openmausbot 0.1.82 → 0.1.83

package/dist-server/pair-cli.js

@@ -17568,15 +17568,23 @@ var init_image_generation = __esm({
   }
 });
 
+// shared/wire.ts
+var EFFORT_LEVELS;
+var init_wire = __esm({
+  "shared/wire.ts"() {
+    "use strict";
+    EFFORT_LEVELS = ["none", "low", "medium", "high", "xhigh", "max"];
+  }
+});
+
 // server/contracts.ts
 function isModelVariant(value) {
   return typeof value === "string" && value.length > 0 && value.length <= 256 && value.trim() === value && !new RegExp("\\p{Cc}", "u").test(value);
 }
-var EFFORT_LEVELS, eventCounter, newEventId, newId;
+var eventCounter, newEventId, newId;
 var init_contracts = __esm({
   "server/contracts.ts"() {
     "use strict";
-    EFFORT_LEVELS = ["none", "low", "medium", "high", "xhigh", "max"];
     eventCounter = 0;
     newEventId = () => `ev-${Date.now().toString(36)}-${(eventCounter++).toString(36)}`;
     newId = () => crypto.randomUUID();
@@ -17937,13 +17945,14 @@ function instanceConfigs(cfg) {
   }
   return map3;
 }
-var optionalText, SSH_ALIAS, LEGACY_BROWSER_PROFILE_ID, BROWSER_PROFILE_ID, MIN_ROOM_TURN_TIMEOUT_MINUTES, MAX_ROOM_TURN_TIMEOUT_MINUTES, MAX_CONCURRENT_BOT_THREADS, MIN_THREAD_EVENT_LOG_BYTES, MAX_THREAD_EVENT_LOG_BYTES, MIN_LOCAL_VM_MAX_INSTANCES, MAX_LOCAL_VM_MAX_INSTANCES, vpsConfigSchema, roomConfigSchema, localVmConfigSchema, browserProfileSchema, legacyBrowserProfileSchema, legacyBrowserProfilesSchema, storedBrowserProfilesSchema, browserProfilesSchema, featureConfigSchema, onboardingConfigSchema, instanceConfigSchema, instanceConfigMapSchema, defaultModelSelectionSchema, appConfigSchema, storedAppConfigSchema, appConfigPatchSchema, jsonObjectSchema, DATA_DIR, LEGACY_DATA_DIR, EVENTS_DIR, NATIVE_DIR, WORKSPACE_CREDENTIAL_ENV, PROVIDER_CREDENTIAL_ENV;
+var optionalText, SSH_ALIAS, LEGACY_BROWSER_PROFILE_ID, BROWSER_PROFILE_ID, MIN_ROOM_TURN_TIMEOUT_MINUTES, MAX_ROOM_TURN_TIMEOUT_MINUTES, DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES, DEFAULT_ROOM_HANDOFF_MIN_RUNWAY_MINUTES, DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES, MAX_CONCURRENT_BOT_THREADS, MIN_THREAD_EVENT_LOG_BYTES, MAX_THREAD_EVENT_LOG_BYTES, MIN_LOCAL_VM_MAX_INSTANCES, MAX_LOCAL_VM_MAX_INSTANCES, vpsConfigSchema, roomConfigSchema, localVmConfigSchema, browserProfileSchema, legacyBrowserProfileSchema, legacyBrowserProfilesSchema, storedBrowserProfilesSchema, browserProfilesSchema, featureConfigSchema, onboardingConfigSchema, instanceConfigSchema, instanceConfigMapSchema, defaultModelSelectionSchema, appConfigSchema, storedAppConfigSchema, appConfigPatchSchema, jsonObjectSchema, DATA_DIR, LEGACY_DATA_DIR, EVENTS_DIR, NATIVE_DIR, WORKSPACE_CREDENTIAL_ENV, PROVIDER_CREDENTIAL_ENV;
 var init_config = __esm({
   "server/config.ts"() {
     "use strict";
     init_zod();
     init_image_generation();
     init_atomic();
+    init_wire();
     init_contracts();
     init_mcp_registry();
     init_schema();
@@ -17953,6 +17962,9 @@ var init_config = __esm({
     BROWSER_PROFILE_ID = /^[a-z0-9_-]{1,40}$/;
     MIN_ROOM_TURN_TIMEOUT_MINUTES = 1;
     MAX_ROOM_TURN_TIMEOUT_MINUTES = 1440;
+    DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES = 30;
+    DEFAULT_ROOM_HANDOFF_MIN_RUNWAY_MINUTES = 10;
+    DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES = 240;
     MAX_CONCURRENT_BOT_THREADS = 10;
     MIN_THREAD_EVENT_LOG_BYTES = 256 * 1024;
     MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
@@ -17964,8 +17976,16 @@ var init_config = __esm({
       }).optional()
     });
     roomConfigSchema = external_exports.object({
-      turnTimeoutMinutes: external_exports.number().int().min(MIN_ROOM_TURN_TIMEOUT_MINUTES).max(MAX_ROOM_TURN_TIMEOUT_MINUTES)
-    });
+      turnTimeoutMinutes: external_exports.number().int().min(MIN_ROOM_TURN_TIMEOUT_MINUTES).max(MAX_ROOM_TURN_TIMEOUT_MINUTES),
+      /** Room handoff tree lifetime. Active execution pauses this clock; the
+       * hard cap is wall-clock and bounds trees that never stop executing. */
+      handoffLifetimeMinutes: external_exports.number().int().min(1).max(MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
+      handoffMinRunwayMinutes: external_exports.number().int().min(1).max(MAX_ROOM_TURN_TIMEOUT_MINUTES).optional(),
+      handoffHardCapMinutes: external_exports.number().int().min(1).max(7 * MAX_ROOM_TURN_TIMEOUT_MINUTES).optional()
+    }).refine(
+      (rooms) => (rooms.handoffMinRunwayMinutes ?? DEFAULT_ROOM_HANDOFF_MIN_RUNWAY_MINUTES) <= (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) && (rooms.handoffLifetimeMinutes ?? DEFAULT_ROOM_HANDOFF_LIFETIME_MINUTES) <= (rooms.handoffHardCapMinutes ?? DEFAULT_ROOM_HANDOFF_HARD_CAP_MINUTES),
+      { message: "rooms handoff bounds must satisfy handoffMinRunwayMinutes <= handoffLifetimeMinutes <= handoffHardCapMinutes" }
