openmausbot 0.1.92 → 0.1.94

package/dist-server/server/index.js

@@ -30,8 +30,9 @@ import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
 import { approvalModeFor, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { createApprovalModeSupport } from "./harness-capabilities.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
+import { threadRefUrl } from "../src/lib/thread-refs.js";
 import { CREDENTIAL_TARGETS, credentialResumeOutcome, credentialIsConfigured, isPendingCredentialRequest, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
+import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegatedApprovalMode } from "./auto-approve.js";
 import { CommandAllowlistStore, commandAllowlistCandidate } from "./command-allowlist.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
@@ -52,8 +53,11 @@ import { RoomTurnDeadline, RoomTurnStallRegistry, roomTurnTimeoutMessage } from
 import * as boat from "./boat.js";
 import { TeamComputers, teamComputerAssignment, teamComputerCreate, teamComputerOwner } from "./team-computers.js";
 import { isEffortLevel } from "../shared/wire.js";
+import { isPersistentQuestionCard, QUESTION_DISMISS_MESSAGE, shouldSettleRequestCard } from "../shared/ask-question.js";
+import { parseToolScope, toolScopeWidens } from "../shared/tool-scope.js";
 import { boatCreateRecoverySnapshot, retireDeletedBoatCreate } from "./boat-create-idempotency.js";
 import { boatDeletionSnapshot } from "./boat-delete-journal.js";
+import { liveDecisionRefusal } from "../shared/live-approval.js";
 import { boatAccountResourceChangeError, cloudBackendChangeError, vpsAliasResourceChangeError, } from "./cloud-backend.js";
 import * as composio from "./composio.js";
 import { connectorCallFromFrame, connectorRefusalText, connectorUnrecognizedText, evaluateConnectorTools } from "./connector-verdict.js";
@@ -63,14 +67,15 @@ import { createMemoryUpkeep, upkeepEnabled } from "./memory-upkeep.js";
 import { appendAboutMe, commitLearned, planLearned } from "./profile-learned.js";
 import { canAccessTeam, canReachPeer, coordinatorSupervises, livePeerRoster, livePeerRosterBlock, peerAllowed, peerName, peerRosterSystemPrompt, peerStatus, peerStatusWords, reachablePeers, resolveTeammate, roomPeerRosterSystemPrompt, roomRosterLine, PEER_ACCESS_HELP } from "./peer-roster.js";
 import { openMausStatusSystemPrompt } from "./openmaus-status-capsule.js";
-import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmRecreatableOnDemand, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
+import { containerComputerAction, containerComputerExists, containerComputerFrame, containerComputerMcp, containerComputerScreenshot, containerComputerStatus, containerExec, containerRuntimeStatus, localVmWakeAction, localVmWorkspaceExists, perBotLocalVmTarget, poolLocalVmTarget, SHARED_LOCAL_VM_TARGET, setupCommands, VM_WORKSPACE_GUEST, } from "./container-computer.js";
 import { attachForTurn, saveBotAttachment } from "./bot-attachment.js";
-import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, } from "./config.js";
+import { ensureDirs, instanceConfigs, loadConfig, providerReloadKeys, localVmIdleTimeoutMinutes, localVmMaxInstances, localVmMode, parseConfigPatch, roomTurnTimeoutMinutes, threadEventLogMaxBytes, maxConcurrentBotThreads, threadEventLogRetentionDays, saveConfig, showToolCallsEnabled, routinesInConversationEnabled, claudeUserMcpEnabled, skillAuthoringEnabled, autoRecallEnabled, captureQuietMs, tidyHour, sharedComputersEnabled, builtInBrowserEnabled, llmThreadTitlesEnabled, computerClaimIdleReleaseEnabled, cloudOverflowAllowlistedThreads, cloudOverflowEnabled, cloudOverflowIdleStopMs, cloudOverflowPerSecondCostUsd, browserProfileReplacementConflict, browserProfilePartitionTarget, syncCredentialEnv, stripWorkspaceCredentialEnv, PROVIDER_CREDENTIAL_ENV, withInstanceCli, persistableInstanceConfigs, vpsSshAlias, browserEngineAttachCdpUrl, DATA_DIR, skillsLibraryEnabled, EVENTS_DIR, NATIVE_DIR, customMcpServers, roomHandoffLimits, onConfigSaved, CLAUDE_API_INSTANCE, liveSettingsFor, } from "./config.js";
