openmausbot 0.1.82 → 0.1.84

package/dist-server/server/local-routing.js

@@ -1,9 +1,15 @@
+/** Hosts whose desktop the app can drive itself: macOS and Windows ship the
+ * CUA driver and keep "This computer" selectable in the UI; Linux is a beta
+ * behind an explicit per-bot choice. */
+const HOSTS_WITH_LOCAL_CONTROL = new Set(["darwin", "win32", "linux"]);
+/** Hosts where Auto may land on the person's own desktop unasked. */
+const HOSTS_WITH_AUTO_LOCAL = new Set(["darwin", "win32"]);
 export function shouldMountLocalComputer({ requested, hostPlatform = process.platform, providerSupportsLocal, }) {
     if (!providerSupportsLocal)
         return false;
     if (requested === "local")
-        return hostPlatform === "darwin" || hostPlatform === "linux";
-    // Preserve the established macOS Auto behavior. Linux local control is a
-    // beta and can only be selected explicitly per bot.
-    return requested === undefined && hostPlatform === "darwin";
+        return HOSTS_WITH_LOCAL_CONTROL.has(hostPlatform);
+    // Preserve the established macOS Auto behavior, which Windows shares.
+    // Linux local control is a beta and can only be selected explicitly per bot.
+    return requested === undefined && HOSTS_WITH_AUTO_LOCAL.has(hostPlatform);
 }

package/dist-server/server/notify.js

@@ -60,7 +60,9 @@ export function buildNotification(kind, bot, threadId, detail, extra) {
                         ? `${who}'s routine is waiting`
                         : kind === "turn-failed"
                             ? `${who} couldn't start`
-                            : `${who} finished`;
+                            : kind === "incident"
+                                ? `${who} hit a problem`
+                                : `${who} finished`;
     // A "finished" with nothing to say is not worth a notification — the
     // badge in the sidebar already carries that much.
     if (kind === "done" && !body)

package/dist-server/server/peer-roster.js

@@ -61,6 +61,37 @@ export function canReachPeer(from, target) {
 export function reachablePeers(bots, from) {
     return bots.filter(bot => canReachPeer(from, bot));
 }
+/** What a bot wrote in a bot-id slot, resolved to a teammate.
+ *
+ * Models copy ids from list_bots most of the time, but a Chief reading its
+ * roster reaches for the name it sees there, and a name that names exactly
+ * one reachable teammate is not a mistake worth refusing: the refusal reads
+ * as a teammate that is gone, and the person is then told the platform lost
+ * their team (#1348). Names resolve only inside `reachablePeers` — the same
+ * set list_bots and the roster show — so a name can never reach a bot the id
+ * could not. An id is always taken as an id, hidden or unreachable included:
+ * the route says what is wrong with it. Two reachable teammates with one
+ * name is the person's naming, not the model's error, so it is refused with
+ * the way out instead of picking one. */
+export function resolveTeammate(bots, from, raw) {
+    const wanted = raw.trim();
+    if (bots.some(bot => bot.id === wanted))
+        return { id: wanted, byName: false };
+    const fold = (value) => value.replace(/^@/, "").replace(/\s+/g, " ").trim().toLowerCase();
+    const name = fold(wanted);
+    // The caller's own argument is echoed, flattened and clipped like any
+    // other text that lands in a model's context, never a bot's persona.
+    const shown = peerName(wanted) || wanted;
+    if (!name)
+        return { error: `No bot with id "${shown}" — call list_bots and copy the exact id from the result` };
+    const matches = reachablePeers(bots, from).filter(bot => fold(bot.name) === name);
+    if (matches.length === 1)
+        return { id: matches[0].id, byName: true };
+    if (matches.length > 1) {
+        return { error: `${matches.length} reachable teammates are named "${shown}" — call list_bots and use the id of the one you mean` };
+    }
+    return { error: `No bot with id or name "${shown}" — call list_bots and copy the exact id from the result` };
+}
 // The roster is interpolated into a TRUSTED bot's system prompt on every
 // turn, and its inputs (name/title/description) are user-editable and — via
 // team import — third-party-authored. Caps bound both the token spend and
@@ -120,7 +151,12 @@ export function renderRoster(team, opts) {
         const role = clip(bot.title ?? "", ROSTER_ROLE_MAX) || "General assistant";
         const about = opts.about ? clip(bot.description ?? "", ROSTER_ABOUT_MAX) : "";
         const availability = peerStatusWords(peerStatus(bot.activity, bot.busy));
-        return `- ${name} — ${role}${about ? `: ${about}` : ""} (${availability})`;
+        // The id rides on every line because it is what the comms tools take. A
+        // Chief that only ever saw names in its prompt reached for the name it
+        // could see, was refused with "no longer exists", and told the person
+        // the platform had lost its team (#1348). Ids are the harness's own
+        // uuids, clipped anyway: bots.json is hand-editable.
+        return `- ${name} — ${role}${about ? `: ${about}` : ""} (${availability}) [id: ${clip(bot.id, ROSTER_NAME_MAX)}]`;
     });
     return (lines.join("\n") +
         (overflow > 0 ? `\n- …and ${overflow} more (use list_bots for the full roster).` : ""));

