openmausbot 0.1.86 → 0.1.88

package/dist-server/server/delegations.js

@@ -16,7 +16,7 @@ import { writeFileAtomic } from "./atomic.js";
 import { getOrCreateChannel, mirrorExchange } from "./comms-visibility.js";
 import { DATA_DIR } from "./config.js";
 import { newId } from "./contracts.js";
-import { requestPeerApproval } from "./peer-approval.js";
+import { peerApprovalFailure, requestPeerApproval } from "./peer-approval.js";
 import { canAccessTeam, peerAllowed } from "./peer-roster.js";
 /** Per source-thread queue. Persisted to delegations.json on every change
  * and reloaded at boot: a handoff queued right before a restart runs after
@@ -40,6 +40,13 @@ const RESULT_MAX_CHARS = 4_000;
  * to expire. This is not an uptime clock: sleep within a running process
  * still counts, and a non-expired restored window keeps its deadline. */
 export const DELEGATION_TTL_MS = 24 * 60 * 60 * 1000;
+/** How long a handoff may wait on a target that never goes idle. The 24-hour
+ * window above bounds the rare case; the busy hold is the common one — a peer
+ * stays busy for a whole day and the delegating bot hears nothing back. Past
+ * this cap a still-blocked handoff expires with its own wording. Env-tunable
+ * so tests (and patient teams) can shrink or stretch it. */
+const configuredBusyHoldMaxMs = Number(process.env.OMB_DELEGATION_BUSY_HOLD_MAX_MS);
+export const DELEGATION_BUSY_HOLD_MAX_MS = Math.max(1_000, Number.isFinite(configuredBusyHoldMaxMs) && process.env.OMB_DELEGATION_BUSY_HOLD_MAX_MS !== "" ? configuredBusyHoldMaxMs : 2 * 60 * 60 * 1000);
 let receipts = [];
 function saveReceipts() {
     try {
@@ -63,6 +70,10 @@ export function recordDelegationReceipt(receipt) {
     };
     if (receipt.result !== undefined)
         bounded.result = receipt.result.slice(0, RESULT_MAX_CHARS);
+    if (receipt.approvalOutcome !== undefined) {
+        bounded.approvalOutcome = receipt.approvalOutcome;
+        bounded.approvalSource = peerApprovalFailure(receipt.approvalOutcome).approvalSource;
+    }
     receipts = [bounded, ...receipts.filter((existing) => existing.id !== bounded.id)]
         .filter((existing) => now - existing.finishedAt <= RECEIPT_MAX_AGE_MS)
         .slice(0, MAX_RECEIPTS);
@@ -90,9 +101,9 @@ export function threadsWaitingOn(toBotId) {
 }
 /** Mark a target's observed busy period as finished and return the source
  * threads that should be retried. A handoff waits until the target is free,
- * bounded only by the 24-hour expiry — this just clears the "parked on a
- * busy period" marker so the next drain re-evaluates it, rather than
- * counting or limiting retries.
+ * bounded by the busy-hold cap and the 24-hour expiry — this just clears the
+ * "parked on a busy period" marker so the next drain re-evaluates it, rather
+ * than counting or limiting retries.
  * `only` narrows the release: a bot that is still busy in one thread has
  * nevertheless freed a slot for the fresh-thread handoffs waiting on it,
  * while its active-thread handoffs go on waiting for it to go idle. */
@@ -104,6 +115,7 @@ export function releaseDelegationsWaitingOn(toBotId, only) {
             if (item.toBotId !== toBotId || item.waitingOnBusy !== true || (only && !only(item)))
                 continue;
             delete item.waitingOnBusy;
+            delete item.busySince;
             any = true;
         }
         if (any)
@@ -164,8 +176,14 @@ export function _loadPending() {
                 };
                 if (item.approvalAlreadyGranted === true)
                     loaded.approvalAlreadyGranted = true;
-                if (item.waitingOnBusy === true)
+                if (item.waitingOnBusy === true) {
                     loaded.waitingOnBusy = true;
+                    const currentHold = Number.isFinite(item.busySince) && item.busySince <= now &&
+                        now - item.busySince < DELEGATION_BUSY_HOLD_MAX_MS;
+                    loaded.busySince = currentHold ? item.busySince : now;
+                    if (!currentHold)
+                        backfilled = true;
+                }
                 if (item.waitAnnounced === true || legacyAlreadyAnnounced)
                     loaded.waitAnnounced = true;
                 if (typeof item.originatingGroupId === "string" && item.originatingGroupId) {
@@ -212,6 +230,10 @@ export function _loadPending() {
                 const receipt = { id, sourceThreadId, toBotId, toBotName, status, finishedAt: finishedAt };
                 if (typeof result === "string")
                     receipt.result = result;
+                if (candidate.approvalOutcome === "deny" || candidate.approvalOutcome === "expired" || candidate.approvalOutcome === "cancelled") {
+                    receipt.approvalOutcome = candidate.approvalOutcome;