+    );
     localVmConfigSchema = external_exports.object({
       mode: external_exports.enum(["shared", "per-bot"]).optional(),
       maxInstances: external_exports.number().int().min(MIN_LOCAL_VM_MAX_INSTANCES).max(MAX_LOCAL_VM_MAX_INSTANCES).optional()
@@ -18137,7 +18157,10 @@ var init_config = __esm({
         maxConcurrentPerBot: external_exports.number().int().min(1).max(MAX_CONCURRENT_BOT_THREADS),
         /** Cap each per-thread events/ and native/ NDJSON log at this many
          * bytes; absent (the default) keeps today's unbounded growth (#1280). */
-        eventLogMaxBytes: external_exports.number().int().min(MIN_THREAD_EVENT_LOG_BYTES).max(MAX_THREAD_EVENT_LOG_BYTES).optional()
+        eventLogMaxBytes: external_exports.number().int().min(MIN_THREAD_EVENT_LOG_BYTES).max(MAX_THREAD_EVENT_LOG_BYTES).optional(),
+        /** Days a closed or archived thread's event logs survive (#1280).
+         * Absent keeps them forever. */
+        eventLogRetentionDays: external_exports.number().int().min(1).max(3650).optional()
       }).strict().optional(),
       localVm: localVmConfigSchema.optional(),
       features: featureConfigSchema.optional(),
@@ -18246,7 +18269,7 @@ function ownerPredatesThisBoot(owner) {
   return false;
 }
 function ownerIsAlive(owner) {
-  return !ownerPredatesThisBoot(owner) && processIsAlive2(owner.pid);
+  return !ownerPredatesThisBoot(owner) && processIsAlive2(owner.pid) && ownerIdentityMatches(owner);
 }
 function isLeaseOwner(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -18296,6 +18319,51 @@ function processIsAlive2(pid) {
     throw leaseError("OpenMausBot could not verify the data-directory lease owner; refusing to start.", error51);
   }
 }
+function parseWmiDateTime(value) {
+  const raw = String(value).trim();
+  const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.(\d{6})([+-]\d{3})$/.exec(raw);
+  if (!match) return null;
+  const [_, year, month, day, hour, minute, second, micro, offset] = match;
+  const ms = Date.UTC(
+    Number(year),
+    Number(month) - 1,
+    Number(day),
+    Number(hour),
+    Number(minute),
+    Number(second),
+    Math.floor(Number(micro) / 1e3)
+  );
+  const offsetMinutes = Number(offset);
+  return ms - offsetMinutes * 60 * 1e3;
+}
+function processCreationTimeMs(pid) {
+  if (process.platform !== "win32") return null;
+  try {
+    const output = execFileSync2(
+      "wmic",
+      ["process", "where", `ProcessId=${pid}`, "get", "CreationDate", "/format:csv"],
+      { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }
+    );
+    for (const line of output.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const lower = trimmed.toLowerCase();
+      if (lower === "node,creationdate" || lower.startsWith("node,")) continue;
+      const parts = trimmed.split(",");
+      const raw = parts[parts.length - 1].trim();
+      const parsed = parseWmiDateTime(raw);
+      if (parsed !== null) return parsed;
+    }
+  } catch {
+  }
+  return null;
+}
+function ownerIdentityMatches(owner) {
+  if (process.platform !== "win32") return true;
+  const created = processCreationTimeMs(owner.pid);
+  if (created === null) return true;
+  return created < owner.createdAt;
+}
 function unlinkExact(path3, message2) {
   try {
     unlinkSync2(path3);
@@ -18701,7 +18769,8 @@ function parseCmdShim(shim, env) {
     return null;
   }
   const dir = dirname4(shim);
-  const targets = [...text4.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m) => join8(dir, m[1])).filter((p) => isFile(p) && basename2(p).toLowerCase() !== "node.exe");
+  const npmEntry = /^SET "NP[MX]_CLI_JS=%~dp0\\([^"]+)"/im.exec(text4);
+  const targets = [...npmEntry ? [npmEntry] : [], ...text4.matchAll(/"%~?dp0%?\\?([^"]+)"/g)].map((m) => join8(dir, m[1])).filter((p) => isFile(p) && basename2(p).toLowerCase() !== "node.exe");
   const script = targets.find((p) => /\.[cm]?js$/i.test(p));
   if (script) {
     const node = nodeExe(dir, env);
@@ -19574,9 +19643,9 @@ var init_local_inject = __esm({
 // shared/approval-mode.ts
 function supportsApprovalMode(driverKind, mode) {
   if (mode === "custom") return driverKind === "codex";
-  if (mode === "edits") return ["claudeAgent", "grokAgent", "antigravityAgent"].includes(driverKind ?? "");
+  if (mode === "edits") return ["claudeAgent", "grokAgent", "antigravityAgent", "qwenAgent", "geminiAgent"].includes(driverKind ?? "");
   if (mode !== "full") return true;
-  return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo"].includes(driverKind ?? "");
+  return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo", "qwenAgent", "geminiAgent"].includes(driverKind ?? "");
 }
 var init_approval_mode = __esm({
   "shared/approval-mode.ts"() {
@@ -19584,12 +19653,7 @@ var init_approval_mode = __esm({
   }
 });
 