package/dist-server/server/recent-work.js

@@ -137,6 +137,9 @@ export function parseSince(value, now = Date.now()) {
     }
     if (/^\d{12,}$/.test(text))
         return Number(text);
-    const parsed = Date.parse(value.trim());
+    // A bare YYYY-MM-DD is the one form Date.parse reads as UTC midnight. Read
+    // it as the start of that local day, like "today", the brief's times, and
+    // the memory/log/YYYY-MM-DD.md day names.
+    const parsed = Date.parse(/^\d{4}-\d{2}-\d{2}$/.test(text) ? `${text}T00:00` : value.trim());
     return Number.isFinite(parsed) ? parsed : null;
 }

package/dist-server/server/redact.js

@@ -22,60 +22,17 @@ function isSecretName(name) {
         return true;
     return /(^|[_.-])keys?$/.test(lower);
 }
-const REDACTION_MARKER = /^«redacted \d+ chars»$/;
-/** Keep repeated redaction byte-for-byte stable. Persisted payloads can pass
- * through both a content scrub and the store-wide scrub; re-masking our own
- * marker would change its reported length (and any hash over the payload). */
-const mask = (value) => (REDACTION_MARKER.test(value) ? value : `«redacted ${value.length} chars»`);
+import { mask, redactSecretsInText } from "../shared/redact.js";
+// Text-shaped secret redaction lives in shared/redact.ts now, so the client
+// (task timeline) and the server scrub identically without the client
+// bundling server code; re-exported here so existing importers keep working.
+export { mask, redactSecretsInText } from "../shared/redact.js";
 // ── content-shaped secrets ────────────────────────────────────────────
 // What a bot's own reply, a tool title, or a permission card can carry —
 // and, since the rebuild replays activity into every handed-over context,
 // what would otherwise become permanent. High precision on purpose: a
 // generic "long hex/base64" heuristic would rewrite real code in the
 // transcript, so only shapes that are unmistakably credentials match.
-const KEY_PREFIXES = [
-    /\bom[dg]_[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/g, // desktop device and model-only credentials
-    /\bsk-(?:ant-|proj-|live-|test-)?[A-Za-z0-9_-]{16,}/g, // anthropic / openai / stripe
-    /\bxai-[A-Za-z0-9_-]{20,}/g, // xai (grok)
-    /\bgsk_[A-Za-z0-9]{40,}/g, // groq
-    /\bhf_[A-Za-z0-9]{30,}/g, // hugging face
-    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g, // github classic
-    /\bgithub_pat_[A-Za-z0-9_]{20,}/g, // github fine-grained
-    /\bxox[abposr]-[A-Za-z0-9-]{20,}/g, // slack
-    /\bAKIA[0-9A-Z]{16}\b/g, // aws access key id
-    /\bAIza[0-9A-Za-z_-]{30,}/g, // google api key
-    /\bnpm_[A-Za-z0-9]{20,}/g, // npm
-    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, // jwt
-];
-const BEARER = /(\bBearer\s+)([A-Za-z0-9._~+/=-]{12,})/g;
-const PEM_BLOCK = /(-----BEGIN [A-Z ]*PRIVATE KEY-----)([\s\S]*?)(-----END [A-Z ]*PRIVATE KEY-----)/g;
-/** key=value / key: value / key="value" where the key is secret-shaped.
- * The value must be a single token of some length; prose after a colon
- * ("password: leave blank…") has spaces and does not match. */
-const KEY_VALUE = /\b((?:[A-Za-z0-9_-]*_)?(?:api[_-]?key|apikey|secret|token|password|passwd|authorization|auth[_-]?token|access[_-]?key|private[_-]?key)s?)(["']?\s*[=:]\s*)(["']?)([A-Za-z0-9._~+/=-]{8,})\3/gi;
-/** `X_KEY=value`, `xai-key=value`: an assignment to a name that ENDS in key
- * is a credential whatever the value looks like, so no length floor. The
- * separator before `key` is what keeps `hotkey=` and `keyboard=` out. */
-const KEY_SUFFIX_ASSIGNMENT = /\b([A-Za-z][A-Za-z0-9_-]*[_-]key)s?(=)(["']?)([A-Za-z0-9._~+/=-]+)\3/gi;
-/** `--token abc`, `--password=abc`: the flag names a secret; the value is
- * whatever single token follows, never another flag. */
-const SECRET_FLAG = /(--(?:token|password|passwd|api-key|apikey|secret|access-key|auth-token)(?:=|\s+))(["']?)(?!-)([A-Za-z0-9._~+/=-]+)\2/gi;
-/** `scheme://user:secret@host` — the password in a URL's userinfo. */
-const URL_USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@'"]+:)([^\s/@'"«»]+)(@)/gi;
-export function redactSecretsInText(text) {
-    if (!text || text.length < 8)
-        return text;
-    let out = text;
-    out = out.replace(PEM_BLOCK, (_m, open, body, close) => `${open}\n${mask(body.trim())}\n${close}`);
-    for (const re of KEY_PREFIXES)
-        out = out.replace(re, (m) => mask(m));
-    out = out.replace(BEARER, (_m, lead, tok) => `${lead}${mask(tok)}`);
-    out = out.replace(KEY_VALUE, (_m, key, sep, quote, value) => `${key}${sep}${quote}${mask(value)}${quote}`);
-    out = out.replace(KEY_SUFFIX_ASSIGNMENT, (_m, key, sep, quote, value) => `${key}${sep}${quote}${mask(value)}${quote}`);
-    out = out.replace(SECRET_FLAG, (_m, flag, quote, value) => `${flag}${quote}${mask(value)}${quote}`);
-    out = out.replace(URL_USERINFO, (_m, lead, secret, at) => `${lead}${mask(secret)}${at}`);
-    return out;
-}
 /** Deep copy with credential VALUES replaced. Handles the two shapes that
  * actually carry them: a plain object of env vars ({KEY: "v"}) and the ACP
  * wire shape (env: [{name, value}]). Anything unrecognised is copied as-is. */

