openmausbot 0.1.85 → 0.1.86

package/dist-server/server/store.js

@@ -3,7 +3,7 @@
 // ProviderSessionDirectory, recipe step 6: persist the binding from day
 // one). messages-<threadId>.json holds the folded transcript.
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, mkdirSync, rmSync, unlinkSync } from "node:fs";
+import { chmodSync, existsSync, readFileSync, mkdirSync, rmSync, statSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
 import { ensureSections, readSections, changeEmptySection } from "./section-context.js";
@@ -18,6 +18,7 @@ import { pickBotName } from "./names.js";
 import { redactSecretsInText } from "./redact.js";
 import { botAvatarProfile } from "../shared/bot-avatar.js";
 import { approvalModeFor, isApprovalMode } from "../shared/approval-mode.js";
+import { isMentionBoundary, isMentionNameContinuation } from "../shared/mention-boundary.js";
 export const groupWireProjectionIsExact = true;
 // Unicode's complete emoji sequences include flags, skin tones and ZWJ
 // combinations. Also allow unqualified single symbols (e.g. ♥), but not
@@ -35,9 +36,18 @@ export function toWireTask(task) {
 }
 const TASK_PATCH_FIELDS = [
     "title", "projectId", "modelSelection", "approvalMode", "autoApprove", "alwaysAllow",
-    "unread", "rewound", "archivedAt", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
+    "unread", "rewound", "archivedAt", "pinned", "pinnedMessageId", "resumeCursors", "lastInstanceId", "cwd",
     "routineRunId", "surface", "appliedCompactionId", "contextFloor", "lastContextModel",
 ];
+/** Only `true` is a pin. false/undefined must not land in bots.json or groups.json. */
+function persistedPin(task) {
+    if (task.pinned === true)
+        return task;
+    if (!("pinned" in task))
+        return task;
+    const { pinned: _pinned, ...rest } = task;
+    return rest;
+}
 /** Everything the BOT authored is scrubbed of content-shaped secrets before
  * it is stored: its reply text, a tool title (an ACP engine's title can be
  * the whole command line) and the command beside it, a permission card's
@@ -254,6 +264,22 @@ export function titleFromLlm(raw) {
 export const botWireProjectionIsExact = true;
 const BOTS_FILE = join(DATA_DIR, "bots.json");
 const GROUPS_FILE = join(DATA_DIR, "groups.json");
+/** The registries carry souls, project paths and per-bot settings, so they are
+ * owner-only like the other data-dir stores. A file written by an older
+ * release (or loosened by hand) is tightened on load. Best effort: failing to
+ * tighten must never stop the fleet from loading, and the next save replaces
+ * the file with a 0600 one anyway. Windows has no POSIX mode bits. */
+function tightenRegistryFile(file) {
+    if (process.platform === "win32")
+        return;
+    try {
+        if ((statSync(file).mode & 0o077) !== 0)
+            chmodSync(file, 0o600);
+    }
+    catch {
+        /* absent, or not ours to change */
+    }
+}
 const messagesFile = (threadId) => join(DATA_DIR, `messages-${threadId}.json`);
 const COLORS = [
     "green",
@@ -283,15 +309,15 @@ export function mentionedBots(text, peers) {
     const found = [];
     let at = -1;
     while ((at = lower.indexOf("@", at + 1)) !== -1) {
-        if (at > 0 && !/\s/.test(text[at - 1]))
+        if (!isMentionBoundary(text, at))
             continue; // user@host, not a tag
         const rest = lower.slice(at + 1);
