openmausbot 0.1.86 → 0.1.88

package/dist-server/server/composio.js

@@ -5,6 +5,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
 import { managedConnectorUnavailableReason } from "../shared/connector-availability.js";
+import { CONNECTOR_TOOL_NAME_PATTERN } from "../shared/wire.js";
+import { CONNECTOR_ALLOWED_TOOLS_ENV, CONNECTOR_ALLOWED_TOOLS_MAX_BYTES, CONNECTOR_SERVICE_SLUGS_ENV, CONNECTOR_SERVICE_SLUGS_MAX_BYTES, serializeConnectorAllowedTools, serializeConnectorServiceSlugs, } from "./connector-advertisement.js";
+import { serviceSlugFor, serviceSlugForCandidates } from "./connector-verdict.js";
 const DEFAULT_BACKEND_ORIGIN = "https://backend.composio.dev";
 function apiBase() {
     return (process.env.OMB_COMPOSIO_API ?? `${DEFAULT_BACKEND_ORIGIN}/api/v3.1`).replace(/\/$/, "");
@@ -443,6 +446,30 @@ const NEEDS_AUTH_CONFIG = /does not manage auth|auth[_ ]?config/i;
 export async function mcpIntegration(cfg, context) {
     if (!configured(cfg))
         return null;
+    // Connector grants 3/5: a grants record rides to the bridge as a capped
+    // JSON env var so tools/list is filtered down to what the bot may call.
+    // No record (legacy all-tools bots) or one past the cap mounts without
+    // the var — the bridge then relays the unfiltered list and every call is
+    // still judged by the slice-2 verdict on the relay endpoint.
+    const allowlist = context.connectorTools === undefined
+        ? undefined
+        : serializeConnectorAllowedTools(context.connectorTools);
+    if (allowlist?.oversized) {
+        console.warn(`[composio] connector allowlist for bot ${context.botId} exceeds ${CONNECTOR_ALLOWED_TOOLS_MAX_BYTES} bytes;`
+            + " tools/list stays unfiltered and grants are enforced per call");
+    }
+    // The connected-service slugs ride alongside the allowlist so the
+    // bridge resolves underscored services (bland_ai) instead of letting a
+    // plain-prefix grant (bland) widen them. An unreachable catalog omits
+    // the var and the filter keeps its plain-split fallback; legacy
+    // all-tools bots mount without it because their list is unfiltered.
+    const serviceSlugs = context.connectorTools === undefined
+        ? undefined
+        : serializeConnectorServiceSlugs(await connectedServiceSlugs(cfg));
+    if (serviceSlugs?.oversized) {
+        console.warn(`[composio] connector service slugs for bot ${context.botId} exceed ${CONNECTOR_SERVICE_SLUGS_MAX_BYTES} bytes;`
+            + " tools/list falls back to plain-prefix resolution");
+    }
     return {
         command: process.execPath,
         args: [SPAWNED_PROXIES.connectors],
@@ -460,6 +487,8 @@ export async function mcpIntegration(cfg, context) {
             OMB_CONNECTOR_TOKEN: context.commsToken,
             OMB_BOT_ID: context.botId,
             OMB_THREAD_ID: context.threadId,
+            ...(allowlist?.env ? { [CONNECTOR_ALLOWED_TOOLS_ENV]: allowlist.env } : {}),
+            ...(serviceSlugs?.env ? { [CONNECTOR_SERVICE_SLUGS_ENV]: serviceSlugs.env } : {}),
         },
     };
 }
@@ -672,6 +701,266 @@ export async function connectedServices(cfg) {
     ]);
     return allServiceStates(summarizeAccounts(accounts, []), toolkits);
 }
+/** Semantic validation for a connectorTools patch (issue #1737): slugs
+ * must name a connected service, and every listed tool name must carry its
+ * own service prefix (GMAIL_SEND_EMAIL under "gmail") — a mismatched name
+ * would be granted yet permanently refused at call time. The prefix check
+ * resolves against the connected-service slugs, so an underscored service
+ * (bland_ai) keeps its BLAND_AI_* names and a plain-prefix grant cannot
+ * capture them; it always runs, degrading to the plain split when the
+ * connection inventory is unreachable. Only the connection-dependent and
+ * catalog checks fail open — an unreachable connection inventory, the
+ * curated fallback, or a catalog walk that did not reach its end never
+ * block the patch, because call-time enforcement (slice 2) stays the
+ * authority either way. Returns the rejection message or null. */
+export async function validateConnectorGrants(cfg, grants) {
+    const connected = await connectedServices(cfg).catch(() => null);
+    const candidates = connected ? Object.keys(connected) : [];
+    for (const [slug, grant] of Object.entries(grants)) {
+        if (grant.tools === "*")
+            continue;
+        // The prefix check runs against the connected-service slugs, so an
+        // underscored service (bland_ai) accepts its own BLAND_AI_* names —
+        // and a plain-prefix grant cannot capture them while the real service
+        // is connected.
