openmausbot 0.1.86 → 0.1.88

package/dist-server/permission-proxy.js

@@ -8,10 +8,11 @@ var MAX_OPTIONS = 12;
 var MAX_QUESTION_TEXT = 400;
 var MAX_LABEL = 120;
 var MAX_DESCRIPTION = 400;
+var MAX_CUSTOM_ANSWER = 2e3;
 function text(value, limit) {
   if (typeof value !== "string") return void 0;
   const trimmed = value.trim();
-  return trimmed ? trimmed.slice(0, limit) : void 0;
+  return trimmed ? trimmed.slice(0, limit).trim() : void 0;
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -59,19 +60,38 @@ function parseAskQuestions(input) {
   }
   return questions.length ? questions : null;
 }
+var OMB_ASK_FENCE = /(^|\n)[ \t]{0,3}(`{3,}|~{3,})[ \t]*omb-ask[ \t]*\r?\n([\s\S]*?)\r?\n[ \t]{0,3}\2[ \t]*(?=\r?\n|$)/;
+var OMB_ASK_FENCE_GLOBAL = new RegExp(OMB_ASK_FENCE.source, OMB_ASK_FENCE.flags + "g");
+var MAX_ANSWER_ECHO = 6 * MAX_CUSTOM_ANSWER;
 function questionAnswersByQuestion(message, questions) {
-  const answers = {};
-  const known = new Map(questions.map((entry) => [entry.question, entry.question]));
-  for (const block of message.split("\n\n")) {
-    const match = /^Q: ([\s\S]+?)\nA: ([\s\S]+)$/.exec(block.trim());
-    if (!match) continue;
-    const question = known.get(match[1].trim());
-    if (question) answers[question] = match[2].trim();
+  return questionAnswersById(message, questions.map((question) => ({ id: question.question, question })));
+}
+function questionAnswersById(message, questions) {
+  const answers = /* @__PURE__ */ Object.create(null);
+  const idByText = /* @__PURE__ */ new Map();
+  const ambiguous = /* @__PURE__ */ new Set();
+  for (const { id, question } of questions) {
+    if (idByText.has(question.question)) {
+      ambiguous.add(question.question);
+      continue;
+    }
+    idByText.set(question.question, id);
+  }
+  const blocks = message.matchAll(/(?:^|\n\n)Q: ([\s\S]+?)\nA: ([\s\S]*?)(?=\n\nQ: |$)/g);
+  let sawBlock = false;
+  for (const match of blocks) {
+    sawBlock = true;
+    const asked = match[1].trim();
+    if (ambiguous.has(asked)) continue;
+    const id = idByText.get(asked);
+    const answer = match[2].trim();
+    if (id && answer) answers[id] = answer;
   }
   if (Object.keys(answers).length) return answers;
+  if (sawBlock) return {};
   const only = questions.length === 1 ? questions[0] : void 0;
   const flat = message.trim();
-  return only && flat ? { [only.question]: flat } : {};
+  return only && flat ? { [only.id]: flat } : {};
 }
 