         const hit = candidates.find((p) => {
             const name = p.name.toLowerCase();
             if (!rest.startsWith(name))
                 return false;
-            const after = rest[name.length]; // must not run into a longer word
-            return after === undefined || !/[a-z0-9]/i.test(after);
+            const after = rest.slice(name.length); // must not run into a longer word
+            return !isMentionNameContinuation(after);
         });
         if (hit && !found.includes(hit))
             found.push(hit);
@@ -324,8 +350,15 @@ export function normalizeGroupDefaultResponder(value, memberIds, dm = false) {
  * otherwise the room policy chooses one member, everyone, or nobody. */
 export function roomResponders(text, members, defaultResponder) {
     const available = members.filter((member) => !member.hidden);
-    if (/(?:^|\s)@everyone\b/i.test(text))
-        return available;
+    const everyone = "everyone";
+    for (let at = text.indexOf("@"); at !== -1; at = text.indexOf("@", at + 1)) {
+        const candidate = text.slice(at + 1, at + 1 + everyone.length);
+        if (isMentionBoundary(text, at) &&
+            candidate.toLocaleLowerCase() === everyone &&
+            !isMentionNameContinuation(text.slice(at + 1 + everyone.length))) {
+            return available;
+        }
+    }
     const mentioned = mentionedBots(text, available);
     if (mentioned.length)
         return mentioned;
@@ -351,6 +384,8 @@ export class Store {
     constructor(defaultSelection) {
         this.defaultSelection = defaultSelection;
         mkdirSync(DATA_DIR, { recursive: true });
+        for (const file of [BOTS_FILE, GROUPS_FILE])
+            tightenRegistryFile(file);
         try {
             this.bots = JSON.parse(readFileSync(BOTS_FILE, "utf8"));
         }
@@ -517,6 +552,7 @@ export class Store {
                     threadId: g.threadId,
                     title: this.firstUserLine(g.threadId) ?? UNTITLED_TASK,
                     createdAt: g.createdAt,
+                    updatedAt: g.createdAt,
                 };
                 if (g.pinnedCwd !== undefined)
                     initialTask.pinnedCwd = g.pinnedCwd;
@@ -552,6 +588,7 @@ export class Store {
                         threadId: b.threadId,
                         title: this.firstUserLine(b.threadId) ?? UNTITLED_TASK,
                         createdAt: b.createdAt,
+                        updatedAt: b.createdAt,
                         resumeCursors: b.resumeCursors ?? {},
                     }];
                 botsMigrated = true;
@@ -564,6 +601,7 @@ export class Store {
                     threadId: b.threadId,
                     title: this.firstUserLine(b.threadId) ?? UNTITLED_TASK,
                     createdAt: b.createdAt,
+                    updatedAt: b.createdAt,
                     resumeCursors: b.resumeCursors ?? {},
                 };
                 b.tasks.unshift(active);
@@ -619,18 +657,124 @@ export class Store {
             if (existsSync(legacyFile))
                 mdb.readThread(threadId, legacyFile);
         }
+        // After legacy transcripts are in SQLite, so the first boot sees their
+        // newest message instead of stamping createdAt and jumping next launch.
+        this.repairThreadUpdatedAts();
+        // After the roster is loaded, so identity resolution sees which opener
+        // ids are still live.