+        const misplaced = grant.tools.filter((tool) => (serviceSlugForCandidates(tool, candidates) ?? serviceSlugFor(tool)) !== slug);
+        if (misplaced.length) {
+            return `connectorTools.${slug}.tools names tools that belong to another service: ${misplaced.join(", ")}`;
+        }
+    }
+    if (!connected)
+        return null;
+    const unconnected = Object.keys(grants).filter((slug) => !connected[slug]?.connected);
+    if (unconnected.length) {
+        return `connectorTools names services that are not connected: ${unconnected.join(", ")}`;
+    }
+    const catalog = await listToolkits(cfg);
+    // source "curated" means the marketplace was unreachable, and a walk that
+    // never reached its natural end served only part of it — either way there
+    // is nothing trustworthy to cross-check against, and a grant for a service
+    // on a page the walk never saw must not be rejected.
+    if (catalog.source !== "api" || !catalog.pagination?.complete)
+        return null;
+    const known = new Set(catalog.cards.map((card) => card.slug.toLowerCase()));
+    const unknown = Object.keys(grants).filter((slug) => !known.has(slug));
+    if (unknown.length) {
+        return `connectorTools names services missing from the connected-apps catalog: ${unknown.join(", ")}`;
+    }
+    return null;
+}
+/** The grant editor's tool inventory, grouped by service slug. Sourced from
+ * the same MCP endpoint the bots' bridge relays to (initialize + tools/list
+ * through relayMcp), so what the picker offers is exactly what a granted bot
+ * would see — in self-hosted and managed modes alike. Platform meta-tools
+ * and per-service connection flows are not per-tool grants (they ride along
+ * whenever a service is granted), so they never appear in the picker. */
+export async function listConnectorTools(cfg, options = {}) {
+    const identity = connectorToolsIdentity(cfg);
+    if (!options.force && connectorToolsCache?.identity === identity
+        && Date.now() - connectorToolsCache.at < CONNECTOR_TOOLS_CACHE_MS) {
+        return connectorToolsCache.services;
+    }
+    // Concurrent misses share one MCP walk — two editors opening together
+    // must not run the initialize + tools/list sequences twice. force
+    // bypasses the settled cache but still joins a walk already running.
+    if (connectorToolsRequest?.identity === identity)
+        return connectorToolsRequest.services;
+    const walk = collectConnectorTools(cfg).then((services) => {
+        connectorToolsCache = { at: Date.now(), identity, services };
+        return services;
+    });
+    connectorToolsRequest = { identity, services: walk };
+    try {
+        return await walk;
+    }
+    finally {
+        if (connectorToolsRequest?.services === walk)
+            connectorToolsRequest = null;
+    }
+}
+const CONNECTOR_TOOLS_CACHE_MS = 60_000;
+let connectorToolsCache = null;
+/** Which backend an inventory walk belongs to, mirroring the relay's own
+ * credential fingerprint: a project key or the managed broker. Cached
+ * inventories are keyed by it, so a config switch can never serve the
+ * previous backend's tools for another cache window. */
+function connectorToolsIdentity(cfg) {
+    const apiKey = projectApiKey(cfg);
+    if (apiKey)
+        return backendFingerprint("project-tools", apiBase(), apiKey);
+    const broker = brokerAccess();
+    return broker ? backendFingerprint("managed-tools", broker.url, broker.token) : "none";
+}
+let connectorToolsRequest = null;
+/** The service slugs grant enforcement resolves tool-name prefixes
+ * against: every key of the connection inventory, connected or not,
+ * because the real backend slugs are what separates an underscored
+ * service (bland_ai) from a plain-prefix grant (bland). Cached like the
+ * tool inventory — 60s, keyed by backend identity, one shared in-flight
+ * walk — and an unreachable inventory reads as an empty list without