-// server/redact.ts
-function isSecretName(name) {
-  const lower = name.toLowerCase();
-  if (SECRET_KEY_PARTS.some((part) => lower.includes(part))) return true;
-  return /(^|[_.-])keys?$/.test(lower);
-}
+// shared/redact.ts
 function redactSecretsInText(text4) {
   if (!text4 || text4.length < 8) return text4;
   let out = text4;
@@ -19604,33 +19668,10 @@ ${close}`);
   out = out.replace(URL_USERINFO, (_m, lead, secret, at) => `${lead}${mask(secret)}${at}`);
   return out;
 }
-function redactSecrets(input, depth = 0) {
-  if (typeof input === "string") return redactSecretsInText(input);
-  if (depth > 12 || input === null || typeof input !== "object") return input;
-  if (Array.isArray(input)) {
-    return input.map((item) => {
-      if (item !== null && typeof item === "object" && !Array.isArray(item) && typeof item.name === "string" && typeof item.value === "string") {
-        const entry = item;
-        return isSecretName(entry.name) ? { ...entry, value: mask(entry.value) } : { ...entry, value: redactSecretsInText(entry.value) };
-      }
-      return redactSecrets(item, depth + 1);
-    });
-  }
-  const out = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (typeof value === "string" && isSecretName(key)) {
-      out[key] = mask(value);
-      continue;
-    }
-    out[key] = redactSecrets(value, depth + 1);
-  }
-  return out;
-}
-var SECRET_KEY_PARTS, REDACTION_MARKER, mask, KEY_PREFIXES, BEARER, PEM_BLOCK, KEY_VALUE, KEY_SUFFIX_ASSIGNMENT, SECRET_FLAG, URL_USERINFO;
+var REDACTION_MARKER, mask, KEY_PREFIXES, BEARER, PEM_BLOCK, KEY_VALUE, KEY_SUFFIX_ASSIGNMENT, SECRET_FLAG, URL_USERINFO;
 var init_redact = __esm({
-  "server/redact.ts"() {
+  "shared/redact.ts"() {
     "use strict";
-    SECRET_KEY_PARTS = ["token", "secret", "password", "passwd", "apikey", "api_key", "authorization", "auth_token"];
     REDACTION_MARKER = /^«redacted \d+ chars»$/;
     mask = (value) => REDACTION_MARKER.test(value) ? value : `\xABredacted ${value.length} chars\xBB`;
     KEY_PREFIXES = [
@@ -19668,6 +19709,44 @@ var init_redact = __esm({
   }
 });
 