+                    receipt.approvalSource = peerApprovalFailure(candidate.approvalOutcome).approvalSource;
+                }
                 loaded.push(receipt);
             }
             receipts = loaded.slice(0, MAX_RECEIPTS);
@@ -405,41 +427,61 @@ function acknowledgeDelegation(threadId, itemId) {
     savePending();
 }
 const isExpired = (item, now) => now - item.queuedAt >= DELEGATION_TTL_MS;
+/** Past the busy-hold cap — the tighter bound that fires while its target is
+ * still busy, long before the 24-hour window. */
+const busyHoldExpired = (item, now) => item.busySince !== undefined && now - item.busySince >= DELEGATION_BUSY_HOLD_MAX_MS;
+/** The busy-hold cap in chip-ready words ("2 hours", "90 minutes"). */
+export function busyHoldCapText(maxMs = DELEGATION_BUSY_HOLD_MAX_MS) {
+    const minutes = Math.max(1, Math.round(maxMs / 60_000));
+    const amount = minutes % 60 === 0 ? minutes / 60 : minutes;
+    const unit = minutes % 60 === 0 ? "hour" : "minute";
+    return `${amount} ${unit}${amount === 1 ? "" : "s"}`;
+}
 /** Record an expired handoff. The chip goes into the source thread only
  * while it still belongs to the bot that owns the handoff — a deleted
  * conversation gets the receipt and nothing else. */
 function expireDelegation(bus, sourceThreadId, item, ownerId) {
-    const name = bus.store.bot(item.toBotId)?.name ?? item.toBotId;
+    const target = bus.store.bot(item.toBotId);
+    const name = target?.name ?? item.toBotId;
+    // A busy hold has its own words so a two-hour busy wait is never reported
+    // as a 24-hour one; every other expiry keeps the TTL wording.
+    const now = Date.now();
+    const busyHold = Boolean(target) && busyHoldExpired(item, now) && !isExpired(item, now);
     recordDelegationReceipt({
         id: item.id,
         sourceThreadId,
         toBotId: item.toBotId,
         toBotName: name,
         status: "expired",
-        result: `@${name} was not free to take this for 24 hours`,
+        result: busyHold ? `@${name} was still busy after ${busyHoldCapText()}` : `@${name} was not free to take this for 24 hours`,
     });
     if (!sourceThreadBelongsToBot(bus.store, ownerId, sourceThreadId))
         return;
     bus.store.appendMessage(sourceThreadId, {
         role: "bot",
         kind: "activity",
-        tool: { name: `Delegation to @${name} expired — not picked up within 24 hours`, ok: false },
+        tool: {
+            name: busyHold
+                ? `Delegation to @${name} expired — still busy after ${busyHoldCapText()}`
+                : `Delegation to @${name} expired — not picked up within 24 hours`,
+            ok: false,
+        },
     });
 }
-/** Past its 24 hours AND unable to be delivered right now — the same rule
+/** Past a delivery bound AND unable to be delivered right now — the same rule
  * `processOne` applies, so the hourly sweep and a live drain never disagree
- * about which items are actually stuck. A target that was deleted counts as
- * "cannot take the turn": there is nothing to wait on, so such items still
- * expire even though there is no bot left to test busy/free against. */
+ * about which items are actually stuck. The busy-hold cap expires a handoff
+ * whose target has been busy the whole time; the 24-hour TTL catches the
+ * rest. A target that was deleted counts as "cannot take the turn": there is
+ * nothing to wait on, so such items still expire even though there is no bot
+ * left to test busy/free against. */
 function isDueForExpiry(bus, item, now) {
-    if (!isExpired(item, now))
-        return false;
     const target = bus.store.bot(item.toBotId);
     if (!target)
-        return true;
-    return !targetCanTakeTurn(bus, target, item);
+        return isExpired(item, now);
+    return !targetCanTakeTurn(bus, target, item) && (isExpired(item, now) || busyHoldExpired(item, now));
 }
-/** Expire every queued handoff past DELEGATION_TTL_MS that still cannot be
+/** Expire every queued handoff past a delivery bound that still cannot be
  * delivered, wherever it waits. A drain already expires what it touches;
  * this covers the handoff nothing drains — a target that never settles
  * while its source sits idle. A thread mid-drain is skipped: that drain
@@ -549,13 +591,15 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
     if (dropIfThreadGone(bus, target, sourceThreadId, item)) {
         return "settled";
     }
-    // Past its 24 hours AND the target still cannot take the turn: this is the
-    // bound on a busy wait. Use the same free/busy test as holdWhileTargetBusy;
-    // an available target gets even an overdue item. Restart recovery renews
-    // elapsed windows in _loadPending before any target becomes busy. Decide
-    // before announcing a wait so an item cannot post both chips in one pass.
