openmausbot 0.1.87 → 0.1.89

package/dist-server/server/tightening-requests.js

@@ -0,0 +1,405 @@
+// propose_tightening: a bot (or a Chief for a section peer) proposes an
+// authority REDUCTION through a human-confirmed card. Same shape as
+// profile-requests.ts: everything is re-validated at confirm time — a card
+// can sit open for days, so the direction is checked against live state
+// again and the revision (a hash of the touched authority surface) must
+// still match. Escalation is inexpressible in the payload and rejected by
+// the validator; restoring authority stays owner-only in Edit Profile.
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { approvalModeFor } from "../shared/approval-mode.js";
+import { TIGHTENING_MODE_TARGETS, validateTightening, } from "../shared/tightening-request.js";
+import { newId } from "./contracts.js";
+import { redactSecretsInText } from "./redact.js";
+const MAX_REASON = 500;
+const STALE = "This bot's authority changed after this card was prepared. Ask the bot to review it and propose again.";
+const NO_SUCH_BOT = "That bot no longer exists";
+const CHOOSE_ONE = "Choose at least one tightening intent: approvalMode, composio, browser, approvePeerComms, alwaysAllow, mcpServers, skills";
+const INTENT_KEYS = [
+    "approvalMode",
+    "composio",
+    "browser",
+    "approvePeerComms",
+    "alwaysAllow",
+    "mcpServers",
+    "skills",
+];
+/** Direction is enforced by shape first: the payload cannot name "full" or
+ * "custom" as a target, cannot ask to switch composio/browser back on, and
+ * the list fields only carry removals. The state-relative remainder (an
+ * upward move inside ask/edits/auto, a grant not currently held) is checked
+ * by validateTightening against live state at propose and confirm. */
+const intentsSchema = z.object({
+    approvalMode: z.enum(TIGHTENING_MODE_TARGETS, {
+        error: 'approvalMode may only be proposed as "ask", "edits", or "auto"; full and custom stay owner-only',
+    }).optional(),
+    composio: z.literal(false, { error: "composio may only be turned off" }).optional(),
+    browser: z.literal(false, { error: "browser may only be turned off" }).optional(),
+    approvePeerComms: z.literal(true, { error: "approvePeerComms may only be turned on" }).optional(),
+    alwaysAllow: z.array(z.string().min(1).max(200)).max(200).optional(),
+    mcpServers: z.array(z.string().min(1).max(200)).max(100).optional(),
+    skills: z.array(z.string().min(1).max(100)).max(100).optional(),
+});
+export class TighteningRequestError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.name = "TighteningRequestError";
+        this.status = status;
+    }
+}
+function reasonText(value) {
+    if (typeof value !== "string")
+        throw new TighteningRequestError("reason is required");
+    const trimmed = value.trim();
+    if (!trimmed)
+        throw new TighteningRequestError("reason is required");
+    if (trimmed.length > MAX_REASON) {
+        throw new TighteningRequestError(`reason must be ${MAX_REASON} characters or fewer`);
+    }
+    return redactSecretsInText(trimmed);
+}
+function parseIntents(input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw new TighteningRequestError(CHOOSE_ONE);
+    }
+    const record = input;
+    for (const key of Object.keys(record)) {
+        if (!INTENT_KEYS.includes(key)) {
+            throw new TighteningRequestError(`unsupported tightening field: ${key}`);
+        }
+    }
+    const parsed = intentsSchema.safeParse(input);
+    if (!parsed.success) {
+        throw new TighteningRequestError(parsed.error.issues[0]?.message ?? CHOOSE_ONE);
+    }
+    const intents = parsed.data;
+    // Copy through only the keys the caller sent, so "did this card touch
+    // approvalMode" stays answerable from the payload alone.
+    const present = {};
+    if (record.approvalMode !== undefined)
+        present.approvalMode = intents.approvalMode;
+    if (record.composio !== undefined)
+        present.composio = intents.composio;
+    if (record.browser !== undefined)
+        present.browser = intents.browser;
+    if (record.approvePeerComms !== undefined)
+        present.approvePeerComms = intents.approvePeerComms;
+    if (record.alwaysAllow !== undefined)
+        present.alwaysAllow = intents.alwaysAllow;
+    if (record.mcpServers !== undefined)
+        present.mcpServers = intents.mcpServers;
+    if (record.skills !== undefined)
+        present.skills = intents.skills;
+    if (Object.keys(present).length === 0)
+        throw new TighteningRequestError(CHOOSE_ONE);
+    return present;
+}
+/** The card revision: a hash of exactly the authority surface a tightening
+ * can touch, plus the private receipt (an older, interrupted card cannot
+ * apply twice). Sorted lists so an unrelated reorder is not a false stale. */
+export function tighteningRevision(state, lastTighteningRequestId = "") {
+    return createHash("sha256")
+        .update(JSON.stringify({
+        approvalMode: state.approvalMode,
+        composio: state.composio,
+        browser: state.browser,
+        approvePeerComms: state.approvePeerComms,
+        alwaysAllow: [...state.alwaysAllow].sort(),
+        mcpServers: [...state.mcpServers].sort(),
+        skills: [...state.skills].sort(),
+        lastTighteningRequestId,
+    }), "utf8")