+// server/redact.ts
+function isSecretName(name) {
+  const lower = name.toLowerCase();
+  if (SECRET_KEY_PARTS.some((part) => lower.includes(part))) return true;
+  return /(^|[_.-])keys?$/.test(lower);
+}
+function redactSecrets(input, depth = 0) {
+  if (typeof input === "string") return redactSecretsInText(input);
+  if (depth > 12 || input === null || typeof input !== "object") return input;
+  if (Array.isArray(input)) {
+    return input.map((item) => {
+      if (item !== null && typeof item === "object" && !Array.isArray(item) && typeof item.name === "string" && typeof item.value === "string") {
+        const entry = item;
+        return isSecretName(entry.name) ? { ...entry, value: mask(entry.value) } : { ...entry, value: redactSecretsInText(entry.value) };
+      }
+      return redactSecrets(item, depth + 1);
+    });
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (typeof value === "string" && isSecretName(key)) {
+      out[key] = mask(value);
+      continue;
+    }
+    out[key] = redactSecrets(value, depth + 1);
+  }
+  return out;
+}
+var SECRET_KEY_PARTS;
+var init_redact2 = __esm({
+  "server/redact.ts"() {
+    "use strict";
+    init_redact();
+    init_redact();
+    SECRET_KEY_PARTS = ["token", "secret", "password", "passwd", "apikey", "api_key", "authorization", "auth_token"];
+  }
+});
+
 // server/thread-log-rotation.ts
 import { closeSync as closeSync4, fstatSync, openSync as openSync4, readSync as readSync2, renameSync as renameSync5, rmSync as rmSync4, statSync as statSync3, writeSync } from "node:fs";
 function currentThreadLogCap() {
@@ -19753,7 +19832,7 @@ var init_native = __esm({
   "server/drivers/native.ts"() {
     "use strict";
     init_config();
-    init_redact();
+    init_redact2();
     init_thread_log_rotation();
   }
 });
@@ -19816,7 +19895,7 @@ var QUESTION_LIMIT, LIMIT, cut;
 var init_tool_summary = __esm({
   "server/tool-summary.ts"() {
     "use strict";
-    init_redact();
+    init_redact2();
     QUESTION_LIMIT = 300;
     LIMIT = 200;
     cut = (text4, limit) => redactSecretsInText(text4).trim().slice(0, limit);
@@ -23968,8 +24047,8 @@ var init_claude = __esm({
         };
         const steer = async (threadId, text4) => {
           const s = sessions.get(threadId);
-          if (!s || !s.turn || s.turn.settled || s.closing || s.child.exitCode !== null) return false;
-          return writeUser(s, threadId, claudeUserMessage(text4, void 0));
+          if (!s || !s.turn || s.turn.settled || s.closing || s.child.exitCode !== null) return "refused";
+          return await writeUser(s, threadId, claudeUserMessage(text4, void 0)) ? "steered" : "refused";
         };
         const login = new ClaudeLoginController({ cli: config2.cli, environment, onAuthenticated: async () => {
           await refreshModels();
@@ -25482,9 +25561,23 @@ var init_codex = __esm({
               return stopped;
             });
             let completeStoppedTurn;
+            let interruptRequested = false;
             const stop = async () => {
               stopRequested = true;
               stopSignal.abort();
+              if (!state.settled && !interruptRequested && codexThreadId && codexTurnId && child.exitCode === null && child.signalCode === null) {
+                interruptRequested = true;
+                const graceMs = Math.max(1, Number(process.env.FAKE_CODEX_INTERRUPT_GRACE_MS ?? 750) || 750);
+                try {
+                  await request("turn/interrupt", { threadId: codexThreadId, turnId: codexTurnId }, graceMs);
+                } catch {
+                }
+                const deadline = Date.now() + graceMs;
+                while (!state.settled && Date.now() < deadline) {
+                  await new Promise((wake) => setTimeout(wake, 15));
+                }
+                if (state.settled) return true;
+              }
               const stopped = await terminate();
               if (stopped) completeStoppedTurn?.();
               return stopped;
@@ -25505,6 +25598,23 @@ var init_codex = __esm({
                 emit({ ...base2(threadId, turnId), type: "runtime.error", message: "codex did not shut down after termination was requested" });
               }
             };
+            const steerActiveTurn = async (text4) => {
+              if (state.settled || abandoned || stopRequested || !codexThreadId || !codexTurnId) return "refused";
+              if (child.exitCode !== null || child.signalCode !== null) return "refused";
+              try {
+                const steerTimeoutMs = Math.max(1, Number(process.env.FAKE_CODEX_STEER_TIMEOUT_MS ?? 1e4) || 1e4);
+                await request("turn/steer", {
+                  threadId: codexThreadId,
+                  input: [{ type: "text", text: text4 }],
+                  expectedTurnId: codexTurnId
+                }, steerTimeoutMs);
+                return "steered";
+              } catch (error51) {
+                const message2 = error51 instanceof Error ? error51.message : String(error51);
+                if (state.settled || message2.includes("timed out")) return "indeterminate";
+                return "refused";
+              }
+            };
             const controlsHost = turn.integrations?.localComputer?.scope === "local-computer";
             const handleServerRequest = (msg) => {
               const method = msg.method;
@@ -25794,6 +25904,10 @@ var init_codex = __esm({
                 void stop();
                 return;
               }
+              if (stopRequested) {
+                void settle(false, "interrupted");
+                return;
+              }
               const recentStderr = stderrSinceOutput.trim();
               const hadStreamedOutput = codexTurnId !== null || state.sawStreamDelta;
               const verdict = signal !== null ? { transient: false, reason: "interrupted" } : classifyError({ exitCode: code, stderr: recentStderr });
@@ -25832,7 +25946,7 @@ var init_codex = __esm({
               });
               void settle(false, "exit_before_result");
             });
-            active.set(threadId, { stop, turnId, asks });
+            active.set(threadId, { stop, turnId, asks, steer: steerActiveTurn });
             if (attempt === 0) emit({ ...base2(threadId, turnId), type: "turn.started" });
             try {
               await request("initialize", {
@@ -26041,6 +26155,7 @@ ${stderr ?? ""}`))
             provider: DRIVER_KIND3,
             capabilities: {
