(undefined, undefined, target);
+                ready = status.ready;
+                canCreate = !ready && autoLocalVmAttachable(status);
+                if (ready || canCreate)
+                    noteLocalVmSeen(target, status);
+                reason = status.problem ?? reason;
+            }
+            else if (surface === "local") {
+                ready = shouldMountLocalComputer({ requested: "local", hostPlatform: process.platform,
+                    providerSupportsLocal: caps?.localComputerMcp === true }) && Boolean(readCuaConnection());
+            }
+            else if (surface === "browser") {
+                ready = caps?.browserMcp === true && builtInBrowserEnabled(cfg) && bot.browser !== false && browserEngineStatus().kind === "ready";
+                reason = "The built-in browser is disabled, not installed, or unsupported by this model engine.";
+            }
+        }
+        catch (error) {
+            reason = error instanceof Error ? error.message : String(error);
+        }
+        const available = ready || canStart || canCreate;
+        return { surface, label: surfaceLabel(surface), available, ready, canStart, canCreate, ...(!available ? { reason } : {}) };
+    }));
+}
+function continueComputerSelection(threadId, generation, succeeded) {
+    const selection = computerSelectionTurns.get(threadId);
+    if (!selection || selection.generation !== generation)
+        return false;
+    if (!succeeded || !selection.selected) {
+        computerSelectionTurns.delete(threadId);
+        return false;
+    }
+    const surface = selection.selected;
+    setImmediate(() => {
+        // Stop, deletion, a new user send, or any replacement generation wins.
+        if (computerSelectionTurns.get(threadId) !== selection || directTurnGenerationByThread.get(threadId) !== generation)
+            return;
+        computerSelectionTurns.delete(threadId);
+        const bot = store.projectBotForTask(selection.botId, threadId);
+        if (!bot || bot.computer === "off" || threadBusy(bot.id, threadId))
+            return;
+        if (store.taskByThread(bot.id, threadId)?.surface !== selection.previousSurface)
+            return;
+        if (queuedThreadPosition(bot.id, threadId) !== null)
+            return;
+        if (store.activePath(threadId).findLast(message => message.role === "user" && message.kind === "text")?.id !== selection.source.id)
+            return;
+        store.patchTask(bot.id, threadId, { surface });
+        const text = `The computer selection is now ${surfaceLabel(surface)}. Continue the user's original request using the tools mounted for this turn; verify the result before claiming success.\n\n${selection.text}`;
+        void startTurn(bot.id, text, { threadId, userMessage: selection.source, computerSelectionContinuation: true }).catch(error => {
+            if (store.taskByThread(bot.id, threadId))
+                store.appendMessage(threadId, { role: "bot", kind: "activity",
+                    tool: { name: `Could not continue on ${surfaceLabel(surface)}: ${error instanceof Error ? error.message : String(error)}`, ok: false } });
+        });
+    });
+    return true;
+}
 /** The engine that dispatched each live turn. A bot's settings may change
  * mid-turn; an interrupt or steer must reach the engine actually running. */
 const runningTurnEngines = new Map();
 function runningTurnInstance(bot, threadId, runOn) {
-    return runningTurnEngines.get(threadId) ?? turnInstance(bot, runOn);
+    return runningTurnEngines.get(threadId) ?? turnInstance(bot, runOn, threadId);
 }
-function providerTransitionForTurn(bot, runOn) {
-    const provider = turnProvider(bot, runOn);
+function providerTransitionForTurn(bot, runOn, threadId) {
+    const provider = turnProvider(bot, runOn, threadId);
     return provider && computerProviderConfigTransitions.has(provider)
         ? providerTransitionMessage(provider)
         : null;
@@ -3338,6 +3592,7 @@ function releaseLocalVmThread(threadId) {
 void (async () => {
     if (localVmMode(cfg) !== "per-bot") {
         const status = await containerComputerStatus(undefined, undefined, SHARED_LOCAL_VM_TARGET).catch(() => null);
+        noteLocalVmSeen(SHARED_LOCAL_VM_TARGET, status);
         if (shouldArmLocalVmIdle(status))
             localVmIdleFor(SHARED_LOCAL_VM_TARGET).touch();
         return;
@@ -3348,6 +3603,7 @@ void (async () => {
     const existing = await discoverExistingPerBotLocalVms(store.bots, runtime.runtime).catch(() => []);
     const statuses = await Promise.all(existing.map(({ target }) => containerComputerStatus(undefined, undefined, target).catch(() => null)));
     existing.forEach(({ target }, index) => {
+        noteLocalVmSeen(target, statuses[index]);
         if (shouldArmLocalVmIdle(statuses[index]))
             localVmIdleFor(target).touch();
     });
@@ -3371,6 +3627,7 @@ async function localVmInventoryPayload() {
         const status = statuses[index];
         if (!status)
             return [];
+        noteLocalVmSeen(target, status);
         const inUse = localVmActiveThreads.has(target.key) ||
             localVmLeaseFor(target).current(localVmOwnerBusy) !== null;
         const entry = localVmInventoryEntry(bot, status, inUse);
@@ -3807,6 +4064,8 @@ bus.subscribe((event) => {
                         store.setTaskActivity(bot.id, event.threadId, "idle");
                     }
                     directTurnBots.delete(event.threadId);
+                    if (continueComputerSelection(event.threadId, generation, event.ok))
+                        return;
                     // Ordinary completion still drains from the existing bus subscribers.
                     // An asynchronous screenshot finishes after those subscribers ran.
                     if (resumeQueued) {
@@ -3868,7 +4127,7 @@ bus.subscribe((event) => {
                 // A failed peer turn stays a chip too. The bot that delegated is woken
                 // with the failure and answers the person in its own thread — buzzing
                 // here as well would ring twice for one piece of news.
-                if ((!routineRun || routineRun.status === "completed") && !internal) {
+                if ((!routineRun || routineRun.status === "completed") && !internal && !computerSelectionTurns.get(event.threadId)?.selected) {
                     // the frame carries the bot's avatar so every desktop client can
                     // show the notification under that bot's own face
                     const completionDetail = routineRun
@@ -4622,7 +4881,7 @@ async function startTurn(botId, text, opts) {
     if (bot.approvalGrant) {
         throw Object.assign(new Error("this bot's approval level is still being confirmed — try again"), { status: 409 });
     }
-    const transitionError = providerTransitionForTurn(bot, opts?.runOn);
+    const transitionError = providerTransitionForTurn(bot, opts?.runOn, threadId);
     if (transitionError)
         throw Object.assign(new Error(transitionError), { status: 409 });
     if (providerFleetReloading)
@@ -4666,9 +4925,10 @@ async function startTurn(botId, text, opts) {
     const task = store.taskByThread(bot.id, threadId);
     if (!task)
         throw Object.assign(new Error("no such task"), { status: 404 });
-    const instance = turnInstance(bot, opts?.runOn);
+    const plan = turnSurfacePlan(bot, opts?.runOn, threadId);
+    const instance = turnInstance(bot, opts?.runOn, threadId);
     if (!instance) {
-        throw Object.assign(new Error(opts?.runOn === "cloud" || bot.computer === "cloud" || inheritedTeamComputer(bot)
+        throw Object.assign(new Error(turnProvider(bot, opts?.runOn, threadId) === "box"
             ? "the Cloud VM runner is unavailable — configure Box in App Settings"
             : `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`), { status: 409 });
     }
@@ -4696,10 +4956,13 @@ async function startTurn(botId, text, opts) {
     if (providerInstancesChanging.has(instanceId)) {
         throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
     }
-    const model = opts?.runOn === "cloud" ? instance.models.default : bot.modelSelection.model;
+    const switchedEngine = instance.instanceId !== bot.modelSelection.instanceId;
+    const model = opts?.runOn === "cloud" || switchedEngine ? instance.models.default : bot.modelSelection.model;
     // a cloud routine borrows the instance default model, so it borrows no
     // per-bot effort either
-    const effort = opts?.runOn === "cloud" ? undefined : bot.modelSelection.effort;
+    const effort = opts?.runOn === "cloud" || switchedEngine ? undefined : bot.modelSelection.effort;
+    const variant = opts?.runOn === "cloud" || switchedEngine ? undefined : bot.modelSelection.variant;
+    assertModelVariantSupported({ variant, effort }, instance.adapter.capabilities);
     // A selection can be persisted while its engine is offline. Re-check when
     // the engine returns so an old or unsupported value never reaches a CLI.
     if (effort && !instance.adapter.capabilities.effortLevels?.includes(effort)) {
@@ -4833,6 +5096,12 @@ async function startTurn(botId, text, opts) {
     directTurnDispatchClaims.set(threadId, { id: dispatchClaimId, botId, threadId, phase: "setup" });
     directTurnBots.set(threadId, bot);
     beginInternalCapabilityGeneration(threadId, dispatchClaimId);
+    if (!opts?.computerSelectionContinuation && !opts?.cardContinuation && !opts?.automationSource && !opts?.unattended &&
+        !opts?.commsDepth && !opts?.coordination && !inheritedTeamComputer(bot) && bot.computer !== "off" && agentsMounted) {
+        const source = store.activePath(threadId).findLast(message => message.id === userMessage?.id && message.role === "user" && !message.peerAsk);
+        if (source)
+            computerSelectionTurns.set(threadId, { generation: dispatchClaimId, botId: bot.id, source, text });
+    }
     store.setTaskActivity(bot.id, threadId, "working");
     // A closed thread that gets a new turn is open again: the person (or the
     // opener) picked it back up, so its row returns to the sidebar and
@@ -4922,21 +5191,23 @@ async function startTurn(botId, text, opts) {
             const teamComputer = inheritedTeamComputer(bot);
             const cloudBackend = teamComputer || opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
             const mountsComputerMcp = instance.adapter.capabilities.computerMcp === true;
-            const mountsCloudComputer = mountsComputerMcp || instance.driverKind === "boxAgent";
+            // Box's native runner owns its computer tools. Local drivers mount
+            // Local VM/VPS tools, but have no Box relay to execute this descriptor.
