openmausbot 0.1.86 → 0.1.87

package/dist-server/server/index.js

@@ -3,7 +3,7 @@
 // folds one SSE event stream; every provider process runs here.
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, rmSync, mkdirSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, rmSync, mkdirSync } from "node:fs";
 import { writeFileAtomic } from "./atomic.js";
 import { rm as removeDirectory } from "node:fs/promises";
 import { createServer } from "node:http";
@@ -26,6 +26,7 @@ import { approvalModeFor, supportsApprovalMode, modelSwitchNeedsAsk, isEmergency
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isReusableCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
 import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
+import { CommandAllowlistStore, commandAllowlistCandidate } from "./command-allowlist.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
 import { providerIconPatchSchema, withInstanceIcon } from "./provider-icon.js";
@@ -36,7 +37,7 @@ import { commandReceipt } from "./commands.js";
 import { buildTurnDigest, coverageForDriver, digestPromptLine, renderDigest, toolEvidence } from "./digest.js";
 import { appendDecision, bindDecisionRetention, boundRetentionDays, decisionRetentionDays, decisionsCsv, flushDecisionLog, pruneDecisions, readDecisionRange, readDecisions, withDecisionActor } from "./decision-log.js";
 import { validateBotCwd } from "./bot-cwd.js";
-import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
+import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveAudio, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
 import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, avatarImageStatus, snapshotAvatarGenerationState, } from "./avatar-image.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
@@ -49,8 +50,9 @@ import { boxCreateRecoverySnapshot, retireDeletedBoxCreate } from "./box-create-
 import { boxDeletionSnapshot } from "./box-delete-journal.js";
 import { boxAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
+import { connectorCallFromFrame, connectorRefusalText, connectorUnrecognizedText, evaluateConnectorTools } from "./connector-verdict.js";
 import { chiefOfStaffSystemPrompt } from "./chief-of-staff.js";
-import { canAccessTeam, canReachPeer, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
+import { canAccessTeam, canReachPeer, coordinatorSupervises, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerRuntimeStatus, localVmRecreatableOnDemand, perBotLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, } from "./container-computer.js";
 import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, } from "./config.js";
@@ -59,6 +61,7 @@ import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
 import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAGE_GROUPINGS, flushUsageLedger } from "./usage-ledger.js";
+import { GroupUsageReader } from "./group-thread-usage.js";
 import { ledgerCost } from "./model-prices.js";
 import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
 import { assertWithinBudget, noteSpend, spendAlertText, spendState, takeSpendAlert } from "./spend.js";
@@ -92,30 +95,32 @@ import { ProviderRegistry } from "./harness/registry.js";
 import { ManagedDesktopProviders } from "./managed-desktop.js";
 import { computerKindForResource, ManagedDesktopPolicy } from "./managed-policy.js";
 import { hostedModelPolicy, HOSTED_MODEL_POLICY_HEADER, HOSTED_PROVIDER_SETTINGS_ERROR } from "./hosted-models.js";
-import { selectDefaultModelSelection } from "./default-model-selection.js";
-import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
+import { selectDefaultModelSelection, withNewBotEffort } from "./default-model-selection.js";
+import { cancelPeerApprovalsFor, cancelPeerApprovalsForThread, dismissStalePeerCards, peerApprovalFailure, requestPeerApproval, resolvePeerComms } from "./peer-approval.js";
 import { peerProvenanceNote, withPeerProvenance } from "./peer-provenance.js";
 import { decideRoomPost, emptyRoomPostBudget } from "./room-post-budget.js";
-import { isProjectEmoji, mentionedBots, roomResponders, sectionKey, Store, titleFromLlm, toWireTask, } from "./store.js";
+import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sectionKey, Store, titleFromLlm, toWireTask, } from "./store.js";
 import * as tts from "./tts/index.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
-import { buildRecoveryText, buildTurnContext, engineIsFresh, peerMessageText } from "./turn-context.js";
+import { buildRecoveryText, buildTurnContext, engineIsFresh, NATIVELY_REPLAYING_DRIVER_KINDS, peerMessageText } from "./turn-context.js";
 import { Handoffs, handedStateUsable, recordHanded, renderUnseen, sessionStart, unseenMessages, withUnseenMessages } from "./delta-context.js";
 import { extractTurnImages } from "./turn-images.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
 import { TurnResources, workspaceResource } from "./turn-resources.js";
 import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, supportsWorkspaceFiles, updateMemory, appendMemoryLog, isMemoryTopicName, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
-import { readMemoryTopic } from "./workspace.js";
+import { listMemoryTopics, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { MEMORY_INDEX, MemoryStoreError, memoryCapacity, memoryOverview, openMemoryLocation, readMemoryDoc, } from "./memory-store.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, flushMemoryJournal, journalMemoryDelete, journalMemoryWrite, readMemoryJournal, revertMemoryChange, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
-import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installSkill, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
+import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
 import { fetchSkillFromSource } from "./skill-fetch.js";
+import { pickBotName } from "./names.js";
+import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
 import { expandLearnTurnText, learnSource } from "./skill-learn.js";
 import { expandSetupTurnText, setupModeActive, setupSystemPrompt } from "./setup-mode.js";
 import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-folder.js";
-import { buildSystemPrompt, computerPrompt, COMPOSIO_PROMPT, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, } from "./system-prompt.js";
-import { readCuaConnection, gatedLocalComputer } from "./local-computer.js";
+import { buildSystemPrompt, userProfileSystemPrompt, computerPrompt, COMPOSIO_PROMPT, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, } from "./system-prompt.js";
+import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
 import { LocalVmIdleTimer } from "./local-vm-idle.js";
 import { LocalVmLeasePool } from "./local-vm-lease.js";
@@ -139,9 +144,8 @@ import { flushAllProfileHistory, flushProfileHistory, readHistory, recordProfile
 import { fetchBotDirectory, matchDirectoryBots } from "./bot-directory.js";
 import { scoutProject, suggestTeam } from "./project-scout.js";
 import { fetchGithubTeam, fetchLibraryTeam, fetchTeamCatalog } from "./team-library.js";
-import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageAgentAsMember, parseBotPackage, renderBotPackageMarkdown } from "./bot-package.js";
-import { createTeamManifest, importedMemberProfile, parseTeamManifest } from "./team-manifest.js";
-import { takeImportName } from "../shared/import-name.js";
+import { BOT_PACKAGE_MAX_SKILLS, isBotPackage, packageSummary, parsePackageDocument, renderBotPackageMarkdown } from "./bot-package.js";
+import { createTeamManifest, parseTeamManifest } from "./team-manifest.js";
 import { readThreadEvents } from "./thread-events.js";
 import { bindThreadLogCapProvider } from "./thread-log-rotation.js";
 import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
@@ -150,13 +154,17 @@ import { WebhookManager } from "./webhooks.js";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
 import { loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, selectBundledSkills } from "./skill-library.js";
 import { installedPlaybookInstructions } from "./installed-playbooks.js";
-import { createBotPackageExport } from "./package-export.js";
+import { createBotPackageExport, createLibraryPackageExport, createTeamPackageExport, picture as sharedPicture, TeamExportError } from "./package-export.js";
+import { importPackageDocument, importTeamManifest, PackageImportError } from "./package-import.js";
+import { applyPresetToBot, createPresetStore, DEFAULTS_PRESET_KEY, PRESET_UNAVAILABLE_MESSAGE, presetFromDefaults, presetOffered, readOrgInstallStatuses, readPublishedLibrary, writePublishedLibrary, } from "./presets.js";
+import { readPublishedTeam, writePublishedTeam } from "./published-teams.js";
+import { OrgLibrary } from "./org-library.js";
 import { createTeamBackup, importTeamBackup } from "./team-backup.js";
 import { MAX_TEAM_BACKUP_BYTES } from "../shared/team-backup.js";
 import { shouldMountLocalComputer } from "./local-routing.js";
 import { autoLocalVmAttachable } from "./container-computer.js";
 import { startAutoVmClaim } from "./auto-vm-claims.js";
-import { computerFreeText, computerStillBusyText, computerWaitEndedText, computerWaitingText } from "./computer-wait.js";
+import { computerFreeAfterText, computerStillBusyText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
 import { modelContextWindow } from "./model-context-window.js";
 import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
 import { PendingTurnCancellations, ProviderTurnGenerationRegistry, RetiredTurnRegistry, guardTurnDispatch, isTurnAdmissionBlocked, isTurnEventQuarantined, } from "./turn-dispatch-guard.js";
@@ -183,6 +191,7 @@ import { PHONE_SECRET_PROTOCOL_VERSION, PhoneSecretBridge, PhoneSecretError, Pho
 import { json, onJsonBody, parsedBodyOf, readBody } from "./harness/http.js";
 import { ROUTES, dispatchRoutes } from "./routes/table.js";
 import { createHostedSlackRoutes } from "./routes/hosted-slack.js";
+import { createBotPresetRoutes } from "./routes/bot-presets.js";
 const PORT = Number(process.env.OMB_PORT || process.env.OGB_PORT || 8799);
 const WEBHOOK_PORT = Number(process.env.OMB_WEBHOOK_PORT || PORT + 1);
 // Behind a proxy or tunnel, the base URL senders should use (docs/self-hosting.md).
@@ -248,6 +257,7 @@ const sessions = new SessionRegistry({
 const sharedComputers = new SharedComputers(id => sessions.isLive(id));
 // Who each thread is for, when a signed-in person can be named (server-private).
 const threadStarters = new ThreadStarters(join(DATA_DIR, "thread-starters.json"));
+const commandAllowlist = new CommandAllowlistStore(join(DATA_DIR, "command-allowlist.json"));
 const SESSION_COOKIE = sessionCookieName(PORT, ENVIRONMENT_ID);
 const HOSTED_WORKSPACE = hostedWorkspaceConfigured();
 let workspaceAccess = null;
@@ -416,6 +426,28 @@ function cardAnswerRefusal(auth, threadId, requestId, behavior) {
         return null;
     return "Only the person who started this conversation or sent this request, or a workspace admin, can answer this card.";
 }
+function canManageCommandAllowlist(auth) {
+    return auth.kind === "loopback" ? auth.trust !== "service" : auth.scopes.includes("admin");
+}
+const COMMAND_ALLOWLIST_DRIVERS = new Set([
+    "claudeAgent", "codex", "antigravityAgent", "grokAgent", "opencodeGo", "kimiAgent",
+    "droidAgent", "cursorAgent", "qwenAgent", "geminiAgent", "hermesAgent", "customAcp",
+]);
+function commandAllowlistResponse(bot) {
+    const instance = registry.get(bot.modelSelection.instanceId);
+    const task = store.taskByThread(bot.id, bot.threadId);
+    let cwd = task?.cwd !== undefined ? task.cwd : bot.cwd ?? join(realpathSync(DATA_DIR), "task-workspaces", bot.id, bot.threadId);
+    if (cwd && existsSync(cwd))
+        cwd = realpathSync(cwd);
+    return {
+        rules: commandAllowlist.list(bot.id),
+        supported: COMMAND_ALLOWLIST_DRIVERS.has(instance?.driverKind ?? ""),
+        context: {
+            providerInstanceId: bot.modelSelection.instanceId,
+            cwd,
+        },
+    };
+}
 function decisionActorFor(auth) {
     if (auth.kind === "loopback")
         return auth.trust === "service" ? { kind: "worker" } : { kind: "loopback" };
@@ -655,7 +687,7 @@ function adminAuditPlan(method, path) {
         return null;
     const plan = {
         config: requiredScope(method, path, { sharedComputers: sharedComputersEnabled(cfg) }) === "admin",
-        createsBots: method === "POST" && (path === "/api/bots" || path === "/api/teams/import"),
+        createsBots: method === "POST" && (path === "/api/bots" || path === "/api/teams/import" || path === "/api/org-library/add"),
         createsWebhook: method === "POST" && path === "/api/webhooks",
         pairing: method === "POST" && path === "/api/auth/pairing",
     };
@@ -994,6 +1026,24 @@ utilityParentPort?.on("message", event => {
     }
     utilityParentPort.postMessage({ type: "openmausbot:managed-desktop-result", requestId, ok });
 });
+// The organization library (server/org-library.ts): Electron relays the
+// verified catalog; the runtime swaps it and acknowledges at once, then
+// reconciles and reports on its own. A relay that arrives before the library
+// exists waits for it (the acknowledgement does not).
+let orgLibrary = null;
+let pendingOrgLibraryRelay = null;
+utilityParentPort?.on("message", event => {
+    const message = event.data;
+    if (message?.type !== "openmausbot:managed-library")
+        return;
+    const requestId = typeof message.requestId === "string" && message.requestId.length <= 100 ? message.requestId : undefined;
+    let ok = true;
+    if (orgLibrary)
+        ok = orgLibrary.applyRelay(message.library ?? null).ok;
+    else
+        pendingOrgLibraryRelay = { library: message.library ?? null };
+    utilityParentPort.postMessage({ type: "openmausbot:managed-desktop-result", requestId, ok });
+});
 // Only Electron owns this port. There is deliberately no HTTP equivalent or
 // config patch for its organization identity, endpoint, or model capability.
 utilityParentPort?.on("message", event => {
@@ -1215,6 +1265,9 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
             // The shared-computer tools are advertised only while the workspace
             // gate is on; the routes behind them refuse regardless.
             OMB_SHARED_COMPUTERS_ENABLED: sharedComputersEnabled(cfg) ? "1" : "0",
+            // Same capability rule for voice: the tool is offered only when this
+            // bot can actually speak, and the route re-checks on every call.
+            OMB_VOICE_NOTES: tts.voiceReady(cfg, (botForThread(botId, threadId) ?? store.bot(botId))?.voice) ? "1" : "0",
         },
     };
 }
@@ -1236,6 +1289,8 @@ function hooksIntegration(botId, threadId, generation) {
 }
 class DirectTurnSetupCancelled extends Error {
 }
+class ComputerWaitGaveUp extends Error {
+}
 const directTurnDispatchClaims = new Map();
 const directTurnGenerationByThread = new Map();
 // Only the latest direct request per thread is retained. A fresh user turn
@@ -1269,6 +1324,10 @@ function settleDirectFollowup(generation) {
 // Keep the exact provider/profile settings that own a running conversation.
 // Selecting another thread or changing a default must not retarget its tools.
 const directTurnBots = new Map();
+/** Prompt bytes for the turn in flight, by thread, until the settled turn
+ * books them next to its token usage: stable bytes ride the cacheable
+ * prefix, volatile bytes are the part that legitimately changes. */
+const turnPromptBytes = new Map();
 let providerFleetReloading = false;
 const turnResources = new TurnResources();
 const sharedComputerControl = new SharedComputerControl(turnResources, () => store.bots.some(bot => botComputerControlSnapshot(bot.id).held));
@@ -1312,7 +1371,49 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
     // Who holds the desktop, as the chip and the give-up error name them: a
     // bot running a titled thread, or a room. Read once, when the wait begins.
     let holder;
+    let holderThreadRef;
     const deadline = Date.now() + GROUP_GOAL_WAIT_MAX_MS;
+    // The wait is history the transcript keeps (#1647): the waiting chip stays
+    // exactly as written, a resolution line is appended beside it, and the
+    // turn.wait_* events carry the same facts for the inspector log.
+    let waitedSince;
+    let waitEnded = false;
+    const waitEventBase = () => {
+        const selection = store.botByThread(owner.threadId)?.modelSelection;
+        const instance = selection ? registry.get(selection.instanceId) : null;
+        return {
+            eventId: newId(),
+            provider: instance?.driverKind ?? "harness",
+            ...(instance && selection ? { providerInstanceId: selection.instanceId } : {}),
+            threadId: owner.threadId,
+            createdAt: new Date().toISOString(),
+        };
+    };
+    const endWait = (outcome) => {
+        if (!waitingMessage || waitEnded)
+            return;
+        waitEnded = true;
+        const waitedMs = waitedSince === undefined ? 0 : Date.now() - waitedSince;
+        const text = outcome === "acquired"
+            ? computerFreeAfterText(holder, waitedMs)
+            : outcome === "gave_up"
+                ? computerStillBusyText(holder, waitedMs)
+                : computerStoppedWaitingText(holder, waitedMs);
+        store.appendMessage(owner.threadId, {
+            role: "bot", kind: "activity",
+            ...(outcome === "gave_up" ? { turnSucceeded: false } : {}),
+            tool: { name: text, ok: outcome !== "gave_up" },
+            ...(holderThreadRef ? { threadRef: holderThreadRef } : {}),
+        });
+        bus.publish({
+            ...waitEventBase(),
+            type: "turn.wait_ended",
+            resource,
+            ...(holder ? { holder } : {}),
+            waitedMs,
+            outcome,
+        });
+    };
     try {
         while (true) {
             if (!active())
@@ -1327,22 +1428,33 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
                 holder = holderBot
                     ? { name: holderBot.name, ...(holderTask?.title ? { task: holderTask.title } : {}) }
                     : holderRoom ? { name: holderRoom.name } : undefined;
+                holderThreadRef = holderBot && holderTask?.title
+                    ? { botId: holderBot.id, threadId: holderTask.threadId, title: holderTask.title }
+                    : undefined;
                 waitingMessage = store.appendMessage(owner.threadId, {
                     role: "bot", kind: "activity",
                     tool: { name: computerWaitingText(holder) },
-                    ...(holderBot && holderTask ? { threadRef: { botId: holderBot.id, threadId: holderTask.threadId, title: holderTask.title } } : {}),
+                    ...(holderThreadRef ? { threadRef: holderThreadRef } : {}),
                 });
+                waitedSince = Date.now();
+                bus.publish({
+                    ...waitEventBase(),
+                    type: "turn.wait_started",
+                    resource,
+                    ...(holder ? { holder } : {}),
+                });
+            }
+            if (Date.now() >= deadline) {
+                endWait("gave_up");
+                throw new ComputerWaitGaveUp(computerStillBusyText(holder, GROUP_GOAL_WAIT_MAX_MS));
             }
-            if (Date.now() >= deadline)
-                throw new Error(computerStillBusyText(holder, GROUP_GOAL_WAIT_MAX_MS));
             await new Promise(resolve => setTimeout(resolve, 100));
         }
     }
     finally {
-        if (waitingMessage)
-            store.patchMessage(owner.threadId, waitingMessage.id, {
-                tool: { name: active() && turnResources.owns(resource, owner) ? computerFreeText() : computerWaitEndedText(), ok: true },
-            });
+        // Never patch the waiting chip over: the queue position this turn held
+        // stays visible beside what the wait came to.