package/dist-server/server/room-handoffs.js

@@ -12,7 +12,7 @@ const nodeSchema = z.object({
     approvalGranted: z.boolean().default(false),
     kind: z.enum(["work", "assignment"]).default("work"),
 });
-export const ROOM_HANDOFF_LIMITS = { depth: 4, requests: 24, executions: 48, lifetimeMs: 30 * 60_000, minRunwayMs: 10 * 60_000, queueMs: 60 * 60_000 };
+export const ROOM_HANDOFF_LIMITS = { depth: 4, requests: 24, executions: 48, lifetimeMs: 30 * 60_000, minRunwayMs: 10 * 60_000, queueMs: 60 * 60_000, hardCapMs: 4 * 60 * 60_000 };
 /** Renders elapsed milliseconds as whole minutes, or seconds under one minute. */
 const duration = (ms) => ms >= 60_000 ? `${Math.floor(ms / 60_000)}m` : `${Math.floor(ms / 1000)}s`;
 const terminal = (n) => ["completed", "failed", "cancelled"].includes(n.status);
@@ -27,10 +27,14 @@ export class RoomHandoffs {
     file;
     hooks;
     now;
-    constructor(file, hooks, now = Date.now) {
+    limits;
+    /** Per-root pause accounting for the tree lifetime clock. */
+    pauses = new Map();
+    constructor(file, hooks, now = Date.now, limits = {}) {
         this.file = file;
         this.hooks = hooks;
         this.now = now;
+        this.limits = { ...ROOM_HANDOFF_LIMITS, ...limits };
         try {
             const saved = z.array(nodeSchema).max(10_000).parse(JSON.parse(readFileSync(file, "utf8")));
             const ids = new Map(saved.map(n => [n.id, n]));
@@ -67,15 +71,54 @@ export class RoomHandoffs {
         }
         return path;
     }
+    /** The tree lifetime clock pauses while any node in the tree is actively
+     * executing: the budget bounds coordination sprawl, not the runtime of
+     * dispatched work. Accounting is in-memory; a restart fails every
+     * interrupted node anyway, so no pause span survives one. */
+    trackExecutionPauses() {
+        const now = this.now();
+        const executing = new Set();
+        for (const n of this.nodes.values()) {
+            if (!terminal(n) && n.status === "running")
+                executing.add(n.rootId);
+        }
+        for (const rootId of executing) {
+            const pause = this.pauses.get(rootId) ?? { accumulatedMs: 0 };
+            pause.since ??= now;
+            this.pauses.set(rootId, pause);
+        }
+        for (const [rootId, pause] of this.pauses) {
+            if (pause.since != null && !executing.has(rootId)) {
+                pause.accumulatedMs += now - pause.since;
+                pause.since = undefined;
+            }
+            const root = this.nodes.get(rootId);
+            if (!root || terminal(root))
+                this.pauses.delete(rootId);
+        }
+    }
+    pausedMs(root) {
+        const pause = this.pauses.get(root.id);
+        if (!pause)
+            return 0;
+        return pause.accumulatedMs + (pause.since != null ? this.now() - pause.since : 0);
+    }
+    /** The lifetime budget consumed so far: wall clock minus paused time. */
+    effectiveAgeMs(root) {
+        return Math.max(0, this.now() - root.createdAt - this.pausedMs(root));
+    }
     /** The earliest moment this node may be failed for lifetime: the tree
      * ceiling, a running node's own start plus a minimum runway, or, for work
-     * parked in a busy teammate's queue, its own queue window (#1238). */
+     * parked in a busy teammate's queue, its own queue window (#1238). The
+     * wall-clock hard cap clamps every extension: a tree that never stops
+     * executing still dies, so runway extensions cannot compound forever. */
     deadline(n) {
         const anchor = n.status === "running" ? n.startedAt ?? n.createdAt : n.createdAt;
+        const root = this.root(n);
         const ceiling = n.status === "queued" && n.executions === 0
-            ? anchor + ROOM_HANDOFF_LIMITS.queueMs
-            : this.root(n).createdAt + ROOM_HANDOFF_LIMITS.lifetimeMs;
-        return Math.max(ceiling, anchor + ROOM_HANDOFF_LIMITS.minRunwayMs);
+            ? anchor + this.limits.queueMs
+            : root.createdAt + this.limits.lifetimeMs + this.pausedMs(root);
+        return Math.min(Math.max(ceiling, anchor + this.limits.minRunwayMs), root.createdAt + this.limits.hardCapMs);
     }
     /** An ancestor past its ceiling is not failed while a descendant is still
      * running inside its own runway; cancelling would cascade into that work. */
@@ -98,9 +141,16 @@ export class RoomHandoffs {
      * never started reports the queue window it waited out, not the tree's. */
     lifetimeError(n) {
         if (n.status === "queued" && n.executions === 0) {
-            return `Room handoff queue budget exhausted: never started while waiting for a busy teammate after ${duration(this.now() - n.createdAt)} of the ${duration(ROOM_HANDOFF_LIMITS.queueMs)} queue window`;
+            return `Room handoff queue budget exhausted: never started while waiting for a busy teammate after ${duration(this.now() - n.createdAt)} of the ${duration(this.limits.queueMs)} queue window`;
         }
-        return `Room handoff lifetime budget exhausted: node was ${n.status} after ${duration(this.now() - this.root(n).createdAt)} of the ${duration(ROOM_HANDOFF_LIMITS.lifetimeMs)} tree lifetime`;
+        const root = this.root(n);