+            const mountsCloudComputer = instance.driverKind === "boxAgent";
             const mountsLocalComputer = instance.adapter.capabilities.localComputerMcp === true;
             // Where this turn's hands may land. The bot's "Works on" choice is
             // strict; a browser-only bot gets no computer at all, and a bot whose
             // browser is withheld (workspace flag, its own switch, or an engine
             // without browser tools) gets told so instead of silently falling back
             // to a desktop it was never meant to touch.
-            const browserOn = builtInBrowserEnabled(cfg) &&
-                bot.browser !== false &&
-                instance.adapter.capabilities.browserMcp === true;
-            const plan = resolveSurface({
-                destination: teamComputer || opts?.runOn === "cloud" ? "cloud" : bot.computer, // cloud routine overrides the MAUS default
-                browserOn,
-            });
-            if (bot.computer === "browser" && plan.computer === "off" && instance.driverKind === "boxAgent") {
+            // The conversation's own place wins over the bot default: the person
+            // pinned it from the composer, or its first Auto turn recorded where it
+            // landed. A team computer or a cloud routine is not this conversation's
+            // choice, so those ignore the pin.
+            const dispatchTask = store.taskByThread(bot.id, threadId);
+            if (plan.clearPin && dispatchTask)
+                store.patchTask(bot.id, threadId, { surface: undefined });
+            if (plan.computer !== undefined && plan.computer !== "cloud" && instance.driverKind === "boxAgent") {
                 throw new Error("the Computer engine works on the cloud computer — set Works on to Cloud, or choose another engine");
             }
             const wants = plan.computer;
@@ -4946,47 +5217,77 @@ async function startTurn(botId, text, opts) {
             let autoVpsProblem = null;
             // Explicit destinations are strict. In particular, Local VM must never
             // fall through to host CUA and accidentally click on the user's Mac.
-            if (wants === "vm") {
+            // The Local VM attach, shared by explicit "Local VM" and by Auto. Explicit
+            // is strict and throws with the reason. Auto only reaches a VM this bot
+            // already has — ready now, or one whose desktop image is prepared and can
+            // be recreated on demand after idling away — and never creates a first
+            // VM on its own; every failure there is a quiet "not this place".
+            const attachLocalVm = async (strict) => {
                 if (!mountsComputerMcp || instance.driverKind === "boxAgent") {
+                    if (!strict)
+                        return false;
                     throw new Error("this model engine cannot use the Local VM — choose Claude or an ACP engine, or select another computer destination");
                 }
                 const localVmTarget = localVmTargetForBot(bot.id);
-                bindTurnComputer(resourceOwner, `computer:vm:${localVmTarget.key}`, true);
-                if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key)) {
-                    throw new Error("this Local VM is being started, stopped, or replaced — wait for setup to finish");
-                }
-                // Claim before the first await. The lifecycle route performs its
-                // matching check synchronously, so neither side can enter while the
-                // other is between inspection and mutation.
-                if (!localVmLeaseFor(localVmTarget).claim(threadId, bot.id, localVmOwnerBusy)) {
-                    throw new Error("this Local VM is already being used by another turn — wait for that turn to finish");
-                }
-                localVmThreadTargets.set(threadId, localVmTarget);
-                localVmActiveThreads.set(localVmTarget.key, threadId);
-                localVmIdleFor(localVmTarget).touch();
-                const localVm = await readyLocalVmForTurn(bot.id, localVmTarget);
-                if (!localVm.ready || !localVm.runtime) {
-                    throw new Error(`${localVm.problem ?? "the Local VM is not ready"} (App Settings → Computers)`);
-                }
-                integrations.localComputer = containerComputerMcp(localVm.runtime, controlIntegration(bot.id, threadId, dispatchClaimId), localVmTarget);
-                computerKind = "vm";
-                // Same contract as the Box and VPS branches below: without this the
-                // poller never starts, so the Local VM publishes no `screen` events
-                // and every client that only has the stream (the phone) waits
-                // forever. The web panel hid the gap by polling the screenshot
-                // route itself.
-                previewCapture = () => {
-                    // The shared desktop outlives the turn. Once another thread owns
-                    // it, a capture still in flight would picture ITS work under this
-                    // bot's name — live and in the settled transcript frame, which is
-                    // taken after the lease is already released. No owner means the
-                    // desktop is simply idle: that final frame is ours to keep.
-                    const owner = localVmLeaseFor(localVmTarget).current(localVmOwnerBusy);
-                    if (owner && owner.threadId !== threadId) {
-                        throw new Error("the Local VM moved on to another turn");
+                if (!strict) {
+                    // Nothing this process has ever seen for this target, and nobody is
+                    // relying on an unattended run: do not pay for a runtime probe.
+                    if (!localVmSeen.has(localVmTarget.key) && !opts?.automationSource)
+                        return false;
+                    const seen = await containerComputerStatus(undefined, undefined, localVmTarget).catch(() => null);
+                    if (!seen || !autoLocalVmAttachable(seen))
+                        return false;
+                    if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key))
+                        return false;
+                }
+                try {
+                    await bindTurnComputer(resourceOwner, `computer:vm:${localVmTarget.key}`, true);
+                    if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key)) {
+                        throw new Error("this Local VM is being started, stopped, or replaced — wait for setup to finish");
                     }
-                    return containerComputerFrame(undefined, undefined, localVmTarget);
-                };
+                    // Claim before the first await. The lifecycle route performs its
+                    // matching check synchronously, so neither side can enter while the
+                    // other is between inspection and mutation.
+                    if (!localVmLeaseFor(localVmTarget).claim(threadId, bot.id, localVmOwnerBusy)) {
+                        throw new Error("this Local VM is already being used by another turn — wait for that turn to finish");
+                    }
+                    localVmThreadTargets.set(threadId, localVmTarget);
+                    localVmActiveThreads.set(localVmTarget.key, threadId);
+                    localVmIdleFor(localVmTarget).touch();
+                    const localVm = await readyLocalVmForTurn(bot.id, localVmTarget);
+                    if (!localVm.ready || !localVm.runtime) {
+                        throw new Error(`${localVm.problem ?? "the Local VM is not ready"} (App Settings → Computers)`);
+                    }
+                    integrations.localComputer = containerComputerMcp(localVm.runtime, controlIntegration(bot.id, threadId, dispatchClaimId), localVmTarget);
+                    // Same contract as the Box and VPS branches below: without this the
+                    // poller never starts, so the Local VM publishes no `screen` events
+                    // and every client that only has the stream (the phone) waits
+                    // forever. The web panel hid the gap by polling the screenshot
+                    // route itself.
+                    previewCapture = () => {
+                        // The shared desktop outlives the turn. Once another thread owns
+                        // it, a capture still in flight would picture ITS work under this
+                        // bot's name — live and in the settled transcript frame, which is
+                        // taken after the lease is already released. No owner means the
+                        // desktop is simply idle: that final frame is ours to keep.
+                        const owner = localVmLeaseFor(localVmTarget).current(localVmOwnerBusy);
+                        if (owner && owner.threadId !== threadId) {
+                            throw new Error("the Local VM moved on to another turn");
+                        }
+                        return containerComputerFrame(undefined, undefined, localVmTarget);
+                    };
+                    return true;
+                }
+                catch (error) {
+                    if (strict)
+                        throw error;
+                    releaseLocalVmThread(threadId);
+                    return false;
+                }
+            };
+            if (wants === "vm") {
+                if (await attachLocalVm(true))
+                    computerKind = "vm";
             }
             else if (wants === "local") {
                 if (!shouldMountLocalComputer({
@@ -4999,7 +5300,7 @@ async function startTurn(botId, text, opts) {
                 const cua = readCuaConnection();
                 if (!cua)
                     throw new Error("CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
-                bindTurnComputer(resourceOwner, "computer:host");
+                await bindTurnComputer(resourceOwner, "computer:host");
                 integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId));
                 computerKind = "local";
             }
@@ -5015,9 +5316,10 @@ async function startTurn(botId, text, opts) {
                 if (!unsupported) {
                     // The remote lifecycle and container are shared by this bot. Keep
                     // its explicit computer turns serialized; ordinary threads still run.
-                    bindTurnComputer(resourceOwner, `computer:vps:${vpsSshAlias(cfg)}:${bot.id}`, true);
+                    await bindTurnComputer(resourceOwner, `computer:vps:${vpsSshAlias(cfg)}:${bot.id}`, true);
                     activeVpsThreads.set(bot.id, threadId);
-                    const remote = wants === "cloud" || bot.autoStartVps
+                    let remote;
+                    remote = vps.vpsStartsForTurn({ wants, autoStartVps: bot.autoStartVps, automationSource: opts?.automationSource })
                         ? await vps.vpsComputerAction("provision", cfg, bot.id)
                         : await vps.inspectVpsForAuto(cfg, bot.id);
                     if (remote?.ready && remote.sshAlias) {
@@ -5040,23 +5342,33 @@ async function startTurn(botId, text, opts) {
                     }
                 }
             }
-            // Cloud is also strict when explicitly selected. Auto (unset) reuses an
-            // existing cloud box, then falls back to host CUA without provisioning.
+            // Cloud is strict when selected. Only the native Box engine can reuse
+            // a Box on Auto; local engines have no relay for its desktop tools.
             if (teamComputer) {
                 const attached = await attachTeamBox(teamComputer, bot.id, resourceOwner, mountsCloudComputer, instance.driverKind === "boxAgent");
                 integrations.computer = attached.integration;
                 previewCapture = attached.capture;
                 computerKind = "box";
             }
-            if (!teamComputer && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && box.boxConfigured(cfg)) {
+            if (!teamComputer && mountsCloudComputer && (wants === "cloud" || wants === undefined) && cloudBackend === "box" && box.boxConfigured(cfg)) {
                 // Explicit cloud turns can provision/wake the same bot's Box. Claim
                 // before any network await so setup itself cannot race another turn.
                 if (wants === "cloud")
-                    bindTurnComputer(resourceOwner, `computer:box-bot:${bot.id}`, true);
+                    await bindTurnComputer(resourceOwner, `computer:box-bot:${bot.id}`, true);
                 if (!mountsCloudComputer && wants === "cloud") {
                     throw new Error("this model engine cannot use computer tools — choose Claude, an ACP engine, or the Computer engine");
                 }
-                let b = await box.findBox(cfg, bot.id).catch(() => null);
+                let b;
+                try {
+                    b = await box.findBox(cfg, bot.id);
+                }
+                catch (error) {
+                    // Auto may fall through when an optional provider is offline, but a
+                    // durable deletion fence must never be mistaken for "no computer".
