openmausbot 0.1.91 → 0.1.92

package/dist-server/server/index.js

@@ -1,6 +1,9 @@
 // OpenMausBot server — the harness host. Clients hold no transports
 // (upstream rule): the React app dispatches typed commands over HTTP and
 // folds one SSE event stream; every provider process runs here.
+// First, before any module that could start a process: a Cloud home's
+// secrets off the launcher's pipe (cloud-secrets-boot.ts).
+import { BOOT_CLOUD_SECRETS } from "./cloud-secrets-boot.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { existsSync, readFileSync, realpathSync, rmSync, mkdirSync } from "node:fs";
@@ -16,7 +19,8 @@ import { draftSummary, foldPoint } from "./compaction-summary.js";
 import { compactBudget, contextWindowFor, shouldCompact } from "./context-budget.js";
 import { autoCompactWindow } from "./drivers/claude.js";
 import { provenRequestPerson, SharedComputers, sharedComputerOperation, sharedComputerRegistration } from "./shared-computers.js";
-import { cloudHomeLendingRefusal, createCloudRoutineAuthors } from "./cloud-lending.js";
+import { cloudHomeLendingRefusal, createCloudRoutineAuthors, ownerOnlyConversation } from "./cloud-lending.js";
+import { botMemoryFiles, createLendingMemory } from "./lending-memory.js";
 import { SharedComputerControl } from "./shared-computer-control.js";
 import { RoomHandoffs } from "./room-handoffs.js";
 import { assertRequestTarget, guardedRequestPath, requestConflict, requestNeedsInput, requestSourceForCard } from "./guarded-requests.js";
@@ -61,7 +65,7 @@ import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, liv
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
 import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmRecreatableOnDemand, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
@@ -80,10 +84,12 @@ import { isModelVariant, TurnNotStartedError, newId, } from "./contracts.js";
 import { RETRY_MAX_ATTEMPTS } from "./drivers/retry.js";
 import { recoveryCapabilityError } from "./automatic-recovery.js";
 import { decodeGeneratedImage } from "./generated-image.js";
-import { MAX_MCP_SERVERS, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
+import { MAX_MCP_SERVERS, isRemoteMcpServer, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, } from "./mcp-registry.js";
+import { McpOAuthError, McpSignInError, McpOAuthManager, mcpOAuthRedirectUri, withMcpSignIn, withoutPendingSignIn } from "./mcp-oauth.js";
 import { probeMcpServer } from "./mcp-probe.js";
 import { GROUP_GOAL_MAX_TURNS, groupGoalAssignmentKey, groupGoalCompletionTurnId, groupGoalCoordinatorInstructions, groupGoalWorkerInstructions, parseGroupGoalDecision, resolveGroupGoalMember, selectGroupGoalCoordinator, } from "./group-goal-run.js";
 import { BUILT_IN_DRIVERS } from "./drivers/builtIn.js";
+import { openCodeProviderKeysAllowed, setOpenCodeProviderKeyPolicy } from "./drivers/acp/opencode-go.js";
 import { getOrCreateChannel, mirrorActivity, mirrorExchange, mirrorReply } from "./comms-visibility.js";
 import { readMessageText, recallMessages, recentMessages, searchMessagesAsync, closeMessageSearch, closeMessageDb, chatFollowups, cancelledChatFollowup, settleChatFollowups, threadsReferencing } from "./message-db.js";
 import { briefCrossingLabel, claimRecallCrossings, recallCrossingLabel } from "./recall-disclosure.js";
@@ -104,7 +110,8 @@ import { ProviderRegistry } from "./harness/registry.js";
 import { ManagedDesktopProviders } from "./managed-desktop.js";
 import { computerKindForResource, ManagedDesktopPolicy } from "./managed-policy.js";
 import { hostedModelPolicy, HOSTED_MODEL_POLICY_HEADER, HOSTED_PROVIDER_SETTINGS_ERROR } from "./hosted-models.js";
-import { boatNotConfiguredMessage, CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_IGNORED_KEYS, CLOUD_PAIRING_PATH, cloudHomeConfiguration, cloudHomeOffersPlace, cloudHomePlaceRefusal, createCloudPairing, readSignedBody, } from "./cloud-home.js";
+import { boatNotConfiguredMessage, CLOUD_HOME_RESTART_EXIT_CODE, CLOUD_HOME_SECRET_KEYS, CLOUD_IGNORED_KEYS, CLOUD_PAIRING_PATH, cloudHomeConfiguration, cloudHomeOffersPlace, cloudHomePlaceRefusal, createCloudPairing, firstCloudTurnPatch, readSignedBody, } from "./cloud-home.js";
+import { CLOUD_PERSONAL_REFUSAL, settleCloudOwnership } from "./cloud-owner.js";
 import { createCloudMoveRoutes } from "./cloud-move-http.js";
 import { holdIncludedServices } from "./included-services.js";
 import { selectDefaultModelSelection, withNewBotEffort } from "./default-model-selection.js";
@@ -120,10 +127,11 @@ import { narrateTool, toUtterances } from "./tts/speech-text.js";
 import { buildRecoveryText, buildTurnContext, engineIsFresh, NATIVELY_REPLAYING_DRIVER_KINDS, peerMessageText } from "./turn-context.js";
 import { Handoffs, handedStateUsable, recordHanded, renderUnseen, sessionStart, unseenMessages, withUnseenMessages } from "./delta-context.js";
 import { extractTurnImages } from "./turn-images.js";
+import { threadTitlePrompt, titleConversationExcerpt } from "./thread-title.js";
 import { TurnWatchdog } from "./turn-watchdog.js";
 import { TurnResources, workspaceResource } from "./turn-resources.js";
 import { IdleReleasePolicy } from "./claim-idle.js";
-import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, supportsWorkspaceFiles, updateMemory, appendMemoryLog, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, workspaceDir, } from "./workspace.js";
+import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, supportsWorkspaceFiles, updateMemory, appendMemoryLog, memorySystemPrompt, memorySourceLabel, searchMemoryFiles, SESSION_SEARCH_SYSTEM_PROMPT, TASK_WORKSPACES_DIR, readMemoryOnlyFromRegularFiles, workspaceDir, } from "./workspace.js";
 import { listMemoryTopics, memoryDate, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, journalMemoryWrite, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
@@ -146,12 +154,12 @@ import * as vps from "./vps-computer.js";
 import { RoutineManager } from "./routines.js";
 import { CalendarCallManager } from "./calendar-calls.js";
 import { BUILT_IN_BROWSER_SYSTEM_PROMPT } from "./browser-engine.js";
-import { BrowserRuntime } from "./browser-runtime.js";
+import { BrowserRuntime, browserRuntimeEnv } from "./browser-runtime.js";
 import { BrowserLive } from "./browser-live.js";
-import { agentBrowserFrame, agentBrowserIntegration, browserEngineEncryptionKey, prepareBrowserSessionState, clearBrowserSessionState, ensureChrome, installAgentBrowserBinary, resolveAgentBrowserBinary, browserEngineStatus, browserSessionId, describeBrowserEngine, } from "./browser-engine.js";
+import { agentBrowserFrame, agentBrowserIntegration, browserEngineEncryptionKey, prepareBrowserSessionState, clearBrowserSessionState, closeBrowserSession, ensureChrome, installAgentBrowserBinary, resolveAgentBrowserBinary, browserEngineStatus, browserSessionId, describeBrowserEngine, } from "./browser-engine.js";
 import { createScreenFrameSource } from "./screen-frame-source.js";
 import { screenFrameHash, screenSurfaceForTool, screenTouchingTool, settledFrameIsNews } from "./screen-frame-gate.js";
-import { RoutineRequestService } from "./routine-requests.js";
+import { asSchedule, RoutineRequestService } from "./routine-requests.js";
 import { createOptionsCard } from "./options-card.js";
 import { buildBotOverview, connectedAppsFacts } from "./bot-overview.js";
 import { ProfileRequestService } from "./profile-requests.js";
@@ -214,6 +222,10 @@ import { createHostedSlackRoutes } from "./routes/hosted-slack.js";
 import { createBotPresetRoutes } from "./routes/bot-presets.js";
 import { createBotMemoryRoutes } from "./routes/bot-memory.js";
 import { createDeciderRoutes } from "./routes/decider.js";
+import { createDesktopViewer, desktopViewerUrl } from "./routes/desktop-viewer.js";
+import { localDesktopTarget, localVmViewerStatus, viewerTargetId } from "./desktop-viewer-targets.js";
+import { createAntigravityLeftoverRoutes } from "./routes/antigravity-leftovers.js";
+import { findAntigravityLeftovers, removeAntigravityLeftovers } from "./drivers/antigravity-temp.js";
 const PORT = Number(process.env.OMB_PORT || process.env.OGB_PORT || 8799);
 const WEBHOOK_PORT = Number(process.env.OMB_WEBHOOK_PORT || PORT + 1);
 // Behind a proxy or tunnel, the base URL senders should use (docs/self-hosting.md).
@@ -223,6 +235,7 @@ const MIME = {
     ".html": "text/html",
     ".js": "text/javascript",
     ".css": "text/css",
+    ".txt": "text/plain; charset=utf-8",
     ".svg": "image/svg+xml",
     ".png": "image/png",
     ".ico": "image/x-icon",
@@ -252,8 +265,12 @@ process.once("exit", releaseDataDirLeaseAtExit);
 // Restore before constructing any long-lived config, Store, session or provider
 // objects. Replacing files underneath a live Store would overwrite restored data.
 let workspaceRestore = { restored: false };
+/** A restore applied at this very start (not the last one on record). */
+let restoredAtStart;
 if (existsSync(join(DATA_DIR, ".backups"))) {
     workspaceRestore = applyPendingWorkspaceRestore(DATA_DIR);
+    if (workspaceRestore.restored)
+        restoredAtStart = workspaceRestore.id;
     if (!workspaceRestore.restored && !workspaceRestore.rolledBack) {
         workspaceRestore = readLastWorkspaceRestore(DATA_DIR) ?? workspaceRestore;
     }
@@ -279,7 +296,16 @@ const sessions = new SessionRegistry({
 const sharedComputers = new SharedComputers(id => sessions.isLive(id));
 // OMB Cloud Pro home machine (server/cloud-home.ts, docs/cloud-pro.md). A
 // partial or invalid boot contract stops the server here, before it serves.
-const CLOUD_HOME = cloudHomeConfiguration();
+// Its secrets come over the launcher's pipe, never this process's
+// environment (cloud-home-start.ts); a server started another way (tests,
+// development) still reads them from its environment.
+const CLOUD_SECRETS = BOOT_CLOUD_SECRETS;
+const CLOUD_ENV = { ...process.env, ...CLOUD_SECRETS };
+const CLOUD_HOME = cloudHomeConfiguration(CLOUD_ENV);
+// A Cloud home is personal: only the owner's own devices, each with admin
+// scope, connect (server/cloud-owner.ts; the stored rest is revoked below).
+if (CLOUD_HOME)
+    sessions.requireAdmin(CLOUD_PERSONAL_REFUSAL);
 /** Lending a computer to this server (the shared-computer routes, the two
  * agent tools, the advertised capability): the maintainer flag anywhere, and
  * always on an OMB Cloud home, where it is the person's own Mac lent to their
@@ -291,6 +317,29 @@ const CLOUD_HOME_LENDER = "cloud-home";
  * the owner started: the only routine turns that may use a lent Mac. */
 const cloudRoutineAuthors = CLOUD_HOME ? createCloudRoutineAuthors(join(DATA_DIR, "lending-routines.json")) : null;
 const ownerStartedRoutineRuns = new Set();
+/** Turns running now that are not provably the owner's, by generation. */
+const foreignTurns = new Map();
+/** Whether each bot's memory is still the owner's (server/lending-memory.ts):
+ * its memory files, and the instruction files its engine reads in the
+ * folders its conversations work in. */
+const lendingMemory = CLOUD_HOME ? createLendingMemory({
+    file: join(DATA_DIR, "lending-memory.json"),
+    files: (botId) => {
+        const bot = store.bot(botId);
+        // The workspace as a turn dispatch leaves it: a bot's first turn seeds
+        // MEMORY.md, and that seed is not a change anyone made. Only the folders
+        // of conversations the owner opened: what a guest's own conversation
+        // writes in its own private folder reaches no turn of the owner's.
+        // (A bot's own conversations are never a room's: its opener is enough.)
+        const ownerOpened = (threadId) => { const starter = threadStarters.get(threadId); return starter === undefined || cloudOwnerPerson(starter); };
+        return botMemoryFiles(bot ? { id: bot.id, cwd: bot.cwd, tasks: store.tasks(bot.id).filter((task) => ownerOpened(task.threadId)) } : undefined, { workspace: ensureWorkspace, taskWorkspaces: TASK_WORKSPACES_DIR });
+    },
+    knownBots: () => store.bots.map((bot) => bot.id),
+    log: (line) => console.warn(line),
+}) : null;
+// On a Cloud home memory is never read through a link (server/workspace.ts).
+if (CLOUD_HOME)
+    readMemoryOnlyFromRegularFiles();
 const cloudPairing = CLOUD_HOME ? createCloudPairing({ secret: CLOUD_HOME.bootstrapSecret, sessions }) : null;
 if (CLOUD_HOME) {
     // The signing secret is held in memory from here on, and a platform
@@ -305,7 +354,12 @@ if (CLOUD_HOME) {
 }
 // Cloud Pro's included Boat, voice and decision relay tokens, when the Admin
 // set them: held in memory from here on, like the signing secret.
-holdIncludedServices();
+holdIncludedServices(CLOUD_ENV);
+for (const key of CLOUD_HOME_SECRET_KEYS)
+    delete process.env[key];
+if (CLOUD_HOME && Object.keys(CLOUD_SECRETS).length === 0) {
+    console.warn("cloud home: its secrets came in this process's environment, which anything running as the same user can read in /proc; start it with cloud-home-start");
+}
 // Who each thread is for, when a signed-in person can be named (server-private).
 const threadStarters = new ThreadStarters(join(DATA_DIR, "thread-starters.json"));
 const commandAllowlist = new CommandAllowlistStore(join(DATA_DIR, "command-allowlist.json"));
@@ -318,7 +372,7 @@ const sharedWorkspaceFullAccessEnabled = () => SHARED_WORKSPACE_FULL_ACCESS && B
 // Who a loopback request without a session is (server/request-auth.ts
 // LoopbackTrust): the owner on a desktop or a one-person server; a service on
 // a shared workspace, where every bot's shell is a loopback caller too.
-const LOOPBACK = resolveLoopbackTrust({ desktopManaged: DESKTOP_MANAGED, hostedWorkspace: HOSTED_WORKSPACE });
+const LOOPBACK = resolveLoopbackTrust({ desktopManaged: DESKTOP_MANAGED, hostedWorkspace: HOSTED_WORKSPACE, cloudHome: Boolean(CLOUD_HOME) });
 // `openmausbot serve` on a service-trust server hands the server it starts a
 // per-launch secret on stdin, then closes it (server/cli.ts). It opens only
 // the pairing route, for that CLI. Never an environment variable: every
@@ -416,7 +470,7 @@ function messageSender(auth) {
     if (auth.kind !== "session")
         return undefined;
     const name = (auth.session.email ?? auth.session.label ?? "").trim();
-    return name ? { name, id: personKey(auth.session) } : undefined;
+    return name ? { name, id: actorKey(auth) } : undefined;
 }
 /** An opaque, stable key for the person behind a session: their account
  * email when they signed in with one (a new device is still them), else the
@@ -474,7 +528,7 @@ function sharedComputerPrincipal(capability) {
     // their devices, or a routine they wrote. Never a guest, a webhook, a room
     // or a line someone else slipped in.
     if (CLOUD_HOME)
-        return cloudHomeLendingRefusal(cloudLendingTurn(capability)) === null ? CLOUD_HOME_LENDER : null;
+        return cloudLendingRefusal(capability) === null ? CLOUD_HOME_LENDER : null;
     return provenRequestPerson(directRequestOwners.get(capability.threadId), capability.generation, (messageId) => linePersonKey(store.messagesFor(capability.threadId).find((message) => message.id === messageId)));
 }
 /** What the lending rule needs to know about one bot turn on a Cloud home. */
@@ -483,7 +537,9 @@ function cloudLendingTurn(capability) {
         request: directRequestOwners.get(capability.threadId),
         generation: capability.generation,
         thread: store.messagesFor(capability.threadId),
-        ownerPerson: cloudOwnerPerson,
+        starters: cloudThreadStarters(capability.threadId),
+        reportsFromOthers: store.messagesFor(capability.threadId).some(cloudOthersRoutineReport),
+        ownerPerson: cloudProvenOwnerPerson,
         cardAnswerer: cloudCardAnswerer,
         routineRun: () => {
             const run = activeRoutineRunForThread(capability.threadId);
@@ -493,9 +549,7 @@ function cloudLendingTurn(capability) {
                 triggerSource: run.triggerSource ?? (run.manual ? "manual" : "schedule"),
                 ownerStarted: ownerStartedRoutineRuns.has(run.id),
                 // What the run snapshotted, on the schedule its routine has now.
-                ownerAuthored: ((routine) => Boolean(routine) && cloudRoutineAuthors?.authored(run.routineId, {
-                    ...routine, prompt: run.prompt, target: run.target, botId: run.botId, groupId: run.groupId, attachments: run.attachments, runOn: run.runOn,
-                }) === true)(routines?.listRoutines().find((candidate) => candidate.id === run.routineId)),
+                ownerAuthored: cloudRoutineRunIsOwners(run, capability.botId, capability.threadId),
             };
         },
     };
@@ -503,6 +557,82 @@ function cloudLendingTurn(capability) {
 /** What a bot on a Cloud home is told when its conversation cannot use the
  * owner's lent Mac because someone else wrote in it. The bot relays it. */
 const LENDING_SOMEONE_ELSE = "Someone else wrote in this conversation, so it can't use your Mac. Start a new conversation to use it.";
+/** …or because its memory was changed where the owner did not write. */
+const LENDING_MEMORY_CHANGED = "This bot's memory was changed in a conversation you didn't write. Review it in Memory to use your Mac again.";
+/** Why this bot turn may not use the owner's lent Mac on a Cloud home, or
+ * null: the conversation's provenance (server/cloud-lending.ts), then the
+ * bot's memory, which every one of its turns loads (server/lending-memory.ts). */
+function cloudLendingRefusal(capability) {
+    const refusal = cloudHomeLendingRefusal(cloudLendingTurn(capability));
+    if (refusal)
+        return refusal;
+    // Checked on every Mac action: one snapshot per tick is enough to look.
+    return lendingMemory?.reconcile(capability.botId, foreignTurnRunning(capability.botId), { cached: true }).changedBySomeoneElse ? "memory-changed" : null;
+}
+/** Who opened a conversation, and the room it is in: on a Cloud home a
+ * person who can name, title and steer it (see cloudThreadRefusal). */
+function cloudThreadStarters(threadId) {
+    const room = store.groupByThread(threadId);
+    return [threadStarters.get(threadId), ...(room && room.threadId !== threadId ? [threadStarters.get(room.threadId)] : [])];
+}
+/** On a Cloud home: a turn that may use the owner's lent Mac, as far as its
+ * conversation goes. Such a turn reads only the owner's own conversations
+ * (session_search, session_read, list_threads). */
+function cloudLendingView(capability) {
+    return CLOUD_HOME !== null && cloudHomeLendingRefusal(cloudLendingTurn(capability)) === null;
+}
+/** On a Cloud home: a routine's report (its lifecycle card, carrying what
+ * the run said) of a routine the owner did not write, as it stands now. It
+ * brings someone else's instructions' results into the conversation it
+ * reports to. */
+function cloudOthersRoutineReport(line) {
+    if (line.kind !== "routine.run" || !line.routineRun)
+        return false;
+    const routine = routines?.listRoutines().find((candidate) => candidate.id === line.routineRun.routineId);
+    return !routine || cloudRoutineAuthors?.authored(routine.id, routine) !== true;
+}
+/** On a Cloud home: a conversation of this bot that only its owner opened
+ * and wrote in (server/cloud-lending.ts ownerOnlyConversation), the only kind
+ * that may feed the bot's memory, daily log, recall or recent-work brief, or
+ * be quoted there by its title. Cached per thread until it gets another
+ * message, and dropped whenever a session is revoked. */
+const ownerOnlyCache = new Map();
+function cloudOwnerOnlyThread(threadId) {
+    if (cloudThreadStarters(threadId).some((person) => person !== undefined && !cloudProvenOwnerPerson(person)))
+        return false;
+    const thread = store.messagesFor(threadId);
+    const last = thread.at(-1);
+    const cached = ownerOnlyCache.get(threadId);
+    // A card answered later changes the answer too: key on its answerer as well.