+        return `Room handoff lifetime budget exhausted: node was ${n.status} after ${duration(this.effectiveAgeMs(root))} of the ${duration(this.limits.lifetimeMs)} tree lifetime`;
+    }
+    /** The wall-clock ceiling ignores pauses: it is what stops a tree whose
+     * execution never pauses long enough to age its lifetime budget. */
+    hardCapError(n) {
+        const root = this.root(n);
+        return `Room handoff hard cap exhausted: node was ${n.status} after ${duration(this.now() - root.createdAt)} of the ${duration(this.limits.hardCapMs)} wall-clock cap`;
     }
     enqueue(source, generation, parentId, target, key, text, approvalGranted = false, rework = false, sourceText = "") {
         if (this.loadError)
@@ -133,17 +183,21 @@ export class RoomHandoffs {
             throw new Error("A room request cannot return to an ancestor room; results are returned automatically");
         // The path includes the source root, so its work-node count is the
         // proposed edge depth: four edges are allowed; the fifth is refused.
-        if (kind === "work" && path.filter(n => n.kind === "work").length > ROOM_HANDOFF_LIMITS.depth)
+        if (kind === "work" && path.filter(n => n.kind === "work").length > this.limits.depth)
             throw new Error("Room handoff depth limit reached");
         const root = fresh ? parent : this.root(parent);
         const count = [...this.nodes.values()].filter(n => n.rootId === parent.rootId && n.parentId).length;
-        if (count >= ROOM_HANDOFF_LIMITS.requests)
+        if (count >= this.limits.requests)
             throw new Error("Room handoff budget exhausted");
         // Refuse work the tree's lifetime budget cannot honestly serve: a node
         // accepted in the root's last minutes would be doomed at enqueue time.
-        const remaining = ROOM_HANDOFF_LIMITS.lifetimeMs - (this.now() - root.createdAt);
-        if (remaining < ROOM_HANDOFF_LIMITS.minRunwayMs) {
-            throw new Error(`Room handoff budget exhausted: only ${duration(Math.max(remaining, 0))} of the ${duration(ROOM_HANDOFF_LIMITS.lifetimeMs)} tree lifetime remains`);
+        // The wall-clock hard cap ignores pauses, so the runway actually
+        // available is the shorter of the two remainders.
+        const lifetimeRemaining = this.limits.lifetimeMs - this.effectiveAgeMs(root);
+        const hardCapRemaining = root.createdAt + this.limits.hardCapMs - this.now();
+        const remaining = Math.min(lifetimeRemaining, hardCapRemaining);
+        if (remaining < this.limits.minRunwayMs) {
+            throw new Error(`Room handoff budget exhausted: only ${duration(Math.max(remaining, 0))} of the ${duration(this.limits.lifetimeMs)} tree lifetime remains`);
         }
         // Retain a bounded audit history without evicting active requests.
         if (this.nodes.size >= 1000) {
@@ -253,14 +307,18 @@ export class RoomHandoffs {
     tick() {
         if (this.loadError)
             return;
+        this.trackExecutionPauses();
         // Validate and expire deepest nodes first so each one is failed with its
         // own status; an ancestor's cancellation then only sweeps what is left.
+        // The hard cap overrides the runner and follow-up protections: it is the
+        // bound that stops a tree whose execution never pauses.
         for (const n of [...this.nodes.values()].reverse()) {
             if (terminal(n))
                 continue;
             const error = this.hooks.validate(n, n.parentId ? this.nodes.get(n.parentId) : undefined);
-            if (error || (this.now() > this.deadline(n) && !this.protectsRunner(n) && !this.owesFollowUp(n))) {
-                this.cancelTree(n, error ?? this.lifetimeError(n), "failed");
+            const hardCapped = this.now() >= this.root(n).createdAt + this.limits.hardCapMs;
+            if (error || hardCapped || (this.now() > this.deadline(n) && !this.protectsRunner(n) && !this.owesFollowUp(n))) {
+                this.cancelTree(n, error ?? (hardCapped ? this.hardCapError(n) : this.lifetimeError(n)), "failed");
             }
         }
         for (const n of this.nodes.values()) {
@@ -292,7 +350,7 @@ export class RoomHandoffs {
                 continue;
             const root = this.root(n);
             const executionCost = 1;
-            if (root.executions + executionCost > ROOM_HANDOFF_LIMITS.executions) {
+            if (root.executions + executionCost > this.limits.executions) {
                 this.cancelTree(n, "Room execution budget exhausted", "failed");
                 continue;
             }
@@ -301,6 +359,11 @@ export class RoomHandoffs {
             root.executions += executionCost;
             n.status = "running";
             n.startedAt = this.now();
+            // Open the pause at the moment execution starts, not at the next tick:
+            // the lifetime clock must not charge the gap before observation.
+            const pause = this.pauses.get(root.id) ?? { accumulatedMs: 0 };
+            pause.since ??= this.now();
+            this.pauses.set(root.id, pause);
             this.publish(n, root);
             const controller = new AbortController();
             this.controllers.set(n.id, controller);