 // server/permission-proxy.ts

package/dist-server/server/admission.js

@@ -0,0 +1,81 @@
+// One admission decision for every surface that starts, steers, or parks
+// work. Each seam used to hand-roll its own busy policy; they agreed by
+// convention and drifted by accident. This module is the frozen record of
+// what each surface does today (M1): same inputs, same outputs, one place.
+//
+// Purity is the contract: no IO, no store reads, no adapter calls. Callers
+// gather state, call admit(), and apply the returned decision with their own
+// side effects. Anything that can settle a turn (an awaited steer, a slow
+// disk) belongs to the caller, which re-reads state and asks again.
+/** The shared admission decision. Pure: same surface, message, and state
+ * always return the same decision, with no side effects. */
+export function admit(surface, message = {}, state = {}) {
+    switch (surface) {
+        case "direct-busy": {
+            // Steer-first for plain text into a capable engine; every mechanical
+            // clamp (attachments, a pending surface choice, an incapable engine)
+            // parks the words for the next ordinary turn instead.
+            const steerable = !message.carriesImages && !message.pendingComputerSelection && message.engineCanSteer === true;
+            return steerable ? { action: "steer" } : { action: "queue" };
+        }
+        case "direct": {
+            if (state.atCapacity || state.threadBusy || state.groupTurn || state.parksBehindCoordination) {
+                // Capacity outranks a room turn in the receipt because the person
+                // can fix it (finish a thread); coordination parking is reasonless.
+                const reason = state.atCapacity ? "capacity" : state.groupTurn ? "group-turn" : undefined;
+                return { action: "queue", reason };
+            }
+            return { action: "start" };
+        }
+        case "room":
+            // Room sends never auto-steer; the queue is the policy. Human override
+            // is the head-only manual steer below.
+            return state.roomWorking ? { action: "queue" } : { action: "start" };
+        case "room-steer": {
+            if (!message.speakerPresent || message.engineCanSteer !== true) {
+                // An incapable room keeps its queue, exactly like an incapable 1:1
+                // engine; the request succeeds without delivering.
+                return { action: "queue" };
+            }
+            if (!message.isQueueHead) {
+                return { action: "refuse", code: "queue-head-only" };
+            }
+            return { action: "steer" };
+        }
+        case "guarded": {
+            // A guarded send is an external contract: never queued, never steered,
+            // never started under stale permissions. Any busy shape refuses.
+            if (state.botBusy || state.threadBusy || state.atCapacity || state.parksBehindCoordination || state.groupTurn) {
+                return { action: "refuse", code: "guarded_busy" };
+            }
+            return { action: "start" };
+        }
+        case "unattended": {
+            // Routines and webhooks share startTurn's admission; busy means a
+            // missed or failed run, not a queue — their receipts are the
+            // monitoring feature.
+            if (state.botPresent === false)
+                return { action: "refuse", code: "missing" };
+            if (state.atCapacity || state.groupTurn)
+                return { action: "refuse", code: "busy" };
+            return { action: "start" };
+        }
+        case "peer": {
+            // Exactly what startTurn admits for a direct thread: the landing
+            // thread free, a free slot, no live room turn. Never the whole-bot
+            // busy flag.
+            if (state.threadBusy || state.atCapacity || state.groupTurn)
+                return { action: "refuse", code: "busy" };
+            return { action: "start" };
+        }
+        case "opened-thread": {
+            // A self-opened thread is brand new: its own busy flag is impossible,
+            // so only a full slot list or a live room turn can park it. Provenance
+            // (peerAsk, unattended) survives the wait in the queue payload.
+            if (state.atCapacity || state.groupTurn) {
+                return { action: "queue", reason: state.atCapacity ? "capacity" : "group-turn" };
+            }
+            return { action: "start" };
+        }
+    }
+}