+        endWait(active() && turnResources.owns(resource, owner) ? "acquired" : "stopped");
     }
     turnResourceOwners.set(owner.threadId, owner);
     turnComputerResources.set(owner.threadId, { owner, resource });
@@ -1457,15 +1569,15 @@ async function interruptAllDirectThreads(botId) {
 }
 const retiredProviderTurns = new RetiredTurnRegistry();
 const pendingCancelledProviderHandshakes = new PendingTurnCancellations();
-const generatedImagesByTurn = new Map();
-function generatedImageTurnKey(threadId, turnId) {
+const turnAttachmentsByTurn = new Map();
+function turnAttachmentKey(threadId, turnId) {
     return `${threadId}:${turnId ?? "active"}`;
 }
-function purgeGeneratedImagesForThread(threadId) {
-    for (const [key, attachments] of generatedImagesByTurn) {
+function purgeTurnAttachmentsForThread(threadId) {
+    for (const [key, attachments] of turnAttachmentsByTurn) {
         if (!key.startsWith(`${threadId}:`))
             continue;
-        generatedImagesByTurn.delete(key);
+        turnAttachmentsByTurn.delete(key);
         for (const attachment of attachments) {
             deleteAttachment(attachment.path);
         }
@@ -1479,13 +1591,13 @@ function clearCancelledProviderHandshake(threadId, ownerId) {
 }
 function retireProviderTurn(turnId) {
     retiredProviderTurns.retire(turnId);
-    // A stopped/replaced turn is never folded again. Delete only image files
-    // that were staged for that exact provider turn so unattached output does
-    // not accumulate invisibly on disk.
-    for (const [key, attachments] of generatedImagesByTurn) {
+    // A stopped/replaced turn is never folded again. Delete only staged files
+    // (images, voice notes) that were parked for that exact provider turn so
+    // unattached output does not accumulate invisibly on disk.
+    for (const [key, attachments] of turnAttachmentsByTurn) {
         if (!key.endsWith(`:${turnId}`))
             continue;
-        generatedImagesByTurn.delete(key);
+        turnAttachmentsByTurn.delete(key);
         for (const attachment of attachments) {
             deleteAttachment(attachment.path);
         }
@@ -1636,8 +1748,26 @@ export function browserEngineSummary() {
         ? { kind: "engine", version: status.version, ...progress }
         : { kind: "unavailable", reason: status.reason, installable: status.installable, ...progress };
 }
-function phoneIntegration() {
-    const env = { ...AGENTS_NODE_FLAG };
+function phoneIntegration(botId, threadId, generation) {
+    // The phone is claimed lazily, at the first tools/call the engine makes
+    // through this proxy (/api/internal/phone/claim): trigger-term matching
+    // only decides whether the tools are mounted, so a conversation that
+    // merely mentions "android" holds nothing while it runs.
+    const token = mintInternalCapability({
+        botId,
+        threadId,
+        generation,
+        depth: 0,
+        kind: "phone",
+        skillAuthoring: false,
+        createdBots: 0,
+        openedThreads: 0,
+    });
+    const env = {
+        ...AGENTS_NODE_FLAG,
+        OMB_PHONE_TOKEN: token,
+        OMB_HARNESS_URL: `http://127.0.0.1:${PORT}`,
+    };
     if (process.env.OMB_ADB_PATH)
         env.OMB_ADB_PATH = process.env.OMB_ADB_PATH;
     if (process.env.OMB_RESOURCES_PATH)
@@ -1933,6 +2063,113 @@ function collectExportSkills(bots, names) {
     }
     return byBot;
 }
+/** Skills on one team's bots for a whole-team share. "all" skips a skill
+ * whose stored SKILL.md changed (listed to the person); an explicit list
+ * refuses instead, because the person asked for that exact skill. */
+/** The team's skills for a whole-team export. `available` (every skill name
+ * on the team's bots) comes back on refusals too: the Share dialog draws its
+ * skill choices from it, so a refused choice can always be changed. */
+function collectTeamSkills(bots, selection) {
+    const all = selection === undefined || selection === "all";
+    const available = [...new Set(bots.flatMap((bot) => listSkills(bot.id).map((skill) => skill.name)))].sort();
+    if (!all && (!Array.isArray(selection) || selection.some((name) => typeof name !== "string" || !isSkillName(name)))) {
+        return { ok: false, error: "skills must be \"all\" or a list of skill names", available };
+    }
+    const chosen = new Set(all ? available : selection);
+    const unknown = [...chosen].find((name) => !available.includes(name));
+    if (unknown)
+        return { ok: false, error: `This team has no skill named "${unknown}"`, available };
+    const skillsByBot = new Map();
+    const skipped = [];
+    for (const bot of bots) {
+        const assigned = [];
+        for (const listing of listSkills(bot.id)) {
+            if (!chosen.has(listing.name))
+                continue;
+            const instructions = readSkillFile(bot.id, listing.name);
+            if (instructions === null) {
+                if (!all)
+                    return { ok: false, error: `Skill "${listing.name}" changed or is unavailable and cannot be shared safely`, available };
+                const part = `skills[${listing.name}]`;
+                if (!skipped.some((skip) => skip.part === part))
+                    skipped.push({ part, reason: "skill_changed" });
+                continue;
+            }
+            assigned.push({
+                name: listing.name,
+                description: listing.description,
+                ...(listing.source ? { source: listing.source } : {}),
+                ...(listing.license ? { license: listing.license } : {}),
+                ...(listing.compatibility ? { compatibility: listing.compatibility } : {}),
+                instructions,
+                enabled: listing.enabled,
+            });
+        }
+        if (assigned.length)
+            skillsByBot.set(bot.id, assigned);
+    }
+    return { ok: true, all, skillsByBot, skipped, available };
+}
+/** A bot's starter notes: MEMORY.md and its topic files. Daily logs never
+ * travel (they are closer to chat history than to notes). */
+function starterNotes(botId) {
+    const notes = [];
+    const index = readMemoryFile(botId).text;
+    if (index.trim())
+        notes.push({ path: "MEMORY.md", text: index });
+    for (const topic of listMemoryTopics(botId).sort((a, b) => a.name.localeCompare(b.name))) {
+        const text = readMemoryTopic(botId, topic.name);
+        if (text?.trim())
+            notes.push({ path: `memory/${topic.name}`, text });
+    }
+    return notes;
+}
+/** The importer's view of this installation. Pictures become ordinary local
+ * avatars, connection slots ordinary (switched-off) MCP servers, starter
+ * notes ordinary memory writes. */
+function packageImportDeps(selection) {
+    return {
+        store,
+        routines: routines,
+        skills: { install: installSkill, setEnabled: setSkillEnabled, installOrg: installOrgSkill },
+        memory: { writeIndex: writeMemoryFile, writeTopic: writeMemoryTopic },
+        mcp: { servers: () => cfg.mcpServers ?? {}, refusal: mcpPolicyRefusal, persist: persistMcpServers },
+        sections: { writeBrief: (section, text) => void writeSectionContext(section, text) },
+        images: {
+            save: (bytes, mime) => {
+                const avatarUrl = botAvatarUrlFromStoredPath(saveImage(Buffer.from(bytes), mime).path);
+                if (!avatarUrl)
+                    throw new Error("A picture in this package could not be stored");
+                return avatarUrl;
+            },
+        },
+        broadcast: (event) => event.kind === "bot"
+            ? broadcast({ kind: "bot", bot: publicBot(event.bot) })
+            : broadcast({ kind: "group", group: publicGroupState(event.group) }),
+        defaultSelection: () => selection,
+        presets: presetStore,
+    };
+}
+/** "Include my New bot defaults as a preset" from an export body: the saved
+ * defaults through the allowlist, with the picture the dialog prepared. */
+function defaultsPresetFor(body, includeNotes) {
+    const skipped = [];
+    let avatar = null;
+    if (body.presetAvatar !== undefined && body.presetAvatar !== null && body.presetAvatar !== "") {
+        const offered = sharedPicture(body.presetAvatar);
+        if (typeof offered === "string")
+            skipped.push({ part: `presets[${DEFAULTS_PRESET_KEY}].bot.appearance.avatar`, reason: offered });
+        else
+            avatar = offered;
+    }
+    const built = presetFromDefaults(cfg.newBotDefaults, {
+        name: typeof body.presetName === "string" ? body.presetName : undefined,
+        description: typeof body.presetDescription === "string" ? body.presetDescription : undefined,
+        includeNotes,
+        avatar,
+    });
+    return { preset: built.value, skipped: [...skipped, ...built.skipped] };
+}
 function checkedGroupResponder(value, memberIds) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return null;
@@ -1970,7 +2207,9 @@ function checkedMemberIds(value) {
     return { ok: true, memberIds };
 }
 let bootSelection = { instanceId: "", model: "" };
-const store = new Store(() => bootSelection);
+/** Preset bots for New bot, from shared files and the organization (presets.ts). */
+const presetStore = createPresetStore();
+const store = new Store(() => bootSelection, (selection) => withNewBotEffort(selection, cfg.newBots?.effort, registry.get(selection.instanceId)?.adapter.capabilities.effortLevels));
 const teamComputers = new TeamComputers(join(DATA_DIR, "team-computers.json"), ENVIRONMENT_ID);
 let followupsReady = false;
 const sendSequencer = new SendSequencer();
@@ -2008,9 +2247,17 @@ if (browserCleanupReferencesReconciled)
  * than the desktop window did. Stripped here rather than at each call site
  * so a new broadcast cannot forget. */
 let activeCoordinationForThread = (_threadId) => false;
-const wireTask = (task) => ({ ...toWireTask(task), waitingForTeammates: activeCoordinationForThread(task.threadId) && !task.busy });
+const wireTask = (task) => {
+    // Time-based snoozes heal on read against the server clock — no client
+    // timer, no device skew. The 0 sentinel ("until new activity") is not a
+    // time and survives reads; only a wake event in the store clears it.
+    const { snoozedUntil, ...base } = toWireTask(task);
+    const coordinated = { ...base, waitingForTeammates: activeCoordinationForThread(task.threadId) && !task.busy };
+    const asleep = snoozedUntil === 0 || (snoozedUntil !== undefined && snoozedUntil > Date.now());
+    return asleep ? { ...coordinated, snoozedUntil } : coordinated;
+};
 const wireBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, ...rest } = bot;
     // An elevated selection is inert until the desktop confirms its exact
     // private reply. Every ordinary client sees the effective Ask state during
     // that two-phase window, never a grant that may still roll back.
@@ -2023,7 +2270,7 @@ const wireBot = (bot) => {
 /** The correlated private response carries the requested value so Electron
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, ...rest } = bot;
     return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
@@ -2046,7 +2293,7 @@ function previewSystemPrompt(bot) {
     const computerPromptKind = previewComputer === "vm"
         ? caps?.computerMcp ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : null
         : previewComputer === "cloud"
-            ? instance?.driverKind === "boxAgent" ? "box-agent" : caps?.computerMcp ? bot.cloudBackend === "vps" ? "vps" : "box" : null
+            ? instance?.driverKind === "boxAgent" ? "box-agent" : caps?.computerMcp ? bot.cloudBackend === "vps" ? "vps" : caps.cloudComputerMcp ? "box-chat" : "box" : null
             : previewComputer === "local"
                 ? caps?.localComputerMcp ? "local" : null
                 : null;
@@ -2070,6 +2317,7 @@ function previewSystemPrompt(bot) {
     });
     const privateWorkspace = instance && supportsWorkspaceFiles(instance.driverKind);
     const built = buildSystemPrompt(persona, bot.soul ?? "", [
+        { id: "user-profile", label: "About the user", text: userProfileSystemPrompt(cfg.profile) },
         {
             id: "setup",
             label: "Setup",
@@ -2889,7 +3137,7 @@ function roomHandoffProblem(node, parent) {
     // cannot silently give a specialist access to another team's transcript.
     const outsideSection = (room, speaker) => room.memberIds.some(id => {
         const member = store.bot(id);
-        return member && !canAccessTeam(speaker, member.section);
+        return member && !canAccessTeam(speaker, member.section) && !coordinatorSupervises(member, speaker);
     });
     if (group && outsideSection(group, bot))
         return "Destination room includes a member outside the agent's section";
@@ -2900,7 +3148,10 @@ function roomHandoffProblem(node, parent) {
         const source = parent.groupId ? store.group(parent.groupId) : undefined;
         if (!from || from.hidden || (parent.groupId ? !source || !source.memberIds.includes(from.id) || !store.groupTaskByThread(source.id, parent.threadId) : !store.taskByThread(from.id, parent.threadId)))
             return "Source membership or task was removed";
-        if (!canAccessTeam(from, bot.section) || (source && outsideSection(source, from)))
+        // A specialist may address its supervisor in their shared conversation;
+        // supervision alone never grants a direct chat or another room's access.
+        const sharedSupervisor = source && group && source.id === group.id && parent.threadId === node.threadId && coordinatorSupervises(bot, from);
+        if ((!canAccessTeam(from, bot.section) && !sharedSupervisor) || (source && outsideSection(source, from)))
             return "Room work cannot cross the sender's section boundary";
         if (source && group && source.id === group.id && parent.threadId !== node.threadId)
             return "Same-room work must stay in the originating conversation";
@@ -3027,11 +3278,12 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
         const result = {};
         const turnText = coordinationTurnText(node, resumed);
         const systemInstructions = coordinationSystemInstructions();
-        if (!resumed && !store.messagesFor(node.threadId).some(m => m.roomRequest?.id === node.id && m.roomRequest.phase === "request")) {
+        const request = roomHandoffs.sharedRequest(node);
+        if (!resumed && !store.messagesFor(node.threadId).some(m => m.roomRequest?.id === request.id && m.roomRequest.phase === "request")) {
             store.appendMessage(node.threadId, { role: "bot", kind: "text",
-                roomRequest: { id: node.id, phase: "request" },
+                roomRequest: { id: request.id, phase: "request" },
                 from: sender ? { botId: sender.id, name: sender.name, color: sender.color } : undefined,
-                text: `@${bot.name} ${node.text}`,
+                text: `${request.botIds.map(id => `@${store.bot(id)?.name ?? "Teammate"}`).join(" ")} ${node.text}`,
             });
         }
         markInternalTurn(node.threadId);
@@ -3108,8 +3360,20 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
     },
 }, Date.now, roomHandoffLimits(cfg));
 activeCoordinationForThread = threadId => roomHandoffs.activeDirect(threadId);
-function publicGroupState(group) {
-    return { ...group, working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)) };
+const groupUsageReader = new GroupUsageReader(DATA_DIR);
+try {
+    groupUsageReader.refresh();
+}
+catch { /* accounting must not block startup */ }
+function publicGroupState(record) {
+    // The organization library's part hashes stay server-side.
+    const { installedPackage: _installedPackage, ...group } = record;
+    let usage;
+    try {
+        usage = groupUsageReader.forThread(group.threadId);
+    }
+    catch { /* accounting must not block chat */ }
+    return { ...group, usage: usage ?? null, working: groupIsWorking(group) || [...roomHandoffs.nodes.values()].some(n => n.groupId === group.id && !["completed", "failed", "cancelled"].includes(n.status)) };
 }
 function beginGroupTurnOperation(groupId, threadId, botIds = []) {
     const operation = {
@@ -3140,6 +3404,13 @@ function finishGroupTurnOperation(groupId, operation) {
     const group = store.group(groupId);
     if (group)
         broadcast({ kind: "group", group: publicGroupState(group) });
+    // The operation can outlive the last member's turn.completed: the fold
+    // releases the speaker, but this map entry is what holds a 1:1 message
+    // queued behind the room (reason "group-turn"), and no later event fires
+    // once the run settles. Drain here, at the true end — the drain's own
+    // block check re-reads activeGroupTurnForBot, so a replacement operation
+    // begun in the interim still keeps its ground.
+    drainQueuedSends();
     // A follow-up sent while this operation was running belongs to the
     // harness, not whichever composer happened to be mounted. Hand the next
     // one to the ordinary channel runner as soon as the channel is truly idle.
@@ -3448,6 +3719,12 @@ store.onChange((change) => {
             break;
         }
         case "bot.deleted":
+            try {
+                commandAllowlist.clear(change.botId);
+            }
+            catch {
+                console.error("[command-allowlist] Could not remove deleted bot's saved rules.");
+            }
             broadcast({ kind: "bot.deleted", botId: change.botId });
             break;
         case "group": {
@@ -3718,6 +3995,17 @@ onSteeredQueueChange(() => broadcast({ kind: "bot.queued", queues: publicBotQueu
 // once can collide on a bare id and patch each other's messages.
 const toolMessageByItem = new Map(); // threadId:itemId -> messageId
 const askMessageByRequest = new Map(); // threadId:requestId -> messageId
+// Only native, live permission metadata can become a remembered grant. Never
+// rebuild executable authority from an imported transcript or display summary.
+const pendingCommandRules = new Map();
+function commandRememberRefusal(auth, threadId, requestId, behavior) {
+    if (!canManageCommandAllowlist(auth))
+        return "Only the workspace owner or an admin can save bot-wide command permissions.";
+    if (behavior !== "allow" || !pendingCommandRules.has(`${threadId}:${requestId}`)) {
+        return "This live request does not contain a command that can be saved. Allow it once instead.";
+    }
+    return null;
+}
 /** Deliver a person's answer to the engine that asked, and tell the truth
  * about what happened. `unavailable` — the turn ended, the ask timed out,
  * the engine has no asks — is fail-closed: the action was never run. The
@@ -3725,7 +4013,7 @@ const askMessageByRequest = new Map(); // threadId:requestId -> messageId
  * a 500 while the card sits open forever. */
 async function answerRequest(threadId, instanceId, requestId, behavior, message, decidedFor, 
 /** "Always allow this session": the provider keeps the allow, not the app */
-always) {
+always, rememberCommand) {
     // Snapshot the card BEFORE delivering the answer: a delivered answer
     // resolves the request synchronously through the fold, which consumes
     // the askMessageByRequest entry — by the time the await returns, nobody
@@ -3738,7 +4026,10 @@ always) {
         ? thread.find((m) => m.id === cardMessageId)
         : thread.find((m) => m.card?.requestId === requestId);
     const card = cardMessage?.card;
-    const instance = registry.get(instanceId);
+    const remembered = rememberCommand ? pendingCommandRules.get(`${threadId}:${requestId}`) : undefined;
+    // Cloud routing and a model change can differ from the bot's current
+    // settings. The live turn owns this question, just as it owns Stop/steer.
+    const instance = runningTurnEngines.get(threadId) ?? registry.get(instanceId);
     let outcome = "unavailable";
     if (instance) {
         try {
@@ -3748,6 +4039,18 @@ always) {
             outcome = "unavailable";
         }
     }
+    if (remembered && outcome === "allowed-once" && behavior === "allow" && store.bot(remembered.botId)) {
+        // Persist only after the provider accepted this exact live request. A dead
+        // card, denied request, failed delivery or process restart saves no grant.