package/dist-server/server/skill-fetch.js

@@ -61,7 +61,7 @@ export function parseSkillSource(input) {
         return { error: "paste a GitHub repository, folder, or SKILL.md URL" };
     if (/^https?:\/\/raw\.githubusercontent\.com\/.+\/SKILL\.md$/i.test(text))
         return { rawUrl: text };
-    const blob = text.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/blob\/([^/]+)\/(.+SKILL\.md)$/i);
+    const blob = text.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/blob\/([^/]+)\/((?:.*\/)?SKILL\.md)$/i);
     if (blob) {
         return { rawUrl: `https://raw.githubusercontent.com/${blob[1]}/${blob[2]}/${blob[3]}/${blob[4]}` };
     }

package/dist-server/server/steer-queue.js

@@ -180,6 +180,35 @@ export function cancelSteeredMessage(botId, messageId, expectedThreadId) {
     }
     return false;
 }
+/** Atomically lift a thread's whole queue out of the map for a live steer.
+ * The entry leaves first so a settle that starts draining while the adapter
+ * is still thinking can never also dispatch the same words as a follow-up
+ * turn. The caller must either restore the held queue or settle its rows. */
+export function holdSteeredQueue(botId, threadId, queueId) {
+    const entry = queues.get(threadId);
+    if (!entry || entry.botId !== botId || !entry.items.some((item) => item.messageId === queueId))
+        return null;
+    queues.delete(threadId);
+    changed();
+    return { botId, threadId, items: entry.items };
+}
+/** Put a held queue back after the steer was refused. Words queued while the
+ * hold was open keep their place behind the restored items. */
+export function restoreHeldSteeredQueue(held) {
+    const existing = queues.get(held.threadId);
+    if (existing && existing.botId !== held.botId)
+        throw new Error("queued task belongs to another bot");
+    queues.set(held.threadId, {
+        botId: held.botId,
+        items: existing ? [...held.items, ...existing.items] : held.items,
+    });
+    changed();
+}
+/** Mark a held queue's durable rows delivered: the words were folded into the
+ * running turn, so a restart must not replay them as a fresh follow-up. */
+export function settleHeldSteeredQueue(held) {
+    settleChatFollowups(held.items.map((item) => item.messageId), null);
+}
 /** Test helper: how many messages remain queued for a thread. */
 export function _queuedCount(threadId) {
     return queues.get(threadId)?.items.length ?? 0;

package/dist-server/server/store.js

@@ -9,7 +9,7 @@ import { writeFileAtomic } from "./atomic.js";
 import { ensureSections, readSections, changeEmptySection } from "./section-context.js";
 import { removeBotFolder, soulFile, soulHash, writeSoulMirror } from "./bot-folder.js";
 import { peerAllowKey } from "./peer-approval-key.js";
-import { DATA_DIR, loadBrowserProfileIdAliases } from "./config.js";
+import { DATA_DIR, EVENTS_DIR, NATIVE_DIR, loadBrowserProfileIdAliases } from "./config.js";
 import * as mdb from "./message-db.js";
 import { workspaceDir } from "./workspace.js";
 import { newId } from "./contracts.js";
@@ -17,6 +17,7 @@ import { pickBotName } from "./names.js";
 import { redactSecretsInText } from "./redact.js";
 import { botAvatarProfile } from "../shared/bot-avatar.js";
 import { approvalModeFor, isApprovalMode } from "../shared/approval-mode.js";
+export const groupWireProjectionIsExact = true;
 // Unicode's complete emoji sequences include flags, skin tones and ZWJ
 // combinations. Also allow unqualified single symbols (e.g. ♥), but not
 // standalone components such as a digit, skin tone or regional indicator.
@@ -24,6 +25,13 @@ const projectEmojiPattern = new RegExp("^(?!\\p{Emoji_Component}$)(?:\\p{RGI_Emo
 export function isProjectEmoji(value) {
     return typeof value === "string" && value.length <= 64 && projectEmojiPattern.exec(value)?.[0] === value;
 }
+export const taskWireProjectionIsExact = true;
+/** The typed wire projection for one task. Pairs with the assertion above:
+ * returning WireTask means an undeclared server field cannot ride silently. */
+export function toWireTask(task) {
+    const { resumeCursors: _resumeCursors, lastInstanceId: _lastInstanceId, handedMessages: _handedMessages, ...wire } = task;