+                    if (wants === "cloud" || error?.status === 409)
+                        throw error;
+                    b = null;
+                }
                 let lifecycle = box.boxTurnLifecycleAction({
                     explicitCloud: wants === "cloud",
                     canMount: mountsCloudComputer,
@@ -5065,7 +5377,7 @@ async function startTurn(botId, text, opts) {
                 if (lifecycle === "provision") {
                     broadcast({ kind: "computer", botId: bot.id, state: "provisioning" });
                     await box.provisionBox(cfg, bot.id, bot.name);
-                    b = await box.findBox(cfg, bot.id).catch(() => null);
+                    b = await box.findBox(cfg, bot.id);
                     lifecycle = box.boxTurnLifecycleAction({
                         explicitCloud: true,
                         canMount: mountsCloudComputer,
@@ -5078,7 +5390,7 @@ async function startTurn(botId, text, opts) {
                 // consent boundary for the resume (~8s, and it un-pauses billing).
                 if (lifecycle === "wake") {
                     broadcast({ kind: "computer", botId: bot.id, state: "waking" });
-                    b = (await box.readyBox(cfg, bot.id).catch(() => null)) ?? b;
+                    b = (await box.readyBox(cfg, bot.id)) ?? b;
                     lifecycle = box.boxTurnLifecycleAction({
                         explicitCloud: true,
                         canMount: mountsCloudComputer,
@@ -5086,7 +5398,7 @@ async function startTurn(botId, text, opts) {
                     });
                 }
                 if (b && lifecycle === "attach") {
-                    bindTurnComputer(resourceOwner, `computer:box:${b.id}`, instance.driverKind === "boxAgent");
+                    await bindTurnComputer(resourceOwner, `computer:box:${b.id}`, instance.driverKind === "boxAgent");
                     previewCapture = () => box.screenshotBox(cfg, bot.id, b.id);
                     if (mountsCloudComputer) {
                         integrations.computer = {
@@ -5107,9 +5419,19 @@ async function startTurn(botId, text, opts) {
             }
             // Auto-only host fallback. Electron owns cua-driver/TCC attribution;
             // the harness only reads its already-running connection descriptor.
+            // Auto reaches a Local VM this bot already has before it ever touches the
+            // host's own desktop: on a headless server that VM is the only desktop
+            // there is, and a person who prepared one meant it to be used.
+            if (wants === undefined && !integrations.computer && !integrations.localComputer && await attachLocalVm(false))
+                computerKind = "vm";
+            // An unattended run on a bot with a VPS configured never lands on the
+            // host's own desktop instead: a scheduled job clicking on someone's
+            // laptop is worse than a scheduled job that fails and says why.
+            const unattendedVps = cloudBackend === "vps" && Boolean(opts?.automationSource);
             if (!integrations.computer &&
                 !integrations.localComputer &&
                 wants === undefined &&
+                !unattendedVps &&
                 shouldMountLocalComputer({
                     requested: undefined,
                     hostPlatform: process.platform,
@@ -5117,7 +5439,7 @@ async function startTurn(botId, text, opts) {
                 })) {
                 const cua = readCuaConnection();
                 if (cua) {
-                    bindTurnComputer(resourceOwner, "computer:host");
+                    await bindTurnComputer(resourceOwner, "computer:host");
                     integrations.localComputer = gatedLocalComputer(cua, controlIntegration(bot.id, threadId, dispatchClaimId));
                     computerKind = "local";
                 }
@@ -5126,10 +5448,13 @@ async function startTurn(botId, text, opts) {
                 cloudBackend === "vps" &&
                 !integrations.computer &&
                 !integrations.localComputer &&
-                autoVpsProblem) {
-                const hint = bot.autoStartVps
-                    ? "Check the VPS connection in App Settings → Connections."
-                    : "Open Computer and enable Start VPS automatically, or choose Cloud to start it manually.";
+                autoVpsProblem &&
+                !computerSelectionTurns.has(threadId)) {
+                const hint = opts?.automationSource
+                    ? "This scheduled run tried to start the VPS computer and could not reach it. Check the VPS connection in App Settings → Connections."
+                    : bot.autoStartVps
+                        ? "Check the VPS connection in App Settings → Connections."
+                        : "Open Computer and enable Start VPS automatically, or choose Cloud to start it manually.";
                 throw new Error(`${autoVpsProblem}. ${hint}`);
             }
             // Agent control tools include peer comms and the secure credential
@@ -5197,8 +5522,13 @@ async function startTurn(botId, text, opts) {
                     description: liveBot?.description ?? bot.description,
                     text: providerText,
                 });
+            // One place per turn. On Auto the branches above may have reached a
+            // computer; then the built-in browser stays unmounted and web work
+            // happens in that computer's own browser, where the person can see it.
+            const mountedComputer = surfaceOfComputerKind(computerKind);
             if (liveBot &&
                 plan.browser &&
+                !(plan.computer === undefined && mountedComputer) &&
                 builtInBrowserEnabled(cfg) &&
                 liveBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true) {
@@ -5218,6 +5548,17 @@ async function startTurn(botId, text, opts) {
                     browserCapture = () => browserRuntime.withAgentAction(session, () => agentBrowserFrame(frame));
                 }
             }
+            // An Auto conversation remembers where its first turn landed, so later
+            // turns stay there and the composer can show it. Explicit settings are
+            // not recorded: changing the bot's Works on should move its threads.
+            if (bot.computer === undefined && !teamComputer && opts?.runOn !== "cloud" && !plan.pinned) {
+                const used = mountedComputer ?? (integrations.browser ? "browser" : null);
+                if (used)
+                    store.patchTask(bot.id, threadId, { surface: used });
+            }
+            const computerSelection = computerSelectionTurns.get(threadId);
+            if (computerSelection)
+                computerSelection.mounted = mountedComputer ?? (integrations.browser ? "browser" : undefined);
             // A cancelled adapter can be between accepting sendTurn and revealing
             // its provider turn id. Never overlap a replacement with that ambiguous
             // pre-id window: wait for the old handshake to settle or for its bounded
@@ -5248,7 +5589,7 @@ async function startTurn(botId, text, opts) {
                 { id: "files", label: "File locations", text: worksInWorkspace && opts?.runOn !== "cloud" ? workspaceLocationsPrompt(bot.id, cwd, liveBot?.cwd ?? bot.cwd) : "" },
                 { id: "computer", label: "Computer", text: computerPrompt(computerPromptKind) },
                 { id: "team-computer", label: "Team computer", text: teamComputerPrompt(teamComputer) },
-                { id: "plan", label: "Surface", text: plan.note },
+                { id: "plan", label: "Surface", text: surfacePrompt({ computer: mountedComputer, browser: Boolean(integrations.browser) }, { pinned: plan.pinned, note: plan.note, canSelect: computerSelectionTurns.has(threadId) }) },
                 // gated on the integration, not the key: the hint only goes to a
                 // bot whose driver actually mounted the tools
                 { id: "composio", label: "Connected apps", text: integrations.composio ? COMPOSIO_PROMPT : "" },
@@ -5264,6 +5605,9 @@ async function startTurn(botId, text, opts) {
                 { id: "profile", label: "Profile changes", text: profilePrompt },
                 { id: "learn", label: "Skill authoring", text: learnPrompt },
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
+                // what the bot said lately in its other conversations, so a task
+                // never redoes — or forgets — what another one already did
+                { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(store, bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId })) },
                 { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace }) },
                 { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
                 { id: "skill-instructions", label: "Skill instructions", text: skillInstructions },
@@ -5276,11 +5620,12 @@ async function startTurn(botId, text, opts) {
                 threadId,
                 botId: bot.id,
                 text: turnText,
-                refreshSystemPrompt: Boolean(opts?.coordination),
+                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(bot, commsDepth > 0),
                 model,
                 effort,
+                variant,
                 // a rewound thread never resumes the abandoned branch's session
                 // the active task's own session — another task's cursor would
                 // resume the wrong conversation and defeat the context bubble
@@ -5291,6 +5636,7 @@ async function startTurn(botId, text, opts) {
                 systemStable: prompt.stable,
                 systemVolatile: prompt.volatile,
                 integrations,
+                mcpFromUserConfig: claudeUserMcpEnabled(cfg),
                 cwd,
             }), () => !directTurnClaimExists(bot.id, dispatchClaimId, threadId), async () => {
                 await instance.adapter.interruptTurn(threadId).catch(() => { });
@@ -5342,6 +5688,8 @@ async function startTurn(botId, text, opts) {
             }
         }
         catch (e) {
+            if (computerSelectionTurns.get(threadId)?.generation === dispatchClaimId)
+                computerSelectionTurns.delete(threadId);
             settleDirectFollowup(dispatchClaimId);
             clearCancelledProviderHandshake(threadId, `direct:${dispatchClaimId}`);
             clearDirectTurnDispatch(threadId, dispatchClaimId);
@@ -5455,6 +5803,8 @@ function routineRunCard(run) {
     };
     if (run.goalStatus)
         card.goalStatus = run.goalStatus;
+    if (run.deferredAt != null && run.status === "queued")
+        card.deferredAt = run.deferredAt;
     if (run.threadId)
         card.executionThreadId = run.threadId;
     if (summary)
@@ -5485,7 +5835,9 @@ function routineRunFallbackText(card) {
                     ? "was cancelled"
                     : card.status === "missed"
                         ? "was missed"
-                        : card.status);
+                        : card.status === "queued" && card.deferredAt != null
+                            ? "deferred: target busy"
+                            : card.status);
     return `Routine “${card.routineName}” ${state}`;
 }
 /** Upsert one durable lifecycle card per run. Replaying the same transition,
@@ -5689,6 +6041,17 @@ routines = new RoutineManager({
         const notificationBot = routineSourceOwner(run)?.bot ?? bot;
         notify(buildNotification("routine-failed", notificationBot, routineSourceThread(run) ?? run.threadId ?? bot.threadId, detail));
     },
+    onRunDeferred: (run) => {
+        const bot = store.bot(run.botId);
+        if (!bot)
+            return;
+        const minutes = run.deferredAt != null && run.deferredNoticeAt != null
+            ? Math.max(1, Math.round((run.deferredNoticeAt - run.deferredAt) / 60_000))
+            : null;
+        const detail = `${redactSecretsInText(run.routineName)}: target busy${minutes != null ? ` for ${minutes} minutes` : ""}`;
+        const notificationBot = routineSourceOwner(run)?.bot ?? bot;
+        notify(buildNotification("routine-deferred", notificationBot, routineSourceThread(run) ?? bot.threadId, detail));
+    },
 });
 // The scheduler receipt and room transcript live in separate durable stores.