+        try {
+            commandAllowlist.add(remembered.botId, remembered.candidate);
+        }
+        catch {
+            store.appendMessage(threadId, { role: "bot", kind: "activity", tool: {
+                    name: "Command allowed once, but its allowlist rule could not be saved. Try again from the permissions menu.", ok: false,
+                } });
+        }
+    }
     // An answered question keeps its words. `request.resolved` only records
     // the behavior, so without this the card reads "answer" forever and the
     // person can no longer see what they told the bot.
@@ -3801,6 +4104,9 @@ always) {
  * be answered. Routine proposals are harness-owned and durable, so they stay
  * actionable even after the proposing turn has stopped. */
 function closeOpenApprovals(threadId) {
+    for (const key of pendingCommandRules.keys())
+        if (key.startsWith(`${threadId}:`))
+            pendingCommandRules.delete(key);
     // Peer approvals also hold an in-memory promise. Resolve those first; merely
     // patching their cards would leave the delegation queue waiting 15 minutes.
     cancelPeerApprovalsForThread(threadId);
@@ -3970,6 +4276,10 @@ bus.subscribe((event) => {
         watchdog.setWaitingOnHuman(event.threadId, true);
     else if (event.type === "request.resolved")
         watchdog.setWaitingOnHuman(event.threadId, false);
+    else if (event.type === "turn.wait_started")
+        watchdog.setWaitingOnComputer(event.threadId, true);
+    else if (event.type === "turn.wait_ended")
+        watchdog.setWaitingOnComputer(event.threadId, false);
     else if (event.type === "turn.completed") {
         watchdog.settle(event.threadId);
         revokeInternalCapabilityForProviderEvent(event);
@@ -4444,8 +4754,12 @@ async function mountHostComputer(owner, botId, providerSupportsLocal) {
             : "this model engine cannot control this computer — choose Claude or an ACP engine, or select another destination");
     }
     const cua = readCuaConnection();
-    if (!cua)
-        throw new Error("CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
+    if (!cua) {
+        const reason = readCuaUnavailableReason();
+        throw new Error(reason
+            ? `CUA Driver is not ready for this computer — ${reason}${process.platform === "darwin" && /(?:Screen Recording|Accessibility).*required/i.test(reason) ? ". Relaunch OpenMausBot after granting the missing macOS permission." : ""}`
+            : "CUA Driver is not ready for this computer — check permissions and restart OpenMausBot");
+    }
     await bindTurnComputer(owner, "computer:host");
     return gatedLocalComputer(cua, controlIntegration(botId, owner.threadId, owner.generation));
 }
@@ -4472,6 +4786,7 @@ async function mountBotVps(bot, owner, opts) {
         owner,
         lazy: true,
         label: "the VPS computer",
+        onRejected: opts.onRejected,
         claim: async () => {
             await bindTurnComputer(owner, vpsResource, true);
             opts.onClaimed(vpsCapture);
@@ -4608,11 +4923,12 @@ function turnProvider(bot, runOn, threadId) {
         return "box";
     return bot.cloudBackend === "vps" ? "vps" : wants === "cloud" ? "box" : null;
 }
-/** A turn on the cloud computer runs ON the cloud computer: the Box runs the
- * bot's own harness there with the computer tools built in, so nothing on this
- * machine relays clicks and screenshots. Every start/interrupt of a turn asks
- * here which engine owns it. */
+/** A driver with a Box bridge keeps the selected model. Other engines use
+ * Box's native runner. Start and interrupt must resolve the same owner. */
 function turnInstance(bot, runOn, threadId) {
+    const selected = registry.get(bot.modelSelection.instanceId);
+    if (selected?.adapter.capabilities.cloudComputerMcp)
+        return selected;
     const onBox = turnProvider(bot, runOn, threadId) === "box";
     return onBox
         ? registry.instances().find((candidate) => candidate.driverKind === "boxAgent") ?? null
@@ -4677,7 +4993,7 @@ async function selectableComputers(bot) {
                     canCreate = Boolean(status?.configured && status.daemonUp && status.container === "missing");
                     reason = status?.problem ?? reason;
                 }
-                else if (box.boxConfigured(cfg) && registry.instances().some(instance => instance.driverKind === "boxAgent")) {
+                else if (box.boxConfigured(cfg) && (caps?.cloudComputerMcp || registry.instances().some(instance => instance.driverKind === "boxAgent"))) {
                     const status = await box.boxStatus(cfg, bot.id);
                     const lifecycle = box.boxTurnLifecycleAction({ explicitCloud: true, canMount: true, state: status.box?.state ?? null });
                     ready = lifecycle === "attach";
@@ -4740,7 +5056,10 @@ function continueComputerSelection(threadId, generation, succeeded) {
         }
         if (store.activePath(threadId).findLast(message => message.role === "user" && message.kind === "text")?.id !== selection.source.id)
             return;
-        store.patchTask(bot.id, threadId, { surface });
+        // The model picked this surface through select_computer; the person
+        // never chose it in the composer or thread settings. It is the
+        // machine's record, so a later Works on change may sweep it.
+        store.patchTask(bot.id, threadId, { surface, surfaceSource: "auto" });
         const text = `The computer selection is now ${surfaceLabel(surface)}. Continue the user's original request using the tools mounted for this turn; verify the result before claiming success.\n\n${selection.text}`;
         void startTurn(bot.id, text, { threadId, userMessage: selection.source, computerSelectionContinuation: true }).catch(error => {
             if (store.taskByThread(bot.id, threadId))
@@ -4965,8 +5284,12 @@ bus.subscribe((event) => {
     const privateImageEvent = event.type === "item.completed" && event.itemType === "assistant_image";
     // The durable message patch below is the public frame. Sending raw base64
     // through runtime SSE would multiply large bytes across every app window.
-    if (!privateImageEvent)
-        broadcast({ kind: "runtime", event });
+    if (!privateImageEvent) {
+        // Exact executable input is internal matching metadata, not inspector UI.
+        // The event bus's persistence redactor does not scrub its live event.
+        const publicEvent = event.type === "request.opened" ? { ...event, command: undefined } : event;
+        broadcast({ kind: "runtime", event: publicEvent });
+    }
     const routineRun = privateImageEvent ? null : (routines?.handleRuntimeEvent(event) ?? null);
     const ownerBot = store.botByThread(event.threadId);
     const bot = ownerBot ? botForThread(ownerBot.id, event.threadId) ?? undefined : undefined;
@@ -5018,10 +5341,10 @@ bus.subscribe((event) => {
                 try {
                     const decoded = decodeGeneratedImage(event.data);
                     const saved = saveImage(decoded.bytes, decoded.mime);
-                    const key = generatedImageTurnKey(event.threadId, event.turnId);
-                    const current = generatedImagesByTurn.get(key) ?? [];
+                    const key = turnAttachmentKey(event.threadId, event.turnId);
+                    const current = turnAttachmentsByTurn.get(key) ?? [];
                     current.push({ kind: "image", path: saved.path, mime: saved.mime });
-                    generatedImagesByTurn.set(key, current);
+                    turnAttachmentsByTurn.set(key, current);
                 }
                 catch (error) {
                     pushMessage({
@@ -5092,14 +5415,22 @@ bus.subscribe((event) => {
             const permission = event.requestType === "permission" && !event.questions?.length;
             // A permission request here is one the provider left for a person: its
             // own mode already ran (Ask, Edits, Auto's reviewer, Custom's config).
-            // OpenMausBot decides nothing about the action itself. Only Full access
-            // answers, because that is exactly what the person granted. A QUESTION
+            // Only the person's explicit Full access or exact saved command answers.
+            // The app does not guess whether the action is safe. A QUESTION
             // always reaches the human — even Full access never invents an answer.
             const asker = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id, event.threadId) : false;
             const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId)) : "ask";
+            // Native shell descriptors are distinct from computer/MCP permissions;
+            // choosing a local desktop must not disable an exact shell grant.
+            const command = permission && asker && event.requestId && !event.requiresExplicitApproval && event.command
+                ? commandAllowlistCandidate({ ...event.command, providerInstanceId: event.providerInstanceId ?? asker.modelSelection.instanceId })
+                : null;
             const verdict = permission && asker && event.requestId
-                ? autoVerdict(effectiveApprovalMode, event.tool, { requiresExplicitApproval: event.requiresExplicitApproval })
+                ? autoVerdict(effectiveApprovalMode, event.tool, {
+                    requiresExplicitApproval: event.requiresExplicitApproval,
+                    commandAllowed: Boolean(command && commandAllowlist.matches(asker.id, command)),
+                })
                 : null;
             // Auto's reviewer is the engine's own. Claude accepts `--permission-mode
             // auto` for any model and starts in Manual without a word when auto is
@@ -5146,8 +5477,8 @@ bus.subscribe((event) => {
                             pushMessage({
                                 role: "bot", kind: "activity",
                                 tool: { name: outcome === "rejected"
-                                        ? "The provider rejected this action despite Full access."
-                                        : "error: could not deliver Full access to the provider; retry the task after reconnecting.", ok: false },
+                                        ? `The provider rejected this action despite ${verdict.source === "command-allowlist" ? "the saved command permission" : "Full access"}.`
+                                        : "error: could not deliver approval to the provider; retry the task after reconnecting.", ok: false },
                             });
                         return;
                     }
@@ -5170,7 +5501,7 @@ bus.subscribe((event) => {
                 })().catch(() => {
                     // A receipt failure must neither crash the server nor manufacture
                     // a new permission request after the provider took our answer.
-                    console.error("[full-access] Could not record the provider approval result.");
+                    console.error("[approval] Could not record the provider approval result.");
                 });
                 break;
             }
@@ -5192,9 +5523,11 @@ bus.subscribe((event) => {
                     options: event.choices?.length ? event.choices : permission ? ["Allow", "Deny"] : [],
                     requestId: event.requestId,
                     tool: permission ? event.tool : undefined,
-                    questionRequest: questions ? { version: 1, questions } : undefined,
-                    // the provider can keep an allow for its session; the app keeps
-                    // no grant of its own for a provider's tool
+                    questionRequest: questions
+                        ? { version: 1, questions, ...(event.origin === "output" ? { origin: "output" } : {}) }
+                        : undefined,
+                    commandAllowlist: command ?? undefined,
+                    // Provider-owned session grants remain separate from exact commands.
                     allowSession: permission && event.allowSession && !event.requiresExplicitApproval ? true : undefined,
                     // The text stays for cards saved before heldCode existed, and for
                     // clients that do not know the key yet.
@@ -5205,6 +5538,8 @@ bus.subscribe((event) => {
             });
             if (event.requestId)
                 askMessageByRequest.set(`${event.threadId}:${event.requestId}`, message.id);
+            if (command && asker && event.requestId)
+                pendingCommandRules.set(`${event.threadId}:${event.requestId}`, { botId: asker.id, candidate: command });
             // Every card that reaches a human is a decision too: "the provider
             // left this for you, in this mode". `question` marks the cards no
             // rule may ever answer; a permission card without a verdict (no known
@@ -5219,6 +5554,7 @@ bus.subscribe((event) => {
                 summary: event.summary,
                 decision: "card-shown",
                 source: !permission ? "question" : verdict ? verdict.source : "no-grant",
+                origin: !permission && event.origin === "output" ? "output" : undefined,
                 unattended: unattended || undefined,
             });
             // Notify from HERE, not from a separate subscriber on request.opened:
@@ -5239,6 +5575,8 @@ bus.subscribe((event) => {
             break;
         }
         case "request.resolved": {
+            if (event.requestId)
+                pendingCommandRules.delete(`${event.threadId}:${event.requestId}`);
             // answered (by whoever): the turn is working again, unless it settled
             const waiting = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             if (bot && store.taskByThread(bot.id, event.threadId)?.activity === "waiting-on-you") {
@@ -5296,26 +5634,60 @@ bus.subscribe((event) => {
             // thread nobody types in again (a deleted bot's) is not held forever.
             const internal = isInternalTurn(event.threadId);
             clearInternalTurn(event.threadId);
-            const generatedKey = generatedImageTurnKey(event.threadId, event.turnId);
-            const generated = generatedImagesByTurn.get(generatedKey) ?? [];
-            generatedImagesByTurn.delete(generatedKey);
-            if (generated.length) {
+            const generatedKey = turnAttachmentKey(event.threadId, event.turnId);
+            const generated = turnAttachmentsByTurn.get(generatedKey) ?? [];
+            turnAttachmentsByTurn.delete(generatedKey);
+            // A turn that never completed never lands its half-said note: parked
+            // audio is deleted when the settle is not ok (person stop, provider
+            // failure) rather than posted as if the turn finished (#1742).
+            // Generated images keep their long-standing settle-anyway behavior.
+            for (const attachment of generated) {
+                if (event.ok || attachment.kind !== "audio")
+                    continue;
+                deleteAttachment(attachment.path);
+            }
+            const settled = event.ok || !generated.length
+                ? generated
+                : generated.filter((attachment) => attachment.kind !== "audio");
+            if (settled.length) {
                 const response = [...store.messagesFor(event.threadId)].reverse().find((message) => message.role === "bot" &&
                     message.kind === "text" &&
                     message.turnId === completedTurnId);
+                // A voice note's text is its transcript: the visible caption search,
+                // compaction and notifications read (#1740 decision 3).
+                const transcript = settled
+                    .filter((attachment) => attachment.kind === "audio" && attachment.text)
+                    .map((attachment) => attachment.text.trim())
+                    .filter(Boolean)
+                    .join("\n\n");
+                const staged = settled.map((attachment) => attachment.kind === "audio"
+                    ? { kind: "audio", path: attachment.path, mime: attachment.mime }
+                    : attachment);
                 if (response) {
                     store.patchMessage(event.threadId, response.id, {
-                        attachments: [...(response.attachments ?? []), ...generated],
+                        attachments: [...(response.attachments ?? []), ...staged],
+                        // The note's text is its transcript and stays visible beside a
+                        // written epilogue: the wire audio carries no text, so letting
+                        // the epilogue replace it would erase what was said (#1740
+                        // decision 3).
+                        ...(transcript
+                            ? {
+                                text: [response.text?.trim(), redactSecretsInText(transcript)]
+                                    .filter(Boolean)
+                                    .join("\n\n"),
+                            }
+                            : {}),
                     });
                 }
                 else {
-                    // Some image turns have no textual epilogue. Keep the image as the
-                    // terminal assistant response instead of inventing model words.
+                    // Some turns have no textual epilogue. Keep the attachment as the
+                    // terminal assistant response instead of inventing model words; a
+                    // voice note's own text is the visible transcript there.
                     pushMessage({
                         role: "bot",
                         kind: "text",
-                        text: "",
-                        attachments: generated,
+                        text: transcript,
+                        attachments: staged,
                         turnId: completedTurnId,
                     });
                 }
@@ -5329,7 +5701,13 @@ bus.subscribe((event) => {
             lastReply.delete(event.threadId);
             // A run that broke — not one the person stopped, and not a routine's,
             // which reports through its own failure path — is the Chief's to see.
-            if (!event.ok && event.stopReason !== "interrupted" && !routines?.runForThread(event.threadId)) {
+            // A lazy computer-claim rejection already reported its failure and
+            // interrupted the turn; Claude settles that interrupt as
+            // exit_before_result, not "interrupted", so this generation's marker
+            // keeps the same failure from reporting a second incident.
+            const lazyClaimAlreadyReported = event.stopReason === "exit_before_result" &&
+                turnResourceOwners.get(event.threadId)?.lazyClaimFailureReported === true;
+            if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !routines?.runForThread(event.threadId)) {
                 const broken = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
                 if (broken)
                     reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: event.stopReason?.trim() || "the run ended without a result" });
@@ -5400,6 +5778,8 @@ bus.subscribe((event) => {
                 const measuredSelection = directTurnBots.get(event.threadId)?.modelSelection ?? selection;
                 store.patchTask(bot.id, event.threadId, { lastContextModel: Number.isFinite(lastContext?.tokens) && (lastContext?.tokens ?? 0) > 0
                         ? `${measuredSelection.instanceId}:${measuredSelection.model}` : undefined });
+                const promptBytes = turnPromptBytes.get(event.threadId);
+                turnPromptBytes.delete(event.threadId);
                 bookTurnUsage({
                     botId: bot.id,
                     botName: bot.name,
@@ -5410,6 +5790,7 @@ bus.subscribe((event) => {
                     input: tokens?.input ?? 0,
                     output: tokens?.output ?? 0,
                     ...(typeof tokens?.cachedInput === "number" ? { cachedInput: tokens.cachedInput } : {}),
+                    ...(promptBytes ? { promptBytes } : {}),
                     costUsd: event.cost ?? null,
                     trigger: routineRun
                         ? { kind: "routine", routineId: routineRun.routineId, label: routineRun.routineName }
@@ -5485,6 +5866,8 @@ bus.subscribe((event) => {
                 const tokens = event.usage ?? lastReported;
                 const speakingBot = store.bot(speaker.botId);
                 const selection = speakingBot?.modelSelection;
+                const promptBytes = turnPromptBytes.get(event.threadId);
+                turnPromptBytes.delete(event.threadId);
                 bookTurnUsage({
                     botId: speaker.botId,
                     botName: speaker.name,
@@ -5495,11 +5878,20 @@ bus.subscribe((event) => {
                     input: tokens?.input ?? 0,
                     output: tokens?.output ?? 0,
                     ...(typeof tokens?.cachedInput === "number" ? { cachedInput: tokens.cachedInput } : {}),
+                    ...(promptBytes ? { promptBytes } : {}),
                     costUsd: event.cost ?? null,
                     trigger: routineRun
                         ? { kind: "routine", routineId: routineRun.routineId, label: routineRun.routineName }
                         : turnTriggers.get(event.threadId) ?? { kind: "owner" },
                 });
+                // Appends are asynchronous. Refresh after persistence so the settled
+                // turn appears immediately, without waiting for another message.
+                void flushUsageLedger(DATA_DIR).then(() => {
+                    groupUsageReader.refresh();
+                    const current = store.group(group.id);
+                    if (current)
+                        broadcast({ kind: "group", group: publicGroupState(current) });
+                }).catch(() => { });
                 if (completedTurnId) {
                     void scheduleTurnDigest({
                         botId: speaker.botId, botName: speaker.name,
@@ -6207,8 +6599,12 @@ function drainQueuedSends() {
  * available. Reuse the existing cancellable, idempotent composer queue. */
 async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger) {
     const capacity = botAtThreadCapacity(botId);
-    if (capacity || threadBusy(botId, threadId) || parksBehindCoordination(botId, threadId)) {
-        const reason = capacity ? "capacity" : undefined;
+    // A room turn holds the bot exactly like the sibling opened-thread queue
+    // below: the drain's own block check waits it out, so the words queue
+    // here rather than bounce off startTurn's 409.