+    const lastKey = last ? `${last.id}:${last.card?.answeredBy ? JSON.stringify(last.card.answeredBy) : ""}` : undefined;
+    if (cached && cached.length === thread.length && cached.last === lastKey)
+        return cached.owner;
+    const owner = ownerOnlyConversation(thread, cloudProvenOwnerPerson, cloudCardAnswerer) && !thread.some(cloudOthersRoutineReport);
+    if (ownerOnlyCache.size > 5_000)
+        ownerOnlyCache.clear();
+    ownerOnlyCache.set(threadId, { length: thread.length, last: lastKey, owner });
+    return owner;
+}
+/** On a Cloud home: a turn that is not provably the owner's starts for this
+ * bot (its memory is "pending" until the turn's generation ends:
+ * server/lending-memory.ts; see revokeInternalCapabilityGeneration). */
+function noteForeignTurn(botId, threadId, generation) {
+    if (!lendingMemory)
+        return;
+    foreignTurns.set(generation, { botId, threadId });
+    // The record is updated in memory before it is saved: a failed save still
+    // leaves the bot pending, and must not fail the turn that is starting
+    // (whose end is what clears this entry).
+    try {
+        lendingMemory.noteForeignTurn(botId);
+    }
+    catch (error) {
+        console.warn(`lending: could not record a turn someone else started: ${error.message}`);
+    }
+}
+function foreignTurnRunning(botId) {
+    return [...foreignTurns.values()].some((turn) => turn.botId === botId);
+}
 /** Whose lent computers a status reader may see: on a Cloud home, only the
  * owner's own devices (admin sessions) see the lent Mac, never a guest or a
  * local process; elsewhere, the person behind the asking session. */
@@ -511,6 +641,239 @@ function sessionLendingPrincipal(auth) {
         return cloudOwnerSession(auth) ? CLOUD_HOME_LENDER : null;
     return auth.kind === "session" ? personKey(auth.session) : null;
 }
+/** Profile fields only the owner may change on a Cloud home: what rides the
+ * bot's prompt, and whether it notifies the owner. */
+const CLOUD_OWNER_PROFILE_FIELDS = ["name", "title", "description", "soul", "notifications"];
+/** On a Cloud home: why this request may not act on a conversation, or
+ * null. The owner's conversations feed the owner's turns (and a lent Mac),
+ * so only one of the owner's own devices may rename them, change how they
+ * run, rewrite or delete them; anyone else only a conversation they started
+ * themselves (a guest's own session). Sends are checked by
+ * cloudGuestSendRefusal instead. Elsewhere always null. */
+function cloudThreadRefusal(auth, threadId) {
+    if (!CLOUD_HOME || cloudOwnerSession(auth))
+        return null;
+    if (auth.kind === "session" && threadStarters.get(threadId) === actorKey(auth))
+        return null;
+    return "On this Cloud you can only change conversations you started.";
+}
+/** On a Cloud home: why a paired guest may not send into a conversation, or
+ * null. A guest writes only in conversations it started, never in the
+ * owner's (a line steered into the owner's running turn would reach it
+ * before anything could reclassify that turn). Local services (loopback)
+ * keep their own conversations; their lines make a conversation someone
+ * else's all the same (see noteSomeoneElsesLine). */
+function cloudGuestSendRefusal(auth, threadId) {
+    if (!CLOUD_HOME || auth.kind !== "session" || cloudOwnerSession(auth))
+        return null;
+    return threadStarters.get(threadId) === actorKey(auth)
+        ? null : "On this Cloud you can only write in conversations you started. Start a new conversation with this bot.";
+}
+/** On a Cloud home: the one key every line, card answer, conversation and
+ * routine of the owner's own devices carries, whichever device and however
+ * often it was paired again, so re-pairing never demotes what the owner
+ * wrote. Only an admin session is given it: a guest keeps its own key. */
+const CLOUD_OWNER_KEY = CLOUD_HOME ? `p_${createHash("sha256").update(`cloud-owner:${CLOUD_HOME.machineId}`).digest("base64url").slice(0, 22)}` : null;
+/** …and the key of nobody at all: what a conversation made for work no
+ * person can be named for (a routine with no recorded writer) opens as. */
+const CLOUD_NOBODY_KEY = `p_${createHash("sha256").update("cloud-nobody").digest("base64url").slice(0, 22)}`;
+/** A Cloud home is personal (server/cloud-owner.ts): the keys its owner's
+ * devices carried before they shared one, settled at boot once the routines
+ * are loaded (settleCloudOwnership, below). `adopted` decides who opened a
+ * conversation, its level and its folder; only `proven` feeds lending and
+ * memory. Nothing is either until then. */
+let cloudEarlierOwners = { adopted: new Set(), proven: new Set() };
+/** Who a session acts as, for lines, openers and answers: on a Cloud home
+ * one of the owner's own devices is the owner; anyone else is themselves. */
+function actorKey(auth) {
+    return CLOUD_OWNER_KEY && auth.scopes.includes("admin") ? CLOUD_OWNER_KEY : personKey(auth.session);
+}
+/** On a Cloud home: whoever is writing a routine in this request (routine
+ * creation and edits can open its results conversation). */
+let routineWriterInFlight;
+function withRoutineWriter(writer, work) {
+    const previous = routineWriterInFlight;
+    routineWriterInFlight = writer;
+    try {
+        return work();
+    }
+    finally {
+        routineWriterInFlight = previous;
+    }
+}
+/** On a Cloud home: a routine the owner approved (its card, or a proposal
+ * applied at once in their own Full-access conversation) is theirs as it
+ * stands: their key as its writer, their fingerprint on it. */
+function cloudOwnersRoutine(routineId) {
+    const routine = routineId ? routines?.listRoutines().find((candidate) => candidate.id === routineId) : undefined;
+    if (!routine || !cloudRoutineAuthors || !CLOUD_OWNER_KEY)
+        return;
+    cloudRoutineAuthors.record(routine.id, routine);
+    cloudRoutineAuthors.wrote(routine.id, CLOUD_OWNER_KEY);
+}
+/** On a Cloud home: a routine that is the owner's as it stands: their
+ * fingerprint matches what it runs, or they are its writer and no
+ * fingerprint of theirs was ever recorded (a template, a restore). */
+function cloudRoutineIsOwners(routineId) {
+    const routine = routineId ? routines?.listRoutines().find((candidate) => candidate.id === routineId) : undefined;
+    if (!routine || !cloudRoutineAuthors || !CLOUD_OWNER_KEY)
+        return false;
+    return cloudRoutineAuthors.authored(routine.id, routine) ||
+        (cloudRoutineAuthors.writer(routine.id) === CLOUD_OWNER_KEY && !cloudRoutineAuthors.recorded(routine.id));
+}
+/** On a Cloud home: a routine run that acts for the owner. Only in the run's
+ * own thread, and only while the owner's fingerprint matches what the run
+ * snapshotted, the same test as lending the Mac. A routine that is the
+ * owner's but not yet cleared for the Mac (no fingerprint: a v0.1.91
+ * approval, a template, a restore) can't clear itself or others this way. */
+function cloudRoutineRunIsOwners(run, botId, threadId) {
+    if (!run || run.threadId !== threadId || store.taskByThread(botId, threadId)?.routineRunId !== run.id || !cloudRoutineAuthors)
+        return false;
+    const routine = routines?.listRoutines().find((candidate) => candidate.id === run.routineId);
+    return Boolean(routine) && cloudRoutineAuthors.authored(run.routineId, {
+        ...routine, prompt: run.prompt, target: run.target, botId: run.botId, groupId: run.groupId, attachments: run.attachments, runOn: run.runOn,
+    }) === true;
+}
+/** After the owner approved a routine request (its card, or at once in their
+ * own conversation): a routine it created is theirs; one it changed, paused
+ * or resumed stays theirs only if it already was (`wasOwners`, taken before
+ * the change). Approving a harmless change never makes anyone else's routine
+ * the owner's. */
+function cloudOwnerApplied(action, routineId, wasOwners) {
+    if (action === "create" || ((action === "update" || action === "pause" || action === "resume") && wasOwners))
+        cloudOwnersRoutine(routineId);
+}
+/** What the owner saw on a card that proposed a routine, and what a routine
+ * runs, in the same terms (everything its fingerprint covers except an
+ * interval's anchor, which only moves when it runs). */
+function approvalShape(shape) {
+    const schedule = shape.schedule && typeof shape.schedule === "object" ? { ...shape.schedule } : null;
+    if (schedule)
+        delete schedule.anchorAt;
+    return JSON.stringify([shape.prompt ?? "", shape.botId ?? "", shape.runOn ?? "maus", schedule, shape.target ?? "bot", shape.groupId ?? null,
+        (shape.attachments ?? []).map((attachment) => [attachment.id, attachment.path])]);
+}
+/** Who opens a routine's results conversation on a Cloud home: the writer
+ * of this request, else the owner for a routine that is theirs (they wrote
+ * it as it stands, or they are its writer: cloud-owner.ts), else its last
+ * writer, else nobody. */
+function routineOpener(routineId) {
+    if (routineWriterInFlight)
+        return routineWriterInFlight;
+    const routine = routines?.listRoutines().find((candidate) => candidate.id === routineId);
+    if (routine && CLOUD_OWNER_KEY && cloudRoutineAuthors?.authored(routineId, routine))
+        return CLOUD_OWNER_KEY;
+    const writer = cloudRoutineAuthors?.writer(routineId);
+    if (writer && CLOUD_OWNER_KEY && writer === CLOUD_OWNER_KEY)
+        return CLOUD_OWNER_KEY;
+    return writer && !cloudOwnerPerson(writer) ? writer : CLOUD_NOBODY_KEY;
+}
+/** On a Cloud home: a conversation someone other than the owner opened (a
+ * guest, a guest's routine, or its room; on a personal Cloud, one a revoked
+ * session opened: nobody's). Its turns run in Ask, confined, in a private
+ * folder of their own (pinned at its first turn, or after it was unpinned at
+ * boot: see pinTaskCwd), and nothing in it reaches the owner's turns. */
+function cloudGuestOpened(threadId) {
+    return Boolean(CLOUD_HOME) && cloudThreadStarters(threadId).some((person) => person !== undefined && !cloudOwnerPerson(person));
+}
+/** On a Cloud home: turns running now that a guest drives through another
+ * conversation (a teammate's handoff started from a guest's turn), by
+ * thread, with their generation. They are guest-driven like the guest's
+ * own conversation while they run (cloudGuestDriven). */
+const guestDrivenTurns = new Map();
+/** On a Cloud home: whether a handoff's chain started in (or passed
+ * through) a guest-driven conversation: work a guest's turn hands a
+ * teammate is the guest's too, however deep. */
+function cloudGuestDrivenHandoff(nodeId) {
+    if (!CLOUD_HOME || !nodeId)
+        return false;
+    let node = roomHandoffs.nodes.get(nodeId);
+    for (let steps = 0; node && steps < 32; steps++) {
+        // Every conversation the work came through, up to the one it started in.
+        if (node.id !== nodeId && cloudGuestDriven(node.threadId))
+            return true;
+        if (node.id === node.rootId)
+            break;
+        node = roomHandoffs.nodes.get(node.parentId ?? node.rootId);
+    }
+    return false;
+}
+/** Who a conversation a bot opens from another is for: on a Cloud home,
+ * never the owner when a guest drives the source (it opens as the guest's,
+ * or nobody's), so it is confined like the source. */
+function openerFrom(fromThreadId) {
+    const person = threadPersonKey(fromThreadId);
+    if (!CLOUD_HOME || !cloudGuestDriven(fromThreadId))
+        return person;
+    return person && !cloudOwnerPerson(person) ? person : CLOUD_NOBODY_KEY;
+}
+/** The model a thread a bot opens from one of its own threads starts on:
+ * that thread's, not the bot default the person may have moved away from
+ * (#1950). Only the bot's own thread counts — a room or a teammate's thread
+ * is not one of its tasks, and another bot's model belongs to another engine.
+ * Approval stays the bot's, except that a level the inherited engine would
+ * have to confirm on a model switch starts the new thread in Ask. */
+function parentThreadModel(botId, parentThreadId) {
+    // The stored profile, never a per-thread projection: the comparison is
+    // against the defaults the new thread would otherwise get.
+    const bot = store.bot(botId);
+    const modelSelection = bot && store.taskByThread(bot.id, parentThreadId)?.modelSelection;
+    if (!bot || !modelSelection)
+        return {};
+    const needsAsk = modelSwitchNeedsAsk(approvalModeFor(bot), registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, registry.cliTarget(modelSelection.instanceId)?.driverKind);
+    return { modelSelection, ...(needsAsk ? { approvalMode: "ask" } : {}) };
+}
+/** On a Cloud home: the conversation that work a guest-driven turn hands a
+ * teammate (delegate_bot, ask_bot) runs in. It is a fresh one of the guest's
+ * own on the teammate, never the owner's conversation with it, so the work,
+ * and anything that later continues there, stays confined. Undefined when
+ * the source is not guest-driven, null when it could not be made. */
+function guestWorkThread(from, target, fromThreadId, brief) {
+    if (!CLOUD_HOME || !cloudGuestDriven(fromThreadId))
+        return undefined;
+    const title = brief.replace(/\s+/g, " ").trim().slice(0, 60) || `From ${from.name}`;
+    const task = store.createTask(target.id, title, false, undefined, { botId: from.id, name: from.name, at: Date.now() });
+    if (!task)
+        return null;
+    threadStarters.set(task.threadId, openerFrom(fromThreadId));
+    return task.threadId;
+}
+/** On a personal Cloud home the only turns confined like a guest's
+ * (cloudGuestDriven) are in what came before it: a routine nobody is proven
+ * to have written, or a conversation or room a revoked session opened. What
+ * the owner is told about one, and when its engine cannot be confined. */
+const ROUTINE_FROM_BEFORE = "This routine was made before this update. Open it and save it once to run it with full access.";
+const CONVERSATION_FROM_BEFORE = "This conversation is from before your Cloud was only yours, so this bot works in it without a shell. Start a new conversation to use it fully.";
+function confinedWhy(threadId) {
+    const run = activeRoutineRunForThread(threadId);
+    const writer = run ? cloudRoutineAuthors?.writer(run.routineId) : undefined;
+    return run && writer && !cloudOwnerPerson(writer) ? ROUTINE_FROM_BEFORE : CONVERSATION_FROM_BEFORE;
+}
+function guestEngineRefusal(threadId) {
+    const why = confinedWhy(threadId);
+    return why === ROUTINE_FROM_BEFORE ? `This bot's engine can't run it that way. ${why}`
+        : "This conversation is from before your Cloud was only yours, and this bot's engine can't work in it. Start a new conversation.";
+}
+/** On a Cloud home: a turn a guest drives, which runs in Ask whatever the
+ * bot's own level (no Full access, no Auto reviewer, no saved commands), with
+ * no shell (guestEngineRefusal): a conversation a guest opened, a run of a
+ * routine a guest wrote, work a guest's turn handed on (guestDrivenTurns), or
+ * a room whose latest line from a person is a guest's. */
+function cloudGuestDriven(threadId) {
+    if (!CLOUD_HOME)
+        return false;
+    if (guestDrivenTurns.has(threadId) || cloudGuestOpened(threadId))
+        return true;
+    // A run of a routine a guest wrote (or last edited) is the guest's.
+    const run = activeRoutineRunForThread(threadId);
+    const writer = run ? cloudRoutineAuthors?.writer(run.routineId) : undefined;
+    if (writer && !cloudOwnerPerson(writer))
+        return true;
+    if (!store.groupByThread(threadId))
+        return false;
+    const person = store.messagesFor(threadId).findLast((line) => line.role === "user" && !line.peerAsk && line.sender?.id)?.sender?.id;
+    return person !== undefined && !cloudOwnerPerson(person);
+}
 /** On a Cloud home: a request from one of the owner's own devices. The
  * Admin's signed pairing gives the desktop an admin session; a guest the
  * owner pairs with chat-only access has client scope. Loopback is not the
@@ -519,10 +882,31 @@ function sessionLendingPrincipal(auth) {
 function cloudOwnerSession(auth) {
     return auth.kind === "session" && auth.scopes.includes("admin");
 }
-/** On a Cloud home: whether a message's person key is one of the owner's own
- * devices right now (a live admin session with that key). */
+/** On a Cloud home: whether a person key is the owner's, for who opened a
+ * conversation, who drives a turn, its approval level and its folder: the
+ * owner's one key, a device of theirs still paired, or a key from before
+ * they shared one (cloud-owner.ts, adopted). */
 function cloudOwnerPerson(person) {
-    return Boolean(person) && sessions.list().some((session) => session.scopes.includes("admin") && personKey(session) === person);
+    if (!person)
+        return false;
+    if (person === CLOUD_OWNER_KEY || cloudEarlierOwners.adopted.has(person))
+        return true;
+    return cloudOwnerDevice(person);
+}
+/** …and whether it is proven the owner's, the only kind whose words may
+ * reach the lent Mac, memory, recall and the recent-work brief: a key from
+ * before counts only with proof it was the owner's (cloud-owner.ts, proven),
+ * never just because nobody revoked it. */
+function cloudProvenOwnerPerson(person) {
+    if (!person)
+        return false;
+    if (person === CLOUD_OWNER_KEY || cloudEarlierOwners.proven.has(person))
+        return true;
+    return cloudOwnerDevice(person);
+}
+/** Written before the owner had one key: a device of theirs still paired. */
+function cloudOwnerDevice(person) {
+    return sessions.list().some((session) => session.scopes.includes("admin") && personKey(session) === person);
 }
 /** On a Cloud home, a session that is not one of the owner's own devices may
  * not answer a card of any kind. */
@@ -594,7 +978,7 @@ function cardAnswererFor(auth) {
     if (auth.kind === "loopback")
         return auth.trust === "service" ? { kind: "worker" } : { kind: "loopback" };
     return { kind: "session", name: (auth.session.email ?? auth.session.label ?? "").trim() || "Signed-in user",
-        ...(CLOUD_HOME ? { person: personKey(auth.session) } : {}) };
+        ...(CLOUD_HOME ? { person: actorKey(auth) } : {}) };
 }
 /** On a Cloud home, who is answering a card right now, by request id: the
  * answer reaches the turn before `answeredBy` is written, and a lending turn
@@ -616,7 +1000,7 @@ async function answeringCardAs(auth, threadId, requestId, work) {
         return Boolean(card && !card.answered && !card.dismissed && !card.expired);
     })();
     if (CLOUD_HOME && open)
-        cloudCardAnswersInFlight.set(requestId, auth.kind === "session" ? personKey(auth.session) : undefined);
+        cloudCardAnswersInFlight.set(requestId, auth.kind === "session" ? actorKey(auth) : undefined);
     try {
         await withDecisionActor(decisionActorFor(auth), work);
     }
@@ -743,6 +1127,11 @@ function settleRoomFloor(group) {
         return;
     store.patchGroup(group.id, { audienceFloor: next === "everyone" ? undefined : next });
 }
+/** On a Cloud home the recent-work brief draws only on conversations the
+ * owner alone wrote in (see cloudOwnerOnlyThread). */
+function recentWorkFilter() {
+    return CLOUD_HOME ? { include: cloudOwnerOnlyThread } : {};
+}
 /** The conversations a bot's recent-work brief may draw on: its own, and the
  * rooms roomFeedsBot allows. */
 function recentWorkSources(bot) {
@@ -757,7 +1146,7 @@ function recentWorkSources(bot) {
  * or a room must not be able to pull a private chat into its reply. The
  * conversations are the ones session_search would search, minus this one. */
 function autoRecallPrompt(bot, threadId, message, opts) {
-    if (!autoRecallEnabled(cfg))
+    if (bot.memoryEnabled === false || !autoRecallEnabled(cfg))
         return "";
     const roomByThread = new Map();
     if (opts.conversations) {
@@ -770,7 +1159,10 @@ function autoRecallPrompt(bot, threadId, message, opts) {
         }
     }
     const threadIds = opts.conversations
-        ? [...new Set([bot.threadId, ...(bot.tasks ?? []).map((task) => task.threadId), ...roomByThread.keys()])].filter((id) => id !== threadId)
+        ? [...new Set([bot.threadId, ...(bot.tasks ?? []).map((task) => task.threadId), ...roomByThread.keys()])]
+            // On a Cloud home a conversation anyone else wrote in never feeds
+            // another: its words would reach the owner's turns (and a lent Mac).
+            .filter((id) => id !== threadId && (!CLOUD_HOME || cloudOwnerOnlyThread(id)))
         : [];
     try {
         const recalled = buildRecall({
@@ -902,11 +1294,13 @@ function adminAuditPlan(method, path) {
     m = /^\/api\/groups\/([\w-]+)$/.exec(path);
     if (m && method === "PATCH")
         plan.roomId = m[1];
-    m = /^\/api\/instances\/([\w.-]+)\/(install|auth\/complete|auth\/sign-out|claude-update)$/.exec(path);
+    m = /^\/api\/instances\/([\w.-]+)\/(install|auth\/complete|auth\/sign-out|claude-update|leftover-files\/remove)$/.exec(path);
     if (m && method === "POST")
         plan.engineAction = { id: m[1], action: m[2].replace("/", "-") };
     if (method === "POST" && path === "/api/instances/claude-accounts")
         plan.engineAction = { id: "claude", action: "account-add" };
+    if (method === "POST" && path === "/api/instances/chatgpt-accounts")
+        plan.engineAction = { id: "chatgpt", action: "account-add" };
     return plan.config || plan.botId || plan.createsBots || plan.deletesBot || plan.createsWebhook || plan.webhookId || plan.sessionId || plan.pairing || plan.engineAction || plan.roomId ? plan : null;
 }
 const WEBHOOK_AUDIT_FIELDS = ["name", "prompt", "botId", "runOn", "enabled", "eventTypes"];
@@ -1081,6 +1475,46 @@ function queuedTurnTrigger(item) {
     return item.sender ? { kind: "user", label: item.sender.name } : { kind: "owner" };
 }
 const providerAuthSessions = new ProviderAuthSessions();
+/** OAuth sign-in for URL servers; tokens live in their own owner-only file. */
+const mcpOAuth = new McpOAuthManager({
+    file: join(DATA_DIR, "mcp-oauth.json"),
+    isOwnerLive: (owner) => owner === "loopback" || sessions.isLive(owner),
+    // Read the registered app when needed; never copy its secret into the token store.