+    // Past a delivery bound AND the target still cannot take the turn: this is
+    // the bound on a busy wait — the busy-hold cap when the target has been
+    // busy the whole time, the 24-hour TTL otherwise. Use the same free/busy
+    // test as holdWhileTargetBusy; an available target gets even an overdue
+    // item. Restart recovery renews elapsed windows in _loadPending before any
+    // target becomes busy. Decide before announcing a wait so an item cannot
+    // post both chips in one pass.
     const canTakeTurn = targetCanTakeTurn(bus, target, item);
-    if (!canTakeTurn && isExpired(item, Date.now())) {
+    if (!canTakeTurn && (isExpired(item, Date.now()) || busyHoldExpired(item, Date.now()))) {
         expireDelegation(bus, sourceThreadId, item, sender.id);
         return "settled";
     }
@@ -564,6 +608,7 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
         return held;
     if (item.waitingOnBusy) {
         delete item.waitingOnBusy;
+        delete item.busySince;
         savePending();
     }
     if (sender.approvePeerComms && !item.approvalAlreadyGranted) {
@@ -582,22 +627,26 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
                 toBotName: target.name,
                 status: "dropped",
                 result: "the peer or source conversation no longer exists",
+                ...(verdict !== "allow" ? { approvalOutcome: verdict } : {}),
             });
             return "settled";
         }
         if (verdict !== "allow") {
+            const failure = peerApprovalFailure(verdict);
             recordDelegationReceipt({
                 id: item.id,
                 sourceThreadId,
                 toBotId: target.id,
                 toBotName: target.name,
-                status: "denied",
-                result: "the user denied this handoff",
+                status: verdict === "deny" ? "denied" : verdict,
+                approvalOutcome: verdict,
+                result: verdict === "deny" ? "the user denied this handoff" : failure.error,
             });
             bus.store.appendMessage(sourceThreadId, {
                 role: "bot",
                 kind: "activity",
-                tool: { name: `Delegation to @${target.name} denied by user`, ok: false },
+                tool: { name: verdict === "deny" ? `Delegation to @${target.name} denied by user`
+                        : `Delegation to @${target.name}: ${failure.error}`, ok: false },
             });
             return "settled";
         }
@@ -614,9 +663,10 @@ async function processOne(bus, approvalBus, from, sourceThreadId, item, runTarge
         }
         // Approval may have waited for minutes (or, with approvalAlreadyGranted,
         // up to 24h since the original ask_bot approval) — recheck the same
-        // free/busy-gated expiry as the pre-approval path before dispatching.
+        // free/busy-gated, busy-hold-capped expiry as the pre-approval path
+        // before dispatching.
         const canTakeTurnAfterApproval = targetCanTakeTurn(bus, current, item);
-        if (!canTakeTurnAfterApproval && isExpired(item, Date.now())) {
+        if (!canTakeTurnAfterApproval && (isExpired(item, Date.now()) || busyHoldExpired(item, Date.now()))) {
             expireDelegation(bus, sourceThreadId, item, currentSender.id);
             return "settled";
         }
@@ -656,18 +706,19 @@ function targetCanTakeTurn(bus, target, item) {
             ? bus.canAdmitDirectTurn(target.id, target.threadId)
             : !target.busy;
 }
-/** A busy target holds the handoff. Neither counts busy periods — the only
- * bound is DELEGATION_TTL_MS, checked in processOne before this runs (using
- * the same `targetCanTakeTurn` test, passed in as `canTakeTurn` when the
- * caller already computed it so the two checks can't disagree). One waiting
- * chip per handoff, worded for what the target is actually doing. Returns
- * null when the target can take the turn now. */
+/** A busy target holds the handoff. Neither counts busy periods — the bounds
+ * are the busy-hold cap and DELEGATION_TTL_MS, checked in processOne before
+ * this runs (using the same `targetCanTakeTurn` test, passed in as
+ * `canTakeTurn` when the caller already computed it so the two checks can't
+ * disagree). One waiting chip per handoff, worded for what the target is
+ * actually doing. Returns null when the target can take the turn now. */
 function holdWhileTargetBusy(bus, target, sourceThreadId, item, canTakeTurn = targetCanTakeTurn(bus, target, item)) {
     if (canTakeTurn)
         return null;
     if (item.waitingOnBusy)
         return "requeued";
     item.waitingOnBusy = true;
+    item.busySince = Date.now();
     if (!item.waitAnnounced) {
         item.waitAnnounced = true;
         bus.store.appendMessage(sourceThreadId, {

package/dist-server/server/drivers/acp/core.js

@@ -31,6 +31,7 @@ import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { PROVIDER_CREDENTIAL_ENV, stripControlPlaneEnv, WORKSPACE_CREDENTIAL_ENV } from "../../config.js";
 import { decodeInjectId } from "../local-inject.js";
+import { promptHalves, readPromptSplitReceipt, splitSessionPrompt, writePromptSplitReceipt } from "../prompt-split.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../../procs.js";
 /**
  * A `host::model` pick talks to a loopback server with its own key.