+        .digest("hex");
+}
+export function tighteningSnapshot(bot, extras) {
+    return {
+        approvalMode: approvalModeFor(bot),
+        composio: bot.composio !== false,
+        browser: bot.browser !== false,
+        approvePeerComms: bot.approvePeerComms === true,
+        alwaysAllow: bot.alwaysAllow ?? [],
+        mcpServers: extras.mcpServers ?? [...(bot.mcpServers ?? [])],
+        skills: extras.skills ?? [],
+    };
+}
+/** Minimal card copy: the judged facts (field, before, after, names) plus
+ * the standing rule that only the owner can grant authority back. */
+export function tighteningCardCopy(target, before, intents, reason) {
+    const title = target.crossBot ? `Tighten @${target.name}'s permissions?` : `Tighten ${target.name}'s permissions?`;
+    const lines = target.crossBot ? [`Whose permissions: @${target.name}`, `Why: ${reason}`] : [`Why: ${reason}`];
+    if (intents.approvalMode !== undefined)
+        lines.push(`Approvals: ${before.approvalMode} → ${intents.approvalMode}`);
+    if (intents.composio !== undefined)
+        lines.push("Connected apps: on → off");
+    if (intents.browser !== undefined)
+        lines.push("Browser: on → off");
+    if (intents.approvePeerComms !== undefined)
+        lines.push("Peer contact: no approval → ask first");
+    if (intents.alwaysAllow?.length)
+        lines.push(`Always-allow grants: remove ${intents.alwaysAllow.join(", ")}`);
+    if (intents.mcpServers?.length)
+        lines.push(`MCP servers: unmount ${intents.mcpServers.join(", ")}`);
+    if (intents.skills?.length)
+        lines.push(`Skills: disable ${intents.skills.join(", ")}`);
+    lines.push(`This reduces ${target.name}'s authority. Only the owner can grant it back.`);
+    const fields = INTENT_KEYS.filter((key) => intents[key] !== undefined);
+    return { title, summary: `${title} · ${fields.join(", ")}`, detail: lines.join("\n") };
+}
+export class TighteningRequestService {
+    store;
+    now;
+    canPersist;
+    autoApply;
+    mountedMcpServers;
+    enabledSkills;
+    disableSkill;
+    targetBusy;
+    /** Public: a caller's section membership can change between propose and
+     * confirm, and tests flip this mid-scenario to model that. */
+    validateTarget;
+    constructor(options) {
+        this.store = options.store;
+        this.now = options.now ?? Date.now;
+        this.canPersist = options.canPersist;
+        this.autoApply = options.autoApply;
+        this.mountedMcpServers = options.mountedMcpServers;
+        this.enabledSkills = options.enabledSkills;
+        this.disableSkill = options.disableSkill;
+        this.targetBusy = options.targetBusy;
+        this.validateTarget = options.validateTarget;
+    }
+    snapshotOf(bot) {
+        return tighteningSnapshot(bot, {
+            mcpServers: this.mountedMcpServers?.(bot),
+            skills: this.enabledSkills?.(bot.id) ?? [],
+        });
+    }
+    /** Disable every named skill, or report the first failure together with
+     * the names still outstanding. Shared by the fresh apply and the
+     * receipt-backed retry so both leave the same trail. */
+    applySkillDisables(botId, names) {
+        for (let index = 0; index < names.length; index += 1) {
+            const disabled = this.disableSkill(botId, names[index]);
+            if (!disabled.ok)
+                return { ok: false, error: disabled.error, outstanding: names.slice(index) };
+        }
+        return { ok: true };
+    }
+    propose(args) {
+        return this.prepare(args);
+    }
+    submit(args) {
+        const proposal = this.prepare(args, true);
+        return { ...proposal, state: proposal.result ? "applied" : "pending" };
+    }
+    prepare(args, submitted = false) {
+        const reason = reasonText(args.reason);
+        const intents = parseIntents(args.intents);
+        const targetBotId = args.targetBotId ?? args.botId;
+        const target = this.store.bot(targetBotId);
+        if (!target)
+            throw new TighteningRequestError(NO_SUCH_BOT, 404);
+        const crossBot = targetBotId !== args.botId;
+        if (crossBot && this.validateTarget) {
+            const refusal = this.validateTarget(args.botId, targetBotId);
+            if (refusal)
+                throw new TighteningRequestError(refusal, 403);
+        }
+        const before = this.snapshotOf(target);
+        const checked = validateTightening(before, intents);
+        if (!checked.ok)
+            throw new TighteningRequestError(checked.error, 400);
+        const requestId = newId();
+        const targetName = redactSecretsInText(target.name);
+        const payload = {
+            version: 1,
+            requestId,
+            botId: args.botId,
+            threadId: args.threadId,
+            targetBotId,
+            targetName,
+            createdAt: this.now(),
+            reason,
+            intents,
+            before,
+            expectedRevision: tighteningRevision(before, target.lastTighteningRequestId),
+        };
+        const copy = tighteningCardCopy({ name: targetName, crossBot }, before, intents, reason);
+        const persistence = this.canPersist?.(args.botId, args.threadId);
+        if (persistence && !persistence.ok) {
+            throw new TighteningRequestError(persistence.error, persistence.status);