+ * caching the failure, so callers fall back to the plain split and the
+ * next call retries. */
+export async function connectedServiceSlugs(cfg) {
+    const identity = connectorToolsIdentity(cfg);
+    if (connectorServiceSlugsCache?.identity === identity
+        && Date.now() - connectorServiceSlugsCache.at < CONNECTOR_SERVICE_SLUGS_CACHE_MS) {
+        return connectorServiceSlugsCache.slugs;
+    }
+    if (connectorServiceSlugsRequest?.identity === identity)
+        return connectorServiceSlugsRequest.slugs;
+    const walk = connectedServices(cfg).then((services) => {
+        const slugs = Object.keys(services);
+        connectorServiceSlugsCache = { at: Date.now(), identity, slugs };
+        return slugs;
+    }, () => []);
+    connectorServiceSlugsRequest = { identity, slugs: walk };
+    try {
+        return await walk;
+    }
+    finally {
+        if (connectorServiceSlugsRequest?.slugs === walk)
+            connectorServiceSlugsRequest = null;
+    }
+}
+const CONNECTOR_SERVICE_SLUGS_CACHE_MS = 60_000;
+let connectorServiceSlugsCache = null;
+let connectorServiceSlugsRequest = null;
+/** Tool names longer than any Composio description worth searching. */
+const TOOL_DESCRIPTION_MAX = 240;
+const TOOLS_LIST_PAGES_MAX = 10;
+function connectorToolListing(tool) {
+    if (!tool || typeof tool !== "object" || Array.isArray(tool))
+        return null;
+    const name = tool.name;
+    if (typeof name !== "string" || !CONNECTOR_TOOL_NAME_PATTERN.test(name))
+        return null;
+    if (name.startsWith("COMPOSIO_"))
+        return null;
+    if (name.endsWith("_MANAGE_CONNECTIONS") || name.endsWith("_WAIT_FOR_CONNECTIONS"))
+        return null;
+    const description = tool.description;
+    const trimmed = typeof description === "string"
+        ? description.replace(/\s+/g, " ").trim().slice(0, TOOL_DESCRIPTION_MAX)
+        : "";
+    return trimmed ? { name, description: trimmed } : { name };
+}
+/** One JSON-RPC response frame from a JSON or SSE body, mirroring the
+ * bridge's parseUpstream: SSE data lines are tried in order and the frame
+ * carrying the request id wins. */
+function parseMcpResponse(text, id) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    const candidate = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+    if (trimmed.startsWith("{")) {
+        const parsed = JSON.parse(trimmed);
+        return candidate(parsed) ? parsed : null;
+    }
+    const frames = trimmed
+        .split(/\r?\n/)
+        .filter((line) => line.startsWith("data:"))
+        .map((line) => line.slice(5).trim())
+        .filter((line) => line && line !== "[DONE]")
+        .flatMap((line) => {
+        try {
+            return [JSON.parse(line)];
+        }
+        catch {
+            return [];
+        }
+    })
+        .filter(candidate);
+    return frames.findLast((frame) => frame.id === id) ?? frames.at(-1) ?? null;
+}
+async function collectConnectorTools(cfg) {
+    // Connected services are the real slugs, so they resolve underscored
+    // services (bland_ai) the plain split would file under "bland"; an
+    // unreachable inventory degrades to that split.
+    const connected = await connectedServices(cfg).catch(() => null);
+    const candidates = connected ? Object.keys(connected) : [];
+    const initialize = await relayMcp(cfg, {
+        jsonrpc: "2.0",
+        id: "omb-grants-initialize",
+        method: "initialize",
+        params: {
+            protocolVersion: "2025-03-26",
+            capabilities: {},
+            clientInfo: { name: "openmausbot-grant-editor", version: "1" },
+        },
+    });
+    if (initialize.status !== 200) {
+        throw new Error(await responseErrorFromBytes(initialize.status, initialize.bytes));
+    }
+    const transportSessionId = initialize.transportSessionId;
+    // Streamable-HTTP servers expect the handshake notification before the
+    // first request; it carries no response, so failures are not fatal.