+        this.repairDuplicatePairConversations();
         this.registeringInitialSections = false;
     }
+    /** Advance a task's update stamp in memory only. Message writes must not
+     * rewrite bots.json; the next snapshot and the startup repair read this. */
+    noteThreadActivity(threadId, at) {
+        if (!Number.isFinite(at))
+            return;
+        const advance = (current) => Math.max(current ?? 0, at);
+        for (const bot of this.bots) {
+            const task = bot.tasks?.find((candidate) => candidate.threadId === threadId);
+            if (!task)
+                continue;
+            const next = advance(task.updatedAt);
+            if (task.updatedAt !== next)
+                task.updatedAt = next;
+        }
+        for (const group of this.groups) {
+            const task = group.tasks?.find((candidate) => candidate.threadId === threadId);
+            if (!task)
+                continue;
+            const next = advance(task.updatedAt);
+            if (task.updatedAt !== next)
+                task.updatedAt = next;
+        }
+    }
+    /** Fill missing stamps, and raise a stamp that is older than the newest
+     * stored message. Never moves a stamp backwards: there is no per-message
+     * delete, and a clock skew must not reshuffle the list on every boot. */
+    repairThreadUpdatedAts() {
+        const botTasks = this.bots.flatMap((bot) => bot.tasks ?? []);
+        const groupTasks = this.groups.flatMap((group) => group.tasks ?? []);
+        const latest = mdb.latestMessageAts([...botTasks, ...groupTasks].map((task) => task.threadId));
+        let botsDirty = false;
+        let groupsDirty = false;
+        const repair = (task) => {
+            const fromMessages = latest.get(task.threadId);
+            const next = fromMessages !== undefined && (task.updatedAt === undefined || fromMessages > task.updatedAt)
+                ? fromMessages
+                : task.updatedAt ?? task.createdAt;
+            if (task.updatedAt === next)
+                return false;
+            task.updatedAt = next;
+            return true;
+        };
+        for (const task of botTasks)
+            if (repair(task))
+                botsDirty = true;
+        for (const task of groupTasks)
+            if (repair(task))
+                groupsDirty = true;
+        if (botsDirty)
+            this.saveBots();
+        if (groupsDirty)
+            this.saveGroups();
+    }
+    /** At most one live pair row per (recipient, sender identity). Servers
+     * before identity-stable matching minted a second live pair row for a
+     * deleted-and-recreated sender while the predecessor's row dangled live
+     * forever; collapse those on load by keeping the row the resolver favors
+     * (first in the task list — the newest, actively used one) and demoting
+     * the rest to closed plain threads. History is kept, never deleted, and
+     * a demoted row is never re-adopted: adoption skips closed rows. Runs on
+     * every load and touches nothing in a store that already holds the
+     * invariant. */
+    repairDuplicatePairConversations() {
+        let botsDirty = false;
+        const sweep = (tasks, repaired) => {
+            const pairs = new Map();
+            for (const task of tasks ?? []) {
+                const by = task.openedBy;
+                if (by?.kind !== "pair" || task.closedBy)
+                    continue;
+                const identity = this.openerIdentity(by);
+                pairs.set(identity, [...(pairs.get(identity) ?? []), task]);
+            }
+            for (const rows of pairs.values()) {
+                // rows are in task-list order, the same order the resolver's
+                // find() favors: the first is the one it keeps using.
+                for (const duplicate of rows.slice(1)) {
+                    const by = duplicate.openedBy;
+                    const identity = this.openerIdentity(by);
+                    const { kind: _kind, ...opened } = by;
+                    duplicate.openedBy = opened;
+                    duplicate.closedBy = {
+                        botId: identity,
+                        name: this.bot(identity)?.name ?? by.name,
+                        at: Date.now(),
+                    };
+                    repaired();
+                }
+            }
+        };
+        // Pair rows only ever live on bots: the resolver requires a bot
+        // recipient, and group tasks carry no peer stamps.