 // If the process exited between those two writes, prefer the correlated
@@ -5784,6 +6147,9 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
     if (computerProviderConfigTransitions.size > 0) {
         return deletionResponse(409, { error: "computer provider settings are being updated — wait before deleting this bot" });
     }
+    if (localVmModeChangeBusy) {
+        return deletionResponse(409, { error: "Local VM settings are being updated — wait before deleting this bot" });
+    }
     if (boxLifecycleBusyBots.has(bot.id)) {
         return deletionResponse(409, { error: "wait for this bot's cloud computer action to finish before deleting the bot" });
     }
@@ -5806,6 +6172,7 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
         return deletionResponse(409, { error: "stop this bot's work before checking and deleting its cloud computer" });
     }
     const botBoxRecovery = boxCreateRecoverySnapshot().filter((entry) => entry.botId === bot.id);
+    const botBoxDeletions = boxDeletionSnapshot().filter((entry) => entry.ownerBotId === bot.id);
     if (botBoxRecovery.some((entry) => !entry.resolved)) {
         return deletionResponse(409, {
             error: "finish reconciling this bot's pending cloud computer creation before deleting it — check ascii.dev, then retry Box setup",
@@ -5822,84 +6189,94 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
         releaseComputerLifecycle();
         return deletionResponse(409, { error: "this bot or one of its channels is securely saving a credential" });
     }
+    let claimedLocalVmTarget = null;
     try {
+        let localVmCleanup = null;
         if (localVmMode(cfg) === "per-bot") {
             const target = perBotLocalVmTarget(bot.id);
             if (localVmActiveThreads.has(target.key) || localVmLifecycleBusy.has(target.key)) {
                 return deletionResponse(409, { error: "stop this bot's Local VM turn or setup action before deleting the bot" });
             }
+            if (localVmLeaseFor(target).current(localVmOwnerBusy)) {
+                return deletionResponse(409, { error: "stop this bot's Local VM turn before deleting the bot" });
+            }
+            // Hold the target from preflight through deletion. A simultaneous
+            // mode change or lifecycle route must not recreate the container
+            // after we checked it and before its bot owner disappears.
+            localVmLifecycleBusy.add(target.key);
+            claimedLocalVmTarget = target;
             const vm = await containerComputerStatus(undefined, undefined, target);
             if (!vm.daemonUp && existsSync(target.workspaceDir)) {
                 return deletionResponse(409, {
-                    error: "start the container runtime and delete this bot's Local VM before deleting the bot",
+                    error: "start the container runtime so OpenMausBot can remove this bot's Local VM while deleting it",
                 });
             }
-            if (vm.container !== "missing") {
-                return deletionResponse(409, { error: "delete this bot's Local VM from its Computer panel before deleting the bot" });
+            if (vm.container !== "missing" && !vm.managed) {
+                return deletionResponse(409, {
+                    error: `The container named ${vm.container_name} was not created by OpenMausBot. Remove it manually before deleting this bot`,
+                });
             }
+            localVmCleanup = {
+                target,
+                removeContainer: vm.container !== "missing",
+            };
         }
-        // VPS containers are also durable and may outlive a destination or
-        // backend switch. Keep the bot as the discoverable owner until the
-        // person explicitly removes that container from Settings.
+        // Preflight every provider before deleting any resource. Cleanup can
+        // still fail mid-flight across independent providers, but a missing
+        // credential or offline daemon should not cause avoidable partial work.
         const vpsInventory = await vps.listManagedVpsComputers(cfg, managedBoxOwners());
         if (vpsInventory.configured && !vpsInventory.available) {
             return deletionResponse(503, {
-                error: `${vpsInventory.problem ?? "VPS computer inventory is unavailable"}. Refresh Settings → Computers before deleting this bot`,
+                error: `${vpsInventory.problem ?? "VPS computer inventory is unavailable"}. The bot was kept so its computer can be retried safely`,
             });
         }
-        if (vpsInventory.instances.some((instance) => instance.ownerBotId === bot.id)) {
+        const ownedVpsComputers = vpsInventory.instances.filter((instance) => instance.ownerBotId === bot.id);
+        if ((botBoxRecovery.length > 0 || botBoxDeletions.length > 0) && !box.boxConfigured(cfg)) {
             return deletionResponse(409, {
-                error: "remove this bot's VPS computer from Settings → Computers before deleting the bot",
+                error: "Reconnect the Box account that owns this bot's remembered cloud computer, then retry deletion",
             });
         }
-        // LIST is eventually consistent, and a remembered Box may also have
-        // been renamed outside OpenMausBot. The create journal is stronger
-        // ownership evidence: inspect every durable id directly before the bot
-        // record that makes it discoverable can be removed. Missing credentials
-        // or an unavailable provider must fail closed.
-        for (const recovery of botBoxRecovery) {
-            if (!recovery.boxId) {
-                return deletionResponse(409, {
-                    error: "finish reconciling this bot's pending cloud computer creation before deleting it",
-                });
-            }
-            const inspected = await box.inspectBoxIdentity(cfg, recovery.boxId);
-            if (!inspected.available) {
-                return deletionResponse(503, {
-                    error: `${inspected.problem ?? "a remembered cloud computer could not be verified"}. Restore its Box account before deleting this bot`,
-                });
-            }
-            if (inspected.identity) {
-                return deletionResponse(409, {
-                    error: "delete this bot's remembered cloud computer from Settings → Computers before deleting the bot",
-                });
-            }
-            // A direct 404/410 is authoritative even while account LIST catches
-            // up. Retire only this exact provider identity, then continue looking
-            // for any older name-based resource the journal never recorded.
-            retireDeletedBoxCreate(recovery.boxId);
-        }
-        // A Box survives destination/backend changes and contains browser
-        // sessions and files. Resolve ownership from a fresh provider listing;
-        // deleting the bot first would make that durable machine look orphaned.
         const cloudInventory = await box.listManagedBoxes(cfg, managedBoxOwners());
         if (cloudInventory.configured && !cloudInventory.available) {
             return deletionResponse(503, {
-                error: `${cloudInventory.problem ?? "cloud computer inventory is unavailable"}. Refresh Settings → Computers before deleting this bot`,
-            });
-        }
-        if (cloudInventory.instances.some((instance) => instance.ownerBotId === bot.id)) {
-            return deletionResponse(409, {
-                error: "delete this bot's cloud computer from Settings → Computers before deleting the bot",
+                error: `${cloudInventory.problem ?? "cloud computer inventory is unavailable"}. The bot was kept so its computer can be retried safely`,
             });
         }
-        // Establish a durable cleanup intent before any teardown. A malformed
-        // or unreadable journal therefore rejects the delete with the bot and
-        // all of its live work untouched. The intent is aborted if a later
-        // pre-delete side effect fails, and committed only after Store deletion.
+        const ownedBoxComputers = cloudInventory.instances.filter((instance) => instance.ownerBotId === bot.id);
+        // Revalidate a reviewed Chief-of-Staff request and establish the
+        // browser cleanup intent before the first irreversible provider
+        // mutation. A stale review or damaged journal therefore leaves every
+        // computer intact. Cross-provider rollback is impossible, so every
+        // subsequent operation is exact and retry-safe.
         revalidate();
         const browserCleanupRequest = browserCleanup.prepare("bot", bot.id);
         try {
+            // Provider-owned computers are durable, billable resources. Remove
+            // each exact, freshly revalidated identity before making its bot
+            // owner disappear. Shared team computers use a different owner id
+            // and are intentionally absent from these lists.
+            for (const instance of ownedBoxComputers) {
+                const removed = await box.deleteManagedBox(cfg, managedBoxOwners(), instance.boxId, instance.name);
+                if (removed.pending) {
+                    throw Object.assign(new Error("The cloud computer deletion has started but is still finishing. The bot was kept; retry in a moment"), { status: 409 });
+                }
+            }
+            for (const instance of ownedVpsComputers) {
+                await vps.removeManagedVpsComputer(cfg, managedBoxOwners(), instance.name, instance.name);
+            }
+            if (localVmCleanup) {
+                if (localVmCleanup.removeContainer) {
+                    await containerComputerAction("remove", undefined, undefined, localVmCleanup.target);
+                }
+                // Unlike the standalone "Delete VM" action, deleting the bot is
+                // a complete erasure: its now-ownerless desktop files and browser
+                // session must not remain hidden on disk or block the event loop.
+                await removeDirectory(localVmCleanup.target.workspaceDir, { recursive: true, force: true });
+                localVmSeen.delete(localVmCleanup.target.key);
+                localVmIdles.get(localVmCleanup.target.key)?.cancel();
+                localVmIdles.delete(localVmCleanup.target.key);
+                localVmLeases.forget(localVmCleanup.target.key);
+            }
             // a running turn dies with its bot
             // Invalidate every bot-callable bearer before the first asynchronous
             // teardown step. A request that already passed its initial header
@@ -5913,7 +6290,6 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
                 revokeInternalCapabilitiesForThread(task.threadId);
             }
             await interruptAllDirectThreads(bot.id);
-            revalidate();
             // Deletion removes the thread before a late turn.completed can fold
             // staged provider images into a message, so dispose them here.
             for (const task of store.tasks(bot.id)) {
@@ -5934,6 +6310,12 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
             const target = perBotLocalVmTarget(bot.id);
             localVmIdles.get(target.key)?.cancel();
             localVmIdles.delete(target.key);
+            // Provider and local-computer teardown above can await for an
+            // arbitrary amount of time. A reviewed Chief deletion is bound to
+            // the exact target profile it presented; re-check that receipt at
+            // the final durable mutation boundary so a concurrent profile edit
+            // cannot be erased under a stale approval.