+    return wire;
+}
 const TASK_PATCH_FIELDS = [
     "title", "projectId", "modelSelection", "approvalMode", "autoApprove", "alwaysAllow",
     "unread", "rewound", "archivedAt", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
@@ -194,6 +202,13 @@ function redactBotAuthored(message) {
     }
     return out;
 }
+/** What changed, emitted by the store itself right after each write. The
+ * server maps these onto its SSE frames in ONE place, so no mutation path
+ * can persist without the app hearing about it — the two-write-paths bug
+ * (persist without emit → UI drifts; emit without persist → a restart
+ * loses what the user just watched) is closed by construction. Bot and
+ * group changes carry only the id: the wire shape (cursor stripping) is
+ * the caller's business. */
 /** The states in which the bot cannot take a new message. */
 export const ACTIVITY_BUSY = new Set(["working", "waiting-on-you", "no-signal"]);
 /** What a task is called before its first message names it. */
@@ -212,6 +227,7 @@ export function titleFromMessage(text) {
     const line = text.trim().split("\n")[0].trim();
     return line.length > 48 ? `${line.slice(0, 47)}…` : line || UNTITLED_TASK;
 }
+export const botWireProjectionIsExact = true;
 const BOTS_FILE = join(DATA_DIR, "bots.json");
 const GROUPS_FILE = join(DATA_DIR, "groups.json");
 const messagesFile = (threadId) => join(DATA_DIR, `messages-${threadId}.json`);
@@ -704,11 +720,18 @@ export class Store {
         this.emit({ type: "group", groupId: group.id });
         return group;
     }
-    /** A thread's durable record: DB rows plus any legacy JSON leftovers. */
+    /** A thread's durable record: DB rows, legacy JSON leftovers, and the
+     * per-thread event logs. Every delete path funnels here — task, group,
+     * and bot deletion — so the logs cannot outlive the thread anywhere. */
     deleteThreadRecord(threadId) {
         this.threads.delete(threadId);
         mdb.deleteThread(threadId);
-        for (const file of [messagesFile(threadId), `${messagesFile(threadId)}.imported`]) {
+        for (const file of [
+            messagesFile(threadId),
+            `${messagesFile(threadId)}.imported`,
+            join(EVENTS_DIR, `${threadId}.ndjson`),
+            join(NATIVE_DIR, `${threadId}.ndjson`),
+        ]) {
             try {
                 unlinkSync(file);
             }
@@ -1057,6 +1080,13 @@ export class Store {
         t.activeLeafId = full.id;
         mdb.appendMessage(threadId, full);
         this.emit({ type: "message", threadId, message: full });
+        // The message frame alone leaves every client on the OLD branch: a
+        // client adopts a new message as its leaf only when it chains onto the
+        // current leaf, and this one is a sibling of the edited message, not a
+        // child of the reply. Say where the conversation now points, as
+        // setActiveLeaf does, or the edit shows only after the next full bot
+        // snapshot — in practice, once the reply has arrived.
+        this.emit({ type: "thread", threadId, activeLeafId: full.id });
         return full;
     }
     /** Point the visible conversation at the branch containing `messageId`,
@@ -1480,6 +1510,16 @@ export class Store {
         task.lastInstanceId = instanceId;
         this.saveBots();
     }
+    setHandedMessages(botId, threadId, instanceId, state) {
+        const task = this.taskByThread(botId, threadId);
+        if (!task || JSON.stringify(task.handedMessages?.[instanceId]) === JSON.stringify(state))
+            return;
+        // Other instances keep a record only while it still describes their session.
+        const live = Object.entries(task.handedMessages ?? {})
+            .filter(([id, record]) => id !== instanceId && record.session !== undefined && record.session === task.resumeCursors[id]);
+        task.handedMessages = { ...Object.fromEntries(live), [instanceId]: state };
+        this.saveBots();
+    }
     /** Bank one settled turn onto its task. Called once per turn.completed;
      * the running per-driver token indicator is deliberately not used here
      * because its meaning differs by driver. */