package/dist-server/server/aside-queue.js

@@ -0,0 +1,294 @@
+// The aside lane: peer context handed to a busy thread's RUNNING turn.
+//
+// A peer send that arrives mid-turn used to degrade straight to the
+// delegation queue — full work, later turn, no reply until then. When the
+// engine running that turn has a mid-turn seam (Adapter.steer), the same
+// words can instead be folded into the live turn at its next step boundary
+// as an ASIDE: context the model reads and usually ignores. The person's
+// lane keeps real steering (parent authority changes the turn's course);
+// an aside never claims that authority, and the envelope says so.
+//
+// Durability follows steer-queue's shape (chat_followups rows, restore
+// only what never dispatched) with one aside-specific rule: the row id is
+// the messageId dedupe key, it is written BEFORE the seam call, and the
+// injected line lands on the transcript with queueId = row id BEFORE the
+// row is deleted. A crash in either window is then self-healing: restore
+// skips any row whose transcript already shows its marker (the words ran;
+// never replay them) and requeues only the rest. "indeterminate" seam
+// outcomes count as injected for the same reason — the words may already
+// be running, and running them twice is the one mistake this lane must
+// never make.
+import { newId } from "./contracts.js";
+import { chatFollowups, saveChatFollowup, settleChatFollowups } from "./message-db.js";
+import { peerName } from "./peer-roster.js";
+const asides = new Map(); // threadId → waiting asides
+/** Threads with an injection or drain in flight: seam calls are awaited
+ * work, so two boundaries firing close together must not double-process
+ * the same words. */
+const inFlight = new Set();
+/** The mandatory non-steering envelope (audit §5.2). Every mid-turn channel
+ * OMB can ride is steering-branded, so the words themselves must say what
+ * they are: peer context from a named sender, not a course change. */
+export function asideEnvelope(fromName, text) {
+    // Peer words sit between fixed markers, and a peer cannot be allowed to
+    // forge the closing marker inside its own text: that would end the aside
+    // early and make the batched context ambiguous downstream.
+    const body = text.replace(/\[\s*end\s+aside\s*\]/gi, "(end aside)");
+    return [
+        `[aside from @${peerName(fromName)} — peer context, not steering; continue your current plan unless this directly changes a fact you are using]`,
+        body,
+        "[end aside]",
+    ].join("\n");
+}
+/** Rebuild the in-memory lane after a restart. Only rows whose dispatch
+ * never began come back; a row whose transcript already shows its queueId
+ * marker was injected before the process died, and those words must never
+ * run twice, so the row is retired instead of requeued. */
+export function restoreAsideMessages(store) {
+    asides.clear();
+    for (const row of chatFollowups("aside")) {
+        if (row.status !== "pending")
+            continue;
+        if (store.messagesFor(row.threadId).some((message) => message.queueId === row.id)) {
+            settleChatFollowups([row.id], null);
+            continue;
+        }
+        const entry = asides.get(row.threadId) ?? { botId: row.ownerId, items: [] };
+        if (entry.botId !== row.ownerId)
+            throw new Error("queued aside belongs to another bot");
+        entry.items.push({
+            messageId: row.id,
+            text: row.payload.text,
+            prompt: row.payload.prompt ?? row.payload.text,
+            aside: row.payload.aside ?? { fromBotId: row.ownerId, fromBotName: "teammate", commsDepth: 0 },
+            trigger: row.payload.trigger,
+        });
+        asides.set(row.threadId, entry);
+    }
+}
+/** Persist one aside and park it for injection. The row exists before any
+ * seam call so a crash can only ever re-queue words that never ran. */
+export function queueAsideMessage(botId, threadId, text, options) {
+    const id = newId();
+    const item = {
+        messageId: id,
+        text,
+        prompt: asideEnvelope(options.fromBotName, text),
+        aside: {
+            fromBotId: options.fromBotId,
+            fromBotName: options.fromBotName,
+            ...(options.unattended ? { unattended: true } : {}),
+            commsDepth: options.commsDepth,
+        },
+        trigger: options.trigger,
+    };
+    const entry = asides.get(threadId) ?? { botId, items: [] };
+    if (entry.botId !== botId)
+        throw new Error("queued aside belongs to another bot");
+    saveChatFollowup({
+        id,
+        kind: "aside",
+        ownerId: botId,
+        threadId,
+        payload: { text: item.text, prompt: item.prompt, aside: item.aside, ...(item.trigger ? { trigger: item.trigger } : {}) },
+    });
+    entry.items.push(item);
+    asides.set(threadId, entry);
+    return { id };
+}
+/** Everything waiting for this thread, in arrival order. */
+export function pendingAsides(botId, threadId) {
+    const entry = asides.get(threadId);
+    return entry?.botId === botId ? [...entry.items] : [];
+}
+/** Record delivered asides: one transcript line per item (enveloped text,
+ * queueId marker, peer provenance), then the durable rows are deleted. The
+ * marker write precedes the delete, so the crash window between them heals
+ * as "already injected" on restore rather than as a replay. */
+export function recordInjectedAsides(store, threadId, items) {
+    const appended = [];
+    for (const item of items) {
+        appended.push(store.appendMessage(threadId, {
+            role: "user",
+            kind: "text",
+            text: item.prompt,
+            queueId: item.messageId,
+            aside: true,
+            peerAsk: {
+                botId: item.aside.fromBotId,
+                name: item.aside.fromBotName,
+                ...(item.aside.unattended ? { unattended: true } : {}),
+            },
+        }));
+    }
+    settleChatFollowups(items.map((item) => item.messageId), null);
+    // The words are delivered and their rows retired; the in-memory lane must
+    // agree, or a later boundary would batch them into another injection.
+    const entry = asides.get(threadId);
+    if (entry) {
+        const delivered = new Set(items.map((item) => item.messageId));
+        const remaining = entry.items.filter((item) => !delivered.has(item.messageId));
+        if (remaining.length)
+            asides.set(threadId, { botId: entry.botId, items: remaining });
+        else
+            asides.delete(threadId);
+    }
+    return appended;
+}
+/** Drop a thread's waiting asides: the bot or task is gone, so no turn will
+ * ever read them. Tombstoned like a cancelled follow-up. */
+export function cancelAsides(threadId) {
+    const entry = asides.get(threadId);
+    if (!entry)
+        return;