               sessionModelSwitch: "unsupported",
+              queueing: true,
               computerMcp: true,
               localComputerMcp: true,
               composioMcp: true,
@@ -26056,6 +26171,10 @@ ${stderr ?? ""}`))
             interruptTurn: async (threadId) => {
               await active.get(threadId)?.stop();
             },
+            steer: async (threadId, text4) => {
+              const turn = active.get(threadId);
+              return turn?.steer ? await turn.steer(text4) : "refused";
+            },
             respondToRequest: async (threadId, requestId, decision) => {
               const turn = active.get(threadId);
               const finish = turn?.asks.get(requestId);
@@ -34674,7 +34793,7 @@ var init_openai_chat = __esm({
   "server/drivers/openai-chat.ts"() {
     "use strict";
     init_contracts();
-    init_redact();
+    init_redact2();
     init_tool_summary();
     init_chat_mcp_tools();
     init_chat_tool_approval();
@@ -35013,6 +35132,11 @@ function liveOauthCredential() {
 function geminiIsAuthenticated(env) {
   return nonBlank(env.GEMINI_API_KEY) || nonBlank(env.GOOGLE_API_KEY) || existsSync12(join24(homedir15(), ".gemini", "oauth_creds.json")) && liveOauthCredential();
 }
+function geminiApprovalArgs(fullAuto, approvalMode) {
+  if (fullAuto) return ["--yolo"];
+  if (approvalMode === "edits") return ["--approval-mode", "auto_edit"];
+  return [];
+}
 var AUTH_PREFERENCE, nonBlank, support3, GeminiAgentDriver;
 var init_gemini = __esm({
   "server/drivers/acp/gemini.ts"() {
@@ -35035,7 +35159,7 @@ var init_gemini = __esm({
       loginNote: "Gemini CLI needs a GEMINI_API_KEY, a Vertex AI setup, or an enterprise Code Assist login \u2014 consumer Google logins stopped working on 2026-06-18 (use the Antigravity engine for those accounts)",
       // --acp is the stable Gemini CLI surface. --experimental-acp remains an
       // alias for older releases, but using it now emits a deprecation warning.
-      spawnArgs: (_config, turn) => ["--acp", ...turn.model ? ["-m", turn.model] : []],
+      spawnArgs: (config2, turn) => ["--acp", ...geminiApprovalArgs(config2.fullAuto, turn.approvalMode), ...turn.model ? ["-m", turn.model] : []],
       credentialEnv: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
       pickAuthMethod: (methods) => {
         const ids = methods.map((m) => m.id).filter((id) => typeof id === "string");
@@ -36468,6 +36592,12 @@ function resolveQwenTurnModel(model, env) {
   if (!matches.length) throw new Error("This Qwen model is no longer configured. Refresh models and select it again.");
   return matches[0].id;
 }
+function qwenApprovalArgs(fullAuto, approvalMode) {
+  if (fullAuto) return ["--yolo"];
+  if (approvalMode === "auto") return ["--approval-mode", "auto"];
+  if (approvalMode === "edits") return ["--approval-mode", "auto-edit"];
+  return [];
+}
 var EMPTY, PROTOCOLS, support8, QwenAgentDriver;
 var init_qwen = __esm({
   "server/drivers/acp/qwen.ts"() {
@@ -36496,7 +36626,7 @@ var init_qwen = __esm({
       },
       // A raw -m only changes the model within the saved provider. ACP switches
       // the complete route and confirms it before any prompt leaves OMB.
-      spawnArgs: () => ["--acp"],
+      spawnArgs: (config2, turn) => ["--acp", ...qwenApprovalArgs(config2.fullAuto, turn.approvalMode)],
       selectModel: { configId: "model" },
       pickAuthMethod: () => null,
       authFailure: "continue",
@@ -44122,6 +44252,7 @@ var init_pi = __esm({
     init_procs();
     init_proxy_paths();
     init_tool_summary();
+    init_wire();
     init_contracts();
     init_local_inject();
     init_native();
@@ -45205,12 +45336,13 @@ var init_browser_bundle_release = __esm({
   "server/browser-bundle-release.ts"() {
     "use strict";
     init_browser_engine_release();
-    CHROME_VERSION = "152.0.7977.82";
+    CHROME_VERSION = "153.0.8010.47";
     CHROME_ASSETS = {
-      "darwin-arm64": { platform: "mac-arm64", bytes: 97760996, sha256: "1615f063c894aa824fd55c89f8f05e9904f63cce0c95d0cbce7394d77884fba5", executableSha256: "ac18537fb2bc2b72b0440893b6ea5d4ef3bacc6220b1e9a1693c73f8b1045fbe" },
-      "darwin-x64": { platform: "mac-x64", bytes: 102895824, sha256: "c903707292c6aaed7c6e572c0bb5e6645454e45d9e0e6db27e876b18e9165f31", executableSha256: "2faefd55d4e47764956e31e338d362a1e794037fa772a426ffd510f122f33f19" },
-      "linux-x64": { platform: "linux64", bytes: 119454769, sha256: "0ca12ea26b502a83e32db334a17883c315348845efc071d908de7a6d94a97eff", executableSha256: "1301a5024fef1d58c4cfbde5d44794cb18c5b2cbbe4f3c64f81cc4eaa683c45f" },
-      "win32-x64": { platform: "win64", bytes: 119768220, sha256: "86fb1fa7fbbda65f6f1572062c358803e61a6e6d9489e6619b37a61d609fa845", executableSha256: "ec0744f041cb6c35c439c85a5ac42d77b507838cd59cac005e25114025336c98" }
+      "darwin-arm64": { platform: "mac-arm64", bytes: 98668949, sha256: "6d28839675b6f22dbd7ba8775dbdabcae7a5be37b482380b27b12f05b748b955", executableSha256: "111ee425ea5b0a01dcb19fda16452a9be0319749cba374b1c987d2437d8dcedb" },
+      "darwin-x64": { platform: "mac-x64", bytes: 103712919, sha256: "aa178547f9751fbcf413e0f57915ddb72e83064d4d1c4a29dc1719b169f9cc2f", executableSha256: "33452695b1b6f18db2f796a422eca69b69ca8aacce36d1ff8c6f5d69eac1a635" },
+      "linux-arm64": { platform: "linux-arm64", bytes: 120245582, sha256: "af0931a58d6bab688112d5ca1f7abd6d95c0b8a296ef34637f272795787774d7", executableSha256: "b6a9f0483c976fddc72c34ce1c983a1275163cdfb95576874bfed5ff07c53807" },
+      "linux-x64": { platform: "linux64", bytes: 119695587, sha256: "7728775cf4a35464cd81c8eea2d44d6d32ccc0bd1edfa75aea7f32d146963d63", executableSha256: "ea90dee9cbd7b17f197eb6c386bd9f1ff636734ee99753cd2408658c45358bf2" },
+      "win32-x64": { platform: "win64", bytes: 120466147, sha256: "9f405cfaf7bc08bf9e046e653cd3086c0faa1d4e25907de857f7e7f093a20122", executableSha256: "01176f6928faeb37ff018bc8884bbca8a0197f51b659d467f2501ab2c64f9fcf" }
     };
   }
 });
@@ -45592,7 +45724,7 @@ function agentBrowserIntegration(input) {
   for (const name of ["PATH", "AGENT_BROWSER_EXECUTABLE_PATH"]) {
     if (sourceEnv[name]) env[name] = sourceEnv[name];
   }
-  const bundle = packagedBrowser({ env: sourceEnv });
+  const bundle = packagedBrowser({ env: sourceEnv, platform: input.platform, arch: input.arch });
   if (!env.AGENT_BROWSER_EXECUTABLE_PATH && bundle && resolve10(input.binaryPath) === bundle.engine && completePackage(bundle, existsSync18)) {
     env.AGENT_BROWSER_EXECUTABLE_PATH = bundle.chrome;
   }