+    await relayMcp(cfg, {
+        jsonrpc: "2.0",
+        method: "notifications/initialized",
+    }, transportSessionId).catch(() => undefined);
+    const grouped = new Map();
+    let cursor;
+    for (let page = 0; page < TOOLS_LIST_PAGES_MAX; page += 1) {
+        const list = await relayMcp(cfg, {
+            jsonrpc: "2.0",
+            id: "omb-grants-tools",
+            method: "tools/list",
+            params: cursor ? { cursor } : {},
+        }, transportSessionId);
+        if (list.status !== 200) {
+            throw new Error(await responseErrorFromBytes(list.status, list.bytes));
+        }
+        const frame = parseMcpResponse(new TextDecoder().decode(list.bytes), "omb-grants-tools");
+        const error = frame && typeof frame.error === "object" && frame.error !== null
+            ? frame.error.message
+            : undefined;
+        if (typeof error === "string" && error)
+            throw new Error(error);
+        const result = frame && typeof frame.result === "object" && frame.result !== null
+            ? frame.result
+            : undefined;
+        if (!result || !Array.isArray(result.tools)) {
+            throw new Error("Composio returned a tools/list response without a tools array");
+        }
+        for (const tool of result.tools) {
+            const listing = connectorToolListing(tool);
+            if (!listing)
+                continue;
+            const slug = serviceSlugForCandidates(listing.name, candidates) ?? serviceSlugFor(listing.name);
+            if (!slug)
+                continue;
+            const bucket = grouped.get(slug) ?? [];
+            if (!bucket.some((existing) => existing.name === listing.name))
+                bucket.push(listing);
+            grouped.set(slug, bucket);
+        }
+        cursor = typeof result.nextCursor === "string" && result.nextCursor ? result.nextCursor : undefined;
+        if (!cursor)
+            break;
+    }
+    for (const bucket of grouped.values())
+        bucket.sort((a, b) => a.name.localeCompare(b.name));
+    return Object.fromEntries([...grouped.entries()].sort(([a], [b]) => a.localeCompare(b)));
+}
+async function responseErrorFromBytes(status, bytes) {
+    try {
+        const body = JSON.parse(new TextDecoder().decode(bytes));
+        const message = body && typeof body === "object" && !Array.isArray(body)
+            ? body.error
+            : undefined;
+        if (message && typeof message === "object" && !Array.isArray(message)) {
+            const text = message.message;
+            if (typeof text === "string" && text)
+                return text;
+        }
+        if (typeof message === "string" && message)
+            return message;
+    }
+    catch {
+        // fall through to the generic status line
+    }
+    return `Composio tools/list: HTTP ${status}`;
+}
 export async function connectionStatus(cfg, slugs) {
     const canonicalSlugs = [...new Set(slugs.map(canonicalToolkitSlug))];
     const apiKey = projectApiKey(cfg);
@@ -989,9 +1278,16 @@ export async function listToolkits(cfg) {
                 const pagingStoppedEarly = lastReportedPage !== undefined
                     && reportedTotalPages !== undefined
                     && lastReportedPage < reportedTotalPages;
-                const pagination = { items: uniqueCards.length, stalled: shortOfReportedTotal || pagingStoppedEarly };
+                const stalled = shortOfReportedTotal || pagingStoppedEarly;
+                // "end" and "total-reached" are the walk's natural finishes; every
+                // other stop reason left pages unread even when the API reports no
+                // totals for stalled to compare against.
+                const complete = (stop === "end" || stop === "total-reached") && !stalled;
+                const pagination = { items: uniqueCards.length, stalled, complete };
                 if (reportedTotalItems !== undefined)
                     pagination.totalItems = reportedTotalItems;
+                if (pagination.stalled)
+                    pagination.reason = stop;
                 if (pagination.stalled) {
                     console.warn(`[composio] marketplace catalog paging stopped early (${stop}) after ${uniqueCards.length} toolkits`
                         + (reportedTotalItems !== undefined ? ` of ~${reportedTotalItems}` : "")

package/dist-server/server/computer-wait.js

@@ -7,8 +7,17 @@
 // that, name the holder as a bot running a thread, and keep the same words
 // on every surface (chat chip, room chip, the gate's refusal) so a person
 // who has read it once recognises it everywhere.