+        }
+        const automatic = submitted && this.autoApply?.(args.botId, args.threadId) === true;
+        const messageInput = {
+            role: "bot",
+            kind: "options",
+            card: {
+                title: copy.title,
+                subtitle: copy.detail,
+                options: automatic ? [] : ["Confirm", "Cancel"],
+                ...(automatic ? { dismissed: true } : {}),
+                requestId,
+                tool: "tighten_permissions",
+                tighteningRequest: payload,
+            },
+        };
+        if (args.from)
+            messageInput.from = args.from;
+        const message = this.store.appendMessage(args.threadId, messageInput);
+        const proposal = { requestId, messageId: message.id, title: copy.title, summary: copy.summary, detail: copy.detail };
+        if (!automatic)
+            return proposal;
+        // The hidden receipt is persisted before the authority changes. The same
+        // validation and durable commit marker serve both automatic and human decisions.
+        const result = this.resolve({ botId: args.botId, threadId: args.threadId, requestId, behavior: "allow" });
+        if (result.state === "applied")
+            return { ...proposal, result };
+        throw new TighteningRequestError(result.state === "invalid" ? result.error : "The tightening could not be applied", result.state === "invalid" ? result.status : 409);
+    }
+    /** Claims a tightening card even after it was settled, so a duplicate
+     * click never re-applies an already-applied reduction. */
+    resolve(args) {
+        const message = this.store
+            .messagesFor(args.threadId)
+            .find((candidate) => candidate.card?.requestId === args.requestId && candidate.card.tighteningRequest);
+        const card = message?.card;
+        const payload = card?.tighteningRequest;
+        if (!message || !card || !payload)
+            return { claimed: false, state: "not_found" };
+        if (payload.requestId !== card.requestId) {
+            return { claimed: true, state: "invalid", error: "This tightening request does not match its card", status: 409 };
+        }
+        if (args.behavior !== "allow" && args.behavior !== "deny") {
+            return { claimed: true, state: "invalid", error: "Tightening confirmations must be confirmed or cancelled", status: 400 };
+        }
+        if (payload.botId !== args.botId || payload.threadId !== args.threadId) {
+            return { claimed: true, state: "invalid", error: "This tightening request belongs to another conversation", status: 403 };
+        }
+        if (card.answered)
+            return { claimed: true, state: "already_settled", behavior: card.answered };
+        let emergency = false;
+        let outstandingSkills = [];
+        try {
+            const target = this.store.bot(payload.targetBotId);
+            // The authority change and receipt share one durable write. If saving
+            // the card failed afterward, a retry only settles it; it never
+            // reapplies authority — but it does finish any skills a failed
+            // attempt left enabled, so a partial disable can never strand the card.
+            if (target?.lastTighteningRequestId === payload.requestId) {
+                const enabled = new Set(this.enabledSkills?.(payload.targetBotId) ?? []);
+                const remaining = (payload.intents.skills ?? []).filter((name) => enabled.has(name));
+                if (remaining.length && !this.disableSkill) {
+                    throw new TighteningRequestError("Skill changes are not available in this workspace", 400);
+                }
+                const finished = this.applySkillDisables(payload.targetBotId, remaining);
+                if (!finished.ok) {
+                    outstandingSkills = finished.outstanding;
+                    throw new TighteningRequestError(finished.error, 409);
+                }
+                const settled = this.store.patchMessage(args.threadId, message.id, {
+                    card: { ...card, answered: "allow", held: undefined, tighteningRequest: { ...payload, appliedAt: payload.appliedAt ?? this.now() } },
+                });
+                if (!settled)
+                    throw new TighteningRequestError("This tightening confirmation card is no longer available", 409);
+                return { claimed: true, state: "already_settled", behavior: "allow" };
+            }
+            if (args.behavior === "deny") {
+                this.store.patchMessage(args.threadId, message.id, { card: { ...card, answered: "deny", held: undefined } });
+                return { claimed: true, state: "denied" };
+            }
+            if (!target)
+                throw new TighteningRequestError(NO_SUCH_BOT, 404);
+            const crossBot = payload.targetBotId !== payload.botId;
+            if (crossBot && this.validateTarget) {
+                const refusal = this.validateTarget(payload.botId, payload.targetBotId);
+                if (refusal)
+                    throw new TighteningRequestError(refusal, 404);
+            }
+            const current = this.snapshotOf(target);
+            if (tighteningRevision(current, target.lastTighteningRequestId) !== payload.expectedRevision) {