+    const groupTurn = activeGroupTurnForBot(botId);
+    if (capacity || threadBusy(botId, threadId) || groupTurn || parksBehindCoordination(botId, threadId)) {
+        const reason = capacity ? "capacity" : groupTurn ? "group-turn" : undefined;
         const queued = queueSteeredMessage(botId, threadId, text, {
             replyToId: replyTo?.id,
             sendId,
@@ -6235,8 +6631,14 @@ async function startOrQueueOpenedThread(botId, threadId, text, unattended) {
     // A room turn holds the bot too (startTurn refuses a direct turn during
     // one); the drain's own block check already waits for it, so the words
     // queue here rather than bounce.
-    if (botAtThreadCapacity(botId) || activeGroupTurnForBot(botId)) {
-        queueSteeredMessage(botId, threadId, text, { reason: "capacity", unattended, peerAsk });
+    const capacity = botAtThreadCapacity(botId);
+    const groupTurn = activeGroupTurnForBot(botId);
+    if (capacity || groupTurn) {
+        queueSteeredMessage(botId, threadId, text, {
+            reason: capacity ? "capacity" : "group-turn",
+            unattended,
+            peerAsk,
+        });
         return { state: "queued", position: queuedThreadPosition(botId, threadId) ?? 1 };
     }
     try {
@@ -6542,11 +6944,12 @@ async function startTurn(botId, text, opts) {
         throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
     }
     const switchedEngine = instance.instanceId !== bot.modelSelection.instanceId;
-    const model = opts?.runOn === "cloud" || switchedEngine ? instance.models.default : bot.modelSelection.model;
-    // a cloud routine borrows the instance default model, so it borrows no
-    // per-bot effort either
-    const effort = opts?.runOn === "cloud" || switchedEngine ? undefined : bot.modelSelection.effort;
-    const variant = opts?.runOn === "cloud" || switchedEngine ? undefined : bot.modelSelection.variant;
+    const useInstanceDefaults = switchedEngine || (opts?.runOn === "cloud" && !instance.adapter.capabilities.cloudComputerMcp);
+    const model = useInstanceDefaults ? instance.models.default : bot.modelSelection.model;
+    // A native cloud runner borrows its instance defaults; a Box bridge keeps
+    // the bot's selected model, effort and variant.
+    const effort = useInstanceDefaults ? undefined : bot.modelSelection.effort;
+    const variant = useInstanceDefaults ? undefined : bot.modelSelection.variant;
     assertModelVariantSupported({ variant, effort }, instance.adapter.capabilities);
     // A selection can be persisted while its engine is offline. Re-check when
     // the engine returns so an old or unsupported value never reaches a CLI.
@@ -6556,7 +6959,7 @@ async function startTurn(botId, text, opts) {
     // an edit hands us its already-branched user message; a plain send appends
     let userMessage = opts?.userMessage;
     if (opts?.editedMessageId) {
-        const edited = store.branchMessage(threadId, opts.editedMessageId, text);
+        const edited = store.branchMessage(threadId, opts.editedMessageId, text, opts.sendId);
         if (!edited)
             throw Object.assign(new Error("only a user text message can be edited"), { status: 400 });
         store.patchTask(bot.id, threadId, { rewound: true });
@@ -6632,6 +7035,12 @@ async function startTurn(botId, text, opts) {
             computerSelectionTurns.set(threadId, { generation: dispatchClaimId, botId: bot.id, source, text });
     }
     store.setTaskActivity(bot.id, threadId, "working");
+    // Watch from admission, not dispatch: a turn can wedge in setup — context
+    // compaction that never returns, a hung browser or VM mount — long before
+    // any provider event exists, and a watch armed only at dispatch never saw
+    // those. Every setup exit below settles or throws into the catch, which
+    // settles under the same generation ownership it already enforces.
+    watchdog.watch(threadId, bot.id);
     // A closed thread that gets a new turn is open again: the person (or the
     // opener) picked it back up, so its row returns to the sidebar and
     // list_threads stops calling it closed. No-op on an open thread.
@@ -6646,6 +7055,16 @@ async function startTurn(botId, text, opts) {
     turnContext.delete(threadId);
     void (async () => {
         try {
+            // Readiness can wait on the network. Admit the task first so its busy
+            // state, Stop action and watchdog own that wait just like VM setup.
+            if (opts?.runOn === "cloud") {
+                const readiness = await cloudRoutineReadiness(botId, threadId);
+                if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId)) {
+                    throw new DirectTurnSetupCancelled("turn stopped during cloud readiness");
+                }
+                if (!readiness.ready)
+                    throw new Error(readiness.reason ?? "The cloud computer is not ready");
+            }
             await compactConversation({ bot, threadId, generation: dispatchClaimId, instance, model,
                 excludedIds: new Set([userMessage.id, ...(opts?.excludeMessageIds ?? [])]), manual: opts?.compactOnly === true });
             if (!directTurnClaimIsCurrent(bot.id, dispatchClaimId, threadId))
@@ -6656,6 +7075,7 @@ async function startTurn(botId, text, opts) {
                 settleDirectFollowup(dispatchClaimId);
                 releaseTurnResources(resourceOwner);
                 store.setTaskActivity(bot.id, threadId, "idle");
+                watchdog.settle(threadId);
                 directTurnBots.delete(threadId);
                 retryDelegationsWaitingOn(bot.id);
                 drainQueuedSends();
@@ -6752,7 +7172,7 @@ async function startTurn(botId, text, opts) {
                     rewound,
                     fresh: fresh || contextReset,
                     externallyUpdated: Boolean(externalContextMarker) || handedStale,
-                    replaysNatively: instance.driverKind === "grok",
+                    replaysNatively: NATIVELY_REPLAYING_DRIVER_KINDS.includes(instance.driverKind),
                 });
                 // Snapshot the cursor alongside the context decision. An external result
                 // can arrive during async computer/setup work and clear the task cursor;
@@ -6808,9 +7228,7 @@ async function startTurn(botId, text, opts) {
                 ...(skillAuthoring ? ["skillAuthoring"] : []),
             ], availableSkills());
             if (selectedSkills.some((skill) => skill.manifest.requiredCapabilities.includes("phoneMcp"))) {
-                if (!claimTurnResource(resourceOwner, "computer:phone"))
-                    throw new Error("another thread is using the phone — wait for it to finish");
-                integrations.phone = phoneIntegration();
+                integrations.phone = phoneIntegration(bot.id, threadId, dispatchClaimId);
             }
             // the user's connected apps, but only to a driver that can mount
             // them — a key in the config says the connections exist, not that
@@ -6875,9 +7293,7 @@ async function startTurn(botId, text, opts) {
             const teamComputer = inheritedTeamComputer(bot);
             const cloudBackend = teamComputer || opts?.runOn === "cloud" || bot.cloudBackend !== "vps" ? "box" : "vps";
             const mountsComputerMcp = instance.adapter.capabilities.computerMcp === true;
-            // Box's native runner owns its computer tools. Local drivers mount
-            // Local VM/VPS tools, but have no Box relay to execute this descriptor.
-            const mountsCloudComputer = instance.driverKind === "boxAgent";
+            const mountsCloudComputer = instance.driverKind === "boxAgent" || instance.adapter.capabilities.cloudComputerMcp === true;
             const mountsLocalComputer = instance.adapter.capabilities.localComputerMcp === true;
             // Where this turn's hands may land. The bot's "Works on" choice is
             // strict; a browser-only bot gets no computer at all, and a bot whose
@@ -6988,6 +7404,32 @@ async function startTurn(botId, text, opts) {
                 previewCapture = localVmPreviewFor(localVmTarget, claimThreadId);
                 return { target: localVmTarget, runtime: localVm.runtime };
             };
+            // Issue #1369: a lazy claim that rejects must not leave its turn busy
+            // behind a gate that can only refuse. Surface the terminal
+            // computer-unavailable error, then end the turn. Fenced to this
+            // dispatch generation and a still-busy thread, so a rejection landing
+            // after settle — or after a newer turn owns the thread — never touches
+            // the newer turn. The gate's refusals stay fail-closed for any screen
+            // call racing this teardown; the turn-failed buzz and incident follow
+            // the dispatch-failure rules (person-started turns only).
+            const surfaceLazyClaimRejection = (label) => (failure) => {
+                if (activeInternalGenerationByThread.get(threadId) !== resourceOwner.generation || !threadBusy(bot.id, threadId))
+                    return;
+                const message = `computer unavailable — ${label} could not be claimed for this turn (${failure})`;
+                store.appendMessage(threadId, {
+                    role: "bot",
+                    kind: "activity",
+                    tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
+                });
+                if (opts?.automationSource === undefined && !opts?.commsDepth && !opts?.cardContinuation) {
+                    notify(buildNotification("turn-failed", bot, threadId, redactSecretsInText(message), { avatarUrl: bot.avatarUrl }));
+                    reportIncident({ kind: "could-not-start", bot, threadId, detail: message });
+                    // Claude settles the interrupt below as exit_before_result; the
+                    // completion fold must not report this failure a second time.
+                    resourceOwner.lazyClaimFailureReported = true;
+                }
+                void interruptDirectThread(bot.id, threadId).catch(() => { });
+            };
             // Explicit destinations are strict. In particular, Local VM must never
             // fall through to host CUA and accidentally click on the user's Mac.
             // The Local VM attach, shared by explicit "Local VM" and by Auto. Explicit
@@ -7030,6 +7472,7 @@ async function startTurn(botId, text, opts) {
                             owner: resourceOwner,
                             lazy: true,
                             label: "the Local VM",
+                            onRejected: surfaceLazyClaimRejection("the Local VM"),
                             claim: async () => {
                                 await claimAutoLocalVm(threadId, localVmTarget);
                                 // The dispatch-site poller start saw a null previewCapture
@@ -7108,6 +7551,7 @@ async function startTurn(botId, text, opts) {
                                 startScreenPoller(bot.id, threadId, { computer: vpsCapture, ...(browserCapture ? { browser: browserCapture } : {}) }, { screenIsTheWork: touched });
                             }
                         },
+                        onRejected: surfaceLazyClaimRejection("the VPS computer"),
                     });
                     if ("integration" in mounted) {
                         integrations.localComputer = mounted.integration;
@@ -7122,8 +7566,8 @@ async function startTurn(botId, text, opts) {
                     }
                 }
             }
-            // Cloud is strict when selected. Only the native Box engine can reuse
-            // a Box on Auto; local engines have no relay for its desktop tools.
+            // Cloud is strict when selected. Native Box and drivers with a Box
+            // bridge may also reuse an already-ready Box on Auto.
             if (teamComputer) {
                 const attached = await attachTeamBox(teamComputer, bot.id, resourceOwner, mountsCloudComputer, instance.driverKind === "boxAgent");
                 integrations.computer = attached.integration;
@@ -7303,11 +7747,12 @@ async function startTurn(botId, text, opts) {
             }
             // An Auto conversation remembers where its first turn landed, so later
             // turns stay there and the composer can show it. Explicit settings are
-            // not recorded: changing the bot's Works on should move its threads.
+            // not recorded: an auto pin yields to a later Works on change (which
+            // sweeps it — store.clearAutoSurfacePins); a person's pin does not.
             if (bot.computer === undefined && !teamComputer && opts?.runOn !== "cloud" && !plan.pinned) {
                 const used = mountedComputer ?? (integrations.browser ? "browser" : null);
                 if (used)
-                    store.patchTask(bot.id, threadId, { surface: used });
+                    store.patchTask(bot.id, threadId, { surface: used, surfaceSource: "auto" });
             }
             const computerSelection = computerSelectionTurns.get(threadId);
             if (computerSelection)
@@ -7320,11 +7765,10 @@ async function startTurn(botId, text, opts) {
             if (!markDirectTurnDispatching(bot.id, dispatchClaimId, threadId)) {
                 throw new DirectTurnSetupCancelled("turn stopped before dispatch");
             }
-            watchdog.watch(threadId, bot.id);
             const computerPromptKind = computerKind === "vm"
                 ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared"
                 : computerKind === "box"
-                    ? instance.driverKind === "boxAgent" ? "box-agent" : "box"
+                    ? instance.driverKind === "boxAgent" ? "box-agent" : instance.adapter.capabilities.cloudComputerMcp ? "box-chat" : "box"
                     : computerKind === "vps"
                         ? "vps"
                         : computerKind === "local"
@@ -7335,6 +7779,7 @@ async function startTurn(botId, text, opts) {
                 throw new DirectTurnSetupCancelled("Coordination access changed before dispatch");
             }
             const prompt = buildSystemPrompt(persona, liveBot?.soul ?? bot.soul ?? "", [
+                { id: "user-profile", label: "About the user", text: userProfileSystemPrompt(cfg.profile) },
                 // first after the soul: the block names agent tools, so it only goes
                 // to a turn whose engine actually mounted them (setupMode is already
                 // false when they are not — see agentsMounted above)
@@ -7368,6 +7813,7 @@ async function startTurn(botId, text, opts) {
                 { id: "webhook", label: "Webhook provenance", text: opts?.automationSource === "webhook" ? WEBHOOK_PROMPT : "" },
                 { id: "mentions", label: "Mentions", text: boundedCoordination && tagged.length ? `The user named these existing teammates: ${tagged.map(b => `${peerName(b.name)} (${b.id})`).join(", ")}. Use coordinate_bots when their contribution is needed; do not substitute native helper agents for these bots.` : mentionPrompt(tagged) },
             ]);
+            turnPromptBytes.set(threadId, { stable: Buffer.byteLength(prompt.stable), volatile: Buffer.byteLength(prompt.volatile) });
             runningTurnEngines.set(threadId, instance);
             // The prompt carries the soul as saved now. If it changed during setup,
             // decide again from what is actually sent — except on a continuation
@@ -7409,6 +7855,9 @@ async function startTurn(botId, text, opts) {
                 system: prompt.text,
                 systemStable: prompt.stable,
                 systemVolatile: prompt.volatile,
+                // the mentions half describes this turn: identical consecutive tags
+                // must still deliver their note (SendTurnInput.mentionTurn)
+                mentionTurn: tagged.length > 0,
                 integrations,
                 mcpFromUserConfig: claudeUserMcpEnabled(cfg) && !managedPolicy.restrictsMcp(),
                 cwd,
@@ -7507,12 +7956,15 @@ async function startTurn(botId, text, opts) {
             if (!ownsLatestGeneration)
                 return;
             const message = e instanceof Error ? e.message : String(e);
-            store.appendMessage(threadId, {
-                role: "bot",
-                kind: "activity",
-                turnSucceeded: false,
-                tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
-            });
+            // The wait already wrote its failure resolution; keep all dispatch
+            // failure bookkeeping below without adding the same error twice.
+            if (!(e instanceof ComputerWaitGaveUp))
+                store.appendMessage(threadId, {
+                    role: "bot",
+                    kind: "activity",
+                    turnSucceeded: false,
+                    tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
+                });
             // Worth a buzz for the same reason a routine failure is, and the rule
             // notify.ts encodes: the bot is not working, and the cause is usually
             // a setting only a person can change — an unattended user would
@@ -7791,8 +8243,9 @@ routines = new RoutineManager({
             handoffs.forget(threadId);
         }
     },
-    startTurn: (botId, threadId, prompt, runOn, triggerSource, onDispatchError) => startTurn(botId, prompt, { threadId, runOn, automationSource: triggerSource, onDispatchError })
-        .then(() => undefined),
+    startTurn: async (botId, threadId, prompt, runOn, triggerSource, onDispatchError) => {
+        await startTurn(botId, prompt, { threadId, runOn, automationSource: triggerSource, onDispatchError });
+    },
     startGoal: async (groupId, threadId, prompt, coordinatorBotId, runId, _onDispatchError) => {
         startGroupTurn(groupId, prompt, undefined, undefined, "goal", undefined, {
             threadId,
@@ -7843,6 +8296,23 @@ routines = new RoutineManager({
         notify(buildNotification("routine-deferred", notificationBot, routineSourceThread(run) ?? bot.threadId, detail));
     },
 });
+orgLibrary = new OrgLibrary({
+    dataDir: DATA_DIR,
+    store,
+    routines: routines,
+    skills: { list: listSkills, stamps: skillPackageStamps, setEnabled: setSkillEnabled, installOrg: installOrgSkill },
+    presets: presetStore,
+    // Runtime → Electron main, which posts the report to Admin. Plain Node
+    // (no parentPort) keeps it in memory only.
+    postState: (message) => utilityParentPort?.postMessage(message),
+});
+{
+    // Set by the port listener above, which TypeScript cannot see run first.
+    const early = pendingOrgLibraryRelay;
+    if (early)
+        orgLibrary.applyRelay(early.library);
+    pendingOrgLibraryRelay = null;
+}
 // The scheduler receipt and room transcript live in separate durable stores.
 // If the process exited between those two writes, prefer the correlated
 // RoutineRun's terminal truth; an uncorrelated manual goal is simply failed
@@ -7885,27 +8355,37 @@ if (recoveryOwners.length > 0) {
 // Chat tools can prepare routine changes, but the harness applies them only
 // after the user confirms a durable card. Keeping this beside the scheduler
 // makes the card resolvable after an app restart without involving the model.
-async function cloudRoutineReadiness() {
+async function cloudRoutineReadiness(botId, threadId) {
+    const bot = threadId ? store.projectBotForTask(botId, threadId) : store.bot(botId);
+    if (!bot || bot.hidden)
+        return { ready: false, reason: "The routine's target bot no longer exists." };
     if (!box.boxConfigured(cfg)) {
         return {
             ready: false,
-            reason: 'The Box-hosted agent needs a working Box API key. For the bot’s existing model and configured computer, including a self-hosted VPS, set run_on="maus" instead. Do not request a Box key unless the user actually wants the Box-hosted agent.',
+            reason: 'The Box cloud computer needs a working Box API key. For the bot’s configured computer, including a self-hosted VPS, set run_on="maus" instead.',
         };
     }
-    const instance = registry.instances().find((candidate) => candidate.driverKind === "boxAgent");
-    if (!instance) {
+    const instance = turnInstance(bot, "cloud", threadId);
+    if (!instance)
         return { ready: false, reason: "The Cloud VM runner is unavailable. Restart OpenMausBot and try again." };
-    }
     try {
-        const snapshot = await instance.snapshot();
-        return snapshot.state === "available"
-            ? { ready: true }
-            : { ready: false, reason: snapshot.reason || "The Cloud VM runner is not ready." };
+        if ((await instance.snapshot()).state !== "available") {
+            return { ready: false, reason: "The target bot's model engine is not ready to use the Box cloud computer." };
+        }
+        const teamComputer = inheritedTeamComputer(bot);
+        const ownerId = teamComputer ? teamComputerOwner(teamComputer.id) : bot.id;
+        const machine = await box.findBox(cfg, ownerId);
+        if (teamComputer && !machine) {
+            return { ready: false, reason: "The team's Box computer is missing; explicitly create or retry it from the Team map." };
+        }
+        // Explicit Cloud may provision or wake the bot's own Box at dispatch.