+        for (const bot of this.bots)
+            sweep(bot.tasks, () => { botsDirty = true; });
+        if (botsDirty)
+            this.saveBots();
+    }
     saveBots(bots = this.bots) {
         this.rememberSections([...this.bots, ...bots].map((bot) => bot.section));
         writeFileAtomic(BOTS_FILE, JSON.stringify(bots.map(({ busy: _busy, activity: _activity, ...bot }) => ({
             ...bot,
-            tasks: bot.tasks?.map(({ busy: _taskBusy, activity: _taskActivity, turnStartedAt: _taskTurnStarted, ...task }) => task),
-        })), null, 2));
+            tasks: bot.tasks?.map(({ busy: _taskBusy, activity: _taskActivity, turnStartedAt: _taskTurnStarted, ...task }) => persistedPin(task)),
+        })), null, 2), { mode: 0o600 });
     }
     saveGroups() {
         this.rememberSections(this.groups.map((group) => group.section));
-        writeFileAtomic(GROUPS_FILE, JSON.stringify(this.groups.map(({ busyBotId: _busyBotId, turnStartedAt: _turnStartedAt, ...g }) => g), null, 2));
+        writeFileAtomic(GROUPS_FILE, JSON.stringify(this.groups.map(({ busyBotId: _busyBotId, turnStartedAt: _turnStartedAt, ...g }) => ({
+            ...g,
+            ...(g.tasks ? { tasks: g.tasks.map((task) => persistedPin(task)) } : {}),
+        })), null, 2), { mode: 0o600 });
     }
     get sections() { return readSections(); }
     rememberSections(names) {
@@ -715,7 +859,7 @@ export class Store {
             section,
         };
         if (!dm) {
-            group.tasks = [{ threadId, title: UNTITLED_TASK, createdAt }];
+            group.tasks = [{ threadId, title: UNTITLED_TASK, createdAt, updatedAt: createdAt }];
             group.setupCompletedAt = setup?.completed ? createdAt : null;
             group.setupSkippedAt = null;
         }
@@ -847,10 +991,12 @@ export class Store {
         const group = this.group(groupId);
         if (!group || group.dm)
             return null;
+        const createdAt = Date.now();
         const task = {
             threadId: newId(),
             title: title?.trim().slice(0, 80) || UNTITLED_TASK,
-            createdAt: Date.now(),
+            createdAt,
+            updatedAt: createdAt,
         };
         group.tasks = [task, ...(group.tasks ?? [])];
         if (activate) {
@@ -874,6 +1020,18 @@ export class Store {
         this.emit({ type: "group", groupId });
         return group;
     }
+    setGroupTaskPinned(groupId, threadId, pinned) {
+        const task = this.groupTaskByThread(groupId, threadId);
+        if (!task)
+            return null;
+        if (pinned)
+            task.pinned = true;
+        else
+            delete task.pinned;
+        this.saveGroups();
+        this.emit({ type: "group", groupId });
+        return task;
+    }
     renameGroupTask(groupId, threadId, title) {
         const task = this.groupTaskByThread(groupId, threadId);
         if (!task)
@@ -1003,6 +1161,9 @@ export class Store {
             throw new Error("Cannot import over an existing conversation");
         mdb.importThread(threadId, messages, activeLeafId);
         this.threads.delete(threadId);
+        const newest = messages.reduce((max, message) => Math.max(max, message.at), Number.NEGATIVE_INFINITY);
+        if (Number.isFinite(newest))
+            this.noteThreadActivity(threadId, newest);
     }
     activeLeaf(threadId) {
         return this.thread(threadId).activeLeafId;
@@ -1051,6 +1212,7 @@ export class Store {
                 this.emit({ type: "message.patch", threadId, message: pruned });
             }
         }
+        this.noteThreadActivity(threadId, full.at);
         this.emit({ type: "message", threadId, message: full });
         // The first-run quiz is not a live ask. Talking past it hides it so the
         // transcript is just the greeting plus what they said. Cards with a
@@ -1081,6 +1243,7 @@ export class Store {
                 this.emit({ type: "message.patch", threadId, message: pruned });
             }
         }
+        this.noteThreadActivity(threadId, full.at);
         this.emit({ type: "message", threadId, message: full });
         // announced after the insert so no client ever sees two siblings
         // claiming the same parent
@@ -1136,6 +1299,7 @@ export class Store {
         t.messages.push(full);
         t.activeLeafId = full.id;
         mdb.appendMessage(threadId, full);
+        this.noteThreadActivity(threadId, full.at);
         this.emit({ type: "message", threadId, message: full });
         // The message frame alone leaves every client on the OLD branch: a
         // client adopts a new message as its leaf only when it chains onto the
@@ -1204,6 +1368,8 @@ export class Store {
             color: profile.color ?? COLORS[this.bots.length % COLORS.length],
             ...(profile.mascotExpression ? { mascotExpression: profile.mascotExpression } : {}),
             ...(profile.mascotBody ? { mascotBody: profile.mascotBody } : {}),
+            // Restricted from its first frame: no one else is ever told it exists.