@@ -42,11 +43,14 @@ export function skipSubscriptionAuthForLocalInject(model) {
 import { newEventId, newId } from "../../contracts.js";
 import { augmentedPath } from "../../env-path.js";
 import { supportsApprovalMode } from "../../../shared/approval-mode.js";
+import { parseAskQuestions, parseChoices, questionAnswersByQuestion } from "../../../shared/ask-question.js";
 import { appendNative } from "../native.js";
+import { acpPermissionCommand, permissionLaunchCwd } from "../permission-command.js";
 import { commandSummary, toolDetailPreview } from "../../tool-summary.js";
 import { extractMcpImages } from "../../mcp-tool-images.js";
 import { redactSecretsInText } from "../../redact.js";
 import { recoveryPromptFor } from "../../resume-recovery.js";
+import { sessionIdlePolicy } from "../session-idle.js";
 /** ACP vendors put the actionable cause in error.data while keeping the
  * JSON-RPC message generic. Only surface known text fields, never a response
  * body/config dump, and redact before bounding the displayed diagnostic. */
@@ -77,6 +81,9 @@ const INIT_TIMEOUT = envOr("OPENMAUS_ACP_INIT_TIMEOUT_MS", 300_000);
 const SESSION_CONFIG_TIMEOUT = envOr("OPENMAUS_ACP_SESSION_CONFIG_TIMEOUT_MS", 300_000); // configureSession's per-request default
 const NEW_SESSION_TIMEOUT = envOr("OPENMAUS_ACP_NEW_SESSION_TIMEOUT_MS", 300_000);
 const LOAD_SESSION_TIMEOUT = envOr("OPENMAUS_ACP_LOAD_SESSION_TIMEOUT_MS", 120_000); // history replay on a long thread is slow
+/** ACP agents may compact their own history without telling the client;
+ * re-send the full prompt after this many bare turns as a backstop. */
+const ACP_PROMPT_RE_ANCHOR_TURNS = 8;
 // Read lazily (not at import) so a test can shorten the window. Unlike the
 // setup calls above, session/prompt legitimately streams for minutes, so a
 // wall-clock deadline would false-positive: this guard only trips when the
@@ -209,6 +216,24 @@ export function versionFromProbe(stdout, stderr) {
     const err = (stderr ?? "").trim().split(/\r\n|\n|\r/, 1)[0]?.trim() ?? "";
     return err || null;
 }
+/** The first dotted numeric triple in a version banner, or null when there is
+ * none. A wrapper that prints its own banner first still parses: the triple
+ * is the version wherever it appears. */
+export function parseVersionTriple(value) {
+    const match = /(\d+)\.(\d+)\.(\d+)/.exec(value);
+    if (!match)
+        return null;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+/** Whether `installed` compares at or above `floor`, componentwise. Every
+ * version floor in the tree is a dotted triple. */
+export function versionAtLeast(installed, floor) {
+    for (let i = 0; i < 3; i += 1) {
+        if (installed[i] !== floor[i])
+            return installed[i] > floor[i];
+    }
+    return true;
+}
 export function createAcpDriver(support) {
     const DRIVER_KIND = support.driverKind;
     const SOURCE = support.nativeSource;
@@ -271,11 +296,7 @@ export function createAcpDriver(support) {
             // contract prompts the live session instead of paying the handshake
             // again. An idle session closes after SESSION_IDLE_MS of quiet.