+    clients: (name, url) => {
+        const raw = cfg.mcpServers?.[name];
+        const parsed = raw === undefined ? null : parseStoredMcpServer(name, raw);
+        return parsed?.ok && isRemoteMcpServer(parsed.server) && parsed.server.url === url ? parsed.server.oauth : undefined;
+    },
+});
+// OpenCode reads provider keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, …) from
+// its environment, as it does in a terminal, but only where that environment
+// is the person's own shell (openCodeProviderKeysAllowed). Wired before the
+// first catalog probe below. Company enrollment arrives later from the
+// desktop parent and is wired in once it can (openCodeOrganisationManaged).
+let openCodeOrganisationManaged = () => false;
+const openCodeKeysAllowed = () => openCodeProviderKeysAllowed({
+    cloudHome: Boolean(CLOUD_HOME),
+    hostedWorkspace: HOSTED_WORKSPACE,
+    organisationManaged: openCodeOrganisationManaged(),
+    sharedSignIn: sharedSignIn(signInAllowList()),
+});
+setOpenCodeProviderKeyPolicy(openCodeKeysAllowed);
+let openCodeKeysLastAllowed = openCodeKeysAllowed();
+/** OpenCode lists a provider's models only while it may read that
+ * provider's key. When enrollment or the sign-in list changes the answer,
+ * list them again, so the picker never offers models its turns lack. */
+function resyncOpenCodeProviderKeys() {
+    const allowed = openCodeKeysAllowed();
+    if (allowed === openCodeKeysLastAllowed)
+        return;
+    openCodeKeysLastAllowed = allowed;
+    for (const instance of registry.instances()) {
+        if (instance.driverKind !== "opencodeGo")
+            continue;
+        void registry.refreshModels(instance.instanceId)
+            .then(() => broadcast({ kind: "config", ...configStatus() }), () => { });
+    }
+}
 await registry.load(providerConfigs(), decorateHostedProvider);
 const bundledSkills = loadBundledSkills();
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
@@ -1179,7 +1613,10 @@ let companyRuntimeReady;
 const companyRuntimeStarted = new Promise(resolve => { companyRuntimeReady = resolve; });
 /** The enrolled organisation's desktop policy: in memory only, read-only, and
  * inert (null) unless Electron's enrolled parent sends one. */
-const managedPolicy = new ManagedDesktopPolicy({ onChange: () => broadcast({ kind: "config", ...configStatus() }) });
+const managedPolicy = new ManagedDesktopPolicy({ onChange: () => {
+        broadcast({ kind: "config", ...configStatus() });
+        resyncOpenCodeProviderKeys();
+    } });
 /** A computer kind this server will not use, refused before anything is
  * prepared: a Cloud home never offers this computer or a Local VM
  * (cloud-home.ts), and an enrolled organisation may disallow any kind. */
@@ -1203,7 +1640,10 @@ const managedDesktop = new ManagedDesktopProviders({
     beforeReplace: stopCompanyInstances,
     // Ids became stable across re-enrolment; carry old references forward once.
     migrate: aliases => { store.renameInstances(new Map(aliases.map(({ from, to }) => [from, to]))); },
-    onAvailability: () => broadcast({ kind: "config", ...configStatus() }),
+    onAvailability: () => {
+        broadcast({ kind: "config", ...configStatus() });
+        resyncOpenCodeProviderKeys();
+    },
     afterReplace: ids => {
         for (const id of providerInstancesChanging)
             if (managedDesktop.owns(id))
@@ -1212,8 +1652,11 @@ const managedDesktop = new ManagedDesktopProviders({
         // Existing renderer config events refresh /api/instances as well, so
         // Company grants and revocations appear without reloading the window.
         broadcast({ kind: "config", ...configStatus() });
+        resyncOpenCodeProviderKeys();
     },
 });
+// An organisation-managed desktop's environment is not the person's shell.
+openCodeOrganisationManaged = () => managedPolicy.current() !== null || managedDesktop.enrolled();
 utilityParentPort?.on("message", event => {
     const message = event.data;
     if (message?.type !== "openmausbot:managed-desktop-identity")
@@ -1336,7 +1779,27 @@ function mintInternalCapability(capability) {
     });
     return token;
 }
+/** A turn that was not provably the owner's has ended: judge its bot's
+ * memory now, so a change it made is caught and an unchanged one is cleared
+ * (server/lending-memory.ts). `generation` undefined: every such turn on the
+ * thread (a teardown that settles threads, not generations). */
+function endForeignTurns(threadId, generation) {
+    for (const [id, foreign] of foreignTurns) {
+        if (foreign.threadId !== threadId || (generation !== undefined && id !== generation))
+            continue;
+        foreignTurns.delete(id);
+        try {
+            lendingMemory?.reconcile(foreign.botId, foreignTurnRunning(foreign.botId));
+        }
+        catch (error) {
+            console.warn(`lending: could not check a bot's memory: ${error.message}`);
+        }
+    }
+}
 function revokeInternalCapabilityGeneration(threadId, generation) {
+    endForeignTurns(threadId, generation);
+    if (guestDrivenTurns.get(threadId) === generation)
+        guestDrivenTurns.delete(threadId);
     for (const [token, capability] of internalCapabilities) {
         if (capability.threadId === threadId && capability.generation === generation) {
             internalCapabilities.delete(token);
@@ -1363,6 +1826,9 @@ function revokeInternalCapabilitiesForThread(threadId) {
 function revokeAllInternalCapabilities() {
     computerSelectionTurns.clear();
     internalCapabilities.clear();
+    // foreignTurns stays: a turn that is not provably the owner's can still
+    // write while its engine is torn down, and its own end (which revokes its
+    // generation by id) is what judges it (server/lending-memory.ts).
     activeInternalGenerationByThread.clear();
     internalGenerationByProviderTurn.clear();
 }
@@ -1474,6 +1940,7 @@ function agentsIntegration(botId, threadId, depth, skillAuthoring, generation, r
             OMB_ROOM_TURN: roomCoordination ? "1" : "0",
             OMB_OWN_THREAD_CREATION: ownThreadCreation ? "1" : "0",
             OMB_SKILL_AUTHORING_ENABLED: skillAuthoring ? "1" : "0",
+            OMB_MEMORY_ENABLED: store.bot(botId)?.memoryEnabled === false ? "0" : "1",
             // The shared-computer tools are advertised only while the workspace
             // gate is on; the routes behind them refuse regardless.
             OMB_SHARED_COMPUTERS_ENABLED: lendingEnabled() ? "1" : "0",
@@ -1902,7 +2369,15 @@ function canAdmitDirectTurn(botId, threadId) {
 /** Routine and webhook dispatch shares startTurn's admission preconditions
  * instead of waiting for whole-bot idleness: a free thread slot and no
  * active group turn. A group turn blocks scheduled starts the same way it
- * blocks every other turn kind; it does not consume a capacity slot. */
+ * blocks every other turn kind; it does not consume a capacity slot.
+ *
+ * A fresh dispatch also pins to the bot's own project folder, exactly like
+ * startTurn's cwd resolution: a free thread slot alone can miss a second
+ * task of this bot landing in that one folder (#F-collide). Predicting that
+ * collision here lets it defer through the same busy-target machinery as
+ * capacity and group-turn contention, instead of reaching startTurn's own
+ * workspace claim — which throws deep inside a detached dispatch that no
+ * caller here awaits, so the run would otherwise fail permanently. */
 function unattendedDispatchState(botId) {
     const bot = store.bot(botId);
     const decision = admit("unattended", {}, {
@@ -1910,7 +2385,19 @@ function unattendedDispatchState(botId) {
         atCapacity: Boolean(bot) && botAtThreadCapacity(botId),
         groupTurn: Boolean(bot) && Boolean(activeGroupTurnForBot(botId)),
     });
-    return decision.action !== "refuse" ? "ready" : decision.code === "missing" ? "missing" : "busy";
+    if (decision.action === "refuse")
+        return decision.code === "missing" ? "missing" : "busy";
+    if (bot?.cwd) {
+        try {
+            if (turnResources.blocker(workspaceResource(bot.cwd), { threadId: "", generation: "" }))
+                return "busy";
+        }
+        catch {
+            // An unresolvable folder is startTurn's own admission check to
+            // report; this prediction only ever adds a defer, never a refusal.
+        }
+    }
+    return "ready";
 }
 function requestedTaskBot(botId, rawThreadId) {
     const profile = store.bot(botId);
@@ -2076,7 +2563,16 @@ function cancelDirectTurnDispatch(botId, expectedThreadId) {
 /** The bot's browser for this turn: agent-browser, one isolated session per
  * browser profile or per bot (docs/plans/browser-engine.md). Null, with the
  * reason logged once, when the engine is not on this machine. */
-const browserRuntime = new BrowserRuntime();
+const browserRuntime = new BrowserRuntime({
+    // The bot's restart_browser tool. An open Browser panel watched the old
+    // browser; drop its stream the way the panel's own Restart button does.
+    closeBrowser: async (session, spec) => {
+        const closed = await closeBrowserSession(spec.command, browserRuntimeEnv({ ...spec.env, AGENT_BROWSER_SESSION: session }));
+        if (closed)
+            browserLive.closeForSession(session);
+        return closed;
+    },
+});
 const browserLive = new BrowserLive({ runtime: browserRuntime });
 // Temporary profiles last for this server run, but are never saved to disk.
 // The viewer and the agent must address the SAME temporary browser.
@@ -2763,7 +3259,7 @@ function previewSystemPrompt(bot) {
         { id: "routine", label: "Routines", text: agentsMounted ? ROUTINE_PROMPT : "" },
         { id: "profile", label: "Profile changes", text: agentsMounted ? PROFILE_PROMPT : "" },
         { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
-        { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace) }) },
+        { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace), enabled: bot.memoryEnabled !== false }) },
         { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
     ]);
     const totalBytes = built.sections.reduce((n, s) => n + s.bytes, 0);
@@ -2851,7 +3347,12 @@ async function botOverview(bot) {
  * with one deliberate exception: a Chief of Staff with Full access makes the
  * threads it delegates Full too (delegatedFullAccess), so the grant the
  * person gave the Chief covers the work the Chief hands out. */
-const approvalModeForTurn = (bot, peerInitiated = false) => {
+const approvalModeForTurn = (bot, peerInitiated = false, threadId = bot.threadId) => {
+    // On a Cloud home a turn a guest drives runs in Ask, whatever the bot's
+    // own level. Judged by the conversation the turn runs in (a room's, for a
+    // room turn), never by whichever of the bot's conversations is active.
+    if (cloudGuestDriven(threadId))
+        return "ask";
     const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
     if (!supportsApprovalMode(bot.modelSelection, mode)) {
         return "ask";
@@ -2866,7 +3367,7 @@ function fullAccessForSource(botId, threadId) {
         return false;
     const bot = store.projectBotForTask(botId, threadId) ?? owner.bot;
     // Origin changes Custom to Auto, never Full; no live-turn state is needed.
-    return approvalModeForTurn(bot) === "full";
+    return approvalModeForTurn(bot, false, threadId) === "full";
 }
 function peerReviewRequired(bot, threadId) {
     return Boolean(bot.approvePeerComms && !fullAccessForSource(bot.id, threadId));
@@ -2890,8 +3391,7 @@ function delegatedFullAccess(from, fromThreadId, target) {
 }
 /** Make a delegated thread Full and say so in it once, so the level the
  * chip shows and the level the turns run at agree, and the person can see
- * where the access came from. Idempotent: a pair conversation is reused
- * across delegations and must not collect a chip per request. */
+ * where the access came from. */
 function grantDelegatedFullAccess(from, target, threadId) {
     if (store.taskByThread(target.id, threadId)?.approvalMode === "full")
         return;
@@ -2905,13 +3405,16 @@ function grantDelegatedFullAccess(from, target, threadId) {
 /** A room member's level for one turn. Work a Full-access Chief hands out
  * in a room runs Full for that turn: the room thread is shared, so the
  * level is not stored on it — it rides the handoff. */
-function roomTurnApprovalMode(bot, orchestration) {
+function roomTurnApprovalMode(bot, threadId, orchestration) {
+    // On a Cloud home a room turn a guest drives runs in Ask (cloudGuestDriven).
+    if (cloudGuestDriven(threadId))
+        return "ask";
     const handoff = orchestration?.roomHandoffId ? roomHandoffs.nodes.get(orchestration.roomHandoffId) : undefined;
     const source = handoff?.parentId ? roomHandoffs.nodes.get(handoff.parentId) : undefined;
     const from = source ? store.bot(source.botId) : undefined;
     if (from && source && delegatedFullAccess(from, source.threadId, bot))
         return "full";
-    return approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId));
+    return approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId), threadId);
 }
 /** Privileged approval-mode transitions are deliberately absent from the
  * loopback HTTP authority model: a bot with shell access can curl that
@@ -3668,6 +4171,10 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
                     : child.status === "completed" ? `${bot?.name ?? "Teammate"} replied${child.groupId ? ` · ${store.group(child.groupId)?.name ?? "Room"}` : ""}`
                         : `${bot?.name ?? "Teammate"} — ${child.status}: ${child.result.slice(0, 180)}`,
                 ok: child.status === "completed" && !problem,
+                // The chip label stays short; the report itself rides along so a
+                // phone can show what the teammate said without opening its thread.
+                ...(child.status === "completed" && !problem && child.result.trim()
+                    ? { output: redactSecretsInText(child.result.trim()).slice(0, 2_000) } : {}),
             },
             ...(child.groupId ? { comm: { groupId: child.groupId, threadId: child.threadId, withBotId: child.botId,
                     withName: bot?.name ?? "Teammate", withColor: bot?.color ?? "blue" } }
@@ -3681,14 +4188,9 @@ const roomHandoffs = new RoomHandoffs(join(DATA_DIR, "room-handoffs.json"), {
             if (source)
                 markTaskContextExternallyUpdated(source, parent.threadId);
         }
-        // A work thread exists only because the pair conversation was busy with
-        // another job. Its result is now in the sender's conversation, so it
-        // closes itself exactly as close_thread would — folded out of the
-        // sidebar, never deleted, and open again the moment anyone speaks
-        // there. A finished job tidies up after itself; a failed or withheld
-        // one stays in the sidebar where the person can see it. The pair
-        // conversation is the standing line between two bots and never
-        // auto-closes.
+        // A successful direct work thread closes after its result is reported:
+        // folded out of the sidebar, never deleted, and reopened if addressed.
+        // Failed or withheld work stays visible.
         const childTask = store.taskByThread(child.botId, child.threadId);
         if (!child.groupId && child.status === "completed" && !problem && !childTask?.closedBy
             && childTask?.openedBy?.kind === "work" && childTask.openedBy.botId === parent.botId) {
@@ -4337,8 +4839,35 @@ function audienceChanged() {
         }
     }
 }
+// Cloud boot can revoke sessions before routes are registered. Create the
+// viewer manager before installing any revocation callbacks.
+const desktopViewer = createDesktopViewer({
+    target: (id) => {
+        if (id.startsWith("vps/")) {
+            const botId = id.slice(4);
+            if (store.bot(botId)?.cloudBackend !== "vps")
+                return;
+            return { key: id, resolve: async () => {
+                    const connection = vps.vpsDesktopConnection(botId);
+                    if (!connection)
+                        throw Object.assign(new Error("VPS viewer is not open"), { status: 409 });
+                    return connection;
+                } };
+        }
+        const targets = [SHARED_LOCAL_VM_TARGET, ...store.bots.map(bot => perBotLocalVmTarget(bot.id)),
+            ...Array.from({ length: localVmMaxInstances(cfg) }, (_, seat) => poolLocalVmTarget(seat))];
+        const target = targets.find(target => viewerTargetId(target) === id);
+        return target && localDesktopTarget(target, {
+            // A viewer can repair a sick CUA driver; skip desktop health probes.
+            status: target => containerComputerStatus(undefined, undefined, target, { probeDesktop: false }),
+            touch: target => localVmIdleFor(target).touch(),
+        });
+    },
+    live: auth => auth.kind === "loopback" || sessions.isLive(auth.session.id),
+});
 function closeSessionStreams(sessionId) {
     browserLive.closeForOwner(sessionId);
+    desktopViewer.closeForOwner(sessionId);
     for (const client of sseClients) {
         if (client.sessionId !== sessionId)
             continue;
@@ -4353,8 +4882,35 @@ function closeSessionStreams(sessionId) {
 }
 sessions.onSessionRevoked((sessionId) => {
     providerAuthSessions.revokeOwner(sessionId);
+    mcpOAuth.revokeOwner(sessionId);
     closeSessionStreams(sessionId);
+    // A revoked owner device no longer vouches for its lines (cloudOwnerPerson).
+    ownerOnlyCache.clear();
 });
+/** On a Cloud home: a line someone else adds to a conversation while one of
+ * the owner's turns runs in it (steered into it, or handed in) makes that
+ * turn someone else's from then on. The lent Mac is refused at its next use
+ * anyway (cloudLendingRefusal reads the whole conversation each time); this
+ * makes whatever the bot writes to its memory from now on count as theirs
+ * too (server/lending-memory.ts). */
+function noteSomeoneElsesLine(threadId) {
+    const generation = activeInternalGenerationByThread.get(threadId);
+    if (!generation || foreignTurns.has(generation))
+        return;
+    const bot = store.botByThread(threadId);
+    if (bot && cloudHomeLendingRefusal(cloudLendingTurn({ botId: bot.id, threadId, generation })) !== null) {
+        noteForeignTurn(bot.id, threadId, generation);
+    }
+}
+if (lendingMemory) {
+    store.onChange((change) => {
+        if (change.type === "message" && change.message.role === "user")
+            noteSomeoneElsesLine(change.threadId);
+        // A deleted bot's record goes with it (and nothing recreates its workspace).
+        else if (change.type === "bot.deleted")
+            lendingMemory.forget(change.botId);
+    });
+}
 /** Every frame is numbered, and the last few hundred are kept, so a client
  * whose connection dropped can ask for what it missed instead of
  * re-downloading every transcript. The desktop reconnects in milliseconds
@@ -4827,10 +5383,34 @@ const memoryUpkeep = createMemoryUpkeep({
         return facts.length;
     },
     sourceLabel: (botId, threadId) => memorySourceLabel({ task: store.taskByThread(botId, threadId), threadId }),
+    // On a Cloud home upkeep only works on the owner's conversations (see the
+    // capture hook below), so its writes are the owner's (lending-memory.ts).
+    ...(lendingMemory ? { writing: (botId, write) => lendingMemory.trustedWrite(botId, write) } : {}),
     quietMs: () => captureQuietMs(cfg),
     tidyHour: () => tidyHour(cfg),
     log: (line) => console.log(line),
 });
+// OMB Cloud home: the first bot turn that finishes here ticks the setup
+// checklist's "try something" step (firstCloudTurnPatch). The server writes
+// it, not an admin, so it is kept out of any admin's recorded changes.
+bus.subscribe((event) => {
+    if (!CLOUD_HOME || event.type !== "turn.completed" || shouldIgnoreProviderEvent(event))
+        return;
+    const patch = firstCloudTurnPatch({
+        cloudHome: true, recorded: cfg.onboarding?.firstTurnAt, ok: event.ok,
+        known: Boolean(store.botByThread(event.threadId) ?? store.groupByThread(event.threadId)),
+    });
+    if (!patch)
+        return;
+    try {
+        adminActorScope.exit(() => saveConfig(patch));
+        Object.assign(cfg, loadConfig());
+        broadcast({ kind: "config", ...configStatus() });
+    }
+    catch (error) {
+        console.warn(`cloud home: could not record the first finished turn (${error instanceof Error ? error.message : "unknown"})`);
+    }
+});
 // A finished 1:1 turn of an upkeep bot waits for capture. Only the person's
 // own conversation: not a room, not a turn another bot or the harness
 // started (its "user" line is not the person), not a failed turn.
@@ -4844,6 +5424,10 @@ bus.subscribe((event) => {
         if (!bot || !upkeepEnabled(bot) || store.groupByThread(event.threadId) || isInternalTurn(event.threadId)
             || isUnattended(bot.id, event.threadId) || routines?.runForThread(event.threadId))
             return;
+        // On a Cloud home the bot's memory reaches its owner's turns (and a lent
+        // Mac): nothing is captured from a conversation anyone else wrote in.