+            ...(profile.visibility && profile.visibility !== "everyone" ? { visibility: structuredClone(profile.visibility) } : {}),
             unread: false,
             modelSelection: profile.modelSelection ?? this.defaultSelection(),
             resumeCursors: {},
@@ -1215,6 +1381,7 @@ export class Store {
                 threadId: bot.threadId,
                 title: UNTITLED_THREAD,
                 createdAt: bot.createdAt,
+                updatedAt: bot.createdAt,
                 resumeCursors: {},
                 modelSelection: structuredClone(bot.modelSelection),
                 unread: false,
@@ -1270,7 +1437,10 @@ export class Store {
                     title: "", description: "", soul: "", notifications: true, color: COLORS[nextBots.length % COLORS.length], unread: false,
                     modelSelection: operation.fields.modelSelection, resumeCursors: {}, createdAt, ...operation.fields,
                     approvalMode: "ask", autoApprove: false, composio: false, approvePeerComms: false,
-                    tasks: [{ threadId: operation.threadId, title: UNTITLED_THREAD, createdAt, resumeCursors: {},
+                    // A Chief's new teammate is seen by exactly the Chief's audience:
+                    // a restricted Chief never creates a bot everyone sees.
+                    ...(chief.visibility && chief.visibility !== "everyone" ? { visibility: structuredClone(chief.visibility) } : {}),
+                    tasks: [{ threadId: operation.threadId, title: UNTITLED_THREAD, createdAt, updatedAt: createdAt, resumeCursors: {},
                             modelSelection: structuredClone(operation.fields.modelSelection), approvalMode: "ask", autoApprove: false,
                             unread: false, activity: "idle", busy: false }],
                 };
@@ -1551,6 +1721,64 @@ export class Store {
             this.emit({ type: "bot", botId: bot.id });
         return changed;
     }
+    /** Company instance ids became stable across re-enrolment. Moves every
+     * saved reference to an old id onto its replacement in one save: model
+     * choices, native resume cursors and handed-message records. An entry that
+     * already exists under the new id wins over the old one. */
+    renameInstances(ids) {
+        const touches = (record) => Boolean(record && Object.keys(record).some(key => ids.has(key)));
+        const rename = (record) => {
+            const next = {};
+            for (const [key, value] of Object.entries(record)) {
+                const target = ids.get(key);
+                if (!target)
+                    next[key] = value;
+                else if (!Object.prototype.hasOwnProperty.call(record, target))
+                    next[target] = value;
+            }
+            return next;
+        };
+        const changed = [];
+        for (const bot of this.bots) {
+            let dirty = false;
+            const selected = ids.get(bot.modelSelection.instanceId);
+            if (selected) {
+                bot.modelSelection = { ...bot.modelSelection, instanceId: selected };
+                dirty = true;
+            }
+            if (touches(bot.resumeCursors)) {
+                bot.resumeCursors = rename(bot.resumeCursors);
+                dirty = true;
+            }
+            for (const task of bot.tasks ?? []) {
+                const taskSelected = task.modelSelection && ids.get(task.modelSelection.instanceId);
+                if (task.modelSelection && taskSelected) {
+                    task.modelSelection = { ...task.modelSelection, instanceId: taskSelected };
+                    dirty = true;
+                }
+                if (touches(task.resumeCursors)) {
+                    task.resumeCursors = rename(task.resumeCursors);
+                    dirty = true;
+                }
+                if (task.handedMessages && touches(task.handedMessages)) {
+                    task.handedMessages = rename(task.handedMessages);
+                    dirty = true;
+                }
+                const last = task.lastInstanceId && ids.get(task.lastInstanceId);
+                if (last) {
+                    task.lastInstanceId = last;
+                    dirty = true;