+        // This probe only checks its identity/account, without starting billing.
+        return { ready: true };
     }
     catch (error) {
         return {
             ready: false,
-            reason: `The Cloud VM runner could not be checked: ${error instanceof Error ? error.message : String(error)}`,
+            reason: `The target bot's cloud computer could not be checked: ${redactSecretsInText(error instanceof Error ? error.message : String(error))}`,
         };
     }
 }
@@ -7965,7 +8445,7 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
     const botBoxDeletions = boxDeletionSnapshot().filter((entry) => entry.ownerBotId === bot.id);
     if (botBoxRecovery.some((entry) => !entry.resolved)) {
         return deletionResponse(409, {
-            error: "finish reconciling this bot's pending cloud computer creation before deleting it — check ascii.dev, then retry Box setup",
+            error: "finish reconciling this bot's pending cloud computer creation before deleting it — check boat.dev, then retry Box setup",
         });
     }
     // Bot deletion awaits VM/browser/provider cleanup. Claim the bot and
@@ -8083,7 +8563,7 @@ async function deleteBotWithLifecycle(botId, revalidate = () => { }, setupReques
             // Deletion removes the thread before a late turn.completed can fold
             // staged provider images into a message, so dispose them here.
             for (const task of store.tasks(bot.id)) {
-                purgeGeneratedImagesForThread(task.threadId);
+                purgeTurnAttachmentsForThread(task.threadId);
                 clearTurnDigestState(task.threadId);
                 settleDirectFollowup(directTurnGenerationByThread.get(task.threadId));
                 directTurnGenerationByThread.delete(task.threadId);
@@ -8645,6 +9125,8 @@ setupRetry = 0) {
     let retainRoomVmLease = false;
     let roomSpeaker;
     let providerDispatched = false;
+    let setupStalled = false;
+    let unregisterSetupStall = () => { };
     // The speaker's own This computer / Cloud mount, and what it must give back.
     let roomComputerKind = null;
     let roomVpsBotId = null;
@@ -8696,9 +9178,7 @@ setupRetry = 0) {
         const skills = availableSkills();
         const selectedSkills = mergeSkills(selectBundledSkills(roomContext, instance.adapter.capabilities.phoneMcp === true ? ["phoneMcp"] : [], skills), selectBundledSkills(latestUser?.text ?? "", skillAuthoring ? ["skillAuthoring"] : [], skills));
         if (selectedSkills.some((skill) => skill.manifest.requiredCapabilities.includes("phoneMcp"))) {
-            if (!claimTurnResource(resourceOwner, "computer:phone"))
-                throw new Error("another thread is using the phone — wait for it to finish");
-            integrations.phone = phoneIntegration();
+            integrations.phone = phoneIntegration(bot.id, threadId, internalGeneration);
         }
         try {
             if (bot.composio !== false && composio.configured(cfg) && instance.adapter.capabilities.composioMcp === true) {
@@ -8822,6 +9302,22 @@ setupRetry = 0) {
         groupSpeakers.set(threadId, roomSpeaker);
         store.patchGroup(readyGroup.id, { busyBotId: bot.id });
         orchestration?.onClaimed?.();
+        // The stall completion handler only exists once the provider turn runs
+        // (registered at dispatch below), but this watch is armed at claim. Latch
+        // a stall that fires during setup — browser, box, and VM mounts can all
+        // wedge — so the dispatch site completes the turn instead of launching a
+        // provider turn the person was already told was stopped. The finally
+        // below unregisters the latch on every other exit.
+        setupStalled = false;
+        unregisterSetupStall = roomStallCompletions.register(threadId, () => {
+            setupStalled = true;
+        });
+        // Watch from claim, not provider dispatch: room setup (connected-app
+        // discovery, browser, box, and VM mounts) can wedge before any provider
+        // event exists. The exits between here and dispatch either throw into the
+        // finally's guarded cleanup or return through the revalidation block,
+        // both of which settle the watch.
+        watchdog.watch(threadId, bot.id);
         // Connected-app discovery above can yield for a network round trip. A
         // profile may be removed, or the browser feature switched off, during that
         // window. Mint the capability only after this turn has synchronously
@@ -8867,7 +9363,7 @@ setupRetry = 0) {
             return false;
         }
         if (roomTeamComputer) {
-            const attached = await attachTeamBox(roomTeamComputer, readyBot.id, resourceOwner, instance.driverKind === "boxAgent", instance.driverKind === "boxAgent");
+            const attached = await attachTeamBox(roomTeamComputer, readyBot.id, resourceOwner, instance.driverKind === "boxAgent" || instance.adapter.capabilities.cloudComputerMcp === true, instance.driverKind === "boxAgent");
             if (isCancelled?.() || groupSpeakers.get(threadId) !== roomSpeaker ||
                 activeInternalGenerationByThread.get(threadId) !== internalGeneration)
                 return false;
@@ -8913,7 +9409,8 @@ setupRetry = 0) {
                 if (!box.boxConfigured(cfg))
                     throw new Error("Cloud box is not configured — add a Box API key or choose Local VM");
                 const remoteAgent = instance.driverKind === "boxAgent";
-                const attached = await attachBotBox(readyBot, resourceOwner, { explicitCloud: true, canMount: remoteAgent, remoteAgent });
+                const attached = await attachBotBox(readyBot, resourceOwner, { explicitCloud: true,
+                    canMount: remoteAgent || instance.adapter.capabilities.cloudComputerMcp === true, remoteAgent });
                 if (!roomSetupIsCurrent())
                     return false;
                 if (!attached?.integration)
@@ -9048,9 +9545,10 @@ setupRetry = 0) {
             }
         }
         const roomSystem = buildSystemPrompt(system, store.bot(bot.id)?.soul ?? bot.soul ?? "", [
+            { id: "user-profile", label: "About the user", text: userProfileSystemPrompt(cfg.profile) },
             { id: "files", label: "File locations", text: workspace ? workspaceLocationsPrompt(bot.id, cwd, readyBot.cwd) : "" },
             { id: "mcp", label: "MCP servers", text: customMcpPrompt(Object.keys(integrations.custom ?? {})) },
-            { id: "computer", label: "Computer", text: computerPrompt(roomTeamComputer || roomComputerKind === "box" ? instance.driverKind === "boxAgent" ? "box-agent" : "box" : roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : roomComputerKind) },
+            { id: "computer", label: "Computer", text: computerPrompt(roomTeamComputer || roomComputerKind === "box" ? instance.driverKind === "boxAgent" ? "box-agent" : instance.adapter.capabilities.cloudComputerMcp ? "box-chat" : "box" : roomVmTarget ? localVmMode(cfg) === "per-bot" ? "vm-private" : "vm-shared" : roomComputerKind) },
             { id: "team-computer", label: "Team computer", text: teamComputerPrompt(roomTeamComputer) },
             { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : surfaceOfComputerKind(roomComputerKind), browser: Boolean(integrations.browser) }, { note: roomPlan.note }) },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
@@ -9089,6 +9587,7 @@ setupRetry = 0) {
                 store.setActivity(bot.id, "idle");
                 retryDelegationsWaitingOn(bot.id);
             }
+            watchdog.settle(threadId);
             return false;
         }
         let replyText = "";
@@ -9157,13 +9656,27 @@ setupRetry = 0) {
                     deadline.setWaitingOnHuman(false);
             });
             deadline.start();
+            // Swap the setup latch for the real completion handler. The swap is
+            // synchronous with the dispatch below, so no stall can fall between
+            // them. A stall latched during setup completes the turn here without a
+            // provider turn: the stopped message is already on the thread, and the
+            // watchdog's bounded cleanup owns releasing the claim.
+            unregisterSetupStall();
+            if (setupStalled) {
+                // No provider turn was launched, so there is no ambiguous event
+                // window to quarantine: marking a cancelled handshake here would
+                // strand the next turn behind its TTL for no benefit. The readiness
+                // stop path above skips the mark for the same reason.
+                finish("stalled");
+                return;
+            }
             unregisterStall = roomStallCompletions.register(threadId, () => {
                 abandonProviderTurn();
                 finish("stalled");
             });
-            watchdog.watch(threadId, bot.id);
             onProviderHandshakeStarted?.();
             providerDispatched = true;
+            turnPromptBytes.set(threadId, { stable: Buffer.byteLength(roomSystem.stable), volatile: Buffer.byteLength(roomSystem.volatile) });
             runningTurnEngines.set(threadId, instance);
             guardTurnDispatch(instance.adapter.sendTurn({
                 threadId,
@@ -9379,11 +9892,12 @@ setupRetry = 0) {
         if (!roomSpeaker && !isSpendCap && !isVariantError)
             throw error;
         const message = error instanceof Error ? error.message : "Local VM setup failed";
-        store.appendMessage(threadId, {
-            role: "bot", kind: "activity",
-            from: { botId: bot.id, name: bot.name, color: bot.color },
-            tool: { name: `error: ${message}`, ok: false },
-        });
+        if (!(error instanceof ComputerWaitGaveUp))
+            store.appendMessage(threadId, {
+                role: "bot", kind: "activity",
+                from: { botId: bot.id, name: bot.name, color: bot.color },
+                tool: { name: `error: ${message}`, ok: false },
+            });
         onDispatchError?.(message);
         if (orchestration) {
             // A spend-cap refusal is deterministic: record it as its own
@@ -9398,12 +9912,14 @@ setupRetry = 0) {
     finally {
         // Covers connector/setup failures, cancellation before dispatch, and all
         // other early returns that never produce a provider terminal event.
+        unregisterSetupStall();
         revokeInternalCapabilityGeneration(threadId, internalGeneration);
         roomHandoffs.sourceSettled(internalGeneration, roomHandoffSourceSucceeded);
         if (!retainRoomVmLease)
             releaseRoomVmLease();
         if (!providerDispatched && roomSpeaker && groupSpeakers.get(threadId) === roomSpeaker) {
             groupSpeakers.delete(threadId);
+            watchdog.settle(threadId);
             if (store.group(group.id)?.busyBotId === bot.id)
                 store.patchGroup(group.id, { busyBotId: null });
             if (store.bot(bot.id)?.busy) {
@@ -10015,7 +10531,7 @@ function roomPostEligibility(bot, group) {
     }
     const outsider = group.memberIds
         .map((id) => store.bot(id))
-        .find((member) => member && !canAccessTeam(bot, member.section));
+        .find((member) => member && !canAccessTeam(bot, member.section) && !coordinatorSupervises(member, bot));
     if (outsider) {
         return {
             ok: false,
@@ -10804,6 +11320,7 @@ function configStatus() {
     const eventLogRetentionDays = threadEventLogRetentionDays(cfg);
     return {
         xai: { configured: Boolean(cfg.xai?.key) },
+        mistral: { configured: Boolean(cfg.mistral?.key) },
         anthropic: { configured: Boolean(cfg.anthropic?.key) },
         // a fleet agent on this server means Settings → Workspaces has something to drive
         fleet: { available: fleetAvailable(fleetSocketPath()) },
@@ -10831,12 +11348,14 @@ function configStatus() {
         tts: tts.describeVoice(cfg),
         imageGen: avatarImageStatus(cfg),
         // not a secret — the sidebar shows it
-        profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "" },
+        profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "" },
         // the enrolled organisation's read-only desktop policy; null when not enrolled
         managedPolicy: managedPolicy.summary(),
         // not a secret — the settings picker shows it; "" = follow the system
         language: cfg.language ?? "",
         rooms: { turnTimeoutMinutes: roomTurnTimeoutMinutes(cfg) },
+        // absent effort = no level is sent, so clients can tell it from any level
+        newBots: cfg.newBots?.effort ? { effort: cfg.newBots.effort } : {},
         threads: {
             maxConcurrentPerBot: maxConcurrentBotThreads(cfg),
             ...(eventLogMaxBytes !== null ? { eventLogMaxBytes } : {}),
@@ -11235,6 +11754,7 @@ const workspaceBackupRoutes = createWorkspaceBackupRoutes({
 // Route modules (server/routes/README.md). `workspaceAccess` is assigned at
 // boot, after this line, so the dependency reads it per request.
 ROUTES.push(createHostedSlackRoutes({ bot: (id) => store.bot(id), hostedReady: () => Boolean(workspaceAccess) && entitled("admin") }));
+ROUTES.push(createBotPresetRoutes({ presets: presetStore, orgStatuses: readOrgInstallStatuses }));
 const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
@@ -11659,6 +12179,21 @@ const handleRequest = async (req, res) => {
         // through a per-process high-entropy test key. The route does not exist
         // unless the launcher explicitly sets that key; production builds never
         // set it.
+        // Isolated fixtures have no Electron parent to relay an organization's
+        // library, so a test relays one here instead. Like the capability route
+        // below, it exists only when the launcher sets its high-entropy key.
+        if (method === "POST" && path === "/api/testing/org-library") {
+            const expected = Buffer.from(process.env.OMB_TEST_ORG_LIBRARY_KEY ?? "");
+            const header = req.headers["x-openmausbot-test-org-library"];
+            const actual = Buffer.from(Array.isArray(header) ? "" : String(header ?? ""));
+            if (expected.length < 32 || actual.length !== expected.length || !timingSafeEqual(actual, expected) || !orgLibrary) {
+                return json(res, 404, { error: "not found" });
+            }
+            const body = await readBody(req);
+            const applied = orgLibrary.applyRelay(body?.library ?? null);
+            await orgLibrary.settled();
+            return json(res, applied.ok ? 200 : 400, { ...applied, report: orgLibrary.lastReport() });
+        }
         if (method === "POST" && path === "/api/testing/internal-capability") {
             const expected = process.env.OMB_TEST_INTERNAL_CAPABILITY_KEY ?? "";
             const actual = Array.isArray(req.headers["x-openmausbot-test-capability"])
@@ -11708,11 +12243,13 @@ const handleRequest = async (req, res) => {
                 ? "hooks"
                 : path === "/api/internal/browser/mcp"
                     ? "browser"
-                    : path.startsWith("/api/internal/connectors/")
-                        ? "connectors"
-                        : path === "/api/internal/computer-control"
-                            ? "computer"
-                            : "agents";
+                    : path === "/api/internal/phone/claim"
+                        ? "phone"
+                        : path.startsWith("/api/internal/connectors/")
+                            ? "connectors"
+                            : path === "/api/internal/computer-control"
+                                ? "computer"
+                                : "agents";
             if (internalCapability.kind !== requiredCapabilityKind) {
                 return json(res, 403, { error: "this internal capability cannot access that service" });
             }
@@ -11870,6 +12407,17 @@ const handleRequest = async (req, res) => {
                 requireActiveInternalCapability();
                 return json(res, 200, { result });
             }
+            if (method === "POST" && path === "/api/internal/phone/claim") {
+                // Lazy phone exclusivity (issue #1663): the turn holds computer:phone
+                // from its first real tool call until it settles. The proxy answers a
+                // conflict as a blocked tool result, so a concurrent caller waits or
+                // does other work instead of losing the whole turn.
+                requireActiveInternalCapability();
+                if (!claimTurnResource(internalCapability, "computer:phone")) {
+                    return json(res, 409, { error: "another thread is using the phone" });
+                }
+                return json(res, 200, { claimed: true });
+            }
             // Off by default: both fall through to the same "unknown internal
             // endpoint" 404 a never-implemented route returns.
             if (method === "GET" && path === "/api/internal/shared-computers" && sharedComputersEnabled(cfg))
@@ -12157,7 +12705,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 200, {
                     teams: teamSetupTeams().filter((name) => canAccessTeam(chief, name)),
                     bots: store.bots.filter((bot) => !bot.hidden && canAccessTeam(chief, bot.section) && (bot.id === chief.id || peerAllowed(chief, bot)))
-                        .map((bot) => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section ?? "", modelSelection: bot.modelSelection })),
+                        .map((bot) => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section ?? "", modelSelection: bot.modelSelection, chiefOfStaff: Boolean(bot.chiefOfStaff) })),
                     instances: instances.map((instance) => ({ instanceId: instance.instanceId, driverKind: instance.driverKind, displayName: instance.displayName,
                         state: instance.snapshot.state, models: instance.models, effortLevels: instance.capabilities?.effortLevels ?? [] })),
                     scope: "Bot model defaults apply to groups and new threads; existing threads retain their models. Full Access applies requested team setup immediately; other modes return a review card. Existing unauthorized teams remain outside this Chief's scope.",
@@ -12497,14 +13045,14 @@ const handleRequest = async (req, res) => {
                 //
                 // per-bot approval gate: a chief-of-staff bot without this on is
                 // free to coordinate; one with it on must wait for a human card
-                // (15-min timeout → deny) before its peer turn starts. The channel
+                // (15-min timeout → expired) before its peer turn starts. The channel
                 // and the chips are created only AFTER the verdict, so a denied
                 // contact leaves no trace of an exchange that never happened.
                 if (peerReviewRequired(from, fromThreadId)) {
                     const verdict = await requestPeerApproval(approvalBus, from, target, message, "ask_bot", fromThreadId);
                     requireActiveInternalCapability();
                     if (verdict !== "allow")
-                        return json(res, 200, { error: "denied by user" });
+                        return json(res, 200, peerApprovalFailure(verdict));
                     // The card may have been open for minutes. Re-read both records so
                     // deleted bots cannot recreate transcripts through stale objects.
                     const freshFrom = store.bot(fromBotId);
@@ -12614,7 +13162,12 @@ const handleRequest = async (req, res) => {
                         if (!sender || (target && !canReachPeer(sender, target))) {
                             return json(res, 403, { error: "Result withheld: team access changed while the teammate was working" });
                         }
-                        return json(res, 200, { status: receipt.status, toBotName: receipt.toBotName, result: receipt.result ?? "" });
+                        return json(res, 200, {
+                            status: receipt.status, toBotName: receipt.toBotName, result: receipt.result ?? "",
+                            ...(receipt.approvalOutcome ? {
+                                approvalOutcome: receipt.approvalOutcome, approvalSource: receipt.approvalSource,
+                            } : {}),
+                        });
                     }
                     const stillQueued = pendingDelegationInfo(taskId);
                     const runningEntry = [...delegationWatch.entries()].find(([, watch]) => watch.taskId === taskId);
@@ -12841,8 +13394,15 @@ const handleRequest = async (req, res) => {
                     if (peerReviewRequired(internalSender, address.threadId)) {
                         const verdicts = await Promise.all(targets.map(target => requestPeerApproval(approvalBus, internalSender, store.bot(target.botId), parsed.data.message, "delegate_bot", address.threadId)));
                         requireActiveInternalCapability();
-                        if (verdicts.some(verdict => verdict !== "allow"))
-                            return json(res, 403, { error: "Denied by user; no work sent." });
+                        const blocked = verdicts.flatMap((verdict, index) => verdict === "allow" ? []
+                            : [{ botId: targets[index].botId, ...peerApprovalFailure(verdict) }]);
+                        if (blocked.length)
+                            return json(res, 403, {
+                                error: blocked.every(failure => failure.approvalOutcome === "deny")
+                                    ? "Denied by user; no work sent."