             const sessions = new Map();
-            const configuredIdleMinimum = Number(process.env.OMB_ACP_SESSION_IDLE_MIN_MS);
-            const sessionIdleMinimum = Number.isFinite(configuredIdleMinimum) && configuredIdleMinimum > 0
-                ? configuredIdleMinimum
-                : 10_000;
-            const SESSION_IDLE_MS = Math.max(sessionIdleMinimum, Number(process.env.OMB_ACP_SESSION_IDLE_MS) || 10 * 60_000);
+            const { idleMs: SESSION_IDLE_MS } = sessionIdlePolicy("ACP");
             const closeSession = (threadId, why) => {
                 const session = sessions.get(threadId);
                 if (!session || session.closing)
@@ -458,6 +479,7 @@ export function createAcpDriver(support) {
              *  session.current, so a request that lands between turns is answered
              *  (never brokered) instead of left hanging. */
             const openSession = (threadId, launch, argv, env, cwd, contractKey) => {
+                const commandCwd = permissionLaunchCwd(cwd);
                 const child = spawnCli(launch.command, argv, {
                     cwd,
                     env,
@@ -660,16 +682,34 @@ export function createAcpDriver(support) {
                         }
                     }
                     const tool = kind === "execute" ? "shell" : kind === "edit" ? "edit" : kind || "tool";
+                    const isShellCommand = !isQuestion && kind === "execute" && !/^mcp(?:__|[.:])/i.test(String(toolCall.title ?? ""));
                     const summary = String(toolCall.rawInput?.command ?? toolCall.title ?? tool).slice(0, 200);
+                    // One structured question beside the flat choices: the richer card
+                    // renders from it while older clients keep answering through
+                    // `choices`. Built once here so the emit and the answer path can
+                    // never disagree. parseAskQuestions enforces the shared caps.
+                    const questionChoices = isQuestion
+                        ? options.flatMap((option) => typeof option.name === "string" && option.name.trim() ? [option.name.trim()] : [])
+                        : [];
+                    const askQuestions = isQuestion && questionChoices.length
+                        ? parseAskQuestions({ questions: [{ question: summary, options: questionChoices }] }) ?? undefined
+                        : undefined;
                     const requestId = newId();
                     const finish = (behavior, source = "user", message, always) => {
                         if (!current.asks.delete(requestId))
-                            return;
+                            return "unavailable";
                         clearTimeout(timer);
                         const want = behavior === "allow" ? "allow" : "reject";
                         const forSession = want === "allow" && always === true && !isQuestion && !current.controlsHost;
+                        // A structured card replies in the Q:/A: block format; recover the
+                        // picked label from it so exact-match keeps working. Flat clients
+                        // send the bare label, which the single-question fallback inside
+                        // questionAnswersByQuestion already returns unchanged.
+                        const picked = askQuestions
+                            ? questionAnswersByQuestion(message ?? "", askQuestions)[askQuestions[0].question] ?? message
+                            : message;
                         const named = isQuestion && behavior === "answer"
-                            ? options.filter((option) => option.optionId === message || option.name?.trim() === message)
+                            ? options.filter((option) => option.optionId === picked || parseChoices([option.name], 1)?.[0] === picked)
                             : [];
                         const optionId = behavior === "cancel"
                             ? null
@@ -700,6 +740,7 @@ export function createAcpDriver(support) {
                             source: optionId ? source : "system",
                             approvalScope: current.controlsHost ? "local-computer" : undefined,
                         });
+                        return !optionId ? "rejected" : isQuestion ? "answered" : behavior === "allow" ? "allowed-once" : "rejected";
                     };
                     const timer = setTimeout(() => {
                         emit({ ...base(threadId, current.turnId), type: "runtime.error", message: DENY_TIMEOUT_NOTE });
@@ -714,9 +755,10 @@ export function createAcpDriver(support) {
                         requestType: isQuestion ? "question" : "permission",
                         tool,
                         summary,
-                        choices: isQuestion
-                            ? options.flatMap((option) => typeof option.name === "string" && option.name.trim() ? [option.name.trim()] : [])
-                            : undefined,
+                        command: isShellCommand ? acpPermissionCommand(toolCall.rawInput, commandCwd) : undefined,
+                        requiresExplicitApproval: isShellCommand && (toolCall.rawInput?.dangerouslyDisableSandbox === true || toolCall.rawInput?.sandbox_permissions === "require_escalated") || undefined,
+                        choices: askQuestions?.[0]?.options.map(option => option.label) ?? (isQuestion ? questionChoices : undefined),
+                        ...(askQuestions ? { questions: askQuestions } : {}),
                         approvalScope: current.controlsHost ? "local-computer" : undefined,
                         // the driver can honor a session-wide allow either way
                         allowSession: !isQuestion && !current.controlsHost ? true : undefined,
@@ -1283,11 +1325,28 @@ export function createAcpDriver(support) {
                             throw error;
                         }
                         emitSessionStarted();
+                        // The stable/volatile split: the full prompt rides only the turn
+                        // that establishes - or re-instructs, after a soul edit - this
+                        // native session. Later turns go through bare unless the volatile
+                        // half changed, so a memory edit neither appends a second copy of
+                        // the prompt to the agent's session history nor re-prices the
+                        // prefix its provider cached. Receipts are durable because the
+                        // native session outlives this process; an un-split turn (a direct
+                        // adapter call) keeps the legacy full-prompt shape.