+                throw new TighteningRequestError(STALE, 409);
+            }
+            // Direction is re-validated against live state, not trusted from the
+            // card: a card that sat open can only ever apply a reduction.
+            const checked = validateTightening(current, payload.intents);
+            if (!checked.ok)
+                throw new TighteningRequestError(checked.error, 409);
+            emergency = payload.intents.approvalMode !== undefined &&
+                (current.approvalMode === "full" || current.approvalMode === "custom") &&
+                payload.intents.approvalMode === "ask";
+            if (this.targetBusy?.(target.id) && !emergency) {
+                if (payload.intents.approvalMode !== undefined) {
+                    throw new TighteningRequestError("Stop this bot's turn before changing its approval level", 409);
+                }
+                if (payload.intents.mcpServers !== undefined) {
+                    throw new TighteningRequestError("Stop this bot's turns before changing its MCP servers", 409);
+                }
+            }
+            // The capability check runs before any mutation: a workspace that
+            // cannot touch skills must not half-apply the card.
+            if (payload.intents.skills?.length && !this.disableSkill) {
+                throw new TighteningRequestError("Skill changes are not available in this workspace", 400);
+            }
+            const patch = { lastTighteningRequestId: payload.requestId };
+            if (payload.intents.approvalMode !== undefined) {
+                patch.approvalMode = payload.intents.approvalMode;
+                patch.autoApprove = payload.intents.approvalMode === "auto";
+                patch.approvalGrant = undefined;
+            }
+            if (payload.intents.composio !== undefined)
+                patch.composio = false;
+            if (payload.intents.browser !== undefined)
+                patch.browser = false;
+            if (payload.intents.approvePeerComms !== undefined)
+                patch.approvePeerComms = true;
+            if (payload.intents.alwaysAllow !== undefined)
+                patch.alwaysAllow = [...checked.after.alwaysAllow];
+            if (payload.intents.mcpServers !== undefined)
+                patch.mcpServers = [...checked.after.mcpServers];
+            if (!this.store.patchBot(target.id, patch))
+                throw new TighteningRequestError(NO_SUCH_BOT, 404);
+            // Skills disable AFTER the receipt write. Each disable persists on
+            // its own, so a failure midway can leave part of the list done — but
+            // the receipt is already durable, which turns every retry into the
+            // branch above: finish the remainder, never reapply authority, and
+            // never leave the card permanently stale.
+            const skills = this.applySkillDisables(target.id, payload.intents.skills ?? []);
+            if (!skills.ok) {
+                outstandingSkills = skills.outstanding;
+                throw new TighteningRequestError(skills.error, 409);
+            }
+            const appliedAt = this.now();
+            const settled = this.store.patchMessage(args.threadId, message.id, {
+                card: { ...card, answered: "allow", held: undefined, tighteningRequest: { ...payload, appliedAt } },
+            });
+            if (!settled)
+                throw new TighteningRequestError("This tightening confirmation card is no longer available", 409);
+            const fields = INTENT_KEYS.filter((key) => payload.intents[key] !== undefined);
+            return { claimed: true, state: "applied", targetBotId: target.id, fields, ...(emergency ? { emergencyStop: true } : {}) };
+        }
+        catch (error) {
+            const status = error instanceof TighteningRequestError ? error.status : 400;
+            const detail = error instanceof Error ? error.message : String(error);
+            const saved = this.store.bot(payload.targetBotId)?.lastTighteningRequestId === payload.requestId;
+            const notice = outstandingSkills.length
+                ? `Permissions tightened. Confirm again to finish disabling: ${redactSecretsInText(outstandingSkills.join(", "))}`
+                : card.dismissed && card.options.length === 0
+                    ? "Permissions tightened. Recording the operation receipt could not finish; the changes will not be applied again."
+                    : "Permissions tightened. Confirm again to finish recording this decision; the changes will not be applied again.";
+            try {
+                this.store.patchMessage(args.threadId, message.id, {
+                    card: { ...card, held: saved ? notice : redactSecretsInText(detail).slice(0, 500) },
+                });
+            }
+            catch { /* The durable receipt still permits a safe retry. */ }
+            if (saved)
+                return {
+                    claimed: true, state: "applied", targetBotId: payload.targetBotId,
+                    fields: INTENT_KEYS.filter((key) => payload.intents[key] !== undefined),
+                    ...(emergency ? { emergencyStop: true } : {}),
+                };
+            return { claimed: true, state: "invalid", error: detail, status };
+        }
+    }
+}