+                }
+            }
+            if (dirty)
+                changed.push(bot);
+        }
+        if (changed.length)
+            this.saveBots();
+        for (const bot of changed)
+            this.emit({ type: "bot", botId: bot.id });
+        return changed.length;
+    }
     setResumeCursor(botId, instanceId, cursor, threadId) {
         const bot = this.bot(botId);
         if (!bot)
@@ -1797,6 +2025,8 @@ export class Store {
         }
         if (typeof patch.title === "string")
             task.title = patch.title.trim().slice(0, 80) || UNTITLED_THREAD;
+        if (Object.prototype.hasOwnProperty.call(patch, "pinned") && task.pinned !== true)
+            delete task.pinned;
         if (bot.threadId === threadId)
             this.mirrorActiveTask(bot, task);
         bot.unread = bot.tasks.some((candidate) => candidate.unread);
@@ -1814,8 +2044,8 @@ export class Store {
             return null;
         const patch = { modelSelection: structuredClone(selection),
             ...(resetApprovalToAsk ? { approvalMode: "ask", autoApprove: false, alwaysAllow: [] } : {}) };
-        const nextTask = { ...task, ...taskPatch, ...patch,
-            ...(typeof taskPatch.title === "string" ? { title: taskPatch.title.trim().slice(0, 80) || UNTITLED_THREAD } : {}) };
+        const nextTask = persistedPin({ ...task, ...taskPatch, ...patch,
+            ...(typeof taskPatch.title === "string" ? { title: taskPatch.title.trim().slice(0, 80) || UNTITLED_THREAD } : {}) });
         // Older threads may still inherit settings. Freeze their effective
         // values before updating the default so "other threads unchanged" also
         // holds for workspaces created before per-thread approval settings.
@@ -1835,6 +2065,20 @@ export class Store {
         this.emit({ type: "bot", botId });
         return task;
     }
+    /** One durable write: never leave only part of a bot's threads updated. */
+    setAllThreadApprovalMode(botId, mode) {
+        const bot = this.bot(botId);
+        if (!bot)
+            return null;
+        const patch = { approvalMode: mode, autoApprove: false, alwaysAllow: [] };
+        const tasks = (bot.tasks ?? []).map(task => ({ ...task, ...patch }));
+        const next = { ...bot, ...patch, approvalGrant: undefined, tasks };
+        this.saveBots(this.bots.map(candidate => candidate === bot ? next : candidate));
+        bot.tasks?.forEach((task, index) => Object.assign(task, tasks[index]));
+        Object.assign(bot, patch, { approvalGrant: undefined });
+        this.emit({ type: "bot", botId });
+        return bot;
+    }
     mirrorActiveTask(bot, task) {
         bot.threadId = task.threadId;
         bot.resumeCursors = structuredClone(task.resumeCursors);
@@ -1843,23 +2087,25 @@ export class Store {
     }
     /** A fresh context on the same bot: new thread, new session, same
      * persona/tools/computer. Becomes the active task. */
-    createTask(botId, title, activate = true, projectId, openedBy) {
+    createTask(botId, title, activate = true, projectId, openedBy, approvalMode) {
         const bot = this.bot(botId);
         if (!bot)
             return null;
         if (projectId !== undefined && !this.project(botId, projectId))
             return null;
+        const createdAt = Date.now();
         const task = {
             threadId: newId(),
             title: threadTitleFrom(title),
-            createdAt: Date.now(),
+            createdAt,
+            updatedAt: createdAt,
             ...(projectId ? { projectId } : {}),
             ...(openedBy ? { openedBy: structuredClone(openedBy) } : {}),
             resumeCursors: {},
             modelSelection: structuredClone(bot.modelSelection),
-            approvalMode: approvalModeFor(bot),
-            autoApprove: Boolean(bot.autoApprove),
-            alwaysAllow: [...(bot.alwaysAllow ?? [])],
+            approvalMode: approvalMode ?? approvalModeFor(bot),
+            autoApprove: approvalMode ? false : Boolean(bot.autoApprove),
+            alwaysAllow: approvalMode ? [] : [...(bot.alwaysAllow ?? [])],
             unread: false,
             activity: "idle",
             busy: false,
@@ -1932,12 +2178,29 @@ export class Store {