package/dist-server/server/auto-approve.js

@@ -7,6 +7,7 @@
 // verdict the app synthesizes is Full access, because that level is the
 // person's explicit, separately confirmed grant to answer every prompt.
 // Questions never come through here: a bot's question always reaches a human.
+import { supportsApprovalMode } from "../shared/approval-mode.js";
 /** A failed delivery is a runtime error, not another permission decision.
  * An expired ask must never become a fresh Allow/Deny card. */
 export async function deliverFullAccessApproval(adapter, threadId, requestId, turnId, isCurrent = () => false) {
@@ -24,7 +25,9 @@ export async function deliverFullAccessApproval(adapter, threadId, requestId, tu
     }
 }
 /** Full access is the person's explicit grant to this receiving bot, including
- * delegated work. It never inherits the sender's mode or elevates another bot.
+ * delegated work. It never inherits the sender's mode or elevates another bot
+ * — with the one exception below (delegationInheritsFullAccess), applied
+ * where a Chief's delegated thread is created rather than here.
  * Custom is a provider-config choice rather than an app Full-access grant, so
  * peer-started Custom turns use Auto. Provider support and grant confirmation
  * are checked by the caller. */
@@ -33,6 +36,17 @@ export function approvalModeForOrigin(mode, origin) {
         return "auto";
     return mode;
 }
+/** Whether work a bot hands to a teammate runs with Full access. Only a Chief
+ * of Staff passes access on, and only the Full access the person gave it for
+ * the conversation it is delegating from: the Chief exists to get the team's
+ * work done without the person answering every card, and a teammate stopping
+ * that work to ask defeats the grant. The recipient's engine has to implement
+ * Full, or the work keeps the recipient's own level. A bot never elevates
+ * itself this way. */
+export function delegationInheritsFullAccess(input) {
+    return input.senderIsChief && input.senderHasFullAccess && !input.sameBot
+        && supportsApprovalMode(input.recipientDriverKind, "full");
+}
 // Tools that ask a PERSON something. A question exists so that a human
 // decides; any mode answering one on their behalf defeats the only reason
 // it was asked. They normally arrive typed as questions and never reach a