package/dist-server/server/tts/chatterbox.js

@@ -44,11 +44,33 @@ async function request(url, init, what, baseUrl) {
 }
 export async function listChatterboxVoices(baseUrl) {
     try {
-        const res = await request(`${apiRoot(baseUrl)}/models`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) }, "listing voices", baseUrl);
-        if (res.ok) {
-            const body = await safeJson(res);
-            const voices = (body?.data ?? [])
-                .map((m) => ({ id: String(m?.id ?? ""), label: String(m?.id ?? "") }))
+        try {
+            const res = await request(`${apiRoot(baseUrl)}/models`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) }, "listing voices", baseUrl);
+            if (res.ok) {
+                const body = await safeJson(res);
+                const voices = (body?.data ?? [])
+                    .map((m) => ({ id: String(m?.id ?? ""), label: String(m?.id ?? "") }))
+                    .filter((v) => v.id);
+                if (voices.length)
+                    return voices;
+            }
+        }
+        catch {
+            // /v1/models missing or unreachable — try /v1/audio/voices next
+        }
+        // Some servers (e.g. Chatterbox-TTS-Server) list voices here instead.
+        const voicesRes = await request(`${apiRoot(baseUrl)}/audio/voices`, { headers: { accept: "application/json" }, signal: AbortSignal.timeout(10_000) }, "listing voices", baseUrl);
+        if (voicesRes.ok) {
+            const body = await safeJson(voicesRes);
+            const voices = (body?.voices ?? [])
+                .map((entry) => {
+                // Chatterbox-TTS-Server currently returns filename strings; docs (and
+                // /get_predefined_voices) describe { filename, display_name } objects.
+                if (typeof entry === "string")
+                    return { id: entry, label: entry };
+                const id = String(entry?.filename ?? entry?.id ?? "");
+                return { id, label: String(entry?.display_name ?? entry?.name ?? id) };
+            })
                 .filter((v) => v.id);
             if (voices.length)
                 return voices;