+    settleChatFollowups(entry.items.map((item) => item.messageId), "cancelled");
+    asides.delete(threadId);
+}
+/** Fold everything waiting on this thread into its running turn.
+ *
+ * The rows are marked "dispatching" BEFORE the seam call: a crash at any
+ * point then leaves words the restart recovery path treats as may-have-run
+ * (recovered to the transcript with a review notice, never re-executed as
+ * a turn). "refused" — provably not delivered — returns them to "pending"
+ * so the next boundary can try again. "steered" and "indeterminate" both
+ * record delivery: the words may already be running, and running them
+ * twice is the one mistake this lane must never make.
+ *
+ * The batch leaves the shared queue BEFORE the seam call and stays out
+ * for the whole await: while the words may already be running inside the
+ * turn, no later boundary may be able to see them again, and a cancel
+ * landing mid-seam must not resurrect them. Only a "refused" outcome on a
+ * lane that is still ours puts the words back — ahead of anything that
+ * arrived during the call.
+ *
+ * Returns null when nothing is waiting or the thread is not this bot's;
+ * otherwise whether the batch was delivered and how many items it held. */
+export async function attemptAsideInjection(store, botId, threadId, inject) {
+    const entry = asides.get(threadId);
+    if (!entry || entry.botId !== botId || entry.items.length === 0)
+        return null;
+    if (inFlight.has(threadId))
+        return { delivered: false, count: entry.items.length };
+    const batch = entry.items;
+    entry.items = [];
+    const ids = batch.map((item) => item.messageId);
+    settleChatFollowups(ids, "dispatching");
+    inFlight.add(threadId);
+    let outcome;
+    try {
+        outcome = await inject(botId, threadId, batch.map((item) => item.prompt).join("\n\n"));
+    }
+    catch {
+        outcome = "indeterminate";
+    }
+    finally {
+        inFlight.delete(threadId);
+    }
+    if (outcome === "refused") {
+        if (asides.get(threadId) === entry) {
+            // Still our lane: back on the queue, ahead of anything that
+            // arrived during the seam call.
+            entry.items = [...batch, ...entry.items];
+            settleChatFollowups(ids, "pending");
+        }
+        else {
+            // cancelAsides took the lane while the seam call was awaited: the
+            // words never ran, but their lane is gone, so they retire with it
+            // instead of coming back as phantom rows after a restart.
+            settleChatFollowups(ids, "cancelled");
+        }
+        return { delivered: false, count: batch.length };
+    }
+    try {
+        recordInjectedAsides(store, threadId, batch);
+    }
+    catch (error) {
+        // The seam says the words may already be running; a failed transcript
+        // write must never hand them to a later boundary. Retire the rows
+        // loudly instead of replaying them.
+        console.error("aside-queue: could not record injected asides", error);
+        settleChatFollowups(ids, null);
+        if (asides.get(threadId) === entry && entry.items.length === 0)
+            asides.delete(threadId);
+    }
+    return { delivered: true, count: batch.length };
+}
+/**
+ * One boundary pass over the aside lane.
+ *
+ * Injection first: a thread already running a seam-capable turn gets every
+ * waiting aside folded in as ONE steer call (envelopes joined by a blank
+ * line — one boundary, one batch). Otherwise, when the thread is idle and
+ * unblocked, the asides degrade to a single enveloped follow-up turn, the
+ * same shape the steer-queue gives queued person messages. Callers run the
+ * steer drain before this one, so at a shared boundary the person's queued
+ * correction lands ahead of peer context.
+ */
+export async function drainAsideMessages(options) {
+    const { store, inject, run, isBlocked } = options;
+    for (const [threadId, entry] of asides) {
+        if (inFlight.has(threadId))
+            continue;
+        const bot = store.projectBotForTask
+            ? store.projectBotForTask(entry.botId, threadId)
+            : store.bot(entry.botId);
+        if (!bot) {
+            // the bot or task was deleted while the aside waited
+            cancelAsides(threadId);
+            continue;
+        }
+        if (bot.busy) {
+            // Seam attempt: one batched call for everything waiting here.
+            await attemptAsideInjection(store, entry.botId, threadId, inject);
+            continue;
+        }
+        if (isBlocked?.(entry.botId, threadId))
+            continue;
+        // Degrade to one follow-up turn. The entry leaves the map before
+        // anything runs, so a settle racing another settle can never fire the
+        // same asides twice.
+        const items = entry.items;
+        const ids = items.map((item) => item.messageId);
+        settleChatFollowups(ids, "dispatching");
+        asides.delete(threadId);
+        const appended = recordDegradedAsides(store, threadId, items);
+        const last = appended.at(-1);
+        if (!last) {
+            settleChatFollowups(ids, null);
+            continue;
+        }
+        const running = run(entry.botId, threadId, items.map((item) => item.prompt).join("\n\n"), last, appended.map((message) => message.id), { trigger: items[0].trigger, aside: items[0].aside });
+        void Promise.resolve(running).then(() => settleChatFollowups(ids, null), () => settleChatFollowups(ids, "interrupted")).catch((error) => console.warn("aside-queue: could not settle degraded aside", error));
+    }
+}
+/** Append the waiting asides as transcript lines for the degraded turn.
+ * Same record shape as injection — enveloped text, queueId marker, peer
+ * provenance — so both deliveries read identically downstream. */
+function recordDegradedAsides(store, threadId, items) {
+    const appended = [];
+    for (const item of items) {
+        appended.push(store.appendMessage(threadId, {
+            role: "user",
+            kind: "text",
+            text: item.prompt,
+            queueId: item.messageId,
+            aside: true,
+            peerAsk: {
+                botId: item.aside.fromBotId,
+                name: item.aside.fromBotName,
+                ...(item.aside.unattended ? { unattended: true } : {}),
+            },
+        }));
+    }
+    return appended;
+}
+/** Whether a thread currently has an injection or drain in flight. The
+ * arrival path uses this to stay honest ("queued") instead of racing a
+ * boundary pass that may be folding the same lane right now. */
+export function asideAttemptInFlight(threadId) {
+    return inFlight.has(threadId);
+}
+/** Test helper: how many asides remain queued for a thread. */
+export function _asideCount(threadId) {
+    return asides.get(threadId)?.items.length ?? 0;
+}