+            revalidate();
             store.deleteBot(bot.id, setupRequest);
             // Removing schedules is not a security revocation. Keep them intact
             // if the bot/receipt write fails, so a failed deletion is retryable.
@@ -5969,6 +6351,8 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
         return deletionResponse(200, { ok: true });
     }
     finally {
+        if (claimedLocalVmTarget)
+            localVmLifecycleBusy.delete(claimedLocalVmTarget.key);
         releaseComputerLifecycle();
         releasePhoneSecretMutation();
     }
@@ -6470,6 +6854,7 @@ setupRetry = 0) {
         // A workspace at its monthly spend limit rechecks the cap at execution time
         // for every room, goal, queued, calendar, and chained-mention turn.
         assertWithinBudget(cfg, DATA_DIR);
+        assertModelVariantSupported(preparedSelection, instance.adapter.capabilities);
         const integrations = {};
         const skillAuthoring = skillAuthoringEnabled(cfg) &&
             hop === 0 &&
@@ -6541,6 +6926,7 @@ setupRetry = 0) {
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
             readyBot.modelSelection.effort !== preparedSelection.effort ||
+            readyBot.modelSelection.variant !== preparedSelection.variant ||
             readyBot.composio !== preparedComposio;
         if (setupChanged) {
             if (setupRetry === 0) {
@@ -6631,7 +7017,15 @@ setupRetry = 0) {
                 readyBot.browser !== false &&
                 instance.adapter.capabilities.browserMcp === true,
         });
-        if (roomPlan.browser) {
+        // Channels currently mount a team Box or a Local VM. Do not let an
+        // explicitly selected, unsupported destination become a tool-free turn
+        // that can claim to have acted on that screen.
+        if (!roomTeamComputer && (roomPlan.computer === "cloud" || roomPlan.computer === "local")) {
+            throw new Error("This computer destination is not available in channels yet — open a bot thread to work on it, or use a Local VM, team computer, or Browser here");
+        }
+        // One place per room turn as well: a team computer reached on Auto means
+        // no separate built-in browser.
+        if (roomPlan.browser && !(roomPlan.computer === undefined && roomTeamComputer)) {
             const selectedProfile = readyBot.browserProfile;
             const browser = await browserIntegration(readyBot.id, selectedProfile, { threadId, generation: internalGeneration });
             if (browser)
@@ -6647,7 +7041,7 @@ setupRetry = 0) {
             return false;
         }
         if (roomTeamComputer) {
-            const attached = await attachTeamBox(roomTeamComputer, readyBot.id, resourceOwner, instance.adapter.capabilities.computerMcp === true || instance.driverKind === "boxAgent", instance.driverKind === "boxAgent");
+            const attached = await attachTeamBox(roomTeamComputer, readyBot.id, resourceOwner, instance.driverKind === "boxAgent", instance.driverKind === "boxAgent");
             if (isCancelled?.() || groupSpeakers.get(threadId) !== roomSpeaker ||
                 activeInternalGenerationByThread.get(threadId) !== internalGeneration)
                 return false;
@@ -6662,7 +7056,7 @@ setupRetry = 0) {
             }
             // A distinct identity fences cleanup even in shared mode on the same room thread.
             const target = { ...localVmTargetForBot(readyBot.id) };
-            bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
+            await bindTurnComputer(resourceOwner, `computer:vm:${target.key}`, true);
             if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(target.key)) {
                 throw new Error("this Local VM is being started, stopped, or replaced");
             }
@@ -6760,14 +7154,32 @@ setupRetry = 0) {
                 store.patchBot(bot.id, { soulDrift: drift.drift });
         }
         const roomMemory = memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace });
+        // The same brief a 1:1 turn gets: what this member said lately in its
+        // other conversations, so a standup is answered from what happened. A
+        // brief can carry a private chat into the room; as with session_search
+        // (#754) the room is told, once per source thread, rather than the
+        // crossing being blocked.
+        const recentLines = recentWork(store, bot, { userName, currentThreadId: threadId });
+        {
+            const crossing = claimRecallCrossings(threadId, recentLines.filter((line) => line.private).map((line) => line.threadId));
+            if (crossing.count) {
+                store.appendMessage(threadId, {
+                    role: "bot",
+                    kind: "activity",
+                    from: { botId: bot.id, name: bot.name, color: bot.color },
+                    tool: { name: briefCrossingLabel(bot.name, crossing.count), ok: true },
+                });
+            }
+        }
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
             { id: "files", label: "File locations", text: workspace ? workspaceLocationsPrompt(bot.id, cwd, readyBot.cwd) : "" },
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
             { id: "computer", label: "Computer", text: computerPrompt(roomTeamComputer ? instance.driverKind === "boxAgent" ? "box-agent" : "box" : roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null) },
             { id: "team-computer", label: "Team computer", text: teamComputerPrompt(roomTeamComputer) },
-            { id: "plan", label: "Surface", text: roomPlan.note },
+            { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : null, browser: Boolean(integrations.browser) }, { note: roomPlan.note }) },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
             { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
+            { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
             // the room path has always put a newline before memory and trimmed
             // the block's leading space; keep that so existing prompts are
@@ -6881,7 +7293,7 @@ setupRetry = 0) {
                 threadId,
                 botId: readyBot.id,
                 text,
-                refreshSystemPrompt: Boolean(orchestration?.roomHandoffId),
+                refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(readyBot, Boolean(orchestration?.roomHandoffId)),
                 system: roomSystem.text,
@@ -6889,7 +7301,10 @@ setupRetry = 0) {
                 systemVolatile: roomSystem.volatile,
                 cwd,
                 integrations,
-                ...memberTurnSelection(readyBot.modelSelection),
+                mcpFromUserConfig: claudeUserMcpEnabled(cfg),
+                ...(instance.instanceId === readyBot.modelSelection.instanceId
+                    ? memberTurnSelection(readyBot.modelSelection)
+                    : { model: instance.models.default }),
             }), () => abandoned || Boolean(isCancelled?.()), async () => {
                 // Stop may have landed while the adapter was authenticating, before
                 // it had an active process for the first interrupt to reach. Now that
@@ -7081,8 +7496,11 @@ setupRetry = 0) {
     catch (error) {
         if (providerDispatched)
             throw error;
+        if (error instanceof DirectTurnSetupCancelled)
+            return false;
         const isSpendCap = typeof error === "object" && error !== null && error.code === "spend_cap";
-        if (!roomSpeaker && !isSpendCap)
+        const isVariantError = typeof error === "object" && error !== null && error.code === "unsupported_model_variant";
+        if (!roomSpeaker && !isSpendCap && !isVariantError)
             throw error;
         const message = error instanceof Error ? error.message : "Local VM setup failed";
         store.appendMessage(threadId, {
@@ -8334,6 +8752,7 @@ function cliProbeEnvironment() {
         "COMPOSIO_API_KEY",
         "OMB_COMPOSIO_BROKER_TOKEN",
         "OMB_TTS_KEY",
+        "OMB_FISH_AUDIO_API_KEY",
         "OMB_OPENAI_IMAGE_KEY",
         "OMB_CUSTOM_IMAGE_KEY",
         "ANTHROPIC_API_KEY",
@@ -8382,6 +8801,7 @@ async function localVmPayload(target) {
  */
 async function readyLocalVmForTurn(botId, target, isCurrent = () => true) {
     let status = await containerComputerStatus(undefined, undefined, target);
+    noteLocalVmSeen(target, status);
     if (!isCurrent())
         return status;
     if (status.ready || !localVmRecreatableOnDemand(status))
@@ -8480,6 +8900,9 @@ function configStatus() {
             // shell and the Settings UI read it so they offer nothing this server
             // would refuse.
             sharedComputers: sharedComputersEnabled(cfg),
+            // Plugins → MCP servers switch: Claude bots also see this machine's
+            // own Claude Code MCP servers
+            claudeUserMcp: claudeUserMcpEnabled(cfg),
         },
         // first-run progress — not a secret; the app decides whether to show
         // the welcome tour from this, never from browser storage
@@ -8517,6 +8940,20 @@ function configForAccess(status, admin) {
 function mcpServerResponse() {
     return { servers: listMcpServers(cfg.mcpServers) };
 }
+/** The fields a new server may set, in whichever shape the form sent — a
+ * command to run or a URL to reach. Absent keys stay absent, so the strict
+ * schema of one shape never sees the other shape's `undefined`s. */
+function mcpServerBody(body) {
+    const out = {};
+    if (!body || typeof body !== "object")
+        return out;
+    const record = body;
+    for (const key of ["command", "args", "env", "type", "url", "headers", "enabled"]) {
+        if (record[key] !== undefined)
+            out[key] = record[key];
+    }
+    return out;
+}
 function persistMcpServers(next) {
     saveConfig({ mcpServers: next });
     // Do not reload the provider fleet: integrations are assembled from cfg at
@@ -8892,7 +9329,7 @@ const handleRequest = async (req, res) => {
         // Hosted workspaces have one sign-in authority. A missing optional layer
         // must not accidentally reactivate legacy email/QR credential minting.
         if (HOSTED_WORKSPACE) {
-            if (method === "POST" && ["/api/auth/pair", "/api/auth/pairing", "/api/auth/email/start", "/api/auth/email/verify"].includes(path)) {
+            if (method === "POST" && ["/api/auth/pair", "/api/pair", "/api/auth/pairing", "/api/auth/email/start", "/api/auth/email/verify"].includes(path)) {
                 return json(res, 403, { error: "Sign in through the workspace portal." });
             }
             if (workspaceAccess) {
@@ -8983,6 +9420,43 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 200, { token: result.token, session: result.session, environment });
         }
+        // The route the iOS and Android companion apps already POST to. Until now
+        // only the desktop's companion sidecar answered it, so a self-hosted
+        // server had nothing for a native phone to pair against: the app could
+        // reach the server and pass its health probe, then ask for a credential
+        // the server could not issue. Same window, same lockout and the same
+        // single-use exchange as /api/auth/pair above; only the request and
+        // response shapes differ, because the apps were written against the
+        // sidecar. Public and unauthenticated for the same reason
+        // /api/auth/pair is: redeeming a one-time credential IS the sign-in.