package/dist-server/server/usage-ledger.js

@@ -11,7 +11,7 @@ import { readFileSync } from "node:fs";
 import { appendFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { billableFor } from "./prices.js";
-export const USAGE_GROUPINGS = ["bot", "model", "user", "day", "engine"];
+export const USAGE_GROUPINGS = ["bot", "model", "user", "day", "engine", "routine"];
 const DIR = "usage";
 const MAX_RANGE_DAYS = 366;
 const DAY_MS = 24 * 60 * 60_000;
@@ -184,6 +184,12 @@ function groupOf(row, groupBy) {
             return { key: triggerKey(row.trigger), label: triggerLabel(row.trigger) };
         case "day":
             return { key: `day:${row.at.slice(0, 10)}`, label: row.at.slice(0, 10) };
+        case "routine":
+            // Turns a routine started are grouped by routine; everything else
+            // (people, the owner, other bots) shares one "manual" bucket.
+            return row.trigger.kind === "routine"
+                ? { key: triggerKey(row.trigger), label: row.trigger.label ?? row.trigger.routineId ?? "unknown" }
+                : { key: "manual", label: "Not from a routine" };
         default:
             return { key: `engine:${row.driverKind}`, label: row.driverKind };
     }

package/dist-server/server/webhooks.js

@@ -10,7 +10,12 @@ const MAX_ATTEMPTS = 2_000;
 const MAX_EVENT_CHARS = 48_000;
 const RATE_WINDOW_MS = 60_000;
 const RATE_LIMIT = 10;
-const MAX_PENDING_RUNS = 3;
+/** Unfinished (queued, running or waiting) runs one webhook may hold before
+ * new deliveries are refused with 429. A webhook can set its own limit; one
+ * fanning out a project manager's events needs more than a CI hook does. */
+export const DEFAULT_MAX_PENDING_RUNS = 3;
+export const MAX_PENDING_RUNS_LIMIT = 50;
+const maxPendingRunsSchema = z.number().int().min(1).max(MAX_PENDING_RUNS_LIMIT);
 const runOnSchema = z.enum(["maus", "cloud"]);
 const deliverySchema = z.enum(["run", "post"]);
 const eventTypesSchema = z.array(z.string()).max(20).optional();
@@ -23,6 +28,8 @@ const triggerInputSchema = z.object({
     enabled: z.boolean().optional(),
     verificationPending: z.boolean().optional(),
     eventTypes: eventTypesSchema,
+    /** `null` goes back to the default. */
+    maxPendingRuns: maxPendingRunsSchema.nullable().optional(),
 });
 const triggerPatchSchema = triggerInputSchema.partial();
 const verificationSampleSchema = z.object({
@@ -49,6 +56,9 @@ const storedWebhookSchema = z.object({
     verifiedAt: z.number().finite().nonnegative().optional(),
     verificationSample: verificationSampleSchema.optional(),
     eventTypes: eventTypesSchema,
+    // A hand-edited value out of range falls back to the default instead of
+    // making the whole webhooks file unreadable.
+    maxPendingRuns: maxPendingRunsSchema.optional().catch(undefined),
     secretHash: z.string().regex(/^[a-f0-9]{64}$/),
 });
 const deliveryReceiptSchema = z.object({
@@ -125,6 +135,8 @@ function cleanInput(input) {
         clean.eventTypes = eventTypes;
     if (input.delivery)
         clean.delivery = input.delivery;
+    if (typeof input.maxPendingRuns === "number")
+        clean.maxPendingRuns = input.maxPendingRuns;
     return clean;
 }
 function parseTriggerInput(value) {
@@ -265,12 +277,15 @@ export class WebhookManager {
             enabled: patch.enabled ?? trigger.enabled,
             verificationPending: patch.verificationPending ?? trigger.verificationPending,
             eventTypes: patch.eventTypes ?? trigger.eventTypes,
+            maxPendingRuns: patch.maxPendingRuns === undefined ? trigger.maxPendingRuns : patch.maxPendingRuns,
         });
         if (this.options.botState(clean.botId) === "missing")
             fail(400, "That MAUS no longer exists");
         Object.assign(trigger, clean, { updatedAt: this.now() });
         if (!clean.eventTypes?.length)
             delete trigger.eventTypes;
+        if (clean.maxPendingRuns === undefined)
+            delete trigger.maxPendingRuns;
         if (patch.enabled === false) {
             this.options.cancelQueued?.(trigger.id, "The webhook was paused before this delivery started");
         }