package/dist-server/server/attachments.js

@@ -61,6 +61,9 @@ const IMAGE_MIMES = {
  * despite using ZIP internally. The claimed mime determines the extension;
  * an attacker-controlled filename never does. */
 const FILE_MIMES = {
+    "video/mp4": ".mp4",
+    "video/webm": ".webm",
+    "video/quicktime": ".mov",
     "audio/opus": ".opus",
     "audio/ogg": ".ogg",
     "audio/mpeg": ".mp3",
@@ -539,6 +542,61 @@ export function saveImage(bytes, mime, requestedUploadId) {
         reservation.release();
     }
 }
+/** Persist one synthesized audio note. Providers return audio/mpeg buffers;
+ * the same atomic-write and quota discipline as saveImage applies, with a
+ * fixed .mp3 extension because the accepted mime determines it exactly. */
+export function saveAudio(bytes, mime) {
+    const normalized = mime.split(";")[0].trim().toLowerCase();
+    if (normalized !== "audio/mpeg") {
+        throw Object.assign(new Error("unsupported audio type"), { status: 400 });
+    }
+    if (bytes.byteLength === 0)
+        throw Object.assign(new Error("empty audio"), { status: 400 });
+    if (bytes.byteLength > FILE_MAX_BYTES) {
+        throw Object.assign(new Error(`audio exceeds ${FILE_MAX_BYTES} bytes`), { status: 413 });
+    }
+    ensureAttachmentsDir();
+    const reservation = new AttachmentReservation();
+    reservation.reserve(bytes.byteLength);
+    const id = randomUUID();
+    const name = `${id}.mp3`;
+    const path = join(ATTACHMENTS_DIR, name);
+    const partialPath = join(ATTACHMENTS_DIR, `.openmaus-upload-${id}-${randomUUID()}.partial`);
+    activePartials.add(partialPath);
+    let partialCleanupFailed = false;
+    try {
+        writeFileSync(partialPath, bytes, { mode: 0o600, flag: "wx" });
+        try {
+            linkSync(partialPath, path);
+            addCommittedBytes(bytes.byteLength);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const saved = readFileSync(path);
+            if (!saved.equals(bytes)) {
+                throw Object.assign(new Error("audio destination already exists with different bytes"), { status: 409 });
+            }
+        }
+        unlinkSync(partialPath);
+        return { path, mime: normalized, bytes: bytes.byteLength };
+    }
+    catch (error) {
+        try {
+            unlinkSync(partialPath);
+        }
+        catch {
+            partialCleanupFailed = true;
+        }
+        throw error;
+    }
+    finally {
+        activePartials.delete(partialPath);
+        if (partialCleanupFailed)
+            invalidateAttachmentAccounting();
+        reservation.release();
+    }
+}
 /** HTTP uploads take the same per-ID lock as streamed files. saveImage stays
  * synchronous for generated avatars, while this wrapper prevents an image
  * and a document using the same caller-supplied UUID from committing with
@@ -567,7 +625,7 @@ export function attachmentExists(name) {
  * filename (no separators, no dotfiles) inside ATTACHMENTS_DIR resolve —
  * the route must never become a general file server for the data dir. */
 export function readAttachment(name) {
-    if (!/^[A-Za-z0-9-]+\.(png|jpg|jpeg|gif|webp)$/.test(name))
+    if (!/^[A-Za-z0-9-]+\.(png|jpg|jpeg|gif|webp|mp3)$/.test(name))
         return null;
     const path = join(ATTACHMENTS_DIR, name);
     if (extname(path) === ".jpeg")
@@ -589,7 +647,46 @@ function mimeForExt(ext) {
             return "image/gif";
         case ".webp":
             return "image/webp";
+        case ".mp3":
+            return "audio/mpeg";
         default:
             return "application/octet-stream";
     }
 }
+/** Parse a single `bytes=` range against a stored audio file. Only the
+ * canonical shapes a player sends are honored: `a-b`, `a-`, and `-n`
+ * (the last-n-bytes suffix). Anything else — commas, letters, reversed
+ * bounds, internal spaces — reads as "not understood" and the caller sends
+ * the whole file, which is always a correct answer to a GET. */
+export function parseAudioRange(header, size) {
+    const raw = header?.trim();
+    if (!raw)
+        return { kind: "none" };
+    const m = raw.match(/^bytes=(\d*)-(\d*)$/);
+    if (!m)
+        return { kind: "none" };
+    const [, rawStart, rawEnd] = m;
+    if (rawStart === "") {
+        // `bytes=-` carries no bounds at all: malformed input, not a suffix
+        // range, so the caller answers with the whole file. A real zero-length
+        // suffix (`bytes=-0`) stays unsatisfiable below, per RFC 9110.
+        if (rawEnd === "")
+            return { kind: "none" };
+        // suffix range: the final n bytes; zero is unsatisfiable by definition
+        const suffix = Number(rawEnd);
+        if (!suffix)
+            return { kind: "unsatisfiable" };
+        if (size === 0)
+            return { kind: "unsatisfiable" };
+        return { kind: "range", start: Math.max(0, size - suffix), end: size - 1 };
+    }
+    const start = Number(rawStart);
+    if (start >= size)
+        return { kind: "unsatisfiable" };
+    if (rawEnd === "")
+        return { kind: "range", start, end: size - 1 };
+    const end = Number(rawEnd);
+    if (end < start)
+        return { kind: "none" };
+    return { kind: "range", start, end: Math.min(end, size - 1) };
+}