+        if (CLOUD_HOME && !cloudOwnerOnlyThread(event.threadId))
+            return;
         const path = store.activePath(event.threadId);
         const replyAt = path.findLastIndex((message) => message.role === "bot" && message.kind === "text" && message.turnId === event.turnId);
         if (replyAt < 0)
@@ -4876,7 +5460,7 @@ bus.subscribe((event) => {
         const messages = store.messagesFor(event.threadId);
         const reply = messages.findLast((message) => message.role === "bot" && message.kind === "text" && message.turnId === event.turnId);
         const bot = store.botByThread(event.threadId) ?? (reply?.from ? store.bot(reply.from.botId) : undefined);
-        if (!bot)
+        if (!bot || bot.memoryEnabled === false)
             return;
         const tools = messages
             .filter((message) => message.kind === "activity" && message.turnId === event.turnId && message.tool?.name)
@@ -4889,13 +5473,21 @@ bus.subscribe((event) => {
         const room = store.groupByThread(event.threadId);
         if (room && !roomFeedsBot(room, bot))
             return;
-        appendMemoryLog(bot.id, line, {
+        // On a Cloud home the log feeds recall in the owner's turns: only the
+        // owner's own conversations leave a line.
+        if (CLOUD_HOME && (room || !cloudOwnerOnlyThread(event.threadId)))
+            return;
+        const writeLine = () => appendMemoryLog(bot.id, line, {
             source: memorySourceLabel({
                 room,
                 task: store.taskByThread(bot.id, event.threadId),
                 threadId: event.threadId,
             }),
         });
+        if (lendingMemory)
+            lendingMemory.trustedWrite(bot.id, writeLine);
+        else
+            writeLine();
     }
     catch {
         // a missing note never fails a turn
@@ -5180,13 +5772,18 @@ const boatLifecycleBusyBots = new Set();
 // A refresh is a reader, not a lifecycle change. Keep its reservation until
 // the provider settles even if the HTTP client leaves, and share it on retry.
 const vpsPreviewRequests = new Map();
+// Joins in flight per bot. A second tab or a quick reconnect waits for the
+// pending join, then reuses its tunnel, instead of being refused by its lane.
+const vpsJoinRequests = new Map();
 const orphanBoatLifecycleBusyIds = new Set();
 const boatInventoryRequestsBusyIds = new Set();
 const computerProviderConfigTransitions = new Set();
 // A restore mutates and cleans a project work tree. Claim the bot across the
 // entire async Git operation so a turn cannot start in that folder midway.
 const checkpointRestoreLeases = new Set();
-const LOCAL_VM_IDLE_MS = 8 * 60 * 60_000;
+/** The effective idle window, read from config so a Settings change applies
+ * to both new and already-armed timers (see the config route). */
+const localVmIdleMs = () => localVmIdleTimeoutMinutes(cfg) * 60_000;
 /** How long a turn waits for Cua Driver after starting the container itself.
  * A cold XFCE desktop needs some seconds; past this the turn reports the
  * status it has rather than hanging on a container that will not come up. */
@@ -5317,7 +5914,7 @@ async function teamComputersPayload() {
  * Assignment authorizes waking, never replacing a missing paid machine. */
 async function attachTeamBoat(computer, botId, owner, canMount, remoteAgent) {
     if (!canMount)
-        throw new Error("This model engine cannot use the team's Boat computer; choose an engine with computer tools or an explicit bot destination");
+        throw new Error("This model cannot use the team's Boat computer; choose a model provider with computer tools or an explicit bot destination");
     if (!boat.boatConfigured(cfg))
         throw new Error("The team's Boat account is not configured; reconnect it in Settings");
     const ownerId = teamComputerOwner(computer.id);
@@ -5353,7 +5950,7 @@ async function mountHostComputer(owner, botId, providerSupportsLocal) {
         // ACP engine" while already on one has nowhere to go.
         throw new Error(providerSupportsLocal
             ? `local computer control is not available on ${process.platform} — select another destination`
-            : "this model engine cannot control this computer — choose Claude or an ACP engine, or select another destination");
+            : "this model cannot control this computer — choose Claude or an ACP model provider, or select another destination");
     }
     const cua = readCuaConnection();
     if (!cua) {
@@ -5626,7 +6223,7 @@ async function selectableComputers(bot) {
             }
             else if (surface === "browser") {
                 ready = caps?.browserMcp === true && builtInBrowserEnabled(cfg) && bot.browser !== false && browserEngineStatus().kind === "ready";
-                reason = "The built-in browser is disabled, not installed, or unsupported by this model engine.";
+                reason = "The built-in browser is disabled, not installed, or unsupported by this model.";
             }
         }
         catch (error) {
@@ -5777,7 +6374,7 @@ function localVmIdleFor(target) {
     let idle = localVmIdles.get(target.key);
     if (idle)
         return idle;
-    idle = new LocalVmIdleTimer(LOCAL_VM_IDLE_MS, () => localVmImageBusy || localVmLifecycleBusy.has(target.key) || localVmActiveThreads.has(target.key), async () => {
+    idle = new LocalVmIdleTimer(localVmIdleMs(), () => localVmImageBusy || localVmLifecycleBusy.has(target.key) || localVmActiveThreads.has(target.key), async () => {
         localVmLifecycleBusy.add(target.key);
         try {
             const status = await containerComputerStatus(undefined, undefined, target);
@@ -6118,10 +6715,13 @@ bus.subscribe((event) => {
             // always reaches the human — even Full access never invents an answer.
             const asker = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
             const unattended = permission && asker && event.requestId ? isUnattended(asker.id, event.threadId) : false;
-            const effectiveApprovalMode = asker ? approvalModeForTurn(asker, isInternalTurn(event.threadId)) : "ask";
+            // A turn a guest drives on a Cloud home is Ask, room turns included,
+            // and no command the owner saved answers for it.
+            const guestDriven = cloudGuestDriven(event.threadId);
+            const effectiveApprovalMode = asker && !guestDriven ? approvalModeForTurn(asker, isInternalTurn(event.threadId), event.threadId) : "ask";
             // Native shell descriptors are distinct from computer/MCP permissions;
             // choosing a local desktop must not disable an exact shell grant.
-            const command = permission && asker && event.requestId && !event.requiresExplicitApproval && event.command
+            const command = permission && asker && event.requestId && !event.requiresExplicitApproval && event.command && !guestDriven
                 ? commandAllowlistCandidate({ ...event.command, providerInstanceId: event.providerInstanceId ?? asker.modelSelection.instanceId })
                 : null;
             const verdict = permission && asker && event.requestId
@@ -6226,7 +6826,8 @@ bus.subscribe((event) => {
                         : undefined,
                     commandAllowlist: command ?? undefined,
                     // Provider-owned session grants remain separate from exact commands.
-                    allowSession: permission && event.allowSession && !event.requiresExplicitApproval ? true : undefined,
+                    // Never on a guest's turn: an "always" for it would outlive it.
+                    allowSession: permission && event.allowSession && !event.requiresExplicitApproval && !guestDriven ? true : undefined,
                     // The text stays for cards saved before heldCode existed, and for
                     // clients that do not know the key yet.
                     held: approvalHeldReason(heldContext),
@@ -6304,12 +6905,19 @@ bus.subscribe((event) => {
                 tool: { name: `retrying — attempt ${event.attempt + 1}/${RETRY_MAX_ATTEMPTS} in ${Math.round(event.delayMs / 1000)}s — ${event.reason}`, ok: true },
             });
             break;
+        case "runtime.notice":
+            // informational: the turn carries on. The prefix keeps it a status row
+            // the person always sees (src/lib/activity-runs.ts), never a tool step
+            // hidden with Tool calls off.
+            pushMessage({ role: "bot", kind: "activity", tool: { name: `notice: ${event.message.slice(0, 240)}`, ok: true } });
+            break;
         case "runtime.error":
             pushMessage({
                 role: "bot",
                 kind: "activity",
                 tool: {
-                    name: `error: ${event.message.slice(0, 160)}`,
+                    // a setup error carries its fix, which must not be cut mid-command
+                    name: `error: ${event.message.slice(0, event.setup ? 320 : 160)}`,
                     ok: false,
                     setup: event.setup,
                     ...(event.terminal ? { terminal: true } : {}),
@@ -7554,14 +8162,10 @@ async function finalScreenFrame(_botId, threadId) {
  * (generateText — Haiku on Claude, the chat completion endpoint's text
  * path on OpenAI-compatible engines). Null whenever that call cannot run,
  * runs long, or answers with something that is not a plain short title;
- * the caller keeps the snippet it already applied. */
-async function generateThreadTitle(provider, text) {
-    const prompt = [
-        "Name the conversation that begins with the message below.",
-        "Reply with only a short title: 3 to 6 words, plain text, no quotes, no trailing period.",
-        "Message:",
-        text.trim().slice(0, 1_500),
-    ].join("\n");
+ * the caller keeps the snippet it already applied. "conversation" names an
+ * existing thread from titleConversationExcerpt (Regenerate title). */
+async function generateThreadTitle(provider, text, source = "first-message") {
+    const prompt = threadTitlePrompt(text, source);
     const expiry = new AbortController();
     let timer;
     try {
@@ -7585,6 +8189,8 @@ async function generateThreadTitle(provider, text) {
         clearTimeout(timer);
     }
 }
+/** Threads whose Regenerate title one-shot is still running: one at a time. */
+const titleRegenerations = new Set();
 // ── turn dispatch (upstream ProviderCommandReactor, miniature) ──────────
 async function startTurn(botId, text, opts) {
     workspaceMaintenance.assertAvailable();
@@ -7671,6 +8277,15 @@ async function startTurn(botId, text, opts) {
     const policyRefusal = policyModelRefusal(instance);
     if (policyRefusal)
         throw Object.assign(new Error(policyRefusal), { status: 409, code: "managed_policy" });
+    // On a Cloud home a guest's turn never gets a shell or reads outside its
+    // own folder (docs/cloud-pro.md): an engine that cannot run it that way is
+    // refused, in one plain line, before anything is recorded.
+    // (The thread is idle here: a mark a turn that never started left is stale.)
+    guestDrivenTurns.delete(threadId);
+    const guestConfined = cloudGuestDriven(threadId) || cloudGuestDrivenHandoff(opts?.coordination?.id);
+    if (guestConfined && instance.adapter.capabilities.guestTurns !== "confined") {
+        throw Object.assign(new Error(guestEngineRefusal(threadId)), { status: 409, code: "guest_engine" });
+    }
     // Resolve only transport tags from this newly submitted text. The original
     // string remains the durable message. Native-image providers get a
     // path-free prompt and bounded inputs instead of needing a Read tool;
@@ -7691,11 +8306,9 @@ async function startTurn(botId, text, opts) {
         const titled = store.titleTaskFromFirstMessage(bot.id, resolvedImages.text, threadId);
         // The snippet is only the fallback name. A cheap one-shot may trade it
         // for a title a person would have typed, but never on a peer-opened
-        // row: adoption recognises those by the exact title their assignment
-        // gave them (openingRequestTitle), and a generated one would break the
-        // comparison it renames under. Everywhere else, the swap happens only
-        // while the row still carries the snippet — a rename by the person or
-        // by adoption has already broken that equality by then.
+        // row: its title belongs to the assigned work. Everywhere else, the
+        // swap happens only while the row still carries the snippet — a rename
+        // by a person has already broken that equality by then.
         const snippet = titled?.title;
         if (titled && snippet && !titled.openedBy?.botId && llmThreadTitlesEnabled(cfg) && instance.generateText) {
             void generateThreadTitle(instance, resolvedImages.text)
@@ -7772,6 +8385,9 @@ async function startTurn(botId, text, opts) {
     // in the background — boat provisioning can take ~90s and must never
     // hang the HTTP request
     const dispatchClaimId = randomUUID();
+    // Guest-driven for as long as it runs, wherever it runs (cloudGuestDriven).
+    if (guestConfined)
+        guestDrivenTurns.set(threadId, dispatchClaimId);
     const resourceOwner = { threadId, generation: dispatchClaimId };
     turnResourceOwners.set(threadId, resourceOwner);
     directTurnGenerationByThread.set(threadId, dispatchClaimId);
@@ -7786,6 +8402,10 @@ async function startTurn(botId, text, opts) {
     requestGenerations.add(dispatchClaimId);
     directRequestOwners.set(threadId, { generation: dispatchClaimId, messageId: requestMessageId,
         generations: requestGenerations, turnId: null, ...(opts?.automationSource ? { automation: opts.automationSource } : {}) });
+    // On a Cloud home, a turn that is not provably the owner's leaves this
+    // bot's memory "pending" until it ends (server/lending-memory.ts).
+    if (CLOUD_HOME && cloudHomeLendingRefusal(cloudLendingTurn({ botId, threadId, generation: dispatchClaimId })) !== null)
+        noteForeignTurn(botId, threadId, dispatchClaimId);
     // An unknown control-plane wake may invalidate a prior final, but it must
     // never acquire authority by guessing the latest user as its origin.
     const pendingSource = requestMessageId ?? store.activePath(threadId).findLast(message => message.role === "user")?.id;
@@ -7911,9 +8531,9 @@ async function startTurn(botId, text, opts) {
             const externalUpdate = Boolean(opts?.coordination?.resumed || unseen?.some((m) => m.keep));
             // What a resumed session keeps from its launch: the standing instructions
             // (tools, servers and — for Claude — the model are passed on every launch),
-            // plus whatever this engine can only set when a session starts. Codex's
-            // thread/resume sends no model selection, and an effort it is not sent stays
-            // at the thread's last value, so both belong to the session there. An
+            // plus settings that a live turn cannot change. Codex now reasserts its
+            // model/provider on resume, but an in-flight turn and an omitted effort
+            // retain the prior selection, so both still belong to the session here. An
             // external update that finds any of it changed since the session started
             // gets the fresh session and replay it always got, rather than a resume.
             const persistentConfig = [bot.name, bot.title, bot.description, sectionContextSystemPrompt(bot.section),
@@ -8014,7 +8634,7 @@ async function startTurn(botId, text, opts) {
             // composio — only to a driver that can mount them. Their tools are
             // never pre-allowed, so every call rides the normal permission flow.
             if (instance.adapter.capabilities.customMcp === true) {
-                const custom = engineMcpServers(bot);
+                const custom = await withMcpSignIn(engineMcpServers(bot), mcpOAuth);
                 if (Object.keys(custom).length)
                     integrations.custom = custom;
             }
@@ -8026,7 +8646,8 @@ async function startTurn(botId, text, opts) {
             if (worksInWorkspace) {
                 ensureWorkspace(bot.id);
                 // baseline for the journal's turn-boundary diff (see the bus hook)
-                beginMemoryTurn(bot.id, threadId);
+                if (bot.memoryEnabled !== false)
+                    beginMemoryTurn(bot.id, threadId);
             }
             const privateWorkspace = worksInWorkspace ? ensureTaskWorkspace(bot.id, threadId) : undefined;
             const skillInstructions = renderSkillInstructions(selectedSkills, {
@@ -8042,8 +8663,13 @@ async function startTurn(botId, text, opts) {
             // bot's folder for a task that runs elsewhere.
             if (opts?.runOn === "cloud")
                 store.pinTaskCwd(bot.id, threadId, undefined, { none: true });
+            // On a Cloud home a conversation a guest opened is pinned to its own
+            // folder when it first runs, not the bot's project folder the owner's
+            // conversations share (what it leaves there reaches none of them). One
+            // that ran before keeps its pin, unless the session that opened it was
+            // revoked: then it was unpinned at boot (server/cloud-owner.ts).
             const pinnedCwd = privateWorkspace && opts?.runOn !== "cloud"
-                ? store.pinTaskCwd(bot.id, threadId, privateWorkspace)
+                ? store.pinTaskCwd(bot.id, threadId, privateWorkspace, { privateOnly: cloudGuestOpened(threadId) })
                 : null;
             const cwd = pinnedCwd ?? undefined;
             if (cwd && !claimTurnResource(resourceOwner, workspaceResource(cwd))) {
@@ -8239,7 +8865,7 @@ async function startTurn(botId, text, opts) {
                 if (!mountsComputerMcp || instance.adapter.capabilities.remoteAgent === true) {
                     if (!strict)
                         return false;
-                    throw new Error("this model engine cannot use the Local VM — choose Claude or an ACP engine, or select another computer destination");
+                    throw new Error("this model cannot use the Local VM — choose Claude or an ACP model provider, or select another computer destination");
                 }
                 if (!strict && localVmMode(cfg) === "pool") {
                     // localVmTargetForThread records pool affinity, so a turn the
@@ -8455,9 +9081,9 @@ async function startTurn(botId, text, opts) {
                 autoVpsProblem &&
                 !computerSelectionTurns.has(threadId)) {
                 const hint = opts?.automationSource
-                    ? "This scheduled run tried to start the VPS computer and could not reach it. Check the VPS connection in App Settings → Connections."
+                    ? "This scheduled run tried to start the VPS computer and could not reach it. Check the VPS connection in Settings → API keys."
                     : bot.autoStartVps
-                        ? "Check the VPS connection in App Settings → Connections."
+                        ? "Check the VPS connection in Settings → API keys."
                         : "Open Computer and enable Start VPS automatically, or choose Cloud to start it manually.";
                 throw new Error(`${autoVpsProblem}. ${hint}`);
             }
@@ -8503,7 +9129,7 @@ async function startTurn(botId, text, opts) {
             const credentialPrompt = integrations.agents ? CREDENTIAL_PROMPT + (boundedCoordination ? "" : THREADS_PROMPT) : "";
             const routinePrompt = integrations.agents ? ROUTINE_PROMPT : "";
             const profilePrompt = integrations.agents ? PROFILE_PROMPT : "";
-            const recallPrompt = integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "";
+            const recallPrompt = integrations.agents && bot.memoryEnabled !== false ? SESSION_SEARCH_SYSTEM_PROMPT : "";
             const learnPrompt = skillAuthoring ? LEARN_PROMPT : "";
             // (activeVpsThreads was already claimed above, before the provision or
             // reuse await, so the backend guards saw this turn the whole time.)
@@ -8636,8 +9262,8 @@ async function startTurn(botId, text, opts) {
                 { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
                 // what the bot said lately in its other conversations, so a task
                 // never redoes — or forgets — what another one already did
-                { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId })) },
-                { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace }) },
+                { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId, ...recentWorkFilter() })) },
+                { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace, enabled: bot.memoryEnabled !== false }) },
                 { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
                 { id: "skill-instructions", label: "Skill instructions", text: skillInstructions },
                 { id: "playbooks", label: "Playbooks", text: packagePlaybooks },
@@ -8681,7 +9307,8 @@ async function startTurn(botId, text, opts) {
                 text: withRecalled(recalled, dispatchContext.turnText),
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: approvalModeForTurn(bot, commsDepth > 0),
+                approvalMode: approvalModeForTurn(bot, commsDepth > 0, threadId),
+                ...(guestConfined ? { guestConfined: true, confinedWhy: confinedWhy(threadId) } : {}),
                 model,
                 effort,
                 variant,
@@ -8972,7 +9599,10 @@ function routineRunFallbackText(card) {
                         : card.status === "queued" && card.deferredAt != null
                             ? "deferred: target busy"
                             : card.status);
-    return `Routine “${card.routineName}” ${state}`;
+    // Clients without the card (older phones) draw only this line, so it
+    // carries what the run said, not just that it finished.
+    const detail = card.summary ?? card.error;
+    return `Routine “${card.routineName}” ${state}${detail ? `\n\n${detail}` : ""}`;
 }
 /** Upsert one durable lifecycle card per run. Replaying the same transition,
  * including restart recovery, patches the existing run id instead of adding
@@ -9017,9 +9647,14 @@ function syncRoutineRunToSource(run) {
         const execution = store.taskByThread(run.botId, run.threadId);
         const freshExecution = execution && run.status === "running" && !execution.routineRunId &&
             store.messagesFor(run.threadId).length === 0;
-        if (execution && (freshExecution || (execution.routineRunId === run.id && execution.unread))) {
+        if (execution && freshExecution) {
             store.patchTask(run.botId, run.threadId, { routineRunId: run.id, unread: false });
         }
+        else if (execution?.routineRunId === run.id && execution.unread) {
+            // Already this run. Clear the dot without rewriting the tag, so a
+            // promoted thread (tag cleared, transcript present) stays visible.
+            store.patchTask(run.botId, run.threadId, { unread: false });
+        }
     }
     // Merely queueing/running is ambient progress. Attention and terminal
     // states become unread in the conversation where the user asked for them.
@@ -9111,8 +9746,13 @@ routines = new RoutineManager({
         }
         return groupIsWorking(group) || coordinator.busy ? "busy" : "ready";
     },
-    createTask: (botId, title, activate = false) => {
+    createTask: (botId, title, activate = false, routineId) => {
         const task = store.createTask(botId, title, activate);
+        // On a Cloud home a run's conversation is opened, like its results
+        // conversation, by whoever wrote the routine: a run of one that is
+        // nobody's is confined to a folder of its own, never the bot's project.
+        if (task && CLOUD_HOME && routineId)
+            threadStarters.set(task.threadId, routineOpener(routineId));
         const bot = store.bot(botId);
         if (task && bot)
             broadcast({ kind: "bot", bot: publicBot(bot) });
@@ -9140,7 +9780,12 @@ routines = new RoutineManager({
         // explicit resultsThreadId must be a visible task owned by the running bot.
         if (!forceNew && routineSourceOwner(routine))
             return routine.resultsThreadId;
-        return store.createTask(routine.botId, `${routine.name} · Results`, false)?.threadId;
+        const threadId = store.createTask(routine.botId, `${routine.name} · Results`, false)?.threadId;
+        // On a Cloud home the results conversation is opened by whoever wrote the
+        // routine: it carries their name for it (cloudGuestOpened).