+        if (method === "POST" && path === "/api/pair") {
+            if (!/^application\/json\b/i.test(String(req.headers["content-type"] ?? ""))) {
+                return json(res, 415, { error: "send the pairing credential as JSON (content-type: application/json)" });
+            }
+            const body = await readBody(req);
+            const credential = typeof body?.credential === "string" ? body.credential : typeof body?.code === "string" ? body.code : "";
+            const label = typeof body?.deviceName === "string" ? body.deviceName : "";
+            const attemptId = typeof body?.pairRequestId === "string" ? body.pairRequestId : undefined;
+            const paired = sessions.exchange({ code: credential, label, attemptId, source: requestSource(req), fallbackLabel: labelFromUserAgent(req.headers["user-agent"]) });
+            if (!paired.ok) {
+                console.warn(`pairing refused from ${requestSource(req)}: ${paired.error}`);
+                return json(res, paired.status, { error: paired.error });
+            }
+            // The shape the companion apps decode (android/core Models.kt,
+            // PairResponseSerializer): token, device and serverName are required;
+            // hosts and endpoints are advisory and deliberately omitted, because a
+            // harness has no sidecar endpoints to advertise.
+            return json(res, 200, {
+                token: paired.token,
+                device: {
+                    id: paired.session.id,
+                    name: paired.session.label,
+                    createdAt: paired.session.createdAt,
+                    lastSeenAt: paired.session.lastSeenAt,
+                },
+                serverName: environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED }).label,
+            });
+        }
         const gate = resolveRequestAuth(req, {
             sessions,
             cookieName: SESSION_COOKIE,
@@ -9078,11 +9552,22 @@ const handleRequest = async (req, res) => {
             const origin = requestOrigin(req);
             const base = publicUrl() ?? (auth.kind === "session" && origin ? origin : null);
             const code = formatPairingCode(opened.code);
+            // Two links for one window. `url` opens the web app and is what a
+            // browser and the iOS app already read. `inviteUrl` is the custom
+            // scheme the native companion scanners accept; it carries the
+            // credential encoding because those scanners cannot take a typed code.
+            const serverName = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED }).label;
+            const invite = base
+                ? `openmausbot://pair?address=${encodeURIComponent(base)}&token=${encodeURIComponent(opened.credential)}&name=${encodeURIComponent(serverName)}`
+                : null;
             return json(res, 200, {
                 id: opened.id,
                 code,
+                credential: opened.credential,
                 expiresAt: opened.expiresAt,
                 url: base ? `${base}/pair#code=${code}` : null,
+                inviteUrl: invite,
+                serverName,
                 hint: base
                     ? null
                     : "this server has no public address to put in a link: set OMB_PUBLIC_URL, or open /pair on the address you use and type the code",
@@ -9302,6 +9787,43 @@ const handleRequest = async (req, res) => {
                 task: store.taskByThread(internalSender.id, internalCapability.threadId),
                 threadId: internalCapability.threadId,
             });
+            if (path === "/api/internal/computer/select" && (method === "GET" || method === "POST")) {
+                const source = computerSelectionTurns.get(internalCapability.threadId);
+                const bot = store.projectBotForTask(internalSender.id, internalCapability.threadId);
+                const canSelect = Boolean(source && source.generation === internalCapability.generation && bot && bot.computer !== "off");
+                if (!bot)
+                    return json(res, 403, { error: "Computer selection belongs to a direct bot conversation." });
+                const requested = method === "POST" ? (await readInternalBody()).surface : undefined;
+                if (method === "POST" && !canSelect)
+                    return json(res, 403, { error: "Computer selection is only available once per direct user request, with computer access enabled." });
+                if (method === "POST" && requested !== "auto" && !parseSurface(requested)) {
+                    return json(res, 400, { error: "surface must be auto, cloud, vm, local, or browser" });
+                }
+                const options = await selectableComputers(bot);
+                const current = source ? source.mounted ?? "off" : await computerPreviewSurface(bot, bot.threadId);
+                requireActiveInternalCapability();
+                if (method === "GET")
+                    return json(res, 200, { current, canSelect, options });
+                if (computerSelectionTurns.get(internalCapability.threadId) !== source)
+                    return json(res, 409, { error: "The user request ended before its computer was selected." });
+                const option = requested === "auto"
+                    ? options.find(option => option.ready && option.surface === current) ?? options.find(option => option.ready && option.surface === "vm") ?? options.find(option => option.ready) ?? options.find(option => option.canStart) ?? options.find(option => option.canCreate && option.surface === "vm") ?? options.find(option => option.canCreate)
+                    : options.find(option => option.surface === requested);
+                if (!option?.available)
+                    return json(res, 409, { error: option?.reason ?? "No configured computer or browser is available. Open the Computer panel to set one up.", options });
+                if (source.selected) {
+                    if (source.selected !== option.surface)
+                        return json(res, 409, { error: "A computer switch is already pending. End this turn to continue there." });
+                }
+                else {
+                    if (option.surface === current && option.ready)
+                        return json(res, 200, { status: "ready", surface: current, message: "This computer is already selected. Use its mounted tools." });
+                    source.selected = option.surface;
+                    source.previousSurface = store.taskByThread(bot.id, bot.threadId)?.surface;
+                }
+                return json(res, 200, { status: "pending", surface: option.surface,
+                    message: `End this turn now without using the previous computer tools. OpenMausBot will continue the original request on ${option.label} with a fresh tool connection.` });
+            }
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
                 const result = updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText }, { source: memorySource() });
@@ -9694,30 +10216,64 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: "source conversation does not belong to sender" });
                 }
                 const q = String(url.searchParams.get("q") ?? "").trim();
-                if (!q)
-                    return json(res, 400, { error: "q is required" });
+                // A recall by time needs no words: "what happened since yesterday"
+                // is the standup question, and it has no keyword.
+                const now = Date.now();
+                const sinceRaw = url.searchParams.get("since");
+                const untilRaw = url.searchParams.get("until");
+                const since = sinceRaw ? parseSince(sinceRaw, now) : null;
+                const until = untilRaw ? parseSince(untilRaw, now) : null;
+                if (sinceRaw && since === null)
+                    return json(res, 400, { error: "since must be a date, or a span like 24h, 3d, today, yesterday" });
+                if (untilRaw && until === null)
+                    return json(res, 400, { error: "until must be a date, or a span like 24h, 3d, today, yesterday" });
+                if (!q && since === null)
+                    return json(res, 400, { error: "q or since is required" });
+                const range = since !== null || until !== null
+                    ? { ...(since !== null ? { since } : {}), ...(until !== null ? { until } : {}) }
+                    : undefined;
                 const rawLimit = Number(url.searchParams.get("limit"));
                 const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(Math.trunc(rawLimit), 25) : 12;
                 // Memory files ride along by default: the bot's own notes are as
                 // much its notebook as its transcripts, and scoped the same way —
-                // the caller's own bot, never another's.
+                // the caller's own bot, never another's. A recall by time alone
+                // has no words to match a file with.
                 const scope = url.searchParams.get("scope") ?? "all";
                 if (scope !== "all" && scope !== "conversations" && scope !== "memory") {
                     return json(res, 400, { error: "scope must be all, conversations, or memory" });
                 }
-                const memoryHits = scope === "conversations" ? [] : searchMemoryFiles(from.id, q, limit);
+                const memoryHits = scope === "conversations" || !q ? [] : searchMemoryFiles(from.id, q, limit);
                 if (scope === "memory")
                     return json(res, 200, { hits: [], memoryHits });
-                const ownThreads = [...new Set([from.threadId, ...(from.tasks ?? []).map((task) => task.threadId)])];
-                // A room is the only place a recall can be a disclosure: in a 1:1 the
-                // user already owns every thread the bot can reach.
+                // Own threads: the bot's main chat and tasks, and the rooms it is a
+                // member of with their tasks — conversations it already saw in full.
+                // Still own-bot: another bot's threads never enter this list.
+                const roomByThread = new Map();
+                for (const group of store.groups) {
+                    if (!group.memberIds.includes(from.id))
+                        continue;
+                    roomByThread.set(group.threadId, group);
+                    for (const task of group.tasks ?? [])
+                        roomByThread.set(task.threadId, group);
+                }
+                const ownThreads = [...new Set([from.threadId, ...(from.tasks ?? []).map((task) => task.threadId), ...roomByThread.keys()])];
+                // A room is the only place a recall can be a disclosure, and only a
+                // private chat is one: in a 1:1 the user already owns every thread
+                // the bot can reach, and a room's lines were said in the open.
                 const inRoom = Boolean(store.groupByThread(fromThreadId));
-                const hits = recallMessages(q, ownThreads, limit).map((hit) => ({
-                    ...hit,
-                    task: store.taskByThread(from.id, hit.threadId)?.title,
-                    current: hit.threadId === fromThreadId,
-                    crossed: inRoom && hit.threadId !== fromThreadId,
-                }));
+                const found = q ? recallMessages(q, ownThreads, limit, range) : recentMessages(ownThreads, range ?? {}, limit);
+                const hits = found.map((hit) => {
+                    const room = roomByThread.get(hit.threadId);
+                    return {
+                        ...hit,
+                        task: room
+                            ? (room.tasks ?? []).find((task) => task.threadId === hit.threadId)?.title
+                            : store.taskByThread(from.id, hit.threadId)?.title,
+                        ...(room ? { room: room.name } : {}),
+                        current: hit.threadId === fromThreadId,
+                        crossed: inRoom && !room && hit.threadId !== fromThreadId,
+                    };
+                });
                 if (inRoom) {
                     discloseRecall(from, fromThreadId, hits.filter((hit) => hit.crossed).map((hit) => hit.threadId));
                 }
@@ -10723,7 +11279,9 @@ const handleRequest = async (req, res) => {
                     // where the work is, and say which room it was.
                     const roomTurn = activeGroupTurnForBot(bot.id);
                     const target = blockedTarget({ ...bot, threadId: internalCapability.threadId }, roomTurn && { ...roomTurn.group, threadId: roomTurn.threadId });
-                    notify(buildNotification("takeover", bot, target.threadId, snapshot.helpReason ?? "asked you to take over", {
+                    const helpPlace = store.taskByThread(bot.id, internalCapability.threadId)?.surface ?? bot.computer;
+                    const helpWhere = helpPlace && helpPlace !== "off" ? ` on ${surfaceLabel(helpPlace)}` : "";
+                    notify(buildNotification("takeover", bot, target.threadId, `${snapshot.helpReason ?? "asked you to take over"}${helpWhere}`, {
                         group: target.group,
                     }));
                     return json(res, 200, { held: snapshot.held, helpOpen: snapshot.helpReason !== null, requestId });
@@ -10852,6 +11410,11 @@ const handleRequest = async (req, res) => {
         if (path === "/api/routines" && method === "POST") {
             return json(res, 201, { routine: routines.create(await readBody(req)) });
         }
+        // The desktop shell polls this to decide whether to hold the computer
+        // awake: a run in flight, or a routine due within the hour.