      *   interleave in one transcript. `label` names that thread; the caller
      *   closes it once its result has been reported. A pair conversation
      *   never auto-closes. */
+    /** The identity a peer-opened row belongs to: its opener's id while that
+     * bot lives, else the one live bot the stamp's name still points at —
+     * what a deleted-and-recreated same-name bot inherits — else the dead id
+     * itself. A name two live bots share resolves to nobody's twin:
+     * ambiguous means unmatched, never a wrong merge. */
+    openerIdentity(openedBy) {
+        if (this.bot(openedBy.botId))
+            return openedBy.botId;
+        const named = this.bots.filter((bot) => bot.name === openedBy.name);
+        return named.length === 1 ? named[0].id : openedBy.botId;
+    }
     resolvePairConversation(sender, recipientId, options) {
         if (!this.bot(recipientId))
             return null;
         const title = `@${sender.name}`;
         const opener = (kind, at = Date.now()) => ({ botId: sender.id, name: sender.name, kind, at });
-        const fromSender = this.tasks(recipientId).filter((task) => task.openedBy?.botId === sender.id);
+        // Identity-stable: the sender's own rows, plus ones a deleted
+        // predecessor opened when the stamp's name still points at exactly
+        // this bot — a same-name recreation inherits the conversation instead
+        // of minting a twin while the old row dangles live. A name two live
+        // bots share matches nobody's inheritance: refusing the fallback can
+        // cost a new row, never merge two bots' histories.
+        const fromSender = this.tasks(recipientId).filter((task) => task.openedBy && this.openerIdentity(task.openedBy) === sender.id);
         let pair = fromSender.find((task) => task.openedBy?.kind === "pair");
         if (!pair) {
             const lastActivity = (task) => this.messagesTail(task.threadId, 1).messages.at(-1)?.at ?? task.openedBy?.at ?? task.createdAt;
@@ -1966,6 +2229,14 @@ export class Store {
             // back up, never replaced: closing is only the sidebar's idle state.
             if (pair.closedBy)
                 this.setTaskClosedBy(recipientId, pair.threadId, null);
+            // An inherited row carries the predecessor's id; rebind it to the
+            // live bot so the name fallback is needed only once — a namesake
+            // appearing later cannot claim the row. The hour it was opened
+            // stays: inheritance is not a new conversation.
+            const inherited = pair.openedBy;
+            if (inherited && inherited.botId !== sender.id) {
+                this.setTaskOpenedBy(recipientId, pair.threadId, { ...inherited, botId: sender.id, name: sender.name });
+            }
             return { task: pair, created: false };
         }
         // The brief is never a title. An 80-character slice of an assignment

package/dist-server/server/team-backup.js

@@ -77,6 +77,7 @@ export function createTeamBackup(store, routines, name) {
             closedBy: "closedBy" in task && task.closedBy
                 ? { botId: task.closedBy.botId, name: task.closedBy.name, at: task.closedBy.at }
                 : undefined,
+            pinned: task.pinned === true ? true : undefined,
             activeLeafId: store.activeLeaf(task.threadId),
             messages: store.messagesFor(task.threadId).map((message) => ({
                 id: message.id, role: message.role, text: messageText(message), at: message.at,
@@ -130,7 +131,7 @@ export function createTeamBackup(store, routines, name) {
 }
 /** Import is always additive, including sections and Chiefs. Rollback owns
  * only the fresh records below and cannot touch any pre-existing bot/chat. */
-export function importTeamBackup(store, routines, input, selection) {
+export function importTeamBackup(store, routines, input, selection, options = {}) {
     const backup = parseTeamBackup(input);
     const bots = [];
     const groups = [];
@@ -175,6 +176,8 @@ export function importTeamBackup(store, routines, input, selection) {
                 color: source.color, mascotExpression: source.mascotExpression,