-/** Whole minutes, or seconds under one minute, for the give-up notice. */
-const minutes = (ms) => ms >= 60_000 ? `${Math.round(ms / 60_000)} minutes` : `${Math.round(ms / 1000)} seconds`;
+/** Whole minutes, or seconds under one minute, singular at exactly one. */
+const minutes = (ms) => {
+    const value = ms >= 60_000 ? Math.round(ms / 60_000) : Math.round(ms / 1000);
+    const unit = ms >= 60_000 ? "minute" : "second";
+    return `${value} ${unit}${value === 1 ? "" : "s"}`;
+};
+/** How long a wait lasted, for the resolution line: waits under a second
+ * are honest about being over in a blink instead of claiming "0 seconds". */
+export function computerWaitDuration(ms) {
+    return ms < 1_000 ? "under a second" : minutes(ms);
+}
 const holderPhrase = (holder) => holder.task ? `${holder.name} is running ${holder.task}` : `${holder.name} is using it`;
 /** The chip a turn shows while it is queued behind another turn's desktop. */
 export function computerWaitingText(holder) {
@@ -16,14 +25,18 @@ export function computerWaitingText(holder) {
         return "Waiting for its turn on this computer. Starts automatically when it is free.";
     return `Waiting for its turn on this computer — ${holderPhrase(holder)}. Starts automatically when that finishes.`;
 }
-/** The same chip once the wait landed and this turn holds the desktop. */
-export function computerFreeText() {
-    return "Computer free — continuing";
+/** The resolution appended once the wait landed and this turn holds the
+ * desktop: how long it waited, and who held it. The waiting chip stays as
+ * written — this line is the history beside it, not its replacement. */
+export function computerFreeAfterText(holder, waitedMs) {
+    const who = holder ? ` (${holder.task ? `${holder.name} · ${holder.task}` : holder.name} held it)` : "";
+    return `Computer free — continuing after waiting ${computerWaitDuration(waitedMs)}${who}`;
 }
-/** The same chip when the wait ended without the desktop: the turn was
- * stopped, or the claim was abandoned. */
-export function computerWaitEndedText() {
-    return "Stopped waiting for the computer";
+/** The resolution appended when the wait ended because the turn was stopped
+ * or its claim was cancelled. */
+export function computerStoppedWaitingText(holder, waitedMs) {
+    const who = holder ? ` — ${holderPhrase(holder)}` : "";
+    return `Stopped waiting for the computer after ${computerWaitDuration(waitedMs)}${who}.`;
 }
 /** The error after the wait ceiling: still names who holds it, and says
  * what a person can do — stop that turn, or move this one. */

package/dist-server/server/config.js

@@ -7,6 +7,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { normalizeImageGenerationUrl } from "../shared/image-generation.js";
 import { writeFileAtomic } from "./atomic.js";
+import { newBotDefaultsSchema } from "./new-bot-defaults.js";
 import { EFFORT_LEVELS } from "../shared/wire.js";
 import { isModelVariant } from "./contracts.js";
 import { PROVIDER_ICON_PRESETS, providerIconError } from "../shared/provider-icon.js";
@@ -32,7 +33,7 @@ export const MAX_THREAD_EVENT_LOG_BYTES = 4 * 1024 * 1024 * 1024;
 export const DEFAULT_LOCAL_VM_MODE = "shared";
 export const DEFAULT_LOCAL_VM_MAX_INSTANCES = 2;
 export const MIN_LOCAL_VM_MAX_INSTANCES = 1;
-export const MAX_LOCAL_VM_MAX_INSTANCES = 4;
+export const MAX_LOCAL_VM_MAX_INSTANCES = 8;
 export function isValidSshAlias(value) {
     return typeof value === "string" && SSH_ALIAS.test(value);
 }
@@ -289,8 +290,8 @@ const instanceConfigSchema = z.object({
 });
 const instanceConfigMapSchema = z.record(z.string(), instanceConfigSchema);
 const defaultModelSelectionSchema = z.object({
-    instanceId: z.string().trim().min(1),
-    model: z.string().trim().min(1),
+    instanceId: z.string().trim().min(1).max(200),
+    model: z.string().trim().min(1).max(500),
     effort: z.enum(EFFORT_LEVELS).optional(),
     variant: z.string().refine(isModelVariant, "invalid model variant").optional(),
 }).refine((selection) => selection.variant === undefined || selection.effort === undefined, "choose either a model variant or an effort level");
@@ -303,6 +304,15 @@ const threadsConfigSchema = z.object({