@@ -394,8 +409,11 @@ export class WebhookManager {
         }
         // A sender retrying an already-accepted delivery must remain idempotent
         // even while this webhook's queue is full. Only new work consumes a slot.
-        if ((this.options.pendingRuns?.(trigger.id) ?? 0) >= MAX_PENDING_RUNS) {
-            fail(429, "This webhook already has too many unfinished tasks");
+        const maxPendingRuns = trigger.maxPendingRuns ?? DEFAULT_MAX_PENDING_RUNS;
+        const pendingRuns = this.options.pendingRuns?.(trigger.id) ?? 0;
+        if (pendingRuns >= maxPendingRuns) {
+            fail(429, `This webhook already has ${pendingRuns} unfinished ${pendingRuns === 1 ? "task" : "tasks"} (its limit is ${maxPendingRuns}). `
+                + "Retry after one finishes, or raise \"Unfinished tasks at once\" in the webhook's settings.");
         }
         const recent = (this.rate.get(trigger.endpointId) ?? []).filter((at) => now - at < RATE_WINDOW_MS);
         if (recent.length >= RATE_LIMIT)

package/dist-server/server/workspace-backup.js

@@ -6,6 +6,7 @@ import { isAbsolute, join, parse, posix, relative, resolve, win32 } from "node:p
 import { homedir } from "node:os";
 import { backup, DatabaseSync } from "node:sqlite";
 import { pipeline } from "node:stream/promises";
+import { Worker } from "node:worker_threads";
 import * as tar from "tar";
 import { fromMarkdown } from "mdast-util-from-markdown";
 import { writeFileAtomic } from "./atomic.js";
@@ -77,8 +78,7 @@ function jobPath(dataDir, id) {
     }
     return path;
 }
-function newJob(dataDir) {
-    const id = randomUUID();
+function newJob(dataDir, id = randomUUID()) {
     const directory = jobPath(dataDir, id);
     mkdirSync(directory, { mode: 0o700 });
     return { id, directory };
@@ -265,13 +265,50 @@ function databaseCounts(path) {
         db.close();
     }
 }
+/** The existing maintenance gate owns exclusivity until this worker has exited.
+ * Keep synchronous file validation/fsync intact, but off the request thread. */
 export async function createWorkspaceBackup(dataDir, options) {
+    const source = new URL("./workspace-backup.worker.ts", import.meta.url);
+    // Assign ownership before the worker can create staging, including crashes
+    // too early to send a job-created message back to this process.
+    const jobId = randomUUID();
+    let worker;
+    let completed = false;
+    try {
+        worker = new Worker(existsSync(source) ? source : new URL("./workspace-backup.worker.js", import.meta.url), {
+            workerData: { dataDir, options, jobId }, execArgv: [],
+        });
+        const result = await new Promise((resolveBackup, reject) => {
+            const failed = () => reject(new Error("The backup worker stopped before completing. Try again."));
+            worker.once("message", (reply) => {
+                if (reply.result)
+                    resolveBackup(reply.result);
+                else if (reply.error)
+                    reject(new Error(reply.error));
+                else
+                    failed();
+            });
+            worker.once("error", failed);
+            worker.once("exit", failed);
+        });
+        completed = true;
+        return result;
+    }
+    finally {
+        await worker?.terminate();
+        // Reuse the guarded deletion path: never sweep other jobs or recovery.
+        if (!completed && entryExists(join(dataDir, ".backups", jobId)))
+            removeWorkspaceBackupJob(dataDir, jobId);
+    }
+}
+/** Worker implementation; application callers use createWorkspaceBackup. */
+export async function createWorkspaceBackupSnapshot(dataDir, options, jobId) {
     if (Object.hasOwn(options, "credentials"))
         throw new Error("Workspace backups do not transfer credentials.");
     assertLocalAuthOutsideSnapshot(dataDir);
     const salt = randomBytes(16);
     const key = await passwordKey(options.password, salt);
-    const job = newJob(dataDir);
+    const job = newJob(dataDir, jobId);
     const snapshot = join(job.directory, "snapshot");
     folder(join(snapshot, "data"));
     const entries = [];