+        if (threadId && CLOUD_HOME)
+            threadStarters.set(threadId, routineOpener(routine.id));
+        return threadId;
     },
     discardResultsThread: (botId, threadId) => {
         const task = store.taskByThread(botId, threadId);
@@ -9202,6 +9847,63 @@ routines = new RoutineManager({
         notify(buildNotification("routine-deferred", notificationBot, routineSourceThread(run) ?? bot.threadId, detail));
     },
 });
+// A Cloud home is personal (server/cloud-owner.ts): every stored session
+// without admin scope is revoked and what it opened or wrote is nobody's;
+// once (and after a restore) the earlier keys are settled. Before anything
+// is served, and before any routine can run.
+if (CLOUD_HOME && CLOUD_OWNER_KEY && cloudRoutineAuthors) {
+    const authors = cloudRoutineAuthors;
+    const routineById = (id) => routines?.listRoutines().find((routine) => routine.id === id);
+    cloudEarlierOwners = settleCloudOwnership({
+        file: join(DATA_DIR, "cloud-owner.json"),
+        machineId: CLOUD_HOME.machineId,
+        ownerKey: CLOUD_OWNER_KEY,
+        nobodyKey: CLOUD_NOBODY_KEY,
+        sessions,
+        personKey,
+        starters: threadStarters,
+        writers: authors,
+        routines: {
+            ids: () => (routines?.listRoutines() ?? []).map((routine) => routine.id),
+            writer: (id) => authors.writer(id),
+            fingerprinted: (id) => { const routine = routineById(id); return Boolean(routine) && authors.authored(id, routine); },
+            resultsOpener: (id) => { const results = routineById(id)?.resultsThreadId; return results ? threadStarters.get(results) : undefined; },
+            shape: (id) => { const routine = routineById(id); return routine ? approvalShape(routine) : undefined; },
+            name: (id, person) => authors.wrote(id, person),
+            pause: (ids) => { for (const id of ids)
+                routines?.update(id, { enabled: false }); },
+        },
+        unpin: (threadIds) => { for (const threadId of threadIds)
+            store.unpinTaskCwd(threadId); },
+        lines: () => {
+            const senders = new Set(), answerers = new Set();
+            const approvals = [];
+            const threads = new Set([...store.bots.flatMap((bot) => store.tasks(bot.id).map((task) => task.threadId)), ...store.groups.map((group) => group.threadId)]);
+            for (const threadId of threads) {
+                for (const line of store.messagesFor(threadId)) {
+                    const sender = linePersonKey(line);
+                    if (sender)
+                        senders.add(sender);
+                    const answerer = line.card?.answeredBy?.kind === "session" ? line.card.answeredBy.person : undefined;
+                    if (answerer)
+                        answerers.add(answerer);
+                    // A routine a bot proposed, created when this person allowed its card.
+                    const request = line.card?.routineRequest;
+                    if (answerer && line.card?.answered === "allow" && request?.operation.action === "create" && request.resultId) {
+                        const definition = request.operation.routine;
+                        approvals.push([request.resultId, answerer, approvalShape({ prompt: definition.instructions, botId: request.operation.forBot?.botId ?? request.botId,
+                                runOn: definition.runOn, schedule: asSchedule(definition.schedule, 0) })]);
+                    }
+                }
+            }
+            return { senders, answerers, approvals };
+        },
+        ...(restoredAtStart ? { restoredNow: restoredAtStart } : {}),
+        ...(workspaceRestore.restored && workspaceRestore.id ? { lastRestore: workspaceRestore.id } : {}),
+        log: (line) => console.log(line),
+    });
+    ownerOnlyCache.clear();
+}
 orgLibrary = new OrgLibrary({
     dataDir: DATA_DIR,
     store,
@@ -9276,7 +9978,7 @@ async function cloudRoutineReadiness(botId, threadId) {
         return { ready: false, reason: "The Cloud VM runner is unavailable. Restart OpenMausBot and try again." };
     try {
         if ((await instance.snapshot()).state !== "available") {
-            return { ready: false, reason: "The target bot's model engine is not ready to use the Boat cloud computer." };
+            return { ready: false, reason: "The target bot's model is not ready to use the Boat cloud computer." };
         }
         const teamComputer = inheritedTeamComputer(bot);
         const ownerId = teamComputer ? teamComputerOwner(teamComputer.id) : bot.id;
@@ -9829,9 +10531,15 @@ function sendRoutineResolution(res, result) {
     });
     return true;
 }
-function resolveAndSendRoutine(res, args) {
+function resolveAndSendRoutine(res, args, ownersAnswer = false) {
     const card = store.messagesFor(args.threadId).find((message) => message.card?.requestId === args.requestId && message.card.routineRequest)?.card;
+    // On a Cloud home a routine the owner approved on its card is theirs; one
+    // it only changed stays whosever it was (cloudOwnerApplied).
+    const operation = card?.routineRequest?.operation;
+    const wasOwners = operation && operation.action !== "create" ? cloudRoutineIsOwners(operation.routineId) : false;
     const result = routineRequests.resolve(args);
+    if (ownersAnswer && result.claimed && result.state === "applied")
+        cloudOwnerApplied(result.action, result.resultId, wasOwners);
     if (result.claimed &&
         (result.state === "applied" || result.state === "denied")) {
         appendDecision(DATA_DIR, {
@@ -9967,12 +10675,25 @@ const webhooks = new WebhookManager({
     findRun: (webhookId, deliveryId) => routines.webhookRunReceipt(webhookId, deliveryId),
     cancelQueued: (webhookId, message) => routines.cancelQueuedWebhook(webhookId, message),
     pendingRuns: (webhookId) => routines.activeWebhookRunCount(webhookId),
-    // delivery:"post" webhooks land in the bot's main chat as the bot's own message.
-    post: (botId, text) => {
-        const bot = store.bot(botId);
-        if (!bot)
+    // delivery:"post" webhooks land in a dedicated "Updates" task, never
+    // bot.threadId (the bot's currently-selected task) -- see
+    // resolvePostThread below. Fixes
+    // https://github.com/milind-soni/OpenMausBot/issues/2071: a post used to
+    // land wherever the owner (or another automation) had last switched
+    // that bot's selection, including a live conversation.
+    post: (botId, threadId, text) => {
+        if (!store.bot(botId))
             return;
-        store.appendMessage(bot.threadId, { role: "bot", kind: "text", text });
+        store.appendMessage(threadId, { role: "bot", kind: "text", text });
+    },
+    // Mirrors resolveResultsThread's routines wiring a few hundred lines up
+    // in this same file: create-on-first-use, never activated (so it never
+    // steals the bot's live selection the way POST /api/bots/:id/tasks
+    // does), reused forever after via trigger.resultsThreadId.
+    resolvePostThread: (trigger, forceNew) => {
+        if (!forceNew && trigger.resultsThreadId)
+            return trigger.resultsThreadId;
+        return store.createTask(trigger.botId, "Updates", false)?.threadId;
     },
 });
 let webhookIngress = null;
@@ -10144,7 +10865,7 @@ setupRetry = 0) {
     // delegated Full elevation makes the two disagree by construction: every
     // such room turn then reads as "settings changed", retries once, and
     // settles as busy without ever dispatching.
-    const preparedApprovalMode = roomTurnApprovalMode(bot, orchestration);
+    const preparedApprovalMode = roomTurnApprovalMode(bot, threadId, orchestration);
     const preparedSelection = { ...bot.modelSelection };
     const preparedComposio = bot.composio;
     const instance = turnInstance(bot);
@@ -10154,8 +10875,14 @@ setupRetry = 0) {
         return true;
     }
     const roomPolicyRefusal = instance ? policyModelRefusal(instance) : undefined;
-    if (!instance || roomPolicyRefusal) {
-        const message = roomPolicyRefusal ?? `${bot.name}'s model is unavailable`;
+    // A room turn a guest drives on a Cloud home is confined like a guest's
+    // own conversation, or refused on an engine that cannot be.
+    if (!groupSpeakers.has(threadId))
+        guestDrivenTurns.delete(threadId);
+    const roomGuestConfined = cloudGuestDriven(threadId) || cloudGuestDrivenHandoff(orchestration?.roomHandoffId);
+    const roomGuestRefusal = roomGuestConfined && instance?.adapter.capabilities.guestTurns !== "confined" ? guestEngineRefusal(threadId) : undefined;
+    if (!instance || roomPolicyRefusal || roomGuestRefusal) {
+        const message = roomPolicyRefusal ?? roomGuestRefusal ?? `${bot.name}'s model is unavailable`;
         store.appendMessage(threadId, {
             role: "bot",
             kind: "activity",
@@ -10188,6 +10915,11 @@ setupRetry = 0) {
         return true;
     }
     const internalGeneration = beginInternalCapabilityGeneration(threadId);
+    if (roomGuestConfined)
+        guestDrivenTurns.set(threadId, internalGeneration);
+    // A room turn is never provably the owner's alone (server/lending-memory.ts).
+    if (CLOUD_HOME)
+        noteForeignTurn(bot.id, threadId, internalGeneration);
     const resourceOwner = { threadId, generation: internalGeneration };
     turnResourceOwners.set(threadId, resourceOwner);
     let roomVmTarget = null;
@@ -10294,7 +11026,7 @@ setupRetry = 0) {
         }
         // user-configured MCP servers: same gating as the 1:1 site above.
         if (instance.adapter.capabilities.customMcp === true) {
-            const custom = engineMcpServers(bot);
+            const custom = await withMcpSignIn(engineMcpServers(bot), mcpOAuth);
             if (Object.keys(custom).length)
                 integrations.custom = custom;
         }
@@ -10316,7 +11048,7 @@ setupRetry = 0) {
         if (!readyGroup || !stillOwnsThread || !readyGroup.memberIds.includes(readyBot.id))
             return false;
         const setupChanged = turnInstance(readyBot) !== instance ||
-            roomTurnApprovalMode(readyBot, orchestration) !== preparedApprovalMode ||
+            roomTurnApprovalMode(readyBot, threadId, orchestration) !== preparedApprovalMode ||
             readyBot.modelSelection.instanceId !== preparedSelection.instanceId ||
             readyBot.modelSelection.model !== preparedSelection.model ||
             readyBot.modelSelection.effort !== preparedSelection.effort ||
@@ -10520,7 +11252,7 @@ setupRetry = 0) {
         // Claim the same lease as direct turns before asynchronous VM setup.
         if (readyBot.computer === "vm") {
             if (instance.adapter.capabilities.computerMcp !== true || instance.adapter.capabilities.remoteAgent === true) {
-                throw new Error("this model engine cannot use the Local VM");
+                throw new Error("this model cannot use the Local VM");
             }
             // A distinct identity fences cleanup even in shared mode on the same room thread.
             const target = { ...localVmTargetForThread(readyBot.id, threadId) };
@@ -10613,7 +11345,7 @@ setupRetry = 0) {
         const worksInWorkspace = supportsWorkspaceFiles(instance.driverKind);
         const workspace = worksInWorkspace ? ensureWorkspace(bot.id) : undefined;
         // a room member's memory writes are journaled the same as a 1:1 turn's
-        if (workspace)
+        if (workspace && bot.memoryEnabled !== false)
             beginMemoryTurn(bot.id, threadId);
         // The room's folder pins here — on the first turn that actually
         // dispatches, not at PATCH time — so a folder set on a never-used room
@@ -10621,19 +11353,22 @@ setupRetry = 0) {
         // has its folder moved underneath it. Off-host members skip the folder
         // but must not decide the pin: the room's desk is a property of the
         // room, not of whichever member happened to speak first.
-        const cwd = groupTurnCwd(workspace, () => store.pinGroupCwd(readyGroup.id, threadId));
+        // A room a guest opened on a Cloud home works in a folder of its own too.
+        const cwd = workspace && cloudGuestOpened(threadId)
+            ? ensureTaskWorkspace(bot.id, threadId)
+            : groupTurnCwd(workspace, () => store.pinGroupCwd(readyGroup.id, threadId));
         {
             const drift = checkSoulDrift(bot.id, bot.soul ?? "", bot.soulHash ?? "");
             if (drift.drift !== Boolean(bot.soulDrift))
                 store.patchBot(bot.id, { soulDrift: drift.drift });
         }
-        const roomMemory = memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace });
+        const roomMemory = memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace, enabled: bot.memoryEnabled !== false });
         // The same brief a 1:1 turn gets: what this member said lately in its
         // other conversations, so a standup is answered from what happened. A
         // brief can carry a private chat into the room; as with session_search
         // (#754) the room is told, once per source thread, rather than the
         // crossing being blocked.
-        const recentLines = recentWork(recentWorkSources(bot), bot, { userName, currentThreadId: threadId });
+        const recentLines = recentWork(recentWorkSources(bot), bot, { userName, currentThreadId: threadId, ...recentWorkFilter() });
         const roomComputerPromptKind = resolveComputerPromptKind({
             kind: roomTeamComputer || roomComputerKind === "box" ? "box" : roomVmTarget ? "vm" : roomComputerKind,
             driverKind: instance.driverKind, cloudComputerMcp: instance.adapter.capabilities.cloudComputerMcp,
@@ -10659,7 +11394,7 @@ setupRetry = 0) {
             { id: "plan", label: "Surface", text: surfacePrompt({ computer: roomTeamComputer ? "cloud" : roomVmTarget ? "vm" : surfaceOfComputerKind(roomComputerKind), browser: Boolean(integrations.browser) }, { note: roomPlan.note, cloudHome: Boolean(CLOUD_HOME) }) },
             { id: "cloud-home", label: "OMB Cloud", text: CLOUD_HOME ? cloudHomePrompt(Boolean(integrations.agents) && lendingEnabled()) : "" },
             { id: "browser", label: "Browser", text: integrations.browser ? BUILT_IN_BROWSER_SYSTEM_PROMPT : "" },
-            { id: "recall", label: "Recall", text: integrations.agents ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
+            { id: "recall", label: "Recall", text: integrations.agents && bot.memoryEnabled !== false ? SESSION_SEARCH_SYSTEM_PROMPT : "" },
             { id: "recent", label: "Recent work", text: recentWorkPrompt(recentLines) },
             { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
             // the room path has always put a newline before memory and trimmed
@@ -10794,7 +11529,8 @@ setupRetry = 0) {
                 text: withRecalled(roomRecalled, text),
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: roomTurnApprovalMode(readyBot, orchestration),
+                approvalMode: roomTurnApprovalMode(readyBot, threadId, orchestration),
+                ...(roomGuestConfined ? { guestConfined: true, confinedWhy: confinedWhy(threadId) } : {}),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
                 systemVolatile: roomSystem.volatile,
@@ -12443,12 +13179,12 @@ function stderrOf(err) {
     const s = err.stderr;
     return typeof s === "string" ? s : Buffer.isBuffer(s) ? s.toString("utf8") : "";
 }
-async function localVmPayload(target) {
+async function localVmPayload(target, auth) {
     const status = await containerComputerStatus(undefined, undefined, target);
     return {
-        ...status,
+        ...localVmViewerStatus(status, auth),
         commands: setupCommands(status.runtime, process.platform, target),
-        idle_timeout_ms: LOCAL_VM_IDLE_MS,
+        idle_timeout_ms: localVmIdleMs(),
         mode: localVmMode(cfg),
         max_instances: localVmMaxInstances(cfg),
     };
@@ -12576,7 +13312,9 @@ function configStatus() {
     return {
         xai: { configured: Boolean(cfg.xai?.key) },
         mistral: { configured: Boolean(cfg.mistral?.key) },
-        anthropic: { configured: Boolean(cfg.anthropic?.key) },
+        anthropic: { configured: Boolean(cfg.anthropic?.key), everyClaudeBot: cfg.anthropic?.everyClaudeBot !== false },
+        openai: { configured: Boolean(cfg.openai?.key) },
+        openrouter: { configured: Boolean(cfg.openrouter?.key) },
         // a fleet agent on this server means Settings → Workspaces has something to drive
         fleet: { available: fleetAvailable(fleetSocketPath()) },
         // what this build is entitled to, so Settings shows only what works here
@@ -12627,6 +13365,7 @@ function configStatus() {
         localVm: {
             mode: localVmMode(cfg),
             maxInstances: localVmMaxInstances(cfg),
+            idleTimeoutMinutes: localVmIdleTimeoutMinutes(cfg),
         },
         features: {
             skillAuthoring: skillAuthoringEnabled(cfg),
@@ -12641,6 +13380,8 @@ function configStatus() {
             // own Claude Code MCP servers
             claudeUserMcp: claudeUserMcpEnabled(cfg),
             autoRecall: autoRecallEnabled(cfg),
+            // hand-edited config.json only; the thread menu offers Regenerate title from it
+            llmThreadTitles: llmThreadTitlesEnabled(cfg),
         },
         // first-run progress — not a secret; the app decides whether to show
         // the welcome tour from this, never from browser storage
@@ -12649,6 +13390,7 @@ function configStatus() {
             version: cfg.onboarding?.version ?? 0,
             reelSeen: cfg.onboarding?.reelSeen === true,
             hintsSeen: cfg.onboarding?.hintsSeen ?? [],
+            ...(cfg.onboarding?.firstTurnAt ? { firstTurnAt: cfg.onboarding.firstTurnAt } : {}),
         },
         // Which browser this server can give bots: the desktop app's surface,
         // the agent-browser engine, or nothing yet (with the reason).
@@ -12682,7 +13424,14 @@ function mcpServerResponse() {
     // While enrolled with custom servers off, say which servers stay configured
     // but never reach bots, and why. Nothing here is written to config.json.
     const policy = managedPolicy.current();
-    const servers = listMcpServers(cfg.mcpServers).map(server => managedPolicy.mcpAllowed(server.name, "url" in server ? server.url : undefined) ? server : { ...server, managedBy: policy.organizationName });
+    const servers = listMcpServers(cfg.mcpServers).map((server) => {
+        if (!("url" in server))
+            return server;
+        const auth = mcpOAuth.authState(server.name, server.url);
+        // the redirect URI to register with a pre-registered sign-in app
+        const listed = server.oauth ? { ...server, oauth: { ...server.oauth, redirectUri: mcpOAuthRedirectUri(server.url) } } : server;
+        return auth === "none" ? listed : { ...listed, auth };
+    }).map(server => managedPolicy.mcpAllowed(server.name, "url" in server ? server.url : undefined) ? server : { ...server, managedBy: policy.organizationName });
     return { servers, ...(policy && !policy.mcp.allowCustom ? { managed: { organizationName: policy.organizationName, allowlist: policy.mcp.allowlist } } : {}) };
 }
 /** Adding or editing a server the organisation has not approved is refused. */
@@ -12697,7 +13446,7 @@ function mcpServerBody(body) {
     if (!body || typeof body !== "object")
         return out;
     const record = body;
-    for (const key of ["command", "args", "env", "type", "url", "headers", "enabled"]) {
+    for (const key of ["command", "args", "env", "type", "url", "headers", "oauth", "enabled"]) {
         if (record[key] !== undefined)
             out[key] = record[key];
     }
@@ -12706,7 +13455,7 @@ function mcpServerBody(body) {
 /** Configured MCP servers that may reach this bot's engine. While enrolled,
  * the organisation's allow-list filters them; config.json is never changed. */
 function engineMcpServers(bot) {
-    return managedPolicy.filterMcp(customMcpServers(cfg, bot.mcpServers));
+    return withoutPendingSignIn(managedPolicy.filterMcp(customMcpServers(cfg, bot.mcpServers)), mcpOAuth);
 }
 function persistMcpServers(next) {
     saveConfig({ mcpServers: next });
@@ -12720,7 +13469,11 @@ async function describeInstances() {
     const configs = providerConfigs();
     return (await registry.describe()).map((instance) => {
         const entry = configs[instance.instanceId];
-        const described = entry?.icon ? { ...instance, icon: entry.icon } : instance;
+        const described = {
+            ...instance,
+            ...(entry?.icon ? { icon: entry.icon } : {}),
+            ...(entry?.access ? { access: entry.access } : {}),
+        };
         if (hostedModels)
             return { ...described, readOnly: true,
                 install: undefined, authentication: undefined, cli: undefined, cliCandidates: [],
@@ -12732,8 +13485,16 @@ async function describeInstances() {
                 ...described, ...policy, readOnly: true, managed: managedDesktop.info(instance.instanceId),
                 install: undefined, authentication: undefined, cli: undefined, cliCandidates: [],
             };
+        // Windows keeps what Antigravity's runtime unpacked whenever it is
+        // stopped by force; its Settings card offers to clear that.
+        if (instance.driverKind === "antigravityAgent" && process.platform === "win32")
+            return { ...described, ...policy, freeUpSpace: true };
         if (entry?.driver !== "claudeAgent")
             return { ...described, ...policy };
+        // Claude on the workspace API key has no account to sign in to.