+                                    : `${blocked.map(failure => failure.error).join("; ")}; no work sent.`,
+                                approvals: blocked,
+                            });
                         approvalGranted = true;
                     }
                     const accepted = [];
@@ -12878,7 +13438,7 @@ const handleRequest = async (req, res) => {
                                     grantDelegatedFullAccess(internalSender, store.bot(target.botId), target.threadId);
                                 }
                             }
-                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "");
+                            const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", destination ? parsed.data.requestKey : undefined);
                             // A re-dispatched request_key is answered by the request it
                             // already made, so a thread resolved for the retry (the pair
                             // conversation was busy with that very request) goes back
@@ -12998,7 +13558,7 @@ const handleRequest = async (req, res) => {
                     const verdict = await requestPeerApproval(approvalBus, from, { id: room.id, name: room.name }, message, "post_to_room", fromThreadId);
                     requireActiveInternalCapability();
                     if (verdict !== "allow")
-                        return json(res, 200, { error: "denied by user" });
+                        return json(res, 200, peerApprovalFailure(verdict));
                     // The card may have been open for minutes. Re-read both records so a
                     // roster change, a section move, or a deletion during that window
                     // cannot be posted through on a stale decision.
@@ -13219,6 +13779,26 @@ const handleRequest = async (req, res) => {
                 if (instructions.length > 1_000) {
                     return json(res, 400, { error: "instructions must be at most 1000 characters" });
                 }
+                let selection;
+                if (body.modelSelection === undefined) {
+                    selection = await defaultSelection();
+                }
+                else {
+                    const checked = checkedModelSelection(body.modelSelection, undefined, true);
+                    if (!checked.ok)
+                        return json(res, checked.status, { error: checked.error });
+                    selection = checked.selection;
+                }
+                if (hostedModels && !hostedModels.allows(selection))
+                    return json(res, 400, { error: hostedModels.error() });
+                // Discovery can yield; check current authority and capacity again before writing.
+                if (store.bot(chief.id) !== chief || chief.hidden || !chief.chiefOfStaff || !connectorThread(chief.id, fromThreadId)) {
+                    return json(res, 403, { error: "only an active Chief of Staff can create operator bots" });
+                }
+                if (internalCapability.createdBots >= 4)
+                    return json(res, 429, { error: "you can create at most 4 bots in one turn" });
+                if (store.bots.length >= MAX_WORKSPACE_BOTS)
+                    return json(res, 409, { error: `this workspace is limited to ${MAX_WORKSPACE_BOTS} bots` });
                 const duplicate = store.bots.find((candidate) => !candidate.hidden &&
                     sectionKey(candidate.section) === sectionKey(chief.section) &&
                     candidate.name.trim().toLowerCase() === name.toLowerCase());
@@ -13229,13 +13809,14 @@ const handleRequest = async (req, res) => {
                     name,
                     title: role,
                     description: instructions,
-                    modelSelection: { ...chief.modelSelection },
+                    modelSelection: selection,
                     section: chief.section,
                     // exactly the Chief's audience: a restricted Chief never makes a bot everyone sees
                     ...(chief.visibility ? { visibility: chief.visibility } : {}),
                 }, { seedMessages: false });
                 const safeBot = store.patchBot(created.id, {
                     composio: false,
+                    connectorTools: {},
                     autoApprove: false,
                     approvePeerComms: false,
                 });
@@ -13246,6 +13827,7 @@ const handleRequest = async (req, res) => {
                     title: safeBot.title,
                     section: safeBot.section || "General",
                     model: safeBot.modelSelection.model,
+                    modelSelection: safeBot.modelSelection,
                 });
             }
             if (method === "POST" && (path === "/api/internal/create-room" || path === "/api/internal/manage-room")) {
@@ -13369,6 +13951,47 @@ const handleRequest = async (req, res) => {
                 });
                 return json(res, 201, { messageId: message.id, label: target.label });
             }
+            if (method === "POST" && path === "/api/internal/voice-note") {
+                const body = await readInternalBody();
+                const text = typeof body.text === "string" ? body.text.trim() : "";
+                if (!text)
+                    return json(res, 400, { error: "text required" });
+                if (text.length > 1000)
+                    return json(res, 413, { error: "voice notes are limited to 1000 characters" });
+                // Advertisement is presentation only; the capability is re-checked
+                // here so a call that reaches an unconfigured workspace answers with
+                // the setup guidance instead of a provider failure.
+                const voiceBot = botForThread(internalSender.id, internalCapability.threadId) ?? internalSender;
+                try {
+                    const audio = await tts.speak(cfg, text, voiceBot.voice);
+                    // Synthesis can outlive its turn: a stop or settle during the await
+                    // revokes the capability and clears the live turn. Re-check both
+                    // before saving so the clip cannot park under the :active fallback
+                    // or onto a later turn's key (#1742).
+                    requireActiveInternalCapability();
+                    const turnId = liveTurnByThread.get(internalCapability.threadId);
+                    if (!turnId) {
+                        return json(res, 409, { error: "this turn has not started yet or already ended" });
+                    }
+                    const saved = saveAudio(Buffer.from(audio.bytes), audio.mime);
+                    const key = turnAttachmentKey(internalCapability.threadId, turnId);
+                    const current = turnAttachmentsByTurn.get(key) ?? [];
+                    current.push({ kind: "audio", path: saved.path, mime: saved.mime, text });
+                    turnAttachmentsByTurn.set(key, current);
+                    return json(res, 201, { attached: true });
+                }
+                catch (error) {
+                    // "no voice configured" is a setup state, not a provider failure —
+                    // 409 with the hint, exactly like /api/tts/speak.
+                    if (error instanceof tts.NoVoiceConfigured)
+                        return json(res, 409, { error: error.message });
+                    const status = error.status;
+                    if (typeof status === "number" && status >= 400 && status < 500) {
+                        return json(res, status, { error: error instanceof Error ? error.message : "voice note failed" });
+                    }
+                    throw error;
+                }
+            }
             if (method === "POST" && path === "/api/internal/connectors/mcp") {
                 const body = await readInternalBody();
                 // Reading a streamed MCP body yields to ordinary settings requests.
@@ -13378,6 +14001,72 @@ const handleRequest = async (req, res) => {
                 if (!currentSender || currentSender.composio === false || !composio.configured(cfg)) {
                     return json(res, 403, { error: "connected apps are not enabled for this bot" });
                 }
+                // Per-bot tool grants (issue #1736): verdict every tools/call frame
+                // against the calling bot's connectorTools before it reaches
+                // Composio. A bot with no grants record keeps the legacy all-tools
+                // behavior; a grants record makes every unrecognized shape a deny.
+                // Rows are fire-and-forget: a log failure must never take the call
+                // (or its refusal) down with it.
+                const call = connectorCallFromFrame(body);
+                if (call.kind === "unrecognized") {
+                    appendDecision(DATA_DIR, {
+                        threadId: internalCapability.threadId,
+                        botId: currentSender.id,
+                        botName: currentSender.name,
+                        tool: call.invoked,
+                        summary: call.reason,
+                        decision: "user-denied",
+                        source: "connector-scope",
+                        rule: "connectorTools",
+                    });
+                    const refusal = connectorUnrecognizedText(call.invoked, call.reason);
+                    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+                    return res.end(JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: body.id ?? null,
+                        result: { content: [{ type: "text", text: refusal }], isError: true },
+                    }));
+                }
+                if (call.kind === "tools") {
+                    const verdict = evaluateConnectorTools(call.names, currentSender.connectorTools);
+                    if (!verdict.allowed) {
+                        for (const denial of verdict.denials) {
+                            appendDecision(DATA_DIR, {
+                                threadId: internalCapability.threadId,
+                                botId: currentSender.id,
+                                botName: currentSender.name,
+                                tool: denial.tool,
+                                summary: denial.service === null
+                                    ? "tool name does not name a service"
+                                    : denial.onGrantedService
+                                        ? "tool is not in this service's grant"
+                                        : "service is not granted",
+                                decision: "user-denied",
+                                source: "connector-scope",
+                                rule: denial.service ? "connectorTools." + denial.service : "connectorTools",
+                            });
+                        }
+                        const refusal = connectorRefusalText(verdict.denials);
+                        res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+                        return res.end(JSON.stringify({
+                            jsonrpc: "2.0",
+                            id: body.id ?? null,
+                            result: { content: [{ type: "text", text: refusal }], isError: true },
+                        }));
+                    }
+                    // One row per allowed call, naming the first target: the audit
+                    // trail reads "which bot ran what", not one row per tool.
+                    appendDecision(DATA_DIR, {
+                        threadId: internalCapability.threadId,
+                        botId: currentSender.id,
+                        botName: currentSender.name,
+                        tool: call.names[0],
+                        summary: ("allowed " + call.names.join(", ")).slice(0, 240),
+                        decision: "user-approved",
+                        source: "connector-scope",
+                        rule: verdict.rule,
+                    });
+                }
                 const upstream = await composio.relayMcp(cfg, body, Array.isArray(req.headers["mcp-session-id"])
                     ? req.headers["mcp-session-id"][0]
                     : req.headers["mcp-session-id"]);
@@ -13873,6 +14562,10 @@ const handleRequest = async (req, res) => {
             }
         };
         if (method === "GET" && path === "/api/bots") {
+            try {
+                groupUsageReader.refresh();
+            }
+            catch { /* accounting must not block a snapshot */ }
             const limit = pageSize(url.searchParams.get("messages"));
             if (limit === null)
                 return json(res, 400, { error: "messages must be a non-negative whole number" });
@@ -14304,8 +14997,102 @@ const handleRequest = async (req, res) => {
             return json(res, 201, { group: { ...publicGroupState(group), messages: [] } });
         }
         if (method === "POST" && path === "/api/teams/export") {
-            const body = await readBody(req);
+            // Pictures the Share dialog prepared ride this body, so it is larger
+            // than the default JSON limit (the document itself is capped at 4 MB).
+            const body = await readBody(req, 8 * 1024 * 1024);
             const profileName = cfg.profile?.name?.trim();
+            if (body.format === "package" && body.version === 2 && body.kind === "library") {
+                // Preset bots and their skills, no team: my New bot defaults as a
+                // preset someone else picks in New bot (presets.ts has the allowlist).
+                const optional = (value) => (typeof value === "string" ? value : undefined);
+                const built = defaultsPresetFor(body, body.includeMemory === true);
+                try {
+                    const exported = createLibraryPackageExport({
+                        name: optional(body.name),
+                        tagline: optional(body.tagline),
+                        summary: optional(body.summary),
+                        release: optional(body.release),
+                        notes: optional(body.notes),
+                        authorName: profileName,
+                        published: readPublishedLibrary(),
+                        preset: built.preset,
+                        skipped: built.skipped,
+                    });
+                    if (body.dryRun !== true)
+                        writePublishedLibrary(exported.published);
+                    return json(res, 200, {
+                        document: exported.document,
+                        filename: exported.filename,
+                        redacted: exported.redacted,
+                        skipped: exported.skipped,
+                        summary: packageSummary(exported.document),
+                    });
+                }
+                catch (error) {
+                    if (error instanceof TeamExportError)
+                        return json(res, error.status, { error: error.message });
+                    throw error;
+                }
+            }
+            if (body.format === "package" && body.version === 2) {
+                // One team, whole, except its chat history (package format v2).
+                if (typeof body.team !== "string")
+                    return json(res, 400, { error: "Choose a team to share." });
+                const team = body.team.trim();
+                if (team && !store.sections.includes(team) && !store.bots.some((bot) => sectionKey(bot.section) === team)) {
+                    return json(res, 404, { error: "That team no longer exists." });
+                }
+                const optional = (value) => (typeof value === "string" ? value : undefined);
+                const teamBots = store.bots.filter((bot) => !bot.hidden && sectionKey(bot.section) === team);
+                const skills = collectTeamSkills(teamBots, body.skills);
+                if (!skills.ok)
+                    return json(res, 400, { error: skills.error, choices: { skills: skills.available } });
+                const avatars = body.avatars && typeof body.avatars === "object" && !Array.isArray(body.avatars)
+                    ? body.avatars
+                    : undefined;
+                // Off unless asked: New bot defaults are personal until shared.
+                const defaults = body.includeDefaultsPreset === true ? defaultsPresetFor(body, body.includeMemory === true) : null;
+                try {
+                    const exported = createTeamPackageExport({
+                        team,
+                        name: optional(body.name),
+                        tagline: optional(body.tagline),
+                        summary: optional(body.summary),
+                        release: optional(body.release),
+                        notes: optional(body.notes),
+                        authorName: profileName,
+                        bots: store.bots,
+                        groups: store.groups,
+                        routines: routines.listRoutines(),
+                        brief: readSectionContext(team)?.text,
+                        published: readPublishedTeam(team),
+                        skillsByBot: skills.skillsByBot,
+                        skillSelection: skills.all ? "all" : "chosen",
+                        memoryByBot: body.includeMemory === true ? new Map(teamBots.map((bot) => [bot.id, starterNotes(bot.id)])) : undefined,
+                        avatars,
+                        mcpServers: cfg.mcpServers ?? {},
+                        skipped: [...skills.skipped, ...(defaults?.skipped ?? [])],
+                        preset: defaults?.preset ?? null,
+                    });
+                    // A preview (the dialog's live counts) never records keys; saving
+                    // the file does, so renaming anything later keeps its identity.
+                    if (body.dryRun !== true)
+                        writePublishedTeam(team, exported.published);
+                    return json(res, 200, {
+                        document: exported.document,
+                        filename: exported.filename,
+                        redacted: exported.redacted,
+                        skipped: exported.skipped,
+                        summary: packageSummary(exported.document),
+                        choices: { skills: skills.available },
+                    });
+                }
+                catch (error) {
+                    if (error instanceof TeamExportError)
+                        return json(res, error.status, { error: error.message, choices: { skills: skills.available } });
+                    throw error;
+                }
+            }
             const name = typeof body.name === "string" && body.name.trim()
                 ? body.name.trim()
                 : profileName
@@ -14414,6 +15201,64 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 200, { directory });
         }
+        // ── the organization library (server/org-library.ts) ─────────────────
+        // Admin scope, as import is. With no organization every read answers
+        // {organization: null} and nothing else changes.
+        if (method === "GET" && path === "/api/org-library") {
+            return json(res, 200, orgLibrary?.list() ?? { organization: null, packages: [] });
+        }
+        m = path.match(/^\/api\/org-library\/packages\/([a-f0-9-]{36})$/);
+        if (m && method === "GET") {
+            const outcome = orgLibrary?.preview(m[1]);
+            if (!outcome)
+                return json(res, 404, { error: "This package is not in your organization's library.", code: "not_listed" });
+            return outcome.ok ? json(res, 200, outcome.value) : json(res, outcome.status, { error: outcome.error, code: outcome.code });
+        }
+        if (method === "POST" && path === "/api/org-library/add") {
+            // One click, no confirmation: the person's click is the decision.
+            const body = await readBody(req);
+            const packageId = typeof body?.packageId === "string" && /^[a-f0-9-]{36}$/.test(body.packageId) ? body.packageId : null;
+            if (!packageId)
+                return json(res, 400, { error: "Choose a package from your organization's library." });
+            if (!orgLibrary)
+                return json(res, 404, { error: "This package is not in your organization's library.", code: "not_listed" });
+            const outcome = orgLibrary.add(packageId, packageImportDeps(await defaultSelection()));
+            if (!outcome.ok)
+                return json(res, outcome.status, { error: outcome.error, code: outcome.code });
+            if (outcome.value.alreadyAdded)
+                return json(res, 200, outcome.value);
+            const imported = outcome.value.result;
+            return json(res, 201, {
+                alreadyAdded: false,
+                installId: imported.installId,
+                name: imported.name,
+                section: imported.section,
+                bots: imported.bots.map((bot) => publicBot(store.bot(bot.id) ?? bot)),
+                groups: imported.groups.map((created) => ({ ...publicGroupState(store.group(created.id) ?? created), messages: [] })),
+                routines: imported.routines,
+                offeredSkills: imported.offeredSkills,
+                connections: imported.connections,
+                skipped: imported.skipped,
+                brief: imported.brief,
+                notes: imported.notes,
+                presets: imported.presets ?? [],
+            });
+        }
+        if (method === "GET" && path === "/api/org-library/skills") {
+            const botId = url.searchParams.get("botId") ?? undefined;
+            return json(res, 200, orgLibrary?.offeredSkills(botId) ?? { organization: null, skills: [] });
+        }
+        if (method === "POST" && path === "/api/org-library/skills") {
+            const body = await readBody(req);
+            const parsed = z.object({ botId: z.string().min(1).max(128), installId: z.string().regex(/^[a-f0-9]{32}$/), name: z.string().min(1).max(64) })
+                .safeParse(body);
+            if (!parsed.success)
+                return json(res, 400, { error: "Choose a bot and a skill from your organization's library." });
+            if (!orgLibrary)
+                return json(res, 404, { error: "This package is not in your organization's library.", code: "not_listed" });
+            const outcome = orgLibrary.addOfferedSkill(parsed.data.botId, parsed.data.installId, parsed.data.name);
+            return outcome.ok ? json(res, 201, { skill: outcome.value }) : json(res, outcome.status, { error: outcome.error, code: outcome.code });
+        }
         if (method === "POST" && path === "/api/teams/import") {
             // Import is additive-only. A manifest is untrusted input (catalog,
             // GitHub, a shared file), so it must be structurally unable to reach
@@ -14479,163 +15324,59 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: error instanceof Error ? error.message : "Backup could not be imported" });
                 }
             }
+            // Every package (v1 JSON, BotMRR Markdown, v2) is read by the one shared
+            // parser as a FILE: it cannot claim a publisher, and its skills and
+            // routines arrive off. A body field such as `trust` is just an unknown
+            // field of the document and is stripped; only the organization library
+            // module ever imports with trust "org".
             let packageDocument = null;
             let manifest = null;
             try {
                 if (isBotPackage(body))
-                    packageDocument = parseBotPackage(body);
+                    packageDocument = parsePackageDocument(body, { trust: "file" });
                 else
                     manifest = parseTeamManifest(body);
             }
             catch (error) {
                 return json(res, 400, { error: error instanceof Error ? error.message : "Invalid bot package" });
             }
-            const pkg = packageDocument?.package;
-            const importName = pkg?.name ?? manifest.team.name;
-            const sourceMembers = pkg
-                ? pkg.agents.map((agent) => ({ member: packageAgentAsMember(agent), playbookKeys: agent.playbooks ?? [], skillNames: agent.skills ?? [] }))
-                : manifest.team.members.map((member) => ({ member, playbookKeys: [], skillNames: [] }));
-            const importedBots = [];
-            const createdGroups = [];
-            const createdRoutineIds = [];
-            // Names already in use, hidden bots included: an archived bot can be
-            // un-archived later, and a revived duplicate would be just as
-            // ambiguous then.