      * Absent keeps them forever. */
     eventLogRetentionDays: z.number().int().min(1).max(3650).optional(),
 }).strict();
+/** Workspace-wide defaults every new bot starts with (Store.createBot). */
+const newBotsConfigSchema = z.object({
+    /** Effort for a new bot whose model selection names none. */
+    effort: z.enum(EFFORT_LEVELS).optional(),
+}).strict();
+/** PATCH newBots: null clears a default back to absent (no level is sent). */
+const newBotsPatchSchema = z.object({
+    effort: newBotsConfigSchema.shape.effort.nullable(),
+}).strict();
 /** PATCH threads: every knob is independently patchable, and null clears an
  * event-log knob back to its absent (off) default. */
 const threadsPatchSchema = threadsConfigSchema.extend({
@@ -317,12 +327,15 @@ const appConfigSchema = z.object({
      * addresses or `@domain` entries; admins get every scope, members chat only. */
     signIn: z.object({ admins: z.array(z.string().max(320)).max(500).optional(), members: z.array(z.string().max(320)).max(5000).optional() }).optional(),
     defaultModelSelection: defaultModelSelectionSchema.optional(),
+    newBotDefaults: newBotDefaultsSchema.optional(),
+    newBots: newBotsConfigSchema.optional(),
     /** CLI-only launch preferences. Never enable remote access implicitly. */
     cliStartup: z.object({
         access: z.enum(["local", "tunnel", "tailscale", "public-url"]),
         publicUrl: z.string().url().optional(),
         phone: z.enum(["ios", "android"]).optional(),
     }).optional(),
+    mistral: z.object({ key: optionalText }).optional(),
     xai: z.object({ key: optionalText, url: optionalText }).optional(),
     /** Anthropic API key for Claude Code billed per token, handed only to
      * Claude instances; `url` only for a proxy or a test double. Never a
@@ -400,8 +413,8 @@ const appConfigSchema = z.object({
         }).optional(),
         customModel: z.string().trim().max(200).refine((value) => !["\r", "\n", "\0"].some((character) => value.includes(character)), "Use a model ID without control characters").optional(),
     }).optional(),
-    /** Non-secret profile details shown in the sidebar. */
-    profile: z.object({ name: optionalText, email: optionalText }).optional(),
+    /** Non-secret profile details; aboutMe is shared with every bot. */
+    profile: z.object({ name: optionalText, email: optionalText, aboutMe: z.string().max(24_000).optional() }).optional(),
     /** UI language override (BCP-47, lowercase). Empty/absent = follow the
      * system language. Unknown tags degrade to English in the renderer. */
     language: optionalText,
@@ -432,7 +445,7 @@ const storedAppConfigSchema = appConfigSchema.extend({
     browserProfiles: storedBrowserProfilesSchema.optional(),
 });
 const appConfigPatchSchema = appConfigSchema.omit({ instances: true, mcpServers: true, cliStartup: true, customDomain: true })
-    .extend({ threads: threadsPatchSchema.optional() });
+    .extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() });
 const jsonObjectSchema = z.record(z.string(), z.json());
 /** Resolve a canonical profile record to its exact durable Electron
  * partition identity. Callers must never substitute the display/API id. */
@@ -670,13 +683,35 @@ function migrateLegacyFeatureFlags() {
         console.error(`[config] could not rename features.skillRecorder: ${error instanceof Error ? error.message : String(error)}`);
     }
 }
+/** The last "config.json is being ignored" warning, so a file that stays
+ * broken is reported once rather than on every loadConfig() call. */
+let lastIgnoredConfigWarning = "";
 export function loadConfig() {
     let cfg = {};
     try {
         cfg = parseStoredConfig(parseJson(readFileSync(join(DATA_DIR, "config.json"), "utf8")));
+        lastIgnoredConfigWarning = "";
     }
-    catch {
-        /* first run — env fallbacks below */
+    catch (error) {
+        // No file yet is a normal first run: env fallbacks below. Any other failure
+        // (unreadable file, invalid JSON, a schema error in one field) means the
+        // whole file is being ignored for this process — every instance, account
+        // and setting in it — so say why instead of silently running on defaults.