package/dist-server/server/workspace-backup.worker.js

@@ -0,0 +1,10 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { createWorkspaceBackupSnapshot } from "./workspace-backup.js";
+const { dataDir, options, jobId } = workerData;
+try {
+    // Same snapshot and cleanup implementation; never send password/options back.
+    parentPort.postMessage({ result: await createWorkspaceBackupSnapshot(dataDir, options, jobId) });
+}
+catch (error) {
+    parentPort.postMessage({ error: error instanceof Error ? error.message : "The workspace backup could not finish." });
+}

package/dist-server/shared/ask-question.js

@@ -124,6 +124,25 @@ export function stripOmbAskBlock(output) {
         return output;
     return output.replace(OMB_ASK_FENCE_GLOBAL, "").replace(/\n{3,}/g, "\n\n").trim();
 }
+/** The prompt contract that teaches a model the turn-held ask transport: end
+ * the reply with a fenced `omb-ask` block carrying the questions, and the
+ * answers come back on the next prompt. A harness that cannot pause mid-run
+ * (the BoxAgent transport) appends this to every prompt; the caps in the text
+ * are the constants above, so the taught contract and the parser cannot
+ * drift apart. */
+export function ombAskProtocolPrompt() {
+    return [
+        "",
+        "## Asking the person a question",
+        "When a decision belongs to the person, end your reply with a fenced block exactly like this:",
+        "",
+        "```omb-ask",
+        '{"questions":[{"question":"Ship the release now?","header":"Release","options":[{"label":"Ship now"},{"label":"Wait for the QA signoff"}]}]}',
+        "```",
+        "",
+        `The block must be the last thing in your reply. You may ask up to ${MAX_QUESTIONS} questions at once, each with up to ${MAX_OPTIONS} options; the person can always answer in their own words. Their answers arrive on your next prompt as \`Q:\`/\`A:\` lines — never invent them.`,
+    ].join("\n");
+}
 /** The one line the card subtitle and a spoken prompt show. */
 export function askQuestionSummary(questions) {
     const first = questions[0]?.question ?? "";

package/dist-server/shared/credential-request.js

@@ -76,11 +76,15 @@ export function credentialIsConfigured(config, id) {
             return Boolean(config.imageGen?.key);
     }
 }
-export function isReusableCredentialRequest(message, target, requestingBotId, roomThread) {
+/** A still-pending credential card for this target — the set a newer
+ * request supersedes. Provided, dismissed, and already-superseded cards
+ * keep their settled state untouched. */
+export function isPendingCredentialRequest(message, target, requestingBotId, roomThread) {
     return (message.kind === "secret" &&
         message.secret?.target === target &&
         message.secret.provided !== true &&
         message.secret.dismissed !== true &&
+        message.secret.superseded !== true &&
         (!roomThread || message.from?.botId === requestingBotId));
 }
 export function credentialResumeOutcome(state) {