package/dist-server/server/auto-vm-claims.js

@@ -0,0 +1,22 @@
+/** Lazy exclusive claims for auto-resolved Local VM attaches (issue #1361).
+ * The table is keyed by thread and owned by the dispatch generation; the
+ * claim closure itself lives in index.ts next to the turn state it needs.
+ * Kept free of index.ts imports so the fire-once semantics stay unit-testable. */
+/** Fire a thread's lazy claim exactly once, fenced by the dispatch
+ * generation. A rejected claim KEEPS the slot and marks it failed: the
+ * computer-control gate then keeps answering held for that generation, so
+ * the bridge refuses every later screen call instead of forwarding it onto
+ * a VM this turn never claimed. `begin` staying set means the claim never
+ * re-fires; turn settle (releaseTurnResources / releaseLocalVmThread in
+ * index.ts) clears the slot, fenced by owner generation. A rejection
+ * mutates only the slot it fired from, so a stale claim can never remove
+ * or mark a newer generation's slot on the same thread. */
+export function startAutoVmClaim(table, threadId, generation) {
+    const slot = table.get(threadId);
+    if (!slot || slot.owner.threadId !== threadId || slot.owner.generation !== generation || slot.begin)
+        return;
+    slot.begin = slot.claim().then(() => { slot.claimed = true; }, (error) => {
+        slot.failed = true;
+        slot.failure = error instanceof Error ? error.message : String(error);
+    });
+}

package/dist-server/server/browser-bundle-release.js

@@ -1,15 +1,16 @@
-// Reviewed vendor assets, downloaded and hashed on 2026-09-07. Update all
+// Reviewed vendor assets, downloaded and hashed on 2026-09-16. Update all
 // pins together and run each platform's packaged, offline browser smoke test.
 // This is Chromium's headless shell, not full Chrome (which includes Widevine).
 import { join } from "node:path";
 import { agentBrowserReleaseUrl, agentBrowserReleaseVersion, resolveAgentBrowserReleaseAsset, } from "./browser-engine-release.js";
-export const CHROME_VERSION = "152.0.7977.82";
-export const SUPPORTED_BROWSER_TARGETS = ["darwin-arm64", "darwin-x64", "linux-x64", "win32-x64"];
+export const CHROME_VERSION = "153.0.8010.47";
+export const SUPPORTED_BROWSER_TARGETS = ["darwin-arm64", "darwin-x64", "linux-arm64", "linux-x64", "win32-x64"];
 const CHROME_ASSETS = {
-    "darwin-arm64": { platform: "mac-arm64", bytes: 97760996, sha256: "1615f063c894aa824fd55c89f8f05e9904f63cce0c95d0cbce7394d77884fba5", executableSha256: "ac18537fb2bc2b72b0440893b6ea5d4ef3bacc6220b1e9a1693c73f8b1045fbe" },
-    "darwin-x64": { platform: "mac-x64", bytes: 102895824, sha256: "c903707292c6aaed7c6e572c0bb5e6645454e45d9e0e6db27e876b18e9165f31", executableSha256: "2faefd55d4e47764956e31e338d362a1e794037fa772a426ffd510f122f33f19" },
-    "linux-x64": { platform: "linux64", bytes: 119454769, sha256: "0ca12ea26b502a83e32db334a17883c315348845efc071d908de7a6d94a97eff", executableSha256: "1301a5024fef1d58c4cfbde5d44794cb18c5b2cbbe4f3c64f81cc4eaa683c45f" },
-    "win32-x64": { platform: "win64", bytes: 119768220, sha256: "86fb1fa7fbbda65f6f1572062c358803e61a6e6d9489e6619b37a61d609fa845", executableSha256: "ec0744f041cb6c35c439c85a5ac42d77b507838cd59cac005e25114025336c98" },
+    "darwin-arm64": { platform: "mac-arm64", bytes: 98668949, sha256: "6d28839675b6f22dbd7ba8775dbdabcae7a5be37b482380b27b12f05b748b955", executableSha256: "111ee425ea5b0a01dcb19fda16452a9be0319749cba374b1c987d2437d8dcedb" },
+    "darwin-x64": { platform: "mac-x64", bytes: 103712919, sha256: "aa178547f9751fbcf413e0f57915ddb72e83064d4d1c4a29dc1719b169f9cc2f", executableSha256: "33452695b1b6f18db2f796a422eca69b69ca8aacce36d1ff8c6f5d69eac1a635" },
+    "linux-arm64": { platform: "linux-arm64", bytes: 120245582, sha256: "af0931a58d6bab688112d5ca1f7abd6d95c0b8a296ef34637f272795787774d7", executableSha256: "b6a9f0483c976fddc72c34ce1c983a1275163cdfb95576874bfed5ff07c53807" },
+    "linux-x64": { platform: "linux64", bytes: 119695587, sha256: "7728775cf4a35464cd81c8eea2d44d6d32ccc0bd1edfa75aea7f32d146963d63", executableSha256: "ea90dee9cbd7b17f197eb6c386bd9f1ff636734ee99753cd2408658c45358bf2" },
+    "win32-x64": { platform: "win64", bytes: 120466147, sha256: "9f405cfaf7bc08bf9e046e653cd3086c0faa1d4e25907de857f7e7f093a20122", executableSha256: "01176f6928faeb37ff018bc8884bbca8a0197f51b659d467f2501ab2c64f9fcf" },
 };
 export function browserBundleSpec(target) {
     if (!Object.hasOwn(CHROME_ASSETS, target))