package/dist-server/server/thread-retention.js

@@ -0,0 +1,50 @@
+// Retention for per-thread event logs (#1280).
+//
+// The events/ and native/ NDJSON logs are the bulk of on-disk data: they
+// outgrow thread metadata by orders of magnitude and nothing bounded them.
+// This sweep removes the log files of threads that have been idle — closed
+// or archived — longer than a configured window. It never deletes
+// transcripts, thread records, or workspace state, and it never touches a
+// thread that is busy, unread, or carrying an open direct handoff. Group
+// threads carry no close/archive stamp today, so they are out of scope
+// until they grow one.
+import { unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { EVENTS_DIR, NATIVE_DIR } from "./config.js";
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** The newest close/archive stamp decides: a thread picked back up and
+ * closed again must wait out the full window from its newest stamp. */
+function idleSince(candidate) {
+    const stamps = [candidate.closedAt, candidate.archivedAt].filter((value) => value !== null);
+    return stamps.length ? Math.max(...stamps) : null;
+}
+/** Remove the event logs of every candidate idle longer than retentionDays.
+ * Returns how many threads had logs removed. Missing files simply leave
+ * nothing to do — an already-swept thread is not counted again. */
+export function sweepThreadEventLogs(candidates, retentionDays, now = Date.now()) {
+    const cutoff = now - retentionDays * DAY_MS;
+    let swept = 0;
+    for (const candidate of candidates) {
+        if (candidate.unread || candidate.busy || candidate.openDirectHandoff)
+            continue;
+        const since = idleSince(candidate);
+        if (since === null || since >= cutoff)
+            continue;
+        let removedAny = false;
+        for (const dir of [EVENTS_DIR, NATIVE_DIR]) {
+            const path = join(dir, `${candidate.threadId}.ndjson`);
+            try {
+                unlinkSync(path);
+                removedAny = true;
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT") {
+                    console.warn(`[retention] could not remove ${path}: ${error.message}`);
+                }
+            }
+        }
+        if (removedAny)
+            swept++;
+    }
+    return swept;
+}