package/dist-server/server/auto-approve.js

@@ -4,8 +4,7 @@
 // provider's own permission mode passed straight through (Claude `auto`,
 // Grok `--permission-mode`, Codex `approvalsReviewer`, …), and a request that
 // reaches this process is one the provider left for a person. The only
-// verdict the app synthesizes is Full access, because that level is the
-// person's explicit, separately confirmed grant to answer every prompt.
+// grants the app applies are Full access and the person's exact saved commands.
 // Questions never come through here: a bot's question always reaches a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
 /** A failed delivery is a runtime error, not another permission decision.
@@ -55,7 +54,7 @@ export function delegationInheritsFullAccess(input) {
 // the permission path in permission-proxy). Approving it there does not
 // produce an answer: the CLI runs the tool with none and the model is told
 // "The user did not answer the questions." — a question silently lost.
-const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user"]);
+const ASKS_A_PERSON = new Set(["askuserquestion", "ask_user", "omb-ask"]);
 export function autoVerdict(mode, tool, context) {
     // A question is for a person, whatever channel it arrived on — and
     // whatever the mode: even Full has no answer to give, only an approval
@@ -70,6 +69,8 @@ export function autoVerdict(mode, tool, context) {
         return { approve: `approved ${tool} (full access)`, source: "full-access" };
     if (context?.requiresExplicitApproval)
         return { approve: null, source: "explicit-approval-block" };
+    if (context?.commandAllowed)
+        return { approve: `approved ${tool} (saved command)`, source: "command-allowlist" };
     if (mode === "auto" || mode === "custom")
         return { approve: null, source: "native-approval" };
     return { approve: null, source: "no-grant" };

package/dist-server/server/auto-vm-claims.js

@@ -18,5 +18,6 @@ export function startAutoVmClaim(table, threadId, generation) {
     slot.begin = slot.claim().then(() => { slot.claimed = true; }, (error) => {
         slot.failed = true;
         slot.failure = error instanceof Error ? error.message : String(error);
+        slot.onRejected?.(slot.failure);
     });
 }