-            const takenNames = new Set(store.bots.map((bot) => bot.name.trim().toLowerCase()));
-            const memberIds = new Map();
-            let group;
-            let importSection;
+            const deps = packageImportDeps(await defaultSelection());
+            const options = {
+                mode: importMode,
+                cwd: projectCwd,
+                room: url.searchParams.get("room") ?? undefined,
+                ...(importVisibility ? { visibility: importVisibility } : {}),
+            };
+            let imported;
             try {
-                const selection = await defaultSelection();
-                const existingSections = new Set([...store.sections, ...store.bots.map((bot) => bot.section), ...store.groups.map((candidate) => candidate.section)]
-                    .filter((section) => Boolean(section?.trim()))
-                    .map((section) => section.trim().toLowerCase()));
-                // Every template gets its own section, including legacy teams and
-                // project imports. Never merge into an existing section (or replace
-                // its Chief). Keep the name editable through the 60-character API.
-                importSection = takeImportName(importName, existingSections, 60);
-                const playbookByKey = new Map((pkg?.playbooks ?? []).map((playbook) => [playbook.key, playbook]));
-                const packageSkillByName = new Map((pkg?.skills?.entries ?? []).map((skill) => [skill.name, skill]));
-                for (const source of sourceMembers) {
-                    const member = source.member;
-                    // importedMemberProfile is the authority boundary: persona fields
-                    // only, colliding names numbered. seedMessages: false — an
-                    // imported bot must not open by greeting the user as though it
-                    // were new. composio: false — a shared persona never starts with
-                    // reach into the user's connected apps (absence would mean
-                    // allowed); the user can switch it on per bot after reading who
-                    // they got.
-                    const created = store.createBot({
-                        ...importedMemberProfile(member, takenNames),
-                        modelSelection: selection,
-                        section: importSection,
-                        ...(importVisibility ? { visibility: importVisibility } : {}),
-                    }, { seedMessages: false });
-                    importedBots.push(created);
-                    const installedPlaybooks = source.playbookKeys.flatMap((key) => {
-                        const playbook = playbookByKey.get(key);
-                        return playbook ? [{ ...playbook }] : [];
-                    });
-                    store.patchBot(created.id, {
-                        composio: false,
-                        ...(installedPlaybooks.length ? { playbooks: installedPlaybooks } : {}),
-                        ...(pkg
-                            ? {
-                                installedPackage: {
-                                    id: pkg.id,
-                                    name: pkg.name,
-                                    release: pkg.release,
-                                    requiredApps: pkg.requirements.apps.map((app) => ({ ...app })),
-                                },
-                            }
-                            : {}),
-                    });
-                    for (const skillName of source.skillNames) {
-                        const skill = packageSkillByName.get(skillName);
-                        if (!skill)
-                            throw new Error(`Package skill "${skillName}" is unavailable`);
-                        const installed = installSkill(created.id, skill.source ?? `package:${pkg.id}`, [
-                            { path: "SKILL.md", content: skill.instructions },
-                        ]);
-                        if ("error" in installed) {
-                            throw new Error(`Package skill "${skillName}" could not be imported: ${installed.error}`);
-                        }
-                    }
-                    memberIds.set(member.key, created.id);
-                }
-                // A package is an explicit structure import: its rooms are created
-                // from package-local keys only, then normalized to fresh bot ids.
-                for (const room of pkg?.rooms ?? []) {
-                    const ids = room.members.map((key) => memberIds.get(key));
-                    let created = store.createGroup(room.name, ids, false, importSection);
-                    createdGroups.push(created);
-                    const defaultResponder = room.defaultResponder.kind === "agent"
-                        ? { kind: "member", botId: memberIds.get(room.defaultResponder.agent) }
-                        : { kind: room.defaultResponder.kind };
-                    created = store.patchGroup(created.id, {
-                        bulletin: room.bulletin ?? "",
-                        defaultResponder,
-                        setupCompletedAt: Date.now(),
-                    }) ?? created;
-                }
-                for (const routine of pkg?.routines ?? []) {
-                    const created = routines.create({
-                        name: routine.name,
-                        prompt: routine.prompt,
-                        botId: memberIds.get(routine.agent),
-                        runOn: routine.runOn,
-                        enabled: false,
-                        schedule: routine.schedule,
-                        durationMinutes: routine.durationMinutes,
-                        ...(routine.timeoutMinutes === undefined ? {} : { timeoutMinutes: routine.timeoutMinutes }),
-                        ...(routine.overlap ? { overlap: routine.overlap } : {}),
-                    });
-                    createdRoutineIds.push(created.id);
-                }
-                if (pkg?.chiefOfStaff) {
-                    store.setChiefOfStaff(memberIds.get(pkg.chiefOfStaff));
-                }
-                // The room is created last, so a failure anywhere above leaves no
-                // half-built project behind — the catch below deletes the bots and
-                // there is no room pointing at them.
-                if (!pkg && importMode === "project" && importedBots.length > 0) {
-                    const roomName = url.searchParams.get("room")?.trim() || manifest.team.name;
-                    group = store.createGroup(roomName, importedBots.map((bot) => bot.id), false, importSection);
-                    createdGroups.push(group);
-                    if (projectCwd) {
-                        // `cwd` is the folder the room WANTS; the store pins it on the
-                        // first turn (pinGroupCwd). Setting the pin here would decide it
-                        // before anyone has worked, which is the store's call, not ours.
-                        group = store.patchGroup(group.id, { cwd: projectCwd }) ?? group;
-                    }
-                    broadcast({ kind: "group", group: publicGroupState(group) });
-                }
-                const publicBots = importedBots.map((bot) => publicBot(store.bot(bot.id)));
-                for (const bot of publicBots)
-                    broadcast({ kind: "bot", bot });
-                return json(res, 201, {
-                    name: importName,
-                    bots: publicBots,
-                    group,
-                    groups: createdGroups.map((created) => ({ ...created, messages: [] })),
-                    routines: createdRoutineIds.flatMap((id) => routines.listRoutines().filter((routine) => routine.id === id)),
-                });
+                const result = packageDocument
+                    ? importPackageDocument(packageDocument, { ...options, trust: "file" }, deps)
+                    : importTeamManifest(manifest, options, deps);
+                // A file import always gets a fresh install id, so it never reports
+                // "already added"; that answer belongs to the organization library.
+                if (result.alreadyAdded)
+                    return json(res, 200, result);
+                imported = result;
             }
             catch (error) {
-                // A room of deleted members must not survive either — patchGroup can
-                // throw (disk) after createGroup already saved.
-                for (const routineId of createdRoutineIds)
-                    routines.remove(routineId);
-                for (const created of createdGroups)
-                    store.deleteGroup(created.id);
-                for (const bot of importedBots)
-                    store.deleteBot(bot.id);
-                // Empty teams are now durable too. This import allocated a fresh
-                // identity, so its failed installation must retire that identity.
-                if (importSection && store.sections.includes(importSection))
-                    store.changeEmptySection(importSection, null);
+                if (error instanceof PackageImportError)
+                    return json(res, error.status, { error: error.message, code: error.code });
                 throw error;
             }
+            return json(res, 201, {
+                name: imported.name,
+                section: imported.section,
+                bots: imported.bots.map((bot) => publicBot(store.bot(bot.id) ?? bot)),
+                group: imported.group,
+                groups: imported.groups.map((created) => ({ ...created, messages: [] })),
+                routines: imported.routines,
+                offeredSkills: imported.offeredSkills,
+                connections: imported.connections,
+                skipped: imported.skipped,
+                brief: imported.brief,
+                notes: imported.notes,
+                presets: imported.presets ?? [],
+            });
         }
         m = path.match(/^\/api\/groups\/([\w-]+)\/setup$/);
         if (m && method === "PATCH") {
@@ -15187,8 +15928,8 @@ const handleRequest = async (req, res) => {
             const section = url.searchParams.get("section")?.trim();
             if (!section)
                 return json(res, 400, { error: "Choose a named team" });
-            if (teamComputers.forSection(section))
-                return json(res, 409, { error: "Unassign this team's computer before renaming or deleting the team" });
+            if (method === "DELETE" && teamComputers.forSection(section))
+                return json(res, 409, { error: "Unassign this team's computer before deleting the team" });
             let nextName = null;
             if (method === "PATCH") {
                 const parsed = z.object({ name: z.string().trim().min(1).max(60) }).strict().safeParse(await readBody(req));
@@ -15196,11 +15937,33 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "Team name must be 1 to 60 characters" });
                 nextName = parsed.data.name;
             }
-            const error = store.changeEmptySection(section, nextName);
+            const error = nextName === null ? store.deleteSection(section) : store.renameSection(section, nextName, teamComputers);
             if (error)
                 return json(res, error === "No such team" ? 404 : 409, { error });
             return json(res, 200, { sections: store.sections });
         }
+        if (method === "PUT" && path === "/api/sidebar-sections") {
+            const section = url.searchParams.get("section")?.trim();
+            if (!section || !store.sections.includes(section))
+                return json(res, 404, { error: "No such team" });
+            const ids = z.array(z.string().regex(/^[\w-]+$/)).max(MAX_WORKSPACE_BOTS);
+            const parsed = z.object({ addBotIds: ids, removeBotIds: ids }).strict().safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "Provide addBotIds and removeBotIds" });
+            for (const [botIds, destination] of [[parsed.data.addBotIds, section], [parsed.data.removeBotIds, undefined]]) {
+                for (const id of botIds) {
+                    const bot = store.bot(id);
+                    if (bot)
+                        assertTeamComputerChangeIdle(bot, { ...bot, section: destination });
+                }
+            }
+            const result = store.updateTeamMembers(section, parsed.data.addBotIds, parsed.data.removeBotIds);
+            if (!result.ok)
+                return json(res, result.reason === "unavailable" ? 404 : 409, { error: result.reason === "chief-conflict" ? "A team can have only one Chief of Staff. Change the Chief before moving this bot."
+                        : result.reason === "membership-changed" ? "Team membership changed. Reopen the dialog and try again."
+                            : "One or more bots are unavailable" });
+            return json(res, 200, { sections: store.sections, bots: result.bots.map(wireBot) });
+        }
         if (method === "POST" && path === "/api/sidebar-sections") {
             const parsed = createSidebarSectionSchema.safeParse(await readBody(req));
             if (!parsed.success) {
@@ -15229,11 +15992,108 @@ const handleRequest = async (req, res) => {
             }
             return json(res, 200, { section: name, sections: store.sections, bots: result.bots.map(wireBot) });
         }
-        if (method === "POST" && path === "/api/bots") {
+        if (method === "GET" && path === "/api/bot-defaults") {
+            return json(res, 200, {
+                defaults: structuredClone(cfg.newBotDefaults ?? newBotDefaultsSchema.parse({})),
+                modelSelection: await defaultSelection(),
+                suggestedName: pickBotName(store.bots.map(bot => bot.name)),
+            });
+        }
+        if (method === "POST" && path === "/api/bot-defaults/skills/preview") {
+            const checked = z.object({ source: z.string().min(1).max(2000) }).strict().safeParse(await readBody(req));
+            if (!checked.success)
+                return json(res, 400, { error: checked.error.message });
+            const input = checked.data;
+            const fetched = await fetchSkillFromSource(input.source);
+            if ("error" in fetched)
+                return json(res, 422, { error: fetched.error });
+            const skills = [];
+            for (const skill of fetched.skills) {
+                const file = skill.files.find(file => file.path === "SKILL.md" || file.path.endsWith("/SKILL.md"));
+                if (!file)
+                    continue;
+                const parsed = parseSkillMd(file.content);
+                if ("error" in parsed)
+                    return json(res, 422, { error: parsed.error });
+                const skippedWarnings = skill.files.filter(candidate => candidate !== file)
+                    .map(candidate => `skipped supporting file "${candidate.path}" — v1 imports only SKILL.md`);
+                const template = botSkillTemplateSchema.safeParse({ name: parsed.name, description: parsed.description, source: skill.source, text: file.content,
+                    enabled: false, warnings: [...scanSkillText(file.content), ...skippedWarnings] });
+                if (!template.success)
+                    return json(res, 422, { error: template.error.message });
+                skills.push(template.data);
+            }
+            return json(res, 200, { skills });
+        }
+        if (method === "POST" && path === "/api/bot-defaults/avatar") {
             const body = await readBody(req);
+            if (!body || typeof body !== "object" || Array.isArray(body))
+                return json(res, 400, { error: "avatar preview must be a JSON object" });
+            const profile = parseBotProfilePatch(body.profile, true);
+            if (!profile.ok)
+                return json(res, 400, { error: profile.error });
+            const checked = avatarGenerationRequestSchema.safeParse({ prompt: body.prompt });
+            if (!checked.success)
+                return json(res, 400, { error: checked.error.message });
+            const { prompt } = checked.data;
+            const generated = await generateAvatarImage(cfg, {
+                name: profile.patch.name ?? "", title: profile.patch.title ?? "", description: profile.patch.description ?? "",
+            }, prompt);
+            // A preview belongs to the draft. Upload it through the existing image
+            // endpoint only when the user commits the new bot or its defaults.
+            return json(res, 200, { dataUrl: `data:${generated.mime};base64,${generated.bytes.toString("base64")}` });
+        }
+        if (method === "POST" && path === "/api/bots") {
+            let body = await readBody(req);
             if (!body || typeof body !== "object" || Array.isArray(body)) {
                 return json(res, 400, { error: "bot must be a JSON object" });
             }
+            const template = resolveBotCreationDefaults(cfg.newBotDefaults, body);
+            const settings = template.profile;
+            if (auth.kind === "session" && !auth.scopes.includes("admin")) {
+                const field = clientBotPatchViolation(settings);
+                if (field || body.preset !== undefined || template.skills.length || template.routines.length || Object.keys(template.memory).length) {
+                    return json(res, 403, { error: "Creating a bot with these defaults needs the admin scope" });
+                }
+            }
+            // A preset (presets.ts) supplies content: playbooks, skills and
+            // starter notes. Name, look and instructions stay the request's own.
+            if (body.preset !== undefined && (typeof body.preset !== "string" || !/^[\w-]{1,64}$/.test(body.preset))) {
+                return json(res, 400, { error: "preset must be a preset id from New bot" });
+            }
+            const resolvedPreset = typeof body.preset === "string" ? presetStore.resolve(body.preset) : null;
+            const preset = resolvedPreset && presetOffered(resolvedPreset.row, readOrgInstallStatuses()) ? resolvedPreset : null;
+            if (body.preset !== undefined && !preset)
+                return json(res, 404, { error: PRESET_UNAVAILABLE_MESSAGE });
+            body = { ...body, ...settings, name: settings.name };
+            if (settings.approvalMode === "full" || settings.approvalMode === "custom") {
+                return json(res, 403, { error: "This approval level requires the desktop permission flow. Use the bot creation dialog or explicitly choose Ask/Auto for API creation." });
+            }
+            if (settings.computer === "local" && settings.approvalMode === "auto" && body.acknowledgeLocalAuto !== true) {
+                return json(res, 400, { error: "Auto mode on this computer requires confirming the warning first (acknowledgeLocalAuto)" });
+            }
+            if (settings.avatarUrl && !storedAvatarExists(settings.avatarUrl)) {
+                return json(res, 400, { error: "avatarUrl must reference an existing stored image" });
+            }
+            if (settings.browserProfile && settings.browserProfile !== "guest" && !(cfg.browserProfiles ?? []).some(profile => profile.id === settings.browserProfile)) {
+                return json(res, 400, { error: "browserProfile must name an existing browser profile" });
+            }
+            if (settings.mcpServers?.some(name => mcpServerNameError(name) !== null) || (settings.mcpServers?.length ?? 0) > MAX_MCP_SERVERS) {
+                return json(res, 400, { error: "Invalid MCP server selection" });
+            }
+            if (settings.managedSections?.length) {
+                if (!settings.chiefOfStaff || settings.managedSections.some(name => name !== "" && !store.sections.includes(name))) {
+                    return json(res, 400, { error: "Only a Chief may manage existing additional teams" });
+                }
+                if (body.acknowledgePeerScope !== true)
+                    return json(res, 400, { error: "Confirm additional team access (acknowledgePeerScope)" });
+                if (auth.kind === "loopback" && !DESKTOP_MANAGED && store.bots.some(bot => bot.busy)) {
+                    return json(res, 409, { error: "Stop running bots before granting access to another team" });
+                }
+            }
+            const checkedCwd = validateBotCwd(settings.cwd ?? null);
+            if (!checkedCwd.ok)
+                return json(res, 400, { error: checkedCwd.error });
             if (body.requireAvailableModel !== undefined && typeof body.requireAvailableModel !== "boolean") {
                 return json(res, 400, { error: "requireAvailableModel must be true or false" });
             }
@@ -15272,14 +16132,91 @@ const handleRequest = async (req, res) => {
             if (store.bots.length >= MAX_WORKSPACE_BOTS) {
                 return json(res, 409, { error: `this workspace is limited to ${MAX_WORKSPACE_BOTS} bots` });
             }
-            // Who may see it, from the first moment (admin route: members cannot
-            // create bots). A bot named for a sensitive job must never be
-            // announced to everyone before it is restricted.
+            // Apply the audience before creation can announce the bot to members.
             const created = body.visibility === undefined ? null : parseVisibility(body.visibility);
             if (created && !created.ok)
                 return json(res, 400, { error: created.error });
-            const bot = store.createBot({ ...profile.patch, section, modelSelection: selection, ...(created?.ok ? { visibility: created.visibility } : {}) });
+            const bot = store.createBot({ ...profile.patch, soul: settings.soul, section, modelSelection: selection,
+                ...(created?.ok ? { visibility: created.visibility } : {}) });
+            const createdRoutines = [];
+            try {
+                const { chiefOfStaff: _chief, managedSections: _managed, ...ordinary } = settings;
+                store.patchBot(bot.id, {
+                    // Store creation completes workspace defaults (including effort).
+                    // Applying the rest of the template must not undo that selection.