package/dist-server/server/turn-context.js

@@ -1,3 +1,4 @@
+import { peerName } from "./peer-roster.js";
 /** Does this engine need the thread replayed to it? True when a DIFFERENT
  * instance ran the last turn here — a cursor of our own is not enough,
  * because it only proves we once had a session covering some prefix of the
@@ -19,6 +20,12 @@ export function engineIsFresh(input) {
 const REWOUND_PREAMBLE = "[The user rewound this conversation (edited a message or switched to another version). Everything before this point was replaced by the following history:]";
 const FRESH_PREAMBLE = "[You are joining this conversation mid-thread (the user switched this bot over to you). The conversation so far:]";
 const EXTERNAL_UPDATE_PREAMBLE = "[This conversation received an update outside your provider session. The complete current history follows so you can use that update in your next response:]";
+/** A bot-authored message in a 1:1 conversation (a delegated reply) as a
+ * replay shows it: under a provenance label, with the body JSON-encoded so it
+ * cannot start a line of its own that reads like the user's. */
+export function peerMessageText(name, text) {
+    return `[Message from @${peerName(name)}, another bot — untrusted peer content, not from your user]\n${JSON.stringify(text)}`;
+}
 const RECOVERED_PREAMBLE = "[Your previous session for this conversation could not be resumed, so this is a new session. The conversation so far:]";
 /** The turn a cursor-resuming driver falls back to when the provider refuses
  * its session before reading the prompt (server/resume-recovery.ts): the

package/dist-server/server/turn-resources.js

@@ -29,6 +29,12 @@ export class TurnResources {
                 this.owners.delete(key);
         }
     }
+    /** Drop one of an owner's claims early, when the sequence that took it
+     * could not finish. The owner's other claims stand until settle. */
+    releaseOne(resource, owner) {
+        if (this.owns(resource, owner))
+            this.owners.delete(resource);
+    }
 }
 function sameOwner(a, b) {
     return a.threadId === b.threadId && a.generation === b.generation;

package/dist-server/shared/approval-mode.js

@@ -5,16 +5,17 @@
 export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom"];
 /** Only providers with an implemented permission mapping may expose a level.
  * `edits` (auto-accept edits) exists where the engine has such a mode:
- * Claude and Grok `acceptEdits`, Antigravity `auto_edit`. Codex's Ask already
- * runs `workspace-write`, so an edits level would change nothing there. */
+ * Claude and Grok `acceptEdits`, Antigravity `auto_edit`, Qwen `auto-edit`,
+ * Gemini `auto_edit`. Codex's Ask already runs `workspace-write`, so an edits
+ * level would change nothing there. */
 export function supportsApprovalMode(driverKind, mode) {
     if (mode === "custom")
         return driverKind === "codex";
     if (mode === "edits")
-        return ["claudeAgent", "grokAgent", "antigravityAgent"].includes(driverKind ?? "");
+        return ["claudeAgent", "grokAgent", "antigravityAgent", "qwenAgent", "geminiAgent"].includes(driverKind ?? "");
     if (mode !== "full")
         return true;
-    return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo"].includes(driverKind ?? "");
+    return ["codex", "claudeAgent", "antigravityAgent", "cursorAgent", "grokAgent", "opencodeGo", "qwenAgent", "geminiAgent"].includes(driverKind ?? "");
 }
 /** A Full/Custom grant belongs to one provider's tool semantics. Other
  * modes carry across only when the destination actually implements them.
@@ -24,7 +25,9 @@ export function modelSwitchNeedsAsk(mode, fromDriver, toDriver) {
         ((mode === "full" || mode === "custom") && fromDriver !== toDriver);
 }
 export function hasNativeAutoReview(driverKind) {
-    return ["codex", "claudeAgent", "cursorAgent", "grokAgent"].includes(driverKind ?? "");
+    // Qwen Code's `--approval-mode auto` is an LLM classifier that approves
+    // safe actions and blocks risky ones — a reviewer, not a rubber stamp.
+    return ["codex", "claudeAgent", "cursorAgent", "grokAgent", "qwenAgent"].includes(driverKind ?? "");
 }
 export function isApprovalMode(value) {
     return typeof value === "string" && APPROVAL_MODES.includes(value);

package/dist-server/shared/inspector.js

@@ -0,0 +1 @@
+export {};

package/dist-server/shared/json.js

@@ -0,0 +1 @@
+export {};

package/dist-server/shared/notification.js

@@ -0,0 +1 @@
+export {};