package/dist-server/server/browser-engine.js

@@ -375,7 +375,7 @@ export function agentBrowserIntegration(input) {
         if (sourceEnv[name])
             env[name] = sourceEnv[name];
     }
-    const bundle = packagedBrowser({ env: sourceEnv });
+    const bundle = packagedBrowser({ env: sourceEnv, platform: input.platform, arch: input.arch });
     if (!env.AGENT_BROWSER_EXECUTABLE_PATH && bundle && resolve(input.binaryPath) === bundle.engine && completePackage(bundle, existsSync)) {
         env.AGENT_BROWSER_EXECUTABLE_PATH = bundle.chrome;
     }

package/dist-server/server/channel-queue.js

@@ -61,6 +61,64 @@ export function cancelChannelMessage(groupId, queueId) {
     }
     return false;
 }
+/** Atomically lift a channel thread's whole queue out for a live steer. The
+ * entry leaves first so a room that settles while the adapter is still
+ * thinking can never also drain the same words as a follow-up turn. Only
+ * the HEAD can be lifted: the success path steers and settles items[0], so
+ * a request naming a later item must not lift the queue at all (it would
+ * steer and delete a different message's words). The caller must either
+ * restore the held queue or settle its head. */
+export function holdChannelQueue(groupId, threadId, queueId) {
+    const entry = queues.get(threadId);
+    if (!entry || entry.groupId !== groupId || entry.items[0]?.id !== queueId)
+        return null;
+    queues.delete(threadId);
+    return { groupId, threadId, items: entry.items };
+}
+/** Put a held queue back after the steer was refused. Words queued while the
+ * hold was open keep their place behind the restored items. */
+export function restoreHeldChannelQueue(held) {
+    const existing = queues.get(held.threadId);
+    if (existing && existing.groupId !== held.groupId)
+        throw new Error("queued task belongs to another channel");
+    queues.set(held.threadId, {
+        groupId: held.groupId,
+        items: existing ? [...held.items, ...existing.items] : held.items,
+    });
+}
+/** Resolve the held head's reply target through a caller-supplied resolver.
+ * The queue is already lifted out of the map here, so a target that cannot
+ * be resolved (missing, non-text, empty — state drift between queueing and
+ * the steer) must not strand the held words outside it until restart:
+ * restore first, then let the error propagate to the request. */
+export function resolveHeldReplyTarget(held, resolve) {
+    const head = held.items[0];
+    if (!head?.replyToId)
+        return undefined;
+    try {
+        return resolve(held.threadId, head.replyToId);
+    }
+    catch (error) {
+        restoreHeldChannelQueue(held);
+        throw error;
+    }
+}
+/** Mark a held queue's head delivered — its words were folded into the
+ * running turn — and re-queue the rest for the room's normal one-at-a-time
+ * drain. A restart must not replay the steered head as a fresh follow-up. */
+export function settleHeldChannelQueueHead(held) {
+    const [head, ...rest] = held.items;
+    settleChatFollowups([head.id], null);
+    if (rest.length === 0)
+        return;
+    const existing = queues.get(held.threadId);
+    if (existing && existing.groupId !== held.groupId)
+        throw new Error("queued task belongs to another channel");
+    queues.set(held.threadId, {
+        groupId: held.groupId,
+        items: existing ? [...rest, ...existing.items] : rest,
+    });
+}
 /**
  * Start at most one follow-up per idle channel. Starting it synchronously
  * marks the channel working again; its completion calls this drain for the

package/dist-server/server/chief-of-staff.js

@@ -29,12 +29,12 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
     });
     const delegation = canDelegate
         ? boundedCoordination
-            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, everything you send a teammate continues your one standing conversation with them, using their own model and permissions, so they still have the context of your earlier assignments. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran."
+            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, everything you send a teammate continues your one standing conversation with them, using their own model and permissions, so they still have the context of your earlier assignments. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
             : [
                 "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
                 "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",
                 "Use ask_bot only for a brief consultation whose answer you must have before writing your current response. Never use ask_bot for an assigned task, background work, or anything potentially long-running.",
-                "Delegate with a clear, self-contained brief. Say that the task is assigned, not completed; only claim completion after the teammate's result has actually arrived.",
+                "Delegate with a clear, self-contained brief. Say that the task is assigned, not completed; only claim completion after the teammate's result has actually arrived. A refusal from delegate_bot or ask_bot means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster) and retry.",
                 "You may assign work to more than one teammate when the request genuinely benefits. Stay responsive while they work, then combine their returned results when the user asks for a synthesis.",
             ].join(" ")
         : "Your current engine cannot contact teammates. Be honest about that limitation and ask the user to choose a delegation-compatible engine before promising coordinated work.";