+        if (instance.instanceId === CLAUDE_API_INSTANCE) {
+            return { ...described, ...policy, authentication: undefined, install: { ...instance.install, signInCommand: undefined } };
+        }
         try {
             const claudeAccount = claudeAccountInfo(instance.instanceId, entry, instance.cli ?? instance.cliDefault ?? "claude");
             return { ...described, ...policy, claudeAccount, install: { ...instance.install, signInCommand: claudeAccount.signInCommand } };
@@ -12872,6 +13633,7 @@ async function reloadProviders() {
             stopScreenPoller(botId, threadId);
             releaseLocalVmThread(threadId);
             releaseTurnResources(owner);
+            endForeignTurns(threadId);
             vpsThreadEnded(botId, threadId);
             watchdog.settle(threadId);
             closeOpenApprovals(threadId);
@@ -12891,6 +13653,7 @@ async function reloadProviders() {
         for (const [threadId, speaker] of rooms) {
             releaseLocalVmThread(threadId);
             releaseTurnResources(turnResourceOwners.get(threadId));
+            endForeignTurns(threadId);
             watchdog.settle(threadId);
             closeOpenApprovals(threadId);
             if (groupSpeakers.get(threadId) !== speaker)
@@ -12922,6 +13685,10 @@ let mcpProbesInFlight = 0;
 // install, and running two self-updates against it would race its files.
 const claudeUpdatesInFlight = new Set();
 // ── HTTP plumbing ─────────────────────────────────────────────────────
+/** The web UI's pages: never framed by another page (a hidden frame could
+ * otherwise act on a pair or sign-in page unseen), and they send no Referer.
+ * Nothing frames the web UI: the desktop app shows it in its own window. */
+const PAGE_HEADERS = { "content-security-policy": "frame-ancestors 'none'", "x-frame-options": "DENY", "referrer-policy": "no-referrer" };
 /** The built UI, when this process serves it (OMB_STATIC_DIR: set by the
  * desktop app and by the container image). Public by design: it is the same
  * bundle anyone can download, holds no secrets, and a remote browser must be
@@ -12934,7 +13701,8 @@ function serveStatic(res, path) {
     const file = join(STATIC_DIR, safe);
     try {
         const data = readFileSync(file);
-        res.writeHead(200, { "content-type": MIME[extname(file)] ?? "application/octet-stream" });
+        const type = MIME[extname(file)] ?? "application/octet-stream";
+        res.writeHead(200, { "content-type": type, ...(type === "text/html" ? PAGE_HEADERS : {}) });
         res.end(data);
         return true;
     }
@@ -12942,7 +13710,7 @@ function serveStatic(res, path) {
         // SPA fallback
         try {
             const data = readFileSync(join(STATIC_DIR, "index.html"));
-            res.writeHead(200, { "content-type": "text/html" });
+            res.writeHead(200, { "content-type": "text/html", ...PAGE_HEADERS });
             res.end(data);
             return true;
         }
@@ -13026,6 +13794,23 @@ ROUTES.push(createBotMemoryRoutes({
     bot: (id) => store.bot(id),
     taskByThread: (botId, threadId) => store.taskByThread(botId, threadId),
     upkeep: memoryUpkeep,
+    ...(lendingMemory ? {
+        lendingReview: {
+            needed: (botId) => {
+                if (!lendingMemory.reconcile(botId, foreignTurnRunning(botId), { cached: true }).changedBySomeoneElse)
+                    return null;
+                const { token, changed } = lendingMemory.reviewInfo(botId);
+                return { token, changed };
+            },
+            accept: (botId, token) => lendingMemory.review(botId, foreignTurnRunning(botId), token).ok,
+            // Like Move to Cloud: one of the owner's own devices, never loopback
+            // (on a Cloud home that is a bot's shell, not the owner).
+            owner: cloudOwnerSession,
+        },
+        // The owner's own Memory edits are theirs even while someone else's
+        // conversation runs; anyone else's are judged like a bot's own write.
+        ownersWrite: (auth, botId, write) => cloudOwnerSession(auth) ? lendingMemory.trustedWrite(botId, write) : write(),
+    } : {}),
     aboutMe: () => cfg.profile?.aboutMe ?? "",
     saveAboutMe: (aboutMe) => {
         saveConfig({ profile: { ...cfg.profile, aboutMe } });
@@ -13034,6 +13819,13 @@ ROUTES.push(createBotMemoryRoutes({
     },
 }));
 ROUTES.push(createDeciderRoutes({ decider }));
+ROUTES.push(createAntigravityLeftoverRoutes({
+    hosted: Boolean(hostedModels),
+    isAntigravity: (instanceId) => registry.get(instanceId)?.driverKind === "antigravityAgent",
+    find: () => findAntigravityLeftovers(),
+    remove: () => removeAntigravityLeftovers(),
+}));
+ROUTES.push(desktopViewer.route);
 const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
@@ -13090,7 +13882,7 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && !path.startsWith("/api/") && !path.startsWith("/.well-known/") && serveStatic(res, path))
             return;
         if (method === "GET" && path === "/.well-known/openmausbot/environment") {
-            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && emailSignIn.enabled(), sharedComputers: lendingEnabled() }));
+            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled() }));
         }
         const domainCheck = /^\/\.well-known\/openmausbot\/domain-check\/([a-f0-9]{64})$/.exec(path);
         if (method === "GET" && domainCheck) {
@@ -13100,7 +13892,11 @@ const handleRequest = async (req, res) => {
         }
         // Sign in with an emailed code (server/account-signin.ts). Public like
         // /api/auth/pair, JSON-only for the same reason, and counted against the
-        // same per-source lockout so a code cannot be guessed.
+        // same per-source lockout so a code cannot be guessed. Never on a Cloud
+        // home: it is personal, and the owner's devices sign in through the Admin.
+        if (CLOUD_HOME && method === "POST" && (path === "/api/auth/email/start" || path === "/api/auth/email/verify")) {
+            return json(res, 403, { error: CLOUD_PERSONAL_REFUSAL, code: "cloud_personal" });
+        }
         if (method === "POST" && (path === "/api/auth/email/start" || path === "/api/auth/email/verify")) {
             if (!/^application\/json\b/i.test(String(req.headers["content-type"] ?? ""))) {
                 return json(res, 415, { error: "send the sign-in request as JSON (content-type: application/json)" });
@@ -13170,13 +13966,27 @@ const handleRequest = async (req, res) => {
             const wantsCookie = body?.cookie === true;
             const label = typeof body?.label === "string" ? body.label : "";
             const attemptId = typeof body?.attemptId === "string" ? body.attemptId : undefined;
-            const result = sessions.exchange({ code, label, attemptId, source: requestSource(req), fallbackLabel: labelFromUserAgent(req.headers["user-agent"]) });
+            // A browser sign-in (the OMB Cloud page's "Use in your browser", docs/cloud-pro.md)
+            // redeems only a window opened for one, and only into this browser's cookie.
+            const browser = body?.browser === true;
+            if (browser && body?.preview === true) {
+                // Whose Cloud it signs in to, shown before the person continues. Redeems nothing.
+                const preview = sessions.previewBrowserSignIn(code);
+                return preview ? json(res, 200, preview) : json(res, 401, { error: "this sign-in link has expired or was already used" });
+            }
+            if (browser && !wantsCookie)
+                return json(res, 400, { error: "a browser sign-in sets this browser's cookie; send cookie: true" });
+            const result = sessions.exchange({ code, label, attemptId, browser, source: requestSource(req), fallbackLabel: labelFromUserAgent(req.headers["user-agent"]) });
             if (!result.ok) {
                 console.warn(`pairing refused from ${requestSource(req)}: ${result.error}`);
                 return json(res, result.status, { error: result.error });
             }
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: emailSignIn.enabled(), sharedComputers: lendingEnabled() });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled() });
             if (wantsCookie) {
+                // A browser sign-in replaces this browser's own session here, if it had one, rather than leaving it behind.
+                const previous = browser ? sessions.authenticate(parseCookies(req.headers.cookie).get(SESSION_COOKIE)) : null;
+                if (previous && previous.id !== result.session.id)
+                    sessions.revoke(previous.id);
                 const secure = requestOrigin(req)?.startsWith("https://") === true;
                 res.setHeader("set-cookie", serializeSessionCookie(SESSION_COOKIE, result.token, { secure, maxAgeSeconds: cookieMaxAgeSeconds(result.session) }));
                 return json(res, 200, { session: result.session, environment });
@@ -13310,12 +14120,18 @@ const handleRequest = async (req, res) => {
                     environmentId: ENVIRONMENT_ID,
                     // the account behind the session, when it came from a sign-in
                     ...(auth.session.email ? { email: auth.session.email } : {}),
+                    // whose OMB Cloud a browser sign-in signed in to
+                    ...(auth.session.owner ? { owner: auth.session.owner } : {}),
                     // a hosted team workspace: the web UI's first run skips the
                     // desktop-only beats there. Absent everywhere else.
                     ...(HOSTED_WORKSPACE ? { hosted: true } : {}),
                     // an OMB Cloud home: the web UI's first run is its engine
                     // sign-in (docs/cloud-pro.md). Absent everywhere else.
                     ...(CLOUD_HOME ? { cloudHome: true } : {}),
+                    // a device that is not one of the owner's own on a Cloud home
+                    // writes only in conversations it opened: the composer offers
+                    // a new conversation everywhere else.
+                    ...(CLOUD_HOME && !cloudOwnerSession(auth) ? { cloudGuest: true, openedThreads: threadStarters.threadsOf(actorKey(auth), 2_000) } : {}),
                 });
         }
         if (method === "POST" && path === "/api/auth/stream-ticket") {
@@ -13339,7 +14155,16 @@ const handleRequest = async (req, res) => {
             }
             const requested = body?.scopes;
             const scopes = Array.isArray(requested) ? requested.filter((v) => v === "admin" || v === "client") : undefined;
-            const opened = sessions.openPairing({ label: typeof body?.label === "string" ? body.label : undefined, scopes });
+            let opened;
+            try {
+                opened = sessions.openPairing({ label: typeof body?.label === "string" ? body.label : undefined, scopes });
+            }
+            catch (error) {
+                // A Cloud home is personal: a device paired to it has admin scope (sessions.requireAdmin).
+                if (error.code === "cloud_personal")
+                    return json(res, 403, { error: error.message, code: "cloud_personal" });
+                throw error;
+            }
             const origin = requestOrigin(req);
             const base = publicUrl() ?? (auth.kind === "session" && origin ? origin : null);
             const code = formatPairingCode(opened.code);
@@ -13702,19 +14527,31 @@ const handleRequest = async (req, res) => {
             // Notes written from a room fewer people can see than this bot would
             // carry that room's words to everyone who can see the bot.
             if ((path === "/api/internal/memory" || path === "/api/internal/memory/log") && method === "POST") {
+                // On a Cloud home a bot's memory loads into its owner's turns, and
+                // through them can reach a lent Mac: only a conversation that is
+                // provably the owner's may write it.
+                if (CLOUD_HOME && cloudHomeLendingRefusal(cloudLendingTurn(internalCapability)) !== null) {
+                    return json(res, 403, { error: "Notes can only be saved from a conversation that only the owner of this Cloud has written in." });
+                }
+                if (internalSender.memoryEnabled === false) {
+                    return json(res, 403, { error: "Memory is disabled for this bot." });
+                }
                 const room = store.groupByThread(internalCapability.threadId);
                 if (room && !roomFeedsBot(room, internalSender)) {
                     return json(res, 403, { error: "This room is visible to fewer people than you are, so notes from it can't go into your memory. Keep them in the room." });
                 }
             }
+            // On a Cloud home only the owner's conversations get here (above): the
+            // write is theirs (server/lending-memory.ts).
+            const ownersWrite = (write) => lendingMemory ? lendingMemory.trustedWrite(internalSender.id, write) : write();
             if (method === "POST" && path === "/api/internal/memory") {
                 const body = await readInternalBody();
-                const result = updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText, ...(body.until !== undefined ? { until: body.until } : {}) }, { source: memorySource() });
+                const result = ownersWrite(() => updateMemory(internalSender.id, { action: body.action, text: body.text, oldText: body.oldText, ...(body.until !== undefined ? { until: body.until } : {}) }, { source: memorySource() }));
                 return json(res, result.ok ? 200 : result.code === "conflict" ? 409 : result.code === "over-budget" ? 413 : 400, result);
             }
             if (method === "POST" && path === "/api/internal/memory/log") {
                 const body = await readInternalBody();
-                const result = appendMemoryLog(internalSender.id, body.text, { source: memorySource() });
+                const result = ownersWrite(() => appendMemoryLog(internalSender.id, body.text, { source: memorySource() }));
                 return json(res, result.ok ? 200 : 400, result);
             }
             if (method === "POST" && path === "/api/internal/browser/mcp") {
@@ -13762,8 +14599,8 @@ const handleRequest = async (req, res) => {
             if (method === "GET" && path === "/api/internal/shared-computers" && lendingEnabled()) {
                 const principal = sharedComputerPrincipal(internalCapability);
                 // Say why an owner's own conversation sees no Mac, so the bot can tell them.
-                const notice = CLOUD_HOME && !principal && sharedComputers.status(CLOUD_HOME_LENDER).length > 0 &&
-                    cloudHomeLendingRefusal(cloudLendingTurn(internalCapability)) === "someone-else" ? { unavailable: LENDING_SOMEONE_ELSE } : {};
+                const why = CLOUD_HOME && !principal && sharedComputers.status(CLOUD_HOME_LENDER).length > 0 ? cloudLendingRefusal(internalCapability) : null;
+                const notice = why === "someone-else" ? { unavailable: LENDING_SOMEONE_ELSE } : why === "memory-changed" ? { unavailable: LENDING_MEMORY_CHANGED } : {};
                 return json(res, 200, { computers: sharedComputers.list(principal), ...notice });
             }
             if (method === "POST" && path === "/api/internal/shared-computers" && lendingEnabled()) {
@@ -13777,8 +14614,9 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: "This bot has no computer. Change its Computer setting to use a shared computer's apps and screen." });
                 }
                 const principal = sharedComputerPrincipal(internalCapability);
-                if (CLOUD_HOME && !principal && cloudHomeLendingRefusal(cloudLendingTurn(internalCapability)) === "someone-else") {
-                    return json(res, 403, { error: LENDING_SOMEONE_ELSE });
+                const why = CLOUD_HOME && !principal ? cloudLendingRefusal(internalCapability) : null;
+                if (why === "someone-else" || why === "memory-changed") {
+                    return json(res, 403, { error: why === "someone-else" ? LENDING_SOMEONE_ELSE : LENDING_MEMORY_CHANGED });
                 }
                 return json(res, 200, { result: await sharedComputers.request(parsed.data, principal, () => lendingEnabled() && internalCapabilityIsActive(internalCapability)) });
             }
@@ -13837,7 +14675,13 @@ const handleRequest = async (req, res) => {
                         return "closed";
                     return "idle";
                 };
+                // On a Cloud home a turn that may use the lent Mac sees only the
+                // conversations the owner alone opened and wrote in: a title is words
+                // too (cloudLendingView).
+                const shown = cloudLendingView(internalCapability) ? cloudOwnerOnlyThread : () => true;
                 for (const task of store.tasks(from.id)) {
+                    if (!shown(task.threadId))
+                        continue;
                     rows.push({
                         threadId: task.threadId, botId: from.id, botName: from.name, title: task.title,
                         state: stateOf(from, task), unread: task.unread === true, openedAt: task.openedBy?.at ?? task.createdAt,
@@ -13846,7 +14690,7 @@ const handleRequest = async (req, res) => {
                 }
                 for (const peer of reachablePeers(store.bots, from)) {
                     for (const task of store.tasks(peer.id)) {
-                        if (task.openedBy?.botId !== from.id)
+                        if (task.openedBy?.botId !== from.id || !shown(task.threadId))
                             continue;
                         rows.push({
                             threadId: task.threadId, botId: peer.id, botName: peer.name, title: task.title,
@@ -14079,6 +14923,12 @@ const handleRequest = async (req, res) => {
                     : body.action === "update"
                         ? { action: body.action, routineId: body.routineId, changes: body.changes, forBot }
                         : { action: body.action, routineId: body.routineId, forBot };
+                // Whether the routine a change is for is the owner's, and whether this
+                // turn acts for the owner (their own conversation, or a run of a
+                // routine that is theirs), both before the change.
+                const wasOwners = proposedInput.action !== "create" && typeof proposedInput.routineId === "string" ? cloudRoutineIsOwners(proposedInput.routineId) : false;
+                const run = activeRoutineRunForThread(fromThreadId);
+                const ownersTurn = cloudOwnerOnlyThread(fromThreadId) || cloudRoutineRunIsOwners(run, from.id, fromThreadId);
                 const proposed = await routineRequests.submit({
                     botId: from.id,
                     threadId: fromThreadId,
@@ -14087,6 +14937,17 @@ const handleRequest = async (req, res) => {
                     canCommit: () => internalCapabilityIsActive(internalCapability),
                 });
                 const proposedCard = store.messagesFor(fromThreadId).find((message) => message.id === proposed.messageId)?.card;
+                // Applied at once in a Full-access conversation. In the owner's own (one
+                // only they provably wrote in) it is theirs, as if they had approved
+                // the card. From anywhere else, a routine it created or changed is no
+                // longer the owner's, like anyone else's edit (the routine PATCH).
+                const applied = CLOUD_HOME && proposed.state === "applied" && "result" in proposed ? proposed.result : undefined;
+                if (applied?.resultId && ownersTurn)
+                    cloudOwnerApplied(applied.action, applied.resultId, wasOwners);
+                else if (applied?.resultId && (applied.action === "create" || applied.action === "update")) {
+                    cloudRoutineAuthors?.forget(applied.resultId);
+                    cloudRoutineAuthors?.wrote(applied.resultId, CLOUD_NOBODY_KEY);
+                }
                 appendDecision(DATA_DIR, {
                     threadId: fromThreadId,
                     requestId: proposed.requestId,
@@ -14305,7 +15166,7 @@ const handleRequest = async (req, res) => {
                 if (scope !== "all" && scope !== "conversations" && scope !== "memory") {
                     return json(res, 400, { error: "scope must be all, conversations, or memory" });
                 }
-                const memoryHits = scope === "conversations" || !q ? [] : searchMemoryFiles(from.id, q, limit);
+                const memoryHits = scope === "conversations" || !q || from.memoryEnabled === false ? [] : searchMemoryFiles(from.id, q, limit);
                 if (scope === "memory")
                     return json(res, 200, { hits: [], memoryHits });
                 // Own threads: the bot's main chat and tasks, and the rooms it is a
@@ -14321,7 +15182,10 @@ const handleRequest = async (req, res) => {
                     for (const task of group.tasks ?? [])
                         roomByThread.set(task.threadId, group);
                 }
-                const ownThreads = [...new Set([from.threadId, ...(from.tasks ?? []).map((task) => task.threadId), ...roomByThread.keys()])];
+                const ownThreads = [...new Set([from.threadId, ...(from.tasks ?? []).map((task) => task.threadId), ...roomByThread.keys()])]
+                    // On a Cloud home a turn that may use the lent Mac searches only the
+                    // conversations the owner alone opened and wrote in.
+                    .filter(cloudLendingView(internalCapability) ? cloudOwnerOnlyThread : () => true);
                 // A room is the only place a recall can be a disclosure, and only a
                 // private chat is one: in a 1:1 the user already owns every thread
                 // the bot can reach, and a room's lines were said in the open.
@@ -14360,7 +15224,8 @@ const handleRequest = async (req, res) => {
                 const messageId = String(url.searchParams.get("messageId") ?? "").trim();
                 if (!threadId || !messageId)
                     return json(res, 400, { error: "threadId and messageId are required" });
-                const own = threadId === from.threadId || Boolean(store.taskByThread(from.id, threadId));
+                const own = (threadId === from.threadId || Boolean(store.taskByThread(from.id, threadId))) &&
+                    (!cloudLendingView(internalCapability) || cloudOwnerOnlyThread(threadId));
                 const message = own ? readMessageText(threadId, messageId) : null;
                 if (!message)
                     return json(res, 404, { error: "no such message in your conversations" });
@@ -14530,7 +15395,12 @@ const handleRequest = async (req, res) => {
                 // can check next turn. If the ledger refuses (cap/depth), fall back
                 // to the plain busy bounce rather than dropping the refusal reason.
                 const queueBusyFallback = (approvalAlreadyGranted = false) => {
-                    const queued = queueDelegation(commsBus, from, { toBotId, message, reason: "asked while busy", depth, approvalAlreadyGranted }, MAX_COMMS_DEPTH, fromThreadId);
+                    const guestThread = guestWorkThread(from, target, fromThreadId, message);
+                    if (guestThread === null)
+                        return json(res, 500, { error: "couldn't open a conversation for that work" });
+                    const queued = queueDelegation(commsBus, from, { toBotId, message, reason: "asked while busy", depth, approvalAlreadyGranted, ...(guestThread ? { targetThreadId: guestThread } : {}) }, MAX_COMMS_DEPTH, fromThreadId);
+                    if ((queued.result !== "ok" || !queued.id) && guestThread)
+                        store.deleteTask(toBotId, guestThread);
                     if (queued.result !== "ok" || !queued.id)
                         return json(res, 200, { busy: true, receipt: peerDeliveryReceipt({
                                 botId: toBotId, botName: target.name, outcome: "failed",
@@ -14558,6 +15428,10 @@ const handleRequest = async (req, res) => {
                 const tryAsideDelivery = async () => {
                     if (peerReviewRequired(from, fromThreadId))
                         return null;
+                    // A guest's request never folds into a turn running in the
+                    // owner's conversation; it waits for a confined one of its own.