+        if (path === "/api/routines/wake" && method === "GET") {
+            return json(res, 200, routines.wakeHold());
+        }
         let routineMatch = path.match(/^\/api\/routines\/([\w-]+)\/run$/);
         if (routineMatch && method === "POST") {
             const run = routines.runNow(routineMatch[1]);
@@ -11084,7 +11647,7 @@ const handleRequest = async (req, res) => {
             if (threadId === undefined &&
                 (auth.kind === "session" || req.headers["x-openmausbot-companion"] === "1") &&
                 store.tasks(botId).length > 1) {
-                throw Object.assign(new Error("This bot has multiple threads. Update this client and choose a thread before sending this action."), { status: 409 });
+                throw Object.assign(new Error("This bot has more than one thread. Update the OpenMausBot app on this device, then choose a thread and try again."), { status: 409 });
             }
         };
         if (method === "GET" && path === "/api/bots") {
@@ -12352,7 +12915,7 @@ const handleRequest = async (req, res) => {
         if (m && method === "PATCH") {
             const body = await readBody(req);
             if (body && typeof body === "object" && !Array.isArray(body)) {
-                const unsupported = Object.keys(body).find((key) => key !== "instanceId" && key !== "model" && key !== "effort");
+                const unsupported = Object.keys(body).find((key) => key !== "instanceId" && key !== "model" && key !== "effort" && key !== "variant");
                 if (unsupported)
                     return json(res, 400, { error: `unsupported model field: ${unsupported}` });
             }
@@ -13497,7 +14060,7 @@ const handleRequest = async (req, res) => {
                     // message intact for the next ordinary turn, where central image
                     // admission can hand it to the provider natively.
                     const carriesImages = extractTurnImages(text).images.length > 0;
-                    if (!carriesImages && instance?.adapter.capabilities.queueing && instance.adapter.steer) {
+                    if (!carriesImages && !computerSelectionTurns.get(threadId)?.selected && instance?.adapter.capabilities.queueing && instance.adapter.steer) {
                         steered = await instance.adapter
                             .steer(threadId, promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"))
                             .catch(() => false);
@@ -13926,7 +14489,7 @@ const handleRequest = async (req, res) => {
             const current = store.projectBotForTask(m[1], m[2]);
             if (!current)
                 return json(res, 404, { error: "no such task" });
-            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt"]);
+            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "surface"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported thread setting" });
             for (const key of ["requireAvailableModel", "acknowledgeLocalAuto", "updateBotDefault", "resetApprovalToAsk"]) {
@@ -13963,6 +14526,18 @@ const handleRequest = async (req, res) => {
                 else
                     return json(res, 400, { error: "archivedAt must be a timestamp, or null to unarchive" });
             }
+            if (body.surface !== undefined) {
+                if (threadBusy(current.id, current.threadId))
+                    return json(res, 409, { error: "Stop this thread before changing its computer destination." });
+                // Where this conversation works, chosen from the composer. Null follows
+                // the bot's Works on again. Reachability is the turn's to judge.
+                if (body.surface === null)
+                    patch.surface = undefined;
+                else if (parseSurface(body.surface))
+                    patch.surface = parseSurface(body.surface);
+                else
+                    return json(res, 400, { error: "surface must be cloud, vm, local, browser, or null to follow the bot" });
+            }
             if (body.pinnedMessageId !== undefined) {
                 if (body.pinnedMessageId === null || body.pinnedMessageId === "")
                     patch.pinnedMessageId = undefined;
@@ -14288,7 +14863,7 @@ const handleRequest = async (req, res) => {
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/local-computer$/);
         if (m && method === "GET") {
-            const bot = store.bot(m[1]);
+            const bot = computerPreviewBot(m[1], url);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
             return json(res, 200, await localVmPayload(localVmTargetForBot(bot.id)));
@@ -14358,9 +14933,12 @@ const handleRequest = async (req, res) => {
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/local-computer\/screenshot$/);
         if (m && method === "POST") {
-            const bot = store.bot(m[1]);
+            const bot = computerPreviewBot(m[1], url);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            if (url.searchParams.has("threadId") && await computerPreviewSurface(bot, bot.threadId) !== "vm") {
+                return json(res, 409, { error: "This conversation is not using the Local VM" });
+            }
             const target = localVmTargetForBot(bot.id);
             localVmIdleFor(target).touch();
             return json(res, 200, {
@@ -14784,7 +15362,7 @@ const handleRequest = async (req, res) => {
                 providerConfigBusy = false;
             }
         }
-        // ── custom MCP servers (stdio, local, secrets write-only) ──
+        // ── custom MCP servers (a local command or a URL; secrets write-only) ──
         if (method === "GET" && path === "/api/mcp/servers") {
             return json(res, 200, mcpServerResponse());
         }
@@ -14830,12 +15408,7 @@ const handleRequest = async (req, res) => {
                 if (Object.keys(current).length >= MAX_MCP_SERVERS) {
                     return json(res, 400, { error: `You can add at most ${MAX_MCP_SERVERS} MCP servers.` });
                 }
-                const parsed = parseMcpServerMutation(name, {
-                    command: body?.command,
-                    args: body?.args,
-                    env: body?.env,
-                    enabled: body?.enabled,
-                });
+                const parsed = parseMcpServerMutation(name, mcpServerBody(body));
                 if (!parsed.ok)
                     return json(res, 400, { error: parsed.error });
                 persistMcpServers({ ...current, [name]: parsed.server });
@@ -14931,6 +15504,14 @@ const handleRequest = async (req, res) => {
             const patch = parseConfigPatch(body);
             if (!Object.keys(patch).length)
                 return json(res, 400, { error: "nothing to save" });
+            const changingVoiceProvider = patch.tts?.provider !== undefined
+                && patch.tts.provider !== tts.voiceProvider(cfg);
+            if (changingVoiceProvider && patch.tts?.voice === undefined) {
+                // Voice ids are provider-owned opaque values. Never carry a default
+                // from one catalog into another. A caller may explicitly supply a
+                // voice for the newly selected provider in this same atomic patch.
+                patch.tts = { ...patch.tts, voice: "" };
+            }
             if (providerConfigBusy)
                 return json(res, 409, { error: "provider settings are already being updated" });
             if (patch.browserProfiles !== undefined && body.expectedBrowserProfiles !== undefined) {
@@ -15014,42 +15595,83 @@ const handleRequest = async (req, res) => {
                     if (resourceError)
                         return json(res, 409, { error: resourceError });
                 }
-                const boxRecovery = changingBoxToken ? boxCreateRecoverySnapshot() : [];
+                let boxRecovery = changingBoxToken ? boxCreateRecoverySnapshot() : [];
+                let boxDeletions = changingBoxToken ? boxDeletionSnapshot() : [];
+                if (changingBoxToken && boxDeletions.length > 0 && !nextBoxToken) {
+                    return json(res, 409, {
+                        error: "finish or retry pending cloud computer deletion before removing the Box account",
+                    });
+                }
+                let replacementProvedByDeletion = false;
+                if (changingBoxToken && boxDeletions.length > 0 && nextBoxToken) {
+                    try {
+                        await box.verifyBoxDeletionCredential({ box: { token: nextBoxToken } });
+                        replacementProvedByDeletion = true;
+                        // Verification can observe a completed operation and retire both
+                        // its deletion fence and matching create receipt. Never continue
+                        // with the pre-verification snapshots: they would demand access
+                        // to a Box whose exact operation just proved it was deleted.
+                        boxRecovery = boxCreateRecoverySnapshot();
+                        boxDeletions = boxDeletionSnapshot();
+                    }
+                    catch (error) {
+                        return json(res, error?.status ?? 503, {
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                    }
+                }
                 let currentBoxInventory = null;
                 let currentBoxResources = null;
                 const journalBoxResources = [];
+                const deletingBoxIds = new Set(boxDeletions.map((entry) => entry.boxId));
                 if (changingBoxToken && currentBoxToken) {
                     currentBoxInventory = await box.listManagedBoxes({ box: { token: currentBoxToken } }, managedBoxOwners());
                     if (!currentBoxInventory.available) {
-                        return json(res, 503, {
-                            error: `${currentBoxInventory.problem ?? "cloud computer inventory is unavailable"}. Keep the current Box account and retry`,
-                        });
-                    }
-                    const currentById = new Map(currentBoxInventory.instances.map((instance) => [instance.boxId, { boxId: instance.boxId, name: instance.name }]));
-                    for (const recovery of boxRecovery) {
-                        if (!recovery.boxId)
-                            continue;
-                        const inspected = await box.inspectBoxIdentity({ box: { token: currentBoxToken } }, recovery.boxId);
-                        if (!inspected.available) {
+                        if (!replacementProvedByDeletion) {
                             return json(res, 503, {
-                                error: `${inspected.problem ?? "a remembered cloud computer could not be verified"}. Keep the current Box account and retry`,
+                                error: `${currentBoxInventory.problem ?? "cloud computer inventory is unavailable"}. Keep the current Box account and retry`,
                             });
                         }
-                        if (!inspected.identity) {
-                            // Reconcile exact stale receipts while the current credential is
-                            // still available. Leaving one behind would make a later token
-                            // addition demand access to a Box the provider proved is gone.