+        // saveConfig() still merges into the raw file, so nothing on disk is lost;
+        // the user just needs to know which field to fix.
+        if (error?.code !== "ENOENT") {
+            // JSON.parse includes a fragment of the input in some error messages.
+            // A malformed credential must never be copied into the server log.
+            const reason = error instanceof SyntaxError ? "invalid JSON"
+                : error instanceof Error ? error.message : "unable to read configuration";
+            const warning = `config: ignoring ${join(DATA_DIR, "config.json")} and using defaults: ${reason}`;
+            if (warning !== lastIgnoredConfigWarning)
+                console.warn(warning);
+            lastIgnoredConfigWarning = warning;
+        }
+        else {
+            lastIgnoredConfigWarning = "";
+        }
     }
     // Env wins over the file for every credential. The desktop shell keeps
     // these secrets OS-encrypted and hands them to this process as env at
@@ -685,6 +720,9 @@ export function loadConfig() {
     // Anything that saves a credential mid-session must keep process.env in
     // step (syncCredentialEnv below), or the value injected at boot would
     // shadow the save until the next launch.
+    cfg.mistral = { ...cfg.mistral };
+    if (process.env.MISTRAL_API_KEY !== undefined)
+        cfg.mistral.key = process.env.MISTRAL_API_KEY;
     cfg.xai = { ...cfg.xai };
     if (process.env.XAI_API_KEY !== undefined)
         cfg.xai.key = process.env.XAI_API_KEY;
@@ -746,6 +784,7 @@ export function loadConfig() {
 export function syncCredentialEnv(patch) {
     const secrets = [
         [patch.xai?.key, "XAI_API_KEY"],
+        [patch.mistral?.key, "MISTRAL_API_KEY"],
         [patch.anthropic?.key, "OMB_ANTHROPIC_API_KEY"],
         [patch.openaiCompat?.key, "OPENAI_COMPAT_API_KEY"],
         [patch.composio?.apiKey, "COMPOSIO_API_KEY"],
@@ -788,6 +827,7 @@ export function syncCredentialEnv(patch) {
  * child these are someone else's keys riding along in `...process.env`. */
 export const WORKSPACE_CREDENTIAL_ENV = [
     "XAI_API_KEY",
+    "MISTRAL_API_KEY",
     "OMB_ANTHROPIC_API_KEY",
     "OMB_ANTHROPIC_API_URL",
     "OMB_HOSTED_MODEL_TOKEN",
@@ -850,6 +890,7 @@ export const PROVIDER_CREDENTIAL_ENV = [
     "OPENAI_API_KEY",
     "OPENCODE_API_KEY",
     "XAI_API_KEY",
+    "MISTRAL_API_KEY",
     "CURSOR_API_KEY",
     "CURSOR_AUTH_TOKEN",
 ];
@@ -874,7 +915,7 @@ export function saveConfig(patch, options = {}) {
     catch {
         /* first write */
     }
-    const checkedPatch = appConfigSchema.partial().extend({ threads: threadsPatchSchema.optional() }).parse(patch);
+    const checkedPatch = appConfigSchema.partial().extend({ threads: threadsPatchSchema.optional(), newBots: newBotsPatchSchema.optional() }).parse(patch);
     const before = configSaveListeners.size ? structuredClone(disk) : disk;
     // A write is the durable migration point. Preserve every other raw key in
     // config.json, but never write #567's mixed-case or duplicate profile ids
@@ -882,7 +923,7 @@ export function saveConfig(patch, options = {}) {
     const storedProfiles = storedBrowserProfilesSchema.safeParse(disk.browserProfiles);
     if (storedProfiles.success)
         disk.browserProfiles = storedProfiles.data;
-    for (const key of ["xai", "anthropic", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine"]) {
+    for (const key of ["xai", "anthropic", "mistral", "openaiCompat", "composio", "box", "opencodeGo", "tts", "imageGen", "profile", "rooms", "threads", "context", "localVm", "features", "budgets", "billing", "decisions", "onboarding", "browserEngine", "newBots"]) {
         const section = checkedPatch[key];
         if (!section)
             continue;
@@ -894,8 +935,9 @@ export function saveConfig(patch, options = {}) {
         if (key === "threads" && !current.success)
             merged.maxConcurrentPerBot = DEFAULT_MAX_CONCURRENT_BOT_THREADS;
         Object.assign(merged, section);
-        // null is the patch's explicit "remove this key" marker (today only the
-        // threads event-log knobs use it); a key the patch omits keeps its value.