+                    if (cloudGuestDriven(fromThreadId))
+                        return null;
                     // Busy elsewhere (room turn, sibling thread): the thread this ask
                     // targets is not the running one, so there is nothing to fold
                     // into here — the queue lane keeps it.
@@ -14664,7 +15538,10 @@ const handleRequest = async (req, res) => {
                     delivery: "ask_bot",
                     unattended: isUnattended(currentFrom.id, fromThreadId),
                 });
-                const targetThreadId = currentTarget.threadId;
+                const guestThread = guestWorkThread(currentFrom, currentTarget, fromThreadId, message);
+                if (guestThread === null)
+                    return json(res, 500, { error: "couldn't open a conversation for that work" });
+                const targetThreadId = guestThread ?? currentTarget.threadId;
                 const outcome = await askBotAndWait(toBotId, prefixed, depth, fromBotId, fromThreadId, targetThreadId);
                 requireActiveInternalCapability();
                 const replySender = store.bot(fromBotId);
@@ -14876,7 +15753,12 @@ const handleRequest = async (req, res) => {
                 if (!connectorThread(from.id, fromThreadId)) {
                     return json(res, 403, { error: "source thread does not belong to sender" });
                 }
-                const queued = queueDelegation(commsBus, from, { toBotId, message, reason, depth }, MAX_COMMS_DEPTH, fromThreadId);
+                const guestThread = guestWorkThread(from, target, fromThreadId, reason ?? message);
+                if (guestThread === null)
+                    return json(res, 500, { error: "couldn't open a conversation for that work" });
+                const queued = queueDelegation(commsBus, from, { toBotId, message, reason, depth, ...(guestThread ? { targetThreadId: guestThread } : {}) }, MAX_COMMS_DEPTH, fromThreadId);
+                if ((queued.result !== "ok" || !queued.id) && guestThread)
+                    store.deleteTask(toBotId, guestThread);
                 if (queued.result !== "ok" || !queued.id) {
                     // the agent reads this string — a bare enum ("too_deep") tells it
                     // nothing about what to do instead
@@ -14944,7 +15826,7 @@ const handleRequest = async (req, res) => {
                     })).filter(g => g.members.length);
                     return json(res, 200, { currentRoom: source ? { id: source.id, name: source.name, workingFolder: source.cwd || null } : null,
                         bots: reachablePeers(store.bots, internalSender).map(bot => ({ id: bot.id, name: bot.name, title: bot.title, section: bot.section, busy: bot.busy })),
-                        rooms, note: "Without group_id: use this room when in a room, otherwise your standing conversation with that teammate — every assignment you send it continues the same thread, so write as if it remembers the last one. Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
+                        rooms, note: "Without group_id: use this room when in a room, otherwise each distinct assignment starts a fresh thread for that teammate. Give a self-contained brief. Each bot uses its own environment and permissions. Files are not transferred: pass absolute paths only when accessible to the recipient, otherwise pass the content." });
                 }
                 if (method === "POST" && path === "/api/internal/coordinate-bots") {
                     const parsed = z.object({
@@ -15021,39 +15903,21 @@ const handleRequest = async (req, res) => {
                         try {
                             requireActiveInternalCapability();
                             if (!destination) {
-                                // One durable conversation per pair of bots, resolved from
-                                // the recipient's own threads — never from this turn, the
-                                // request key, or the thread the person has selected there.
-                                const resolved = store.resolvePairConversation(internalSender, target.botId, {
-                                    label: parsed.data.label,
-                                    // "Still working" exactly as close_thread reads it: a
-                                    // running turn, a queued one, or coordinated work already
-                                    // addressed at that thread.
-                                    working: threadId => threadBusy(target.botId, threadId)
-                                        || queuedThreadPosition(target.botId, threadId) !== null
-                                        || roomHandoffs.activeDirect(threadId),
-                                });
-                                if (!resolved)
+                                const task = store.createTask(target.botId, `@${internalSender.name}${parsed.data.label ? ` · ${parsed.data.label}` : " · work"}`, false, undefined, { botId: internalSender.id, name: internalSender.name, kind: "work", at: Date.now() });
+                                if (!task)
                                     throw new Error("The recipient no longer exists");
-                                target.threadId = resolved.task.threadId;
-                                if (resolved.created)
-                                    createdThread = resolved.task.threadId;
-                                // A work thread carries one assignment: it is for the person
-                                // this coordination serves. The durable pair conversation is
-                                // shared by every assignment between two bots, so it names nobody.
-                                if (resolved.created && resolved.task.openedBy?.kind === "work")
-                                    threadStarters.set(resolved.task.threadId, threadPersonKey(address.threadId));
+                                target.threadId = createdThread = task.threadId;
                                 if (delegatedFullAccess(internalSender, internalCapability.threadId, store.bot(target.botId))) {
                                     grantDelegatedFullAccess(internalSender, store.bot(target.botId), target.threadId);
                                 }
                             }
                             const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", destination ? parsed.data.requestKey : undefined);
-                            // A re-dispatched request_key is answered by the request it
-                            // already made, so a thread resolved for the retry (the pair
-                            // conversation was busy with that very request) goes back
-                            // before anyone sees a row that leads nowhere.
-                            if (duplicate && createdThread && createdThread !== node.threadId)
+                            // A retry keeps its original task; discard the speculative row.
+                            if (duplicate && createdThread && createdThread !== node.threadId) {
                                 store.deleteTask(target.botId, createdThread);
+                            }
+                            if (!duplicate && createdThread)
+                                threadStarters.set(createdThread, openerFrom(address.threadId));
                             createdThread = undefined; // The durable coordinator now owns this task.
                             accepted.push({ requestId: node.id, botId: node.botId, duplicate, status: node.status });
                             // A duplicate request_key lands on the node enqueue already
@@ -15093,8 +15957,9 @@ const handleRequest = async (req, res) => {
                             }
                         }
                         catch (error) {
-                            if (createdThread)
+                            if (createdThread) {
                                 store.deleteTask(target.botId, createdThread);
+                            }
                             const said = error instanceof Error ? error.message : String(error);
                             errors.push({ botId: target.botId, error: said });
                             receipts.push(peerDeliveryReceipt({
@@ -15337,10 +16202,11 @@ const handleRequest = async (req, res) => {
                 }
                 const sourceTitle = owner.group ? owner.group.name : (store.taskByThread(from.id, fromThreadId)?.title ?? "");
                 if (target.id === from.id) {
-                    const task = store.createTask(from.id, title, false, projectId, { botId: from.id, name: from.name, at: Date.now() });
+                    const inherited = parentThreadModel(from.id, fromThreadId);
+                    const task = store.createTask(from.id, title, false, projectId, { botId: from.id, name: from.name, at: Date.now() }, inherited.approvalMode, inherited.modelSelection);
                     if (!task)
                         return json(res, 500, { error: "couldn't create that thread" });
-                    threadStarters.set(task.threadId, threadPersonKey(fromThreadId));
+                    threadStarters.set(task.threadId, openerFrom(fromThreadId));
                     internalCapability.openedThreads += 1;
                     const chip = {
                         role: "bot",
@@ -15383,7 +16249,7 @@ const handleRequest = async (req, res) => {
                 if (!task)
                     return json(res, 500, { error: "couldn't create that thread" });
                 // The work is still for the person whose request the opener is on.
-                threadStarters.set(task.threadId, threadPersonKey(fromThreadId));
+                threadStarters.set(task.threadId, openerFrom(fromThreadId));
                 if (delegatedFullAccess(from, fromThreadId, target))
                     grantDelegatedFullAccess(from, target, task.threadId);
                 const queued = queueDelegation(commsBus, from, { toBotId: target.id, message, depth, targetThreadId: task.threadId }, MAX_COMMS_DEPTH, fromThreadId);
@@ -15932,16 +16798,25 @@ const handleRequest = async (req, res) => {
                     .filter((run) => routineVisible(run, visible)),
             });
         }
+        // On a Cloud home a routine reports only where its writer may write: a
+        // guest's into a conversation the guest started, never the owner's.
+        const routineResultsRefusal = (body) => body && typeof body === "object" && typeof body.resultsThreadId === "string"
+            ? cloudThreadRefusal(auth, body.resultsThreadId) : null;
         if (path === "/api/routines" && method === "POST") {
             const body = await readBody(req);
             const hidden = hiddenRoutineTarget(body, visible);
             if (hidden)
                 return json(res, 404, { error: hidden });
-            const routine = routines.create(body);
+            const notYours = routineResultsRefusal(body);
+            if (notYours)
+                return json(res, 403, { error: notYours });
+            const writer = auth.kind === "session" ? actorKey(auth) : CLOUD_NOBODY_KEY;
+            const routine = withRoutineWriter(writer, () => routines.create(body));
             // On a Cloud home, a routine the owner writes from their own device may
             // use their lent Mac when it runs (server/cloud-lending.ts).
             if (cloudRoutineAuthors && cloudOwnerSession(auth))
                 cloudRoutineAuthors.record(routine.id, routine);
+            cloudRoutineAuthors?.wrote(routine.id, writer);
             return json(res, 201, { routine });
         }
         // The desktop shell polls this to decide whether to hold the computer
@@ -15962,9 +16837,27 @@ const handleRequest = async (req, res) => {
             const hidden = hiddenRoutineTarget(body, visible);
             if (hidden)
                 return json(res, 404, { error: hidden });
+            const notYours = routineResultsRefusal(body);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             const before = cloudRoutineAuthors ? routines.listRoutines().find((candidate) => candidate.id === routineMatch[1]) : undefined;
             const wasOwners = Boolean(before && cloudRoutineAuthors?.authored(before.id, before));
-            const routine = routines.update(routineMatch[1], body);
+            const previous = cloudRoutineAuthors?.writer(routineMatch[1]);
+            // Who this edit leaves as the routine's writer: the owner when the
+            // routine stays (or becomes) theirs (their fingerprint, or already
+            // theirs as its writer: a template, a restore), a guest when a guest
+            // edits it, else whoever wrote it before.
+            // An owner writer is proof only for a routine that never had the
+            // owner's fingerprint (a template, a restore, one the settlement named):
+            // a fingerprint that no longer matches means someone else changed what
+            // it runs, and only the owner rewriting its instructions renews it.
+            const ownerWriterOnly = CLOUD_OWNER_KEY !== null && previous === CLOUD_OWNER_KEY && !cloudRoutineAuthors?.recorded(routineMatch[1]);
+            const ownerAuthors = cloudOwnerSession(auth) && (wasOwners || ownerWriterOnly ||
+                (body && typeof body === "object" && "prompt" in body));
+            const writer = ownerAuthors && CLOUD_OWNER_KEY ? CLOUD_OWNER_KEY
+                : auth.kind === "session" && !cloudOwnerSession(auth) ? actorKey(auth)
+                    : previous && !cloudOwnerPerson(previous) ? previous : CLOUD_NOBODY_KEY;
+            const routine = withRoutineWriter(writer, () => routines.update(routineMatch[1], body));
             // The owner's own edit keeps (or, when it rewrites the instructions,
             // makes) the routine theirs. Anyone else's edit, of any field (its
             // schedule, where its results go, whether it is on), makes it no longer
@@ -15972,15 +16865,16 @@ const handleRequest = async (req, res) => {
             if (routine && cloudRoutineAuthors) {
                 if (!cloudOwnerSession(auth))
                     cloudRoutineAuthors.forget(routine.id);
-                else if (wasOwners || (body && typeof body === "object" && "prompt" in body))
+                else if (ownerAuthors)
                     cloudRoutineAuthors.record(routine.id, routine);
+                cloudRoutineAuthors.wrote(routine.id, writer);
             }
             return routine ? json(res, 200, { routine }) : json(res, 404, { error: "no such routine" });
         }
         if (routineMatch && method === "DELETE") {
             const removed = routines.remove(routineMatch[1]);
             if (removed)
-                cloudRoutineAuthors?.forget(routineMatch[1]);
+                cloudRoutineAuthors?.remove(routineMatch[1]);
             return removed
                 ? json(res, 200, { ok: true })
                 : json(res, 404, { error: "no such routine" });
@@ -16742,6 +17636,9 @@ const handleRequest = async (req, res) => {
             if (hiddenMember)
                 return json(res, 400, { error: `unknown channel member: ${String(hiddenMember)}` });
             const group = createChannel(body);
+            // On a Cloud home whoever opens a room names it (cloudThreadRefusal).
+            if (CLOUD_HOME && auth.kind === "session")
+                threadStarters.set(group.threadId, actorKey(auth));
             return json(res, 201, { group: { ...publicGroupState(group), messages: [] } });
         }
         if (method === "POST" && path === "/api/teams/export") {
@@ -17209,7 +18106,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 500, { error: "couldn't create that task" });
             // Who opened it decides who may answer its cards on a shared workspace.
             if (auth.kind === "session")
-                threadStarters.set(task.threadId, personKey(auth.session));
+                threadStarters.set(task.threadId, actorKey(auth));
             const fresh = groupWithThread(store.group(group.id));
             broadcast({ kind: "group", group: fresh });
             return json(res, 201, { group: fresh, task });
@@ -17286,6 +18183,9 @@ const handleRequest = async (req, res) => {
             // without the old handler turning a missing title into "Untitled".
             // That echo is not a rename. A real rename stays blocked while working.
             const titleChange = renaming && body.title !== existing.title;
+            const notYours = titleChange ? cloudThreadRefusal(auth, m[2]) : null;
+            if (notYours)
+                return json(res, 403, { error: notYours });
             if (channelTaskBlocked(group) && !(pinning && !titleChange)) {
                 return json(res, 409, { error: "this channel is working or waiting on you — finish that turn first" });
             }
@@ -17318,6 +18218,9 @@ const handleRequest = async (req, res) => {
             }
             if (!store.groupTaskByThread(group.id, m[2]))
                 return json(res, 404, { error: "no such channel task" });
+            const notYours = cloudThreadRefusal(auth, m[2]);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             const stagedSkillCleanups = stagedSkillCleanupsForThread(m[2]);
             lastReply.delete(m[2]);
             cancelTeamSetupResumesForThread(m[2]);
@@ -17339,6 +18242,14 @@ const handleRequest = async (req, res) => {
                 if (field)
                     return json(res, 403, { error: `forbidden: this session may rename or mark a room, not change "${field}" (needs the admin scope)` });
             }
+            // On a Cloud home a room's name and bulletin are its opener's (or the owner's).
+            const renamed = store.group(m[1]);
+            if (renamed && body && typeof body === "object" &&
+                ((body.name !== undefined && body.name !== renamed.name) || (body.bulletin !== undefined && body.bulletin !== (renamed.bulletin ?? "")))) {
+                const notYours = cloudThreadRefusal(auth, renamed.threadId);
+                if (notYours)
+                    return json(res, 403, { error: notYours });
+            }
             const group = updateChannel(m[1], body);
             return json(res, 200, { group: publicGroupState(group) });
         }
@@ -17963,9 +18874,14 @@ const handleRequest = async (req, res) => {
                             throw Object.assign(new Error(enabled.error), { status: 422 });
                     }
                 }
+                // On a Cloud home only the owner's devices create bots: its routines
+                // (and the conversations they report into) are theirs.
+                const ownersRoutines = CLOUD_OWNER_KEY && auth.kind === "session" && cloudOwnerSession(auth) ? CLOUD_OWNER_KEY : null;
                 for (const routine of template.routines) {
                     const created = routines.create({ ...routine, botId: bot.id, enabled: false });
                     createdRoutines.push({ id: created.id, enabled: routine.enabled !== false });
+                    if (ownersRoutines)
+                        cloudRoutineAuthors?.wrote(created.id, ownersRoutines);
                 }
             }
             catch (error) {
@@ -18051,6 +18967,17 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: "avatarUrl must reference an existing stored image" });
             }
             const existingBot = store.bot(m[1]);
+            // On a Cloud home a bot's name, title, description and standing
+            // instructions ride every one of the owner's turns (and a lent Mac):
+            // only the owner's own devices change them. Anyone else keeps the
+            // picture and the voice. Resending an unchanged value is not a change.
+            if (CLOUD_HOME && existingBot && !cloudOwnerSession(auth)) {
+                const changed = CLOUD_OWNER_PROFILE_FIELDS.find((field) => parsed.patch[field] !== undefined && (field === "notifications"
+                    ? (parsed.patch.notifications !== false) !== (existingBot.notifications !== false)
+                    : parsed.patch[field] !== (existingBot[field] ?? "")));
+                if (changed)
+                    return json(res, 403, { error: "On this Cloud only its owner can change a bot's name, title, description, instructions or notifications." });
+            }
             const beforeProfile = existingBot ? profileSnapshot(existingBot) : undefined;
             const bot = store.patchBotProfile(m[1], parsed.patch);
             if (!bot)
@@ -18304,6 +19231,15 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "voiceNotes must be true or false" });
                 patch.voiceNotes = body.voiceNotes;
             }
+            if (body.memoryEnabled !== undefined) {
+                if (typeof body.memoryEnabled !== "boolean")
+                    return json(res, 400, { error: "memoryEnabled must be true or false" });
+                if (existingBot && (existingBot.busy || activeGroupTurnForBot(existingBot.id)) &&
+                    body.memoryEnabled !== (existingBot.memoryEnabled !== false)) {
+                    return json(res, 409, { error: "stop this bot's turn before changing its memory setting" });
+                }
+                patch.memoryEnabled = body.memoryEnabled;
+            }
             // which of those apps' tools this bot may call (connector grants 1/5:
             // data model only — enforcement lands with slice 2). null returns the
             // bot to boolean-only legacy behavior; {} means no tools.
@@ -18640,6 +19576,13 @@ const handleRequest = async (req, res) => {
                 sectionKey(existingBot?.section) !== sectionKey(section);
             let bot;
             const freshBrowserBot = store.bot(m[1]);
+            // Connector validation and runtime revocation can yield after the first
+            // memory check. Keep the same idle-only transition at the final commit.
+            if (freshBrowserBot && body.memoryEnabled !== undefined &&
+                body.memoryEnabled !== (freshBrowserBot.memoryEnabled !== false) &&
+                (freshBrowserBot.busy || activeGroupTurnForBot(freshBrowserBot.id))) {
+                return json(res, 409, { error: "stop this bot's turn before changing its memory setting" });
+            }
             // Custom servers are process configuration: a running turn cannot
             // unmount them. Recheck after any awaited runtime revocation above.
             if (body.mcpServers !== undefined) {
@@ -18695,7 +19638,7 @@ const handleRequest = async (req, res) => {
             }
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
-            if (body.memoryUpkeep === false)
+            if (body.memoryUpkeep === false || body.memoryEnabled === false)
                 memoryUpkeep.dropBot(bot.id);
             // A defined Works on is the newest explicit choice: this bot's
             // auto-recorded pins that now point elsewhere give way immediately, so
@@ -19165,6 +20108,9 @@ const handleRequest = async (req, res) => {
             // receipt after a task switch, while a genuinely new send still has to
             // target the task that is active now.
             const threadId = body.threadId ?? bot.threadId;
+            const notYours = cloudGuestSendRefusal(auth, threadId);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             // Who this message is from, for the ledger. It is captured here and
             // travels with the message: into the turn it starts, or into the queue
             // until it drains. A message steered into someone else's running turn
@@ -19425,6 +20371,9 @@ const handleRequest = async (req, res) => {
             const body = await readBody(req);
             requirePinnedClientThread(m[1], body?.threadId);
             const bot = requestedTaskBot(m[1], body?.threadId);
+            const notYours = cloudThreadRefusal(auth, bot.threadId);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             await startTurn(bot.id, "Summarize conversation context", {
                 threadId: bot.threadId, compactOnly: true, cardContinuation: true, trigger: usageTriggerFor(auth),
             });
@@ -19440,6 +20389,9 @@ const handleRequest = async (req, res) => {
             const body = await readBody(req);
             requirePinnedClientThread(m[1], body?.threadId);
             const bot = requestedTaskBot(m[1], body.threadId);
+            const notYours = cloudThreadRefusal(auth, bot.threadId);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             const text = String(body.text ?? "").trim();
             if (!text)
                 return json(res, 400, { error: "text required" });
@@ -19492,6 +20444,9 @@ const handleRequest = async (req, res) => {
             const body = await readBody(req);
             requirePinnedClientThread(m[1], body?.threadId);
             const bot = requestedTaskBot(m[1], body.threadId);
+            const notYours = cloudThreadRefusal(auth, bot.threadId);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             if (threadBusy(bot.id, bot.threadId))
                 return json(res, 409, { error: "the thread is working — stop it before switching versions" });
             if (phoneSecretSubmissions.hasThread(bot.threadId)) {
@@ -19532,7 +20487,7 @@ const handleRequest = async (req, res) => {
                     threadId: bot.threadId,
                     requestId: String(body.requestId),
                     behavior,
-                }))
+                }, auth.kind === "session" && cloudOwnerSession(auth)))
                     return;
                 if (resolveAndSendProfile(res, {
                     botId: bot.id,
@@ -19630,7 +20585,7 @@ const handleRequest = async (req, res) => {
                         threadId,
                         requestId,
                         behavior,
-                    }))
+                    }, auth.kind === "session" && cloudOwnerSession(auth)))
                         return;
                 }
                 const setupCard = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId && message.card.teamSetupRequest);
@@ -19869,7 +20824,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 500, { error: "couldn't create that task" });
             // Who opened it decides who may answer its cards on a shared workspace.
             if (auth.kind === "session")
-                threadStarters.set(task.threadId, personKey(auth.session));
+                threadStarters.set(task.threadId, actorKey(auth));
             const fresh = botWithThread(store.bot(bot.id));
             broadcast({ kind: "bot", bot: fresh });
             return json(res, 201, { bot: fresh, task: wireTask(task) });
@@ -19915,6 +20870,16 @@ const handleRequest = async (req, res) => {
             const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "pinned", "snoozedUntil", "surface"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported thread setting" });
+            const notYours = cloudThreadRefusal(auth, m[2]);
+            if (notYours)
+                return json(res, 403, { error: notYours });
+            // On a Cloud home only the owner decides whether a bot may act without
+            // asking them, even in a conversation someone else started, and what
+            // the bot itself defaults to.