-                            retireDeletedBoxCreate(recovery.boxId);
-                            continue;
-                        }
-                        const listed = currentById.get(inspected.identity.boxId);
-                        if (listed && listed.name !== inspected.identity.name) {
-                            return json(res, 503, { error: "ascii.dev returned conflicting cloud computer identities; keep the current Box account and retry" });
+                        // The old token may be the reason this deletion is stuck. A
+                        // target-bound operation/identity proved the replacement belongs
+                        // to the same account, so do not deadlock credential recovery on
+                        // an inventory request made with the expired token.
+                        currentBoxInventory = null;
+                    }
+                    if (currentBoxInventory) {
+                        const currentById = new Map(currentBoxInventory.instances.map((instance) => [instance.boxId, { boxId: instance.boxId, name: instance.name }]));
+                        for (const recovery of boxRecovery) {
+                            if (!recovery.boxId)
+                                continue;
+                            // A failed provisioning attempt may never have reached the
+                            // deterministic rename. The replacement credential already
+                            // proved the exact deletion target, so its in-flight resource
+                            // is governed by that stronger target-bound receipt rather
+                            // than an OpenMausBot name check.
+                            if (replacementProvedByDeletion && deletingBoxIds.has(recovery.boxId))
+                                continue;
+                            const inspected = await box.inspectBoxIdentity({ box: { token: currentBoxToken } }, recovery.boxId);
+                            if (!inspected.available) {
+                                return json(res, 503, {
+                                    error: `${inspected.problem ?? "a remembered cloud computer could not be verified"}. Keep the current Box account and retry`,
+                                });
+                            }
+                            if (!inspected.identity) {
+                                // Reconcile exact stale receipts while the current credential is
+                                // still available. Leaving one behind would make a later token
+                                // addition demand access to a Box the provider proved is gone.
+                                retireDeletedBoxCreate(recovery.boxId);
+                                continue;
+                            }
+                            const listed = currentById.get(inspected.identity.boxId);
+                            if (listed && listed.name !== inspected.identity.name) {
+                                return json(res, 503, { error: "ascii.dev returned conflicting cloud computer identities; keep the current Box account and retry" });
+                            }
+                            currentById.set(inspected.identity.boxId, inspected.identity);
+                            journalBoxResources.push(inspected.identity);
                         }
-                        currentById.set(inspected.identity.boxId, inspected.identity);
-                        journalBoxResources.push(inspected.identity);
+                        currentBoxResources = [...currentById.values()];
                     }
-                    currentBoxResources = [...currentById.values()];
                 }
                 if (changingLocalVmMode) {
                     if (localVmActiveThreads.size > 0 || localVmLifecycleBusy.size > 0 || localVmImageBusy) {
@@ -15096,7 +15718,7 @@ const handleRequest = async (req, res) => {
                     if (!check.ok)
                         return json(res, 400, { error: check.message });
                 }
-                if (changingBoxToken && !currentBoxToken && boxRecovery.length > 0) {
+                if (changingBoxToken && (!currentBoxToken || replacementProvedByDeletion) && boxRecovery.length > 0) {
                     if (!nextBoxToken) {
                         return json(res, 409, { error: "restore the Box account that owns the remembered cloud computers before clearing it" });
                     }
@@ -15104,6 +15726,8 @@ const handleRequest = async (req, res) => {
                         if (!recovery.boxId) {
                             return json(res, 409, { error: "finish reconciling pending cloud computer creation before changing the Box account" });
                         }
+                        if (replacementProvedByDeletion && deletingBoxIds.has(recovery.boxId))
+                            continue;
                         const inspected = await box.inspectBoxIdentity({ box: { token: nextBoxToken } }, recovery.boxId);
                         if (!inspected.available) {
                             return json(res, 503, {
@@ -15147,15 +15771,17 @@ const handleRequest = async (req, res) => {
                     if (resourceError)
                         return json(res, 409, { error: resourceError });
                 }
-                // same rule for a voice key — and check it against the provider the
-                // patch SELECTS, not the one already saved, or pasting a Cartesia key
-                // while switching from ElevenLabs validates against the wrong service
+                // Each cloud voice provider owns its own credential. Validate the field
+                // against that provider rather than whichever provider happens to be
+                // selected, so switching engines never sends one service another's key.
                 const newTts = patch.tts;
-                // Chatterbox has no key at all — its credential is a local server
-                // address, and an ElevenLabs round trip would be the wrong test
-                const selectedVoiceProvider = newTts?.provider ?? cfg.tts?.provider ?? "elevenlabs";
-                if (newTts?.key?.trim() && selectedVoiceProvider !== "chatterbox") {
-                    const check = await tts.verifyKey(newTts.key.trim());
+                if (newTts?.key?.trim()) {
+                    const check = await tts.verifyKey("elevenlabs", newTts.key.trim());
+                    if (!check.ok)
+                        return json(res, 400, { error: check.message });
+                }
+                if (newTts?.fishKey?.trim()) {
+                    const check = await tts.verifyKey("fish", newTts.fishKey.trim());
                     if (!check.ok)
                         return json(res, 400, { error: check.message });
                 }
@@ -15200,6 +15826,13 @@ const handleRequest = async (req, res) => {
                 let configWriteCommitted = false;
                 const externalSecretStorage = url.searchParams.get("secretStorage") === "external";
                 try {
+                    // Provider-owned voice ids must be invalidated before the provider
+                    // commit. If bots.json cannot be written, leave the old provider in
+                    // place rather than committing a new provider with stale bot voices.
+                    // A later config-write failure may leave voices cleared, which is the
+                    // safe side of this cross-file mutation: no foreign id can be spoken.
+                    if (changingVoiceProvider)
+                        store.clearVoiceSelections();
                     if (externalSecretStorage) {
                         // The packaged Electron caller commits supplied credentials to the
                         // OS-encrypted store before entering this route. Persist every
@@ -15217,6 +15850,8 @@ const handleRequest = async (req, res) => {
                             persisted.opencodeGo.apiKey = "";
                         if (persisted.tts?.key !== undefined)
                             persisted.tts.key = "";
+                        if (persisted.tts?.fishKey !== undefined)
+                            persisted.tts.fishKey = "";
                         if (persisted.imageGen?.key !== undefined)
                             persisted.imageGen.key = "";
                         if (persisted.imageGen?.customApiKey !== undefined)
@@ -15582,15 +16217,18 @@ const handleRequest = async (req, res) => {
         // ── the bot's cloud computer (Box) ──
         m = path.match(/^\/api\/bots\/([\w-]+)\/computer$/);
         if (m && method === "GET") {
-            const bot = store.bot(m[1]);
+            const bot = computerPreviewBot(m[1], url);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            const surface = url.searchParams.has("threadId") ? await computerPreviewSurface(bot, bot.threadId) : "cloud";
+            if (surface !== "cloud")
+                return json(res, 200, { surface, configured: false, backend: bot.cloudBackend === "vps" ? "vps" : "box" });
             const teamComputer = inheritedTeamComputer(bot);
             if (teamComputer)
-                return json(res, 200, { backend: "box", teamComputer: { id: teamComputer.id, name: teamComputer.name }, ...(await box.boxStatus(cfg, teamComputerOwner(teamComputer.id))) });
+                return json(res, 200, { surface, backend: "box", teamComputer: { id: teamComputer.id, name: teamComputer.name }, ...(await box.boxStatus(cfg, teamComputerOwner(teamComputer.id))) });
             return bot.cloudBackend === "vps"
-                ? json(res, 200, { backend: "vps", ...(await vps.vpsComputerStatus(cfg, bot.id)) })
-                : json(res, 200, { backend: "box", ...(await box.boxStatus(cfg, bot.id)) });
+                ? json(res, 200, { surface, backend: "vps", ...(await vps.vpsComputerStatus(cfg, bot.id)) })
+                : json(res, 200, { surface, backend: "box", ...(await box.boxStatus(cfg, bot.id)) });
         }
         // Who is driving this bot's computer. GET is the panel's initial read;
         // POST take/release/dismiss-help are the person's three moves. The bot
@@ -15651,7 +16289,7 @@ const handleRequest = async (req, res) => {
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/viewer-close$/);
         if (m && method === "POST") {
-            const bot = store.bot(m[1]);
+            const bot = computerPreviewBot(m[1], url);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
@@ -15662,9 +16300,14 @@ const handleRequest = async (req, res) => {
         m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/(provision|join|sleep|exec|screenshot|remove)$/);
         if (m && method === "POST") {
             const botId = m[1];
-            const bot = store.bot(botId);
+            const previewOnly = m[2] === "screenshot" || m[2] === "join";
+            const bot = previewOnly ? computerPreviewBot(botId, url) : store.bot(botId);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            const threadPreview = previewOnly && url.searchParams.has("threadId");
+            if (threadPreview && await computerPreviewSurface(bot, bot.threadId) !== "cloud") {
+                return json(res, 409, { error: "This conversation is not using the cloud computer" });
+            }
             // Requiring JSON makes every computer mutation a non-simple browser
             // request (same reasoning as the Local VM lifecycle routes above): a
             // hostile page cannot submit it with a form, and its cross-origin JSON
@@ -15756,7 +16399,7 @@ const handleRequest = async (req, res) => {
                     });
                 }
             }
-            if (bot.computer !== "cloud") {
+            if (bot.computer !== "cloud" && !threadPreview) {
                 return json(res, 409, {
                     error: "Choose Cloud before changing or opening this Box. Auto only checks existing computer state.",
                 });
@@ -15771,7 +16414,7 @@ const handleRequest = async (req, res) => {
                     case "provision":
                         return json(res, 200, await box.provisionBox(cfg, botId, bot.name));
                     case "join":
-                        return json(res, 200, await (activeBoxTurn ? box.joinReadyBox(cfg, botId) : box.joinBox(cfg, botId)));
+                        return json(res, 200, await (activeBoxTurn || threadPreview ? box.joinReadyBox(cfg, botId) : box.joinBox(cfg, botId)));
                     case "sleep":
                         return json(res, 200, await box.sleepBox(cfg, botId));
                     case "exec":