+                        const halves = promptHalves(turn);
+                        let promptInput = promptTurn;
+                        let pendingSplitReceipt = null;
+                        if (halves.stable !== null) {
+                            const receiptKey = JSON.stringify([threadId, sessionId]);
+                            const composed = splitSessionPrompt(halves.stable, halves.volatile, readPromptSplitReceipt(DRIVER_KIND, receiptKey), promptTurn.system, promptTurn.text, Boolean(turn.mentionTurn), ACP_PROMPT_RE_ANCHOR_TURNS);
+                            promptInput = { ...promptTurn, system: "", text: composed.text };
+                            pendingSplitReceipt = { key: receiptKey, receipt: composed.receipt };
+                        }
                         const text = support.buildPromptText
-                            ? support.buildPromptText(promptTurn)
-                            : promptTurn.system
-                                ? `${promptTurn.system}\n\n${promptTurn.text}`
-                                : promptTurn.text;
+                            ? support.buildPromptText(promptInput)
+                            : promptInput.system
+                                ? `${promptInput.system}\n\n${promptInput.text}`
+                                : promptInput.text;
                         const imageBlocks = support.images === true && runtimeAcceptsImages
                             ? await readAcpImageBlocks(turn.images ?? [])
                             : [];
@@ -1301,6 +1360,12 @@ export function createAcpDriver(support) {
                         const promptIdleMs = promptIdleTimeoutMs();
                         const result = await request("session/prompt", { sessionId, prompt: [{ type: "text", text }, ...imageBlocks] }, undefined, undefined, promptIdleMs, `${DRIVER_KIND} went fully silent ${Math.round(promptIdleMs / 1000)} s after the message and the turn was stopped. ` +
                             "Raise OPENMAUS_ACP_PROMPT_IDLE_TIMEOUT_MS if this model legitimately takes longer to answer.");
+                        if (pendingSplitReceipt) {
+                            // session/prompt resolving is the acceptance boundary: a
+                            // rejected prompt leaves the receipt unwritten, so the next
+                            // turn redelivers what this one never received.
+                            writePromptSplitReceipt(DRIVER_KIND, pendingSplitReceipt.key, pendingSplitReceipt.receipt);
+                        }
                         // opencode 1.18.18 reports usage at the result root; grok and
                         // gemini put it under _meta. Read both rather than lose the count.
                         const usage = result?.usage ?? result?._meta ?? {};
@@ -1407,12 +1472,7 @@ export function createAcpDriver(support) {
                         const finish = turn?.asks.get(requestId);
                         if (!finish)
                             return "unavailable"; // settled, timed out, or turn gone
-                        finish(decision.behavior, "user", decision.message, decision.always === true);
-                        return decision.behavior === "allow"
-                            ? "allowed-once"
-                            : decision.behavior === "answer"
-                                ? "answered"
-                                : "rejected";
+                        return finish(decision.behavior, "user", decision.message, decision.always === true);
                     },
                     hasSession: (threadId) => active.has(threadId),
                     stopAll: async () => {

package/dist-server/server/drivers/acp/cursor.js

@@ -1,3 +1,4 @@
+import { titleCaseModelId } from "../../contracts.js";
 import { execCli } from "../../procs.js";
 import { createAcpDriver } from "./core.js";
 /** Translate an argv `--model` slug into the id this ACP session will accept.