+        // null is the patch's explicit "remove this key" marker (the threads
+        // event-log knobs and newBots.effort use it); a key the patch omits
+        // keeps its value.
         for (const [sectionKey, sectionValue] of Object.entries(section)) {
             if (sectionValue === null)
                 delete merged[sectionKey];
@@ -915,6 +957,24 @@ export function saveConfig(patch, options = {}) {
     // an effort level omitted from the new selection.
     if (checkedPatch.defaultModelSelection !== undefined) {
         disk.defaultModelSelection = checkedPatch.defaultModelSelection;
+        if (disk.newBotDefaults) {
+            const previousDefaults = newBotDefaultsSchema.parse(disk.newBotDefaults);
+            disk.newBotDefaults = newBotDefaultsSchema.parse({
+                ...previousDefaults,
+                profile: { ...previousDefaults.profile, modelSelection: checkedPatch.defaultModelSelection },
+            });
+        }
+    }
+    // Replace the complete template so clearing a field, file or routine
+    // cannot revive an old value through the general section merge above.
+    if (checkedPatch.newBotDefaults !== undefined) {
+        disk.newBotDefaults = checkedPatch.newBotDefaults;
+        if (checkedPatch.newBotDefaults.profile.modelSelection) {
+            disk.defaultModelSelection = checkedPatch.newBotDefaults.profile.modelSelection;
+        }
+        else {
+            delete disk.defaultModelSelection;
+        }
     }
     if (checkedPatch.cliStartup !== undefined)
         disk.cliStartup = checkedPatch.cliStartup;
@@ -938,6 +998,14 @@ export function saveConfig(patch, options = {}) {
         if (routingConflict)
             throw Object.assign(new Error(routingConflict), { status: 409 });
         disk.browserProfiles = nextProfiles;
+        if (disk.newBotDefaults) {
+            const defaults = newBotDefaultsSchema.parse(disk.newBotDefaults);
+            const profileId = defaults.profile.browserProfile;
+            if (profileId && profileId !== "guest" && !nextProfiles.some(profile => profile.id === profileId)) {
+                delete defaults.profile.browserProfile;
+                disk.newBotDefaults = defaults;
+            }
+        }
     }
     if (checkedPatch.instances) {
         const currentInstances = jsonObjectSchema.safeParse(disk.instances);
@@ -1046,6 +1114,8 @@ export function persistableInstanceConfigs(cfg) {
  * environment of an unrelated child process. */
 function injectedEnvironment(cfg, driver) {
     const environment = new Map();
+    if (driver === "mistral" && cfg.mistral?.key)
+        environment.set("MISTRAL_API_KEY", cfg.mistral.key);
     if (driver === "grok" && cfg.xai?.key)
         environment.set("XAI_API_KEY", cfg.xai.key);
     // The workspace Anthropic key reaches Claude Code as the variable it
@@ -1096,6 +1166,7 @@ export function instanceConfigs(cfg) {
         opencodeGo: { driver: "opencodeGo" },
         computer: { driver: "boxAgent" },
         openaiCompat: { driver: "openai-compat" },
+        mistral: { driver: "mistral" },
         qwen: { driver: "qwenAgent" },
         hermes: { driver: "hermesAgent" },
         pi: { driver: "piAgent" },
@@ -1111,6 +1182,7 @@ export function instanceConfigs(cfg) {
     const PRODUCT_FLEET_ADDITIONS = {
         cursor: { driver: "cursorAgent" },
         openaiCompat: { driver: "openai-compat" },
+        mistral: { driver: "mistral" },
         ...CUSTOM_ONLY,
     };
     const configured = cfg.instances && Object.keys(cfg.instances).length ? cfg.instances : null;