                 mascotBody: botMascotBody(source.mascotBody),
                 modelSelection: selection, section: sectionFor(source.section),
+                // who may see the imported team is the importing admin's choice
+                ...(options.visibility ? { visibility: options.visibility } : {}),
             }, { seedMessages: false });
             bots.push(bot);
             botIds.set(source.key, bot.id);
@@ -203,6 +206,10 @@ export function importTeamBackup(store, routines, input, selection) {
                 const closer = task.closedBy && botIds.get(task.closedBy.botId);
                 if (task.closedBy && closer)
                     record.closedBy = { botId: closer, name: task.closedBy.name, at: task.closedBy.at };
+                if (task.pinned === true)
+                    record.pinned = true;
+                const newest = task.messages.reduce((max, message) => Math.max(max, message.at), task.createdAt);
+                record.updatedAt = newest;
                 return record;
             });
             // Own the task IDs before writing their transcripts, so rollback also
@@ -229,6 +236,8 @@ export function importTeamBackup(store, routines, input, selection) {
             if (!source.dm) {
                 group.tasks = source.tasks.map((task, i) => ({
                     threadId: threads[i], title: task.title, createdAt: task.createdAt,
+                    updatedAt: task.messages.reduce((max, message) => Math.max(max, message.at), task.createdAt),
+                    ...(task.pinned === true ? { pinned: true } : {}),
                     ...(task.titleFromFirstMessage ? { titleFromFirstMessage: true } : {}),
                 }));
                 store.switchGroupTask(group.id, threads[source.tasks.findIndex((task) => task.key === source.activeTask)]);

package/dist-server/server/thread-starters.js

@@ -0,0 +1,53 @@
+// Who each thread is for, when a signed-in person can be named: the person
+// who opened it from a session, or — for a thread a bot opened while working
+// on someone's request — the person that request came from. One small
+// server-private file (<data>/thread-starters.json, 0600), never sent to a
+// client and never part of a bot or room record, so no wire projection can
+// leak it. It decides one thing only: on a workspace several people share,
+// whose session may answer the cards raised in that thread
+// (server/index.ts cardAnswerRefusal). A thread with no entry names nobody,
+// and then anyone who may chat may answer, as before.
+import { readFileSync } from "node:fs";
+import { writeFileAtomic } from "./atomic.js";
+const KEY = /^p_[\w-]{22}$/;
+const THREAD = /^[\w-]{1,128}$/;
+/** Oldest entries go first past this; a thread that old has long settled. */
+const MAX_ENTRIES = 50_000;
+export class ThreadStarters {
+    starters = new Map();
+    file;
+    constructor(file) {
+        this.file = file;
+        let raw;
+        try {
+            raw = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            return; // absent or unreadable: nobody is named, which is today's behaviour
+        }
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return;
+        for (const [threadId, person] of Object.entries(raw)) {
+            if (THREAD.test(threadId) && typeof person === "string" && KEY.test(person))
+                this.starters.set(threadId, person);
+        }
+    }
+    get(threadId) {
+        return this.starters.get(threadId);
+    }
+    /** Record once; a thread keeps the person it was first opened for. */
+    set(threadId, person) {
+        if (!person || !KEY.test(person) || !THREAD.test(threadId) || this.starters.has(threadId))
+            return;
+        this.starters.set(threadId, person);
+        while (this.starters.size > MAX_ENTRIES)
+            this.starters.delete(this.starters.keys().next().value);
+        try {
+            writeFileAtomic(this.file, JSON.stringify(Object.fromEntries(this.starters)) + "\n", { mode: 0o600 });
+        }
+        catch (error) {
+            // Kept in memory for this run; after a restart the thread names nobody.
+            console.warn(`thread starters: could not save ${this.file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}