@@ -86,13 +87,8 @@ function asRecord(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function labelFor(id, explicit) {
-    if (explicit?.trim())
-        return explicit.trim();
-    return id
-        .split(/[-_./]+/g)
-        .filter(Boolean)
-        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
-        .join(" ");
+    const trimmed = explicit?.trim();
+    return trimmed || titleCaseModelId(id, /[-_./]+/);
 }
 function pushModel(options, seen, id, label, custom = false) {
     if (!SLUG.test(id) || seen.has(id))

package/dist-server/server/drivers/acp/droid.js

@@ -16,8 +16,8 @@
 // options set over the wire (session/set_model, session/set_mode), which is
 // why both live in configureSession() below and NOT in spawnArgs.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
+import { userHome } from "../../env-path.js";
 import { decodeInjectId, hostApiKey, localHost, mergeLocalInject } from "../local-inject.js";
 import { createAcpDriver } from "./core.js";
 // FACTORY_HOME_OVERRIDE replaces the HOME the CLI resolves, NOT the data root:
@@ -34,7 +34,7 @@ import { createAcpDriver } from "./core.js";
 // out. Names read from the 0.196.0 binary.
 const AUTH_FILES = ["auth.v2.file", "auth.v2.loginkeychain", "auth.v2.keyring"];
 function authFilePaths(env) {
-    const home = env.FACTORY_HOME_OVERRIDE || env.HOME || homedir();
+    const home = env.FACTORY_HOME_OVERRIDE || userHome(env);
     return AUTH_FILES.map((name) => join(home, ".factory", name));
 }
 const INJECT_ID_PREFIX = "custom:openmausbot-";
@@ -42,9 +42,6 @@ export function droidInjectId(host, model) {
     const safe = `${host}-${model}`.replace(/[^a-zA-Z0-9._+-]+/g, "-").replace(/-+/g, "-");
     return `${INJECT_ID_PREFIX}${safe}`;
 }
-function factoryHome(env) {
-    return env.FACTORY_HOME_OVERRIDE || env.HOME || env.USERPROFILE || homedir();
-}
 /** Upsert a BYOK custom model so session/set_model can reach the local host. */
 export function ensureDroidInjectModel(modelId, env = process.env) {
     const inject = decodeInjectId(modelId);
@@ -54,7 +51,7 @@ export function ensureDroidInjectModel(modelId, env = process.env) {
     if (!host)
         return modelId;
     const id = droidInjectId(inject.host, inject.model);
-    const dir = join(factoryHome(env), ".factory");
+    const dir = join(env.FACTORY_HOME_OVERRIDE || userHome(env), ".factory");
     mkdirSync(dir, { recursive: true });
     const path = join(dir, "settings.json");
     let settings = {};
@@ -105,7 +102,7 @@ export function applyDroidLocalAuthEnv(env, modelId) {
     env.FACTORY_API_KEY = "openmausbot-local";
 }
 function readSettings(env) {
-    return JSON.parse(readFileSync(join(factoryHome(env), ".factory", "settings.json"), "utf8"));
+    return JSON.parse(readFileSync(join(env.FACTORY_HOME_OVERRIDE || userHome(env), ".factory", "settings.json"), "utf8"));
 }
 async function resolveModels(env) {
     let catalog = MODELS;

package/dist-server/server/drivers/acp/gemini.js

@@ -26,8 +26,8 @@
 // the ACP flag + auth method ids follow the published Gemini CLI ACP contract
 // and should be re-verified end-to-end once the CLI is present.
 import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
+import { userHome } from "../../env-path.js";
 import { createAcpDriver } from "./core.js";
 // Prefer an explicit key method, then personal OAuth, then Vertex — but fall
 // back to whatever the CLI advertises so a new method id still works.
@@ -37,9 +37,9 @@ const AUTH_PREFERENCE = ["gemini-api-key", "oauth-personal", "vertex-ai"];
  * an enterprise licence may still redeem. A stale consumer credential —
  * the common case since 2026-06-18 — reads as not signed in, which is the
  * truthful answer for an engine that would fail its first turn anyway. */
-function liveOauthCredential() {
+function liveOauthCredential(env) {
     try {
-        const creds = JSON.parse(readFileSync(join(homedir(), ".gemini", "oauth_creds.json"), "utf8"));
+        const creds = JSON.parse(readFileSync(join(userHome(env), ".gemini", "oauth_creds.json"), "utf8"));
         if (typeof creds.access_token !== "string" || creds.access_token.trim().length === 0)
             return false;
         const hasRefresh = typeof creds.refresh_token === "string" && creds.refresh_token.trim().length > 0;
@@ -62,7 +62,7 @@ const nonBlank = (value) => Boolean(value?.trim());
 export function geminiIsAuthenticated(env) {
     return (nonBlank(env.GEMINI_API_KEY) ||
         nonBlank(env.GOOGLE_API_KEY) ||
-        (existsSync(join(homedir(), ".gemini", "oauth_creds.json")) && liveOauthCredential()));
+        (existsSync(join(userHome(env), ".gemini", "oauth_creds.json")) && liveOauthCredential(env)));
 }
 /** Gemini CLI's approval modes, passed through: `--approval-mode auto_edit`
  * approves file edits, `--yolo` approves everything; Gemini has no

package/dist-server/server/drivers/acp/grok.js

@@ -4,8 +4,8 @@
 // The generic protocol runtime lives in acp/core.ts; this file is only the
 // per-harness quirks. Verified against grok 1.0.0.