+                    ...ordinary, name: bot.name, section, modelSelection: bot.modelSelection,
+                    mascotExpression: ordinary.mascotExpression ?? undefined,
+                    avatarUrl: ordinary.avatarUrl || undefined,
+                    computer: ordinary.computer ?? undefined, cwd: checkedCwd.cwd ?? undefined,
+                    peers: ordinary.peers ?? undefined, mcpServers: ordinary.mcpServers ?? undefined,
+                    browserProfile: ordinary.browserProfile || undefined,
+                    autoApprove: ordinary.approvalMode === "auto",
+                });
+                // What the preset brings wins over the saved defaults for the same
+                // skill name or note file.
+                const presetSkills = new Set(preset?.preset.skills ?? []);
+                const presetNotes = new Set(Object.keys(preset?.preset.seed?.memory ?? {}));
+                for (const [file, text] of Object.entries(template.memory)) {
+                    if (presetNotes.has(file))
+                        continue;
+                    journalMemoryWrite(bot.id, file, text, { actor: "person", via: "api" });
+                }
+                if (preset) {
+                    applyPresetToBot(bot.id, preset, {
+                        store,
+                        skills: { install: installSkill, setEnabled: setSkillEnabled },
+                        memory: { writeIndex: writeMemoryFile, writeTopic: writeMemoryTopic },
+                    });
+                }
+                for (const skill of template.skills) {
+                    if (presetSkills.has(skill.name))
+                        continue;
+                    const parsed = parseSkillMd(skill.text);
+                    if ("error" in parsed || parsed.name !== skill.name)
+                        throw Object.assign(new Error("Skill name does not match its contents"), { status: 400 });
+                    const installed = installSkill(bot.id, skill.source, [{ path: "SKILL.md", content: skill.text }]);
+                    if ("error" in installed)
+                        throw Object.assign(new Error(installed.error), { status: 422 });
+                    if (skill.enabled) {
+                        const enabled = setSkillEnabled(bot.id, skill.name, true);
+                        if ("error" in enabled)
+                            throw Object.assign(new Error(enabled.error), { status: 422 });
+                    }
+                }
+                for (const routine of template.routines) {
+                    const created = routines.create({ ...routine, botId: bot.id, enabled: false });
+                    createdRoutines.push({ id: created.id, enabled: routine.enabled !== false });
+                }
+            }
+            catch (error) {
+                for (const routine of createdRoutines)
+                    routines.remove(routine.id);
+                store.deleteBot(bot.id);
+                throw error;
+            }
+            // Creation is complete. Activation errors must not invite a duplicate
+            // creation retry or delete a bot whose routine may already have run.
+            const warnings = [];
+            if (settings.chiefOfStaff) {
+                try {
+                    store.patchBot(bot.id, { managedSections: settings.managedSections ?? [] });
+                    store.setChiefOfStaff(bot.id);
+                }
+                catch {
+                    warnings.push("Bot created; review its Chief of Staff setting before delegating work.");
+                }
+            }
+            for (const routine of createdRoutines)
+                if (routine.enabled) {
+                    try {
+                        routines.update(routine.id, { enabled: true });
+                    }
+                    catch {
+                        warnings.push(`Bot created; routine ${routine.id} could not be activated.`);
+                    }
+                }
             return json(res, 201, {
+                ...(warnings.length ? { warnings } : {}),
                 bot: {
                     ...wireBot(bot),
                     messages: store.messagesFor(bot.threadId),
@@ -15398,6 +16335,30 @@ const handleRequest = async (req, res) => {
             broadcast({ kind: "bot", bot: visible });
             return json(res, 200, { bot: visible });
         }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/command-allowlist(?:\/([\w-]+))?$/);
+        if (m && ["GET", "POST", "DELETE"].includes(method)) {
+            if (!canManageCommandAllowlist(auth))
+                return json(res, 403, { error: "Only the workspace owner or an admin can manage command permissions." });
+            const bot = requestedTaskBot(m[1], url.searchParams.get("threadId") ?? undefined);
+            if (method === "GET" && !m[2])
+                return json(res, 200, commandAllowlistResponse(bot));
+            if (method === "POST" && !m[2]) {
+                const candidate = commandAllowlistCandidate(await readBody(req));
+                if (!candidate)
+                    return json(res, 400, { error: "Enter an exact command without secret values, an absolute working folder, and a provider." });
+                const instance = registry.get(candidate.providerInstanceId);
+                if (!instance || !COMMAND_ALLOWLIST_DRIVERS.has(instance.driverKind)) {
+                    return json(res, 400, { error: "This provider does not supply structured command approvals." });
+                }
+                commandAllowlist.add(bot.id, candidate);
+                return json(res, 200, commandAllowlistResponse(bot));
+            }
+            if (method === "DELETE" && m[2]) {
+                commandAllowlist.remove(bot.id, m[2]);
+                return json(res, 200, commandAllowlistResponse(bot));
+            }
+            return json(res, 405, { error: "Unsupported command allowlist operation" });
+        }
         m = path.match(/^\/api\/bots\/([\w-]+)\/always-allow$/);
         if (m && method === "POST") {
             const body = await readBody(req);
@@ -15555,6 +16516,20 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "composio must be true or false" });
                 patch.composio = body.composio;
             }
+            // which of those apps' tools this bot may call (connector grants 1/5:
+            // data model only — enforcement lands with slice 2). null returns the
+            // bot to boolean-only legacy behavior; {} means no tools.
+            if (body.connectorTools !== undefined) {
+                if (body.connectorTools === null) {
+                    patch.connectorTools = undefined;
+                }
+                else {
+                    const parsed = parseConnectorTools(body.connectorTools);
+                    if (!parsed.ok)
+                        return json(res, 400, { error: parsed.error });
+                    patch.connectorTools = parsed.grants;
+                }
+            }
             // Queue this bot's direct messages behind outstanding delegated work
             // instead of steering the conversation immediately (#1194).
             if (body.parkDirectMessages !== undefined) {
@@ -15920,6 +16895,12 @@ const handleRequest = async (req, res) => {
             }
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
+            // A defined Works on is the newest explicit choice: this bot's
+            // auto-recorded pins that now point elsewhere give way immediately, so
+            // the next turn on each thread follows the new setting. Person-set pins
+            // and pins that already match stay; returning to Auto sweeps nothing.
+            if (computerSpecified && requestedComputer !== undefined)
+                store.clearAutoSurfacePins(m[1], requestedComputer);
             if (normalizedSelection && selectedTask)
                 store.patchTask(bot.id, selectedTask.threadId, { modelSelection: normalizedSelection,
                     ...hostedModels?.resetTask(selectedTask.modelSelection, normalizedSelection) });
@@ -15983,6 +16964,27 @@ const handleRequest = async (req, res) => {
         // ── bot skills: imported Agent Skills (SKILL.md) ────────────────────
         // Import lands DISABLED; the UI shows SKILL.md + scan warnings and a
         // person enables after reading. See server/skills.ts for the policy.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/skill-template$/);
+        if (m && method === "POST") {
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            const checked = botSkillTemplateSchema.safeParse(await readBody(req));
+            if (!checked.success)
+                return json(res, 400, { error: checked.error.message });
+            const input = checked.data;
+            const parsed = parseSkillMd(input.text);
+            if ("error" in parsed || parsed.name !== input.name)
+                return json(res, 400, { error: "Skill name does not match its contents" });
+            const installed = installSkill(m[1], input.source, [{ path: "SKILL.md", content: input.text }]);
+            if ("error" in installed)
+                return json(res, 422, { error: installed.error });
+            if (input.enabled) {
+                const enabled = setSkillEnabled(m[1], input.name, true);
+                if ("error" in enabled)
+                    return json(res, 422, { error: enabled.error });
+            }
+            return json(res, 201, { installed });
+        }
         m = path.match(/^\/api\/bots\/([\w-]+)\/skills$/);
         if (m && method === "GET") {
             if (!store.bot(m[1]))
@@ -16766,6 +17768,23 @@ const handleRequest = async (req, res) => {
             const text = String(body.text ?? "").trim();
             if (!text)
                 return json(res, 400, { error: "text required" });
+            const threadMessages = store.messagesFor(bot.threadId);
+            const source = threadMessages.find((msg) => msg.id === messageId);
+            if (!source || source.role !== "user" || source.kind !== "text") {
+                return json(res, 404, { error: "only user messages can be edited" });
+            }
+            // The client's id for this edit. A retry of an edit the server already
+            // forked answers with that fork instead of forking (and rerunning) again.
+            // Checked before the busy guard: that fork's own turn is what is busy.
+            const sendId = parseSendId(body.sendId);
+            if (sendId) {
+                const accepted = acceptedSendMatch(threadMessages, sendId, text, source.replyToId);
+                if (accepted.kind === "conflict" || (accepted.kind === "match" && (accepted.message.parentId ?? null) !== (source.parentId ?? null))) {
+                    return json(res, 409, { error: "sendId already belongs to another message" });
+                }
+                if (accepted.kind === "match")
+                    return json(res, 202, { ok: true, message: accepted.message });
+            }
             // everything from here down is synchronous, so two racing edits can
             // never both get past this check: startTurn flips busy before the
             // next request is handled
@@ -16774,10 +17793,6 @@ const handleRequest = async (req, res) => {
             if (phoneSecretSubmissions.hasThread(bot.threadId)) {
                 return json(res, 409, { error: "this task is securely saving a credential — try again when it finishes" });
             }
-            const source = store.messagesFor(bot.threadId).find((msg) => msg.id === messageId);
-            if (!source || source.role !== "user" || source.kind !== "text") {
-                return json(res, 404, { error: "only user messages can be edited" });
-            }
             if (!registry.get(bot.modelSelection.instanceId)) {
                 return json(res, 409, {
                     error: `provider instance "${bot.modelSelection.instanceId}" is unavailable — pick another model in settings`,
@@ -16790,7 +17805,7 @@ const handleRequest = async (req, res) => {
             // startTurn admits the rerun before branching. A shared-resource or
             // concurrency-limit refusal must leave the original transcript intact.
             const replyTo = source.replyToId ? resolveReplyTarget(bot.threadId, source.replyToId) : undefined;
-            const message = await startTurn(bot.id, text, { threadId: bot.threadId, editedMessageId: messageId, replyTo, trigger: usageTriggerFor(auth) });
+            const message = await startTurn(bot.id, text, { threadId: bot.threadId, editedMessageId: messageId, replyTo, sendId, trigger: usageTriggerFor(auth) });
             return json(res, 202, { ok: true, message });
         }
         // switch which fork of the conversation is visible (no new turn)
@@ -16823,6 +17838,11 @@ const handleRequest = async (req, res) => {
             const refusal = cardAnswerRefusal(auth, bot.threadId, String(body.requestId), behavior);
             if (refusal)
                 return json(res, 403, { error: refusal });
+            if (body.rememberCommand === true) {
+                const refusal = commandRememberRefusal(auth, bot.threadId, String(body.requestId), behavior);
+                if (refusal)
+                    return json(res, 403, { error: refusal });
+            }
             return await answeringCardAs(auth, bot.threadId, String(body.requestId), async () => {
                 if (await resolveAndSendTeamSetup(res, {
                     botId: bot.id, threadId: bot.threadId, requestId: String(body.requestId), behavior,
@@ -16860,7 +17880,7 @@ const handleRequest = async (req, res) => {
                     resolvePeerComms(approvalBus, String(body.requestId), behavior)) {
                     return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
                 }
-                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true);
+                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true, body.rememberCommand === true);
                 return json(res, 200, { ok: true, outcome });
             });
         }
@@ -16879,6 +17899,11 @@ const handleRequest = async (req, res) => {
             const refusal = cardAnswerRefusal(auth, threadId, requestId, behavior);
             if (refusal)
                 return json(res, 403, { error: refusal });
+            if (body.rememberCommand === true) {
+                const refusal = commandRememberRefusal(auth, threadId, requestId, behavior);
+                if (refusal)
+                    return json(res, 403, { error: refusal });
+            }
             return await answeringCardAs(auth, threadId, requestId, async () => {
                 const skillCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.skillRequest);
                 if (skillCard?.card?.skillRequest) {
@@ -16958,7 +17983,7 @@ const handleRequest = async (req, res) => {
                 if (!owner && !pending)
                     return json(res, 404, { error: "nothing is waiting on an answer in this conversation" });
                 const requestOwner = owner ? botForThread(owner.id, threadId) : null;
-                const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true);
+                const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true, body.rememberCommand === true);
                 return json(res, 200, { ok: true, outcome });
             });
         }
@@ -17163,7 +18188,7 @@ const handleRequest = async (req, res) => {
             const current = store.projectBotForTask(m[1], m[2]);
             if (!current)
                 return json(res, 404, { error: "no such task" });
-            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "pinned", "surface"]);
+            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "pinned", "snoozedUntil", "surface"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported thread setting" });
             for (const key of ["requireAvailableModel", "acknowledgeLocalAuto", "updateBotDefault", "resetApprovalToAsk"]) {
@@ -17205,15 +18230,28 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "pinned must be a boolean" });
                 patch.pinned = body.pinned ? true : undefined;
             }
+            if (body.snoozedUntil !== undefined) {
+                if (body.snoozedUntil === null)
+                    patch.snoozedUntil = undefined;
+                else if (typeof body.snoozedUntil === "number" && Number.isFinite(body.snoozedUntil) && body.snoozedUntil >= 0)
+                    patch.snoozedUntil = body.snoozedUntil;
+                else
+                    return json(res, 400, { error: "snoozedUntil must be a timestamp, 0 to snooze until activity, or null to wake now" });
+            }
             if (body.surface !== undefined) {
                 if (threadBusy(current.id, current.threadId))
                     return json(res, 409, { error: "Stop this thread before changing its computer destination." });
-                // Where this conversation works, chosen from the composer. Null follows
-                // the bot's Works on again. Reachability is the turn's to judge.
-                if (body.surface === null)
+                // Where this conversation works, chosen by the person and recorded as
+                // theirs, so a later Works on change never sweeps it. Null follows the
+                // bot's Works on again. Reachability is the turn's to judge.
+                if (body.surface === null) {
                     patch.surface = undefined;
-                else if (parseSurface(body.surface))
+                    patch.surfaceSource = undefined;
+                }
+                else if (parseSurface(body.surface)) {
                     patch.surface = parseSurface(body.surface);
+                    patch.surfaceSource = "user";
+                }
                 else
                     return json(res, 400, { error: "surface must be cloud, vm, local, browser, or null to follow the bot" });
             }
@@ -17783,7 +18821,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: `provider must be one of ${PROVIDER_KEY_KINDS.join(", ")}` });
             }
             const kind = provider;
-            const saved = kind === "anthropic" ? cfg.anthropic : kind === "openaiCompat" ? cfg.openaiCompat : cfg.xai;
+            const saved = kind === "anthropic" ? cfg.anthropic : kind === "openaiCompat" ? cfg.openaiCompat : kind === "mistral" ? cfg.mistral : cfg.xai;
             if (body?.key !== undefined && typeof body.key !== "string") {
                 return json(res, 400, { error: "key must be a string" });
             }
@@ -17792,7 +18830,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "No key to test. Paste one or save one first." });
             if (key.length > 512)
                 return json(res, 400, { error: "That does not look like an API key." });
-            const url = typeof body?.url === "string" && body.url.trim() ? body.url.trim() : saved?.url;
+            const url = typeof body?.url === "string" && body.url.trim() ? body.url.trim() : (saved && "url" in saved ? saved.url : undefined);
             res.setHeader("cache-control", "no-store");
             return json(res, 200, await checkProviderKey({ provider: kind, key, url }));
         }
@@ -18095,8 +19133,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "Account settings are currently available for Claude only." });
                 }
                 if (body.tools !== undefined) {
-                    if (!["openai-compat", "grok", "minimax"].includes(entry.driver)) {
-                        return json(res, 400, { error: "The tools setting is available for OpenAI-compatible, Grok API and MiniMax API instances only." });
+                    if (!["openai-compat", "grok", "minimax", "mistral"].includes(entry.driver)) {
+                        return json(res, 400, { error: "The tools setting is available for OpenAI-compatible, Grok API, MiniMax API and Mistral API instances only." });
                     }
                     entry.config = { ...entry.config, tools: body.tools };
                 }
@@ -18298,9 +19336,22 @@ const handleRequest = async (req, res) => {
         }
         if ((method === "PUT" || method === "PATCH") && path === "/api/config") {
             const body = await readBody(req);
-            if (hostedModels && ["instances", "anthropic", "openaiCompat", "xai", "opencodeGo"].some(key => Object.hasOwn(body, key)))
+            if (hostedModels && ["instances", "anthropic", "openaiCompat", "xai", "mistral", "opencodeGo"].some(key => Object.hasOwn(body, key)))
                 return json(res, 403, { error: HOSTED_PROVIDER_SETTINGS_ERROR });
             const patch = parseConfigPatch(body);
+            if (patch.newBotDefaults) {
+                if (patch.newBotDefaults.profile.modelSelection) {
+                    const checked = checkedModelSelection(patch.newBotDefaults.profile.modelSelection);
+                    if (!checked.ok)
+                        return json(res, checked.status, { error: checked.error });
+                    patch.newBotDefaults.profile.modelSelection = checked.selection;
+                }
+                for (const skill of patch.newBotDefaults.skills) {
+                    const parsed = parseSkillMd(skill.text);
+                    if ("error" in parsed || parsed.name !== skill.name)
+                        return json(res, 400, { error: "Skill name does not match its contents" });
+                }
+            }
             if (hostedModels && patch.defaultModelSelection) {
                 const checked = checkedModelSelection(patch.defaultModelSelection);
                 if (!checked.ok)
@@ -18470,7 +19521,7 @@ const handleRequest = async (req, res) => {
                             }
                             const listed = currentById.get(inspected.identity.boxId);
                             if (listed && listed.name !== inspected.identity.name) {
-                                return json(res, 503, { error: "ascii.dev returned conflicting cloud computer identities; keep the current Box account and retry" });
+                                return json(res, 503, { error: "boat.dev returned conflicting cloud computer identities; keep the current Box account and retry" });
                             }
                             currentById.set(inspected.identity.boxId, inspected.identity);
                             journalBoxResources.push(inspected.identity);
@@ -19381,6 +20432,18 @@ for (const row of chatFollowups()) {
 }
 restoreSteeredMessages();
 restoreChannelMessages();
+// Repair known auto pins that conflict with Works on before dispatch starts.
+// Legacy pins have no provenance and may be deliberate person selections:
+// preserve them rather than guessing. The sweep is idempotent.
+{
+    let movedAutoPins = 0;
+    for (const bot of store.bots) {
+        if (bot.computer !== undefined)
+            movedAutoPins += store.clearAutoSurfacePins(bot.id, bot.computer);
+    }
+    if (movedAutoPins)
+        console.log(`Works on: moved ${movedAutoPins} auto-pinned thread(s) to their bot's current Works on`);
+}
 server.listen(PORT, "127.0.0.1", () => {
     companyRuntimeReady();
     console.log(`openmausbot server on http://127.0.0.1:${PORT}`);