+            if (CLOUD_HOME && !cloudOwnerSession(auth) &&
+                (body.approvalMode !== undefined || body.autoApprove !== undefined || body.acknowledgeLocalAuto !== undefined || body.updateBotDefault === true)) {
+                return json(res, 403, { error: "On this Cloud only its owner can change how a bot asks for approval, or its default model." });
+            }
             for (const key of ["requireAvailableModel", "acknowledgeLocalAuto", "updateBotDefault", "resetApprovalToAsk"]) {
                 if (body[key] !== undefined && typeof body[key] !== "boolean")
                     return json(res, 400, { error: `${key} must be a boolean` });
@@ -20040,6 +21005,9 @@ const handleRequest = async (req, res) => {
             if (!bot || !store.taskByThread(bot.id, m[2])) {
                 return json(res, 404, { error: "no such task" });
             }
+            const notYours = cloudThreadRefusal(auth, m[2]);
+            if (notYours)
+                return json(res, 403, { error: notYours });
             if (phoneSecretSubmissions.hasThread(m[2])) {
                 return json(res, 409, { error: "this task is securely saving a credential — try again when it finishes" });
             }
@@ -20060,6 +21028,55 @@ const handleRequest = async (req, res) => {
             broadcast({ kind: "bot", bot: fresh });
             return json(res, 200, { bot: fresh });
         }
+        // Regenerate title (#1858): name the thread again from its conversation
+        // as it is now. The person asked, so the result replaces any title, but
+        // only the one this started from: a rename that lands while the one-shot
+        // runs wins, and the late result is dropped.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/tasks\/([\w-]+)\/title$/);
+        if (m && method === "POST") {
+            const current = store.projectBotForTask(m[1], m[2]);
+            if (!current)
+                return json(res, 404, { error: "no such task" });
+            const notYours = cloudThreadRefusal(auth, m[2]);
+            if (notYours)
+                return json(res, 403, { error: notYours });
+            if (!llmThreadTitlesEnabled(cfg))
+                return json(res, 409, { error: "generated thread titles are turned off on this server" });
+            if (hostedModels && !hostedModels.allows(current.modelSelection))
+                return json(res, 409, { error: hostedModels.error() });
+            const instance = registry.get(current.modelSelection.instanceId);
+            if (!instance?.generateText)
+                return json(res, 409, { error: "this bot's model can't generate a title — rename the thread instead" });
+            // An engine the organisation disallows never receives the text, even for a title.
+            const refusal = policyModelRefusal(instance);
+            if (refusal)
+                return json(res, 409, { error: refusal });
+            if (titleRegenerations.has(m[2]))
+                return json(res, 409, { error: "a new title is already being generated for this thread" });
+            const excerpt = titleConversationExcerpt(store.messagesTail(m[2], 200).messages);
+            if (!excerpt)
+                return json(res, 409, { error: "this thread has no messages to take a title from yet" });
+            try {
+                assertWithinBudget(cfg, DATA_DIR);
+            }
+            catch (error) {
+                return json(res, 409, { error: error instanceof Error ? error.message : String(error) });
+            }
+            const startedFrom = store.taskByThread(m[1], m[2]).title;
+            titleRegenerations.add(m[2]);
+            try {
+                const title = await generateThreadTitle(instance, excerpt, "conversation");
+                if (!title)
+                    return json(res, 502, { error: "couldn't generate a title — try again, or rename the thread" });
+                const task = store.retitleTask(m[1], m[2], startedFrom, title) ?? store.taskByThread(m[1], m[2]);
+                if (!task)
+                    return json(res, 404, { error: "no such task" });
+                return json(res, 200, { task: wireTask(task) });
+            }
+            finally {
+                titleRegenerations.delete(m[2]);
+            }
+        }
         // Named team Boats use real independent ownership, never a hidden bot or
         // an arbitrary provider id. These new routes remain admin-only by default.
         if (path === "/api/team-computers" && method === "GET") {
@@ -20253,7 +21270,7 @@ const handleRequest = async (req, res) => {
         // what the user's machine can host: which runtime is installed, whether
         // its daemon is up, and whether the desktop image and container exist
         if (method === "GET" && path === "/api/local-computer") {
-            return json(res, 200, await localVmPayload(SHARED_LOCAL_VM_TARGET));
+            return json(res, 200, await localVmPayload(SHARED_LOCAL_VM_TARGET, auth));
         }
         if (method === "GET" && path === "/api/local-computer/instances") {
             res.setHeader("cache-control", "private, no-store");
@@ -20299,9 +21316,9 @@ const handleRequest = async (req, res) => {
                 if (action === "stop" || action === "remove")
                     localVmIdleFor(SHARED_LOCAL_VM_TARGET).cancel();
                 return json(res, 200, {
-                    ...status,
+                    ...localVmViewerStatus(status, auth),
                     commands: setupCommands(status.runtime, process.platform, SHARED_LOCAL_VM_TARGET),
-                    idle_timeout_ms: LOCAL_VM_IDLE_MS,
+                    idle_timeout_ms: localVmIdleMs(),
                     mode: localVmMode(cfg),
                     max_instances: localVmMaxInstances(cfg),
                 });
@@ -20325,7 +21342,7 @@ const handleRequest = async (req, res) => {
             const bot = computerPreviewBot(m[1], url);
             if (!bot)
                 return json(res, 404, { error: "no such bot" });
-            return json(res, 200, await localVmPayload(localVmTargetForStatus(bot.id, bot.threadId)));
+            return json(res, 200, await localVmPayload(localVmTargetForStatus(bot.id, bot.threadId), auth));
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/local-computer\/(run|stop|remove)$/);
         if (m && method === "POST") {
@@ -20382,9 +21399,9 @@ const handleRequest = async (req, res) => {
                 if (action === "stop" || action === "remove")
                     localVmIdleFor(target).cancel();
                 return json(res, 200, {
-                    ...status,
+                    ...localVmViewerStatus(status, auth),
                     commands: setupCommands(status.runtime, process.platform, target),
-                    idle_timeout_ms: LOCAL_VM_IDLE_MS,
+                    idle_timeout_ms: localVmIdleMs(),
                     mode: localVmMode(cfg),
                     max_instances: localVmMaxInstances(cfg),
                 });
@@ -20549,7 +21566,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: `provider must be one of ${PROVIDER_KEY_KINDS.join(", ")}` });
             }
             const kind = provider;
-            const saved = kind === "anthropic" ? cfg.anthropic : kind === "openaiCompat" ? cfg.openaiCompat : kind === "mistral" ? cfg.mistral : cfg.xai;
+            const saved = { anthropic: cfg.anthropic, openai: cfg.openai, openrouter: cfg.openrouter, openaiCompat: cfg.openaiCompat, mistral: cfg.mistral, xai: cfg.xai }[kind];
             if (body?.key !== undefined && typeof body.key !== "string") {
                 return json(res, 400, { error: "key must be a string" });
             }
@@ -20666,6 +21683,30 @@ const handleRequest = async (req, res) => {
                 providerConfigBusy = false;
             }
         }
+        if (method === "POST" && path === "/api/instances/chatgpt-accounts") {
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json"))
+                return json(res, 415, { error: "content-type must be application/json" });
+            const parsed = createClaudeAccountSchema.pick({ displayName: true }).safeParse(await readBody(req, 8192));
+            if (!parsed.success)
+                return json(res, 400, { error: "Enter an account name (up to 80 characters)." });
+            if (providerConfigBusy)
+                return json(res, 409, { error: "provider settings are already being updated" });
+            providerConfigBusy = true;
+            try {
+                const instances = persistableInstanceConfigs(cfg);
+                const instanceId = `chatgpt-${randomUUID()}`;
+                // Reuse the selected executable, never another account's environment.
+                const cli = instances.chatgpt?.config?.cli
+                    ?? instances.codex?.config?.cli;
+                instances[instanceId] = { driver: "codex", displayName: parsed.data.displayName,
+                    config: { authMode: "chatgpt-plan", ...(typeof cli === "string" && cli ? { cli } : {}) } };
+                await persistProviderInstance(instanceId, instances);
+                return json(res, 201, { instanceId, instances: await describeInstances() });
+            }
+            finally {
+                providerConfigBusy = false;
+            }
+        }
         if (method === "POST" && path === "/api/instances/claude-accounts") {
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
@@ -20716,6 +21757,11 @@ const handleRequest = async (req, res) => {
                     const instance = registry.get(instanceId);
                     if (!instance)
                         return json(res, 404, { error: "unknown instance" });
+                    // The official local OAuth callback terminates on this machine,
+                    // not a phone or the browser visiting a remotely hosted workspace.
+                    if (instance.authenticationMethod === "browser-pkce" && (isProxied(req) || !isLoopbackHost(req.socket.remoteAddress))) {
+                        return json(res, 403, { error: "Continue with ChatGPT on the computer running OpenMausBot. Hosted Pro sign-in requires OpenAI's hosted-app approval." });
+                    }
                     const started = await providerAuthSessions.start(instance, owner);
                     // Revocation can arrive while the CLI is obtaining a device code.
                     if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
@@ -20939,13 +21985,78 @@ const handleRequest = async (req, res) => {
             res.once("close", disconnect);
             mcpProbesInFlight += 1;
             try {
-                return json(res, 200, await probeMcpServer(parsed.server, undefined, controller.signal));
+                const name = mcpTest[1];
+                let target = parsed.server;
+                if (isRemoteMcpServer(target) && mcpOAuth.authState(name, target.url) === "signed-in") {
+                    const signedIn = (await withMcpSignIn({ [name]: target }, mcpOAuth))[name];
+                    if (signedIn)
+                        target = { ...signedIn, enabled: target.enabled };
+                }
+                const result = await probeMcpServer(target, undefined, controller.signal);
+                if (!result.ok && result.auth === "required" && isRemoteMcpServer(target))
+                    mcpOAuth.markNeedsSignIn(name, target.url);
+                return json(res, 200, result);
             }
             finally {
                 res.off("close", disconnect);
                 mcpProbesInFlight -= 1;
             }
         }
+        // The loopback listener and authenticated paste-back complete the same flow.
+        const mcpSignIn = /^\/api\/mcp\/servers\/([a-z][a-z0-9_-]{0,31})\/(sign-in|sign-out)(?:\/([0-9a-f-]{36}))?$/.exec(path);
+        if (mcpSignIn) {
+            const [, name, action, flowId] = mcpSignIn;
+            const raw = cfg.mcpServers?.[name];
+            const parsed = raw === undefined ? null : parseStoredMcpServer(name, raw);
+            if (!parsed?.ok)
+                return json(res, 404, { error: "MCP server not found." });
+            if (!isRemoteMcpServer(parsed.server))
+                return json(res, 400, { error: "Only servers reached by URL can be signed in to." });
+            const url = parsed.server.url;
+            if (action === "sign-out" && method === "POST" && !flowId) {
+                await mcpOAuth.signOut(name, url);
+                return json(res, 200, mcpServerResponse());
+            }
+            const owner = auth.kind === "session" ? auth.session.id : "loopback";
+            res.setHeader("Cache-Control", "no-store");
+            try {
+                if (action === "sign-in" && method === "GET" && flowId) {
+                    const status = mcpOAuth.status(name, flowId, owner);
+                    return status ? json(res, 200, { auth: status }) : json(res, 404, { error: "This sign-in is no longer available in this browser. Start again." });
+                }
+                if (action === "sign-in" && method === "DELETE") {
+                    mcpOAuth.cancelFlow(name, owner, flowId);
+                    return json(res, 200, { ok: true });
+                }
+                if (action === "sign-in" && method === "POST" && flowId) {
+                    if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                        return json(res, 415, { error: "content-type must be application/json" });
+                    }
+                    const body = await readBody(req, 20_480);
+                    if (typeof body?.callbackUrl !== "string")
+                        return json(res, 400, { error: "A complete callbackUrl is required." });
+                    return json(res, 200, { auth: await mcpOAuth.completeCallback(name, flowId, body.callbackUrl, owner) });
+                }
+                if (action === "sign-in" && method === "POST" && !flowId) {
+                    const started = await mcpOAuth.start(name, url, undefined, owner);
+                    if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                        mcpOAuth.revokeOwner(owner);
+                        return json(res, 401, { error: "Your session ended. Start a new sign-in." });
+                    }
+                    return json(res, 200, { auth: started });
+                }
+            }
+            catch (error) {
+                if (error instanceof McpSignInError)
+                    return json(res, error.status, { error: error.message });
+                if (error instanceof McpOAuthError)
+                    return json(res, 400, { error: error.message, code: error.code });
+                if (method === "POST" && !flowId)
+                    return json(res, 502, { error: error instanceof Error ? error.message : "Sign-in could not start." });
+                throw error;
+            }
+            return json(res, 405, { error: "method not allowed" });
+        }
         if (method === "POST" && path === "/api/mcp/servers") {
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
@@ -21031,6 +22142,7 @@ const handleRequest = async (req, res) => {
                     const next = { ...current };
                     delete next[name];
                     persistMcpServers(next);
+                    mcpOAuth.forget(name);
                     return json(res, 200, mcpServerResponse());
                 }
                 const existing = parseStoredMcpServer(name, current[name]);
@@ -21052,6 +22164,17 @@ const handleRequest = async (req, res) => {
                 if (refusal)
                     return json(res, 403, { error: refusal, code: "managed_policy" });
                 persistMcpServers({ ...current, [name]: parsed.server });
+                // a sign-in belongs to one address; a token never follows the entry elsewhere
+                const before = isRemoteMcpServer(existing.server) ? existing.server.url : null;
+                const after = isRemoteMcpServer(parsed.server) ? parsed.server.url : null;
+                // ...and to one sign-in app with its scopes; a new secret for the same app keeps it
+                const app = (server) => isRemoteMcpServer(server) && server.oauth
+                    ? JSON.stringify([server.oauth.clientId, server.oauth.scopes ?? []]) : null;
+                // Any other edit (a new header, say) drops a sign-in request that has
+                // no tokens behind it; the next Test asks again if it still applies.
+                if (before !== after || app(existing.server) !== app(parsed.server)
+                    || (after && mcpOAuth.authState(name, after) === "needs-sign-in"))
+                    mcpOAuth.forget(name);
                 return json(res, 200, mcpServerResponse());
             }
             finally {
@@ -21064,9 +22187,13 @@ const handleRequest = async (req, res) => {
         }
         if ((method === "PUT" || method === "PATCH") && path === "/api/config") {
             const body = await readBody(req);
-            if (hostedModels && ["instances", "anthropic", "openaiCompat", "xai", "mistral", "opencodeGo"].some(key => Object.hasOwn(body, key)))
+            if (hostedModels && ["instances", "anthropic", "openai", "openrouter", "openaiCompat", "xai", "mistral", "opencodeGo"].some(key => Object.hasOwn(body, key)))
                 return json(res, 403, { error: HOSTED_PROVIDER_SETTINGS_ERROR });
             const patch = parseConfigPatch(body);
+            // A Cloud home is personal: nobody is invited to sign in to it.
+            if (CLOUD_HOME && (patch.signIn?.admins?.length || patch.signIn?.members?.length)) {
+                return json(res, 403, { error: CLOUD_PERSONAL_REFUSAL, code: "cloud_personal" });
+            }
             if (patch.newBotDefaults) {
                 if (patch.newBotDefaults.profile.modelSelection) {
                     const checked = checkedModelSelection(patch.newBotDefaults.profile.modelSelection);
@@ -21506,9 +22633,17 @@ const handleRequest = async (req, res) => {
                     }
                     throw error;
                 }
+                // Desktops already counting down move to the new window at once, in
+                // every isolation mode; busy work still defers its expiry.
+                if (patch.localVm?.idleTimeoutMinutes !== undefined) {
+                    for (const idle of localVmIdles.values())
+                        idle.setIdleMs(localVmIdleMs());
+                }
                 let browserReferenceCleanupError = null;
-                if (patch.signIn !== undefined)
+                if (patch.signIn !== undefined) {
                     sessions.revalidateEmailSessions();
+                    resyncOpenCodeProviderKeys();
+                }
                 if (!lendingEnabled()) {
                     sharedComputers.close();
                     sharedComputerControl.close();
@@ -21969,6 +23104,10 @@ const handleRequest = async (req, res) => {
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
             }
+            if (m[2] === "join" && bot.cloudBackend === "vps") {
+                for (let pending; (pending = vpsJoinRequests.get(botId));)
+                    await pending;
+            }
             const remoteProvider = bot.cloudBackend === "vps" ? "vps" : "box";
             if (computerProviderConfigTransitions.has(remoteProvider)) {
                 return json(res, 409, { error: providerTransitionMessage(remoteProvider) });
@@ -22016,6 +23155,10 @@ const handleRequest = async (req, res) => {
                 // Opening the existing SSH viewer can coexist with a capture. Start,
                 // stop, remove and Settings deletion still exclude pending previews.
                 const releaseComputerLifecycle = claimBotComputerLifecycle(botId, m[2] === "join");
+                // Settles only after the lane is released, so a waiter can claim it.
+                let joinSettled;
+                if (m[2] === "join")
+                    vpsJoinRequests.set(botId, new Promise(resolve => { joinSettled = resolve; }));
                 try {
                     if (m[2] === "exec") {
                         return json(res, 409, { error: "the VPS console is available to the bot through its scoped computer tools" });
@@ -22027,13 +23170,20 @@ const handleRequest = async (req, res) => {
                         return json(res, 409, { error: "the VPS computer is being used by this bot — interrupt the turn first" });
                     }
                     if (m[2] === "join") {
-                        return json(res, 200, await vps.vpsComputerJoin(cfg, botId));
+                        const remote = auth.kind !== "loopback";
+                        const result = await vps.vpsComputerJoin(cfg, botId, undefined, remote);
+                        return json(res, 200, { ...result, joinUrl: remote
+                                ? desktopViewerUrl(`vps/${botId}`, bot.threadId) : result.joinUrl });
                     }
                     const action = m[2] === "provision" ? "provision" : m[2] === "remove" ? "remove" : "stop";
                     return json(res, 200, await vps.vpsComputerAction(action, cfg, botId));
                 }
                 finally {
                     releaseComputerLifecycle();
+                    if (joinSettled) {
+                        vpsJoinRequests.delete(botId);
+                        joinSettled();
+                    }
                 }
             }
             const activeBoatTurn = botHasActiveTurn(botId);
@@ -22098,6 +23248,7 @@ const handleRequest = async (req, res) => {
     }
 };
 const server = createServer(handleRequest);
+desktopViewer.attach(server, handleRequest);
 calendarCalls.start();
 // Resolve the edition before accepting requests so /api/edition is never a guess.
 console.log(describeEdition(await loadEnterpriseLayer()));
@@ -22278,6 +23429,7 @@ if (TUNNEL_SOCKET) {
     if (process.platform !== "win32")
         rmSync(TUNNEL_SOCKET, { force: true });
     tunnelListener = createServer(handleRequest);
+    desktopViewer.attach(tunnelListener, handleRequest);
     tunnelListener.listen(TUNNEL_SOCKET, () => {
         console.log(`openmausbot tunnel listener on ${TUNNEL_SOCKET}`);
     });
@@ -22296,6 +23448,7 @@ const gracefulShutdown = createGracefulShutdown({
             sharedComputers.close();
             sharedComputerControl.close();
             browserLive.closeAll();
+            desktopViewer.closeAll();
             for (const idle of localVmIdles.values())
                 idle.cancel();
             vps.closeAllVpsDesktopTunnels();
@@ -22332,6 +23485,7 @@ const gracefulShutdown = createGracefulShutdown({
             code = 1;
         }
         closeMessageDb();
+        mcpOAuth.dispose();
         releaseDataDirLeaseAtExit();
         // A Cloud home's launcher starts the server again on this code only.
         process.exit(cloudHomeRestartRequested && code === 0 ? CLOUD_HOME_RESTART_EXIT_CODE : code);