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
 import { join } from "node:path";
+import { harnessHome } from "../../env-path.js";
 import { decodeInjectId, hostApiKey, localHost, mergeLocalInject } from "../local-inject.js";
 import { createAcpDriver } from "./core.js";
 export const STATIC_GROK_MODELS = {
@@ -17,11 +17,6 @@ export const STATIC_GROK_MODELS = {
     ],
 };
 const SLUG = /^[a-z0-9][a-z0-9._-]*$/i;
-function grokHome(env) {
-    if (env.GROK_HOME)
-        return env.GROK_HOME;
-    return join(env.HOME || env.USERPROFILE || homedir(), ".grok");
-}
 function unquote(raw) {
     const value = raw.trim();
     if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
@@ -32,7 +27,7 @@ function unquote(raw) {
 /** Local slugs from ~/.grok/config.toml, plus the cloud defaults.
  *  `grok -m <slug>` already accepts these; the picker just didn't list them. */
 export function readGrokModelCatalog(env = process.env) {
-    const path = join(grokHome(env), "config.toml");
+    const path = join(env.GROK_HOME || harnessHome("grok", env), "config.toml");
     let text = "";
     try {
         text = readFileSync(path, "utf8");
@@ -114,7 +109,7 @@ export function ensureGrokInjectSlug(modelId, env = process.env) {
     const host = localHost(inject.host);
     if (!host)
         return modelId;
-    const path = join(grokHome(env), "config.toml");
+    const path = join(env.GROK_HOME || harnessHome("grok", env), "config.toml");
     let text = "";
     try {
         text = readFileSync(path, "utf8");
@@ -258,7 +253,7 @@ const support = {
     // an unauthenticated CLI is a user action, not something to paper over.
     pickAuthMethod: (methods) => (methods.some((m) => m.id === "cached_token") ? "cached_token" : null),
     authFailure: "fail",
-    isAuthenticated: () => existsSync(join(homedir(), ".grok", "auth.json")),
+    isAuthenticated: (env) => existsSync(join(harnessHome("grok", env), "auth.json")),
     // `--append-system-prompt`/`--rules` are accepted by the CLI but do NOT
     // reach the agent-stdio system prompt (verified against 1.0.0), so the
     // persona is prepended codex-style.

package/dist-server/server/drivers/acp/hermes.js

@@ -9,6 +9,7 @@ import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
+import { harnessHome } from "../../env-path.js";
 import { resolveCli } from "../../procs.js";
 import { decodeInjectId, hostApiKey, INJECT_SEP, localHost, mergeLocalInject } from "../local-inject.js";
 import { createAcpDriver } from "./core.js";
@@ -25,9 +26,6 @@ export function bindHermesScreenshotCompat(env, modelId) {
     env[HERMES_OPENMAUS_SCREENSHOT_COMPAT] = "1";
     env[HERMES_OPENMAUS_SCREENSHOT_COMPAT_MODEL] = inject.model;
 }
-function hermesHome(env) {
-    return env.HERMES_HOME || join(env.HOME || env.USERPROFILE || homedir(), ".hermes");
-}
 function quoteYaml(value) {
     if (/^[\w./:+-]+$/.test(value))
         return value;
@@ -69,7 +67,7 @@ export function ensureHermesInjectProvider(modelId, env = process.env) {
     const host = localHost(inject.host);
     if (!host)
         return modelId;
-    const dir = hermesHome(env);
+    const dir = env.HERMES_HOME || harnessHome("hermes", env);
     mkdirSync(dir, { recursive: true });
     const path = join(dir, "config.yaml");
     let text = "";
@@ -199,7 +197,7 @@ function hermesConfigDefault(text) {
  * catalog exactly as it was for local-only setups.
  */
 export function hermesConfiguredModel(env = process.env) {
-    const dir = hermesHome(env);
+    const dir = env.HERMES_HOME || harnessHome("hermes", env);
     let secrets = "";
     try {
         secrets = readFileSync(join(dir, ".env"), "utf8");