 import { sweepThreadEventLogs } from "./thread-retention.js";
 import { ComputerControl } from "./computer-control.js";
 import { augmentedPath, findCliCandidates, resetPathCache } from "./env-path.js";
 import { registerEnginesBinDir } from "./engine-install.js";
 import { appendUsage, parseUsageRange, readUsage, summarizeUsage, usageCsv, USAGE_GROUPINGS, flushUsageLedger } from "./usage-ledger.js";
+import { loadPlanUsage, planAccountsFromInstances } from "./plan-usage.js";
 import { GroupUsageReader } from "./group-thread-usage.js";
 import { ledgerCost } from "./model-prices.js";
 import { checkProviderKey, PROVIDER_KEY_KINDS } from "./provider-key-check.js";
@@ -102,7 +107,7 @@ import { attemptAsideInjection, drainAsideMessages, queueAsideMessage, restoreAs
 import { promptWithReply, transcriptText } from "./replies.js";
 import { admit, DRAIN_COALESCE_MAX_ITEMS } from "./admission.js";
 import { _loadPending, buildDelegationFailurePrompt, buildDelegationRevivalPrompt, DELEGATION_TTL_MS, DelegationWakeBudget, discardDelegations, drainDelegations, expireStaleDelegations, findDelegationReceipt, pendingDelegationInfo, pendingDelegationSnapshot, pendingThreads, queueDelegation, recordDelegationReceipt, releaseDelegationsWaitingOn, summarizeDelegatedActivity } from "./delegations.js";
-import { cancelSteeredMessage, drainSteeredMessages, hasQueuedSteeredMessages, holdSteeredQueue, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
+import { cancelSteeredMessage, drainSteeredMessages, hasQueuedSteeredMessages, holdSteeredQueue, isSteeredMessageQueued, onSteeredQueueChange, queuedSteerSnapshot, queuedSteeredMessage, queuedThreadPosition, queueSteeredMessage, restoreHeldSteeredQueue, restoreSteeredMessages, settleHeldSteeredQueue, } from "./steer-queue.js";
 import { cancelChannelMessage, drainChannelMessages, holdChannelQueue, headChannelGroup, queuedChannelMessage, queueChannelMessage, restoreChannelMessages, restoreHeldChannelQueue, resolveHeldReplyTarget, settleHeldChannelQueueHead, } from "./channel-queue.js";
 import { acceptedSendMatch, parseSendId, sendFingerprint, SendSequencer, } from "./send-idempotency.js";
 import { EventBus } from "./harness/bus.js";
@@ -123,7 +128,10 @@ import { isProjectEmoji, mentionedBots, parseConnectorTools, roomResponders, sec
 import * as tts from "./tts/index.js";
 import { createDecider, deciderIncludedHere, deciderReady, deciderSavePatch, describeDecider } from "./decider/index.js";
 import { decideRoomResponder } from "./decider/room-routing.js";
+import { createLiveSession, liveAttachUrl, LiveSessionError } from "./live-call.js";
+import { LiveCallController, LiveCallSignedOutError } from "./live-call-controller.js";
 import { narrateTool, toUtterances } from "./tts/speech-text.js";
+import { turnStartLogLine } from "./turn-log.js";
 import { buildRecoveryText, buildTurnContext, engineIsFresh, NATIVELY_REPLAYING_DRIVER_KINDS, peerMessageText } from "./turn-context.js";
 import { Handoffs, handedStateUsable, recordHanded, renderUnseen, sessionStart, unseenMessages, withUnseenMessages } from "./delta-context.js";
 import { extractTurnImages } from "./turn-images.js";
@@ -135,7 +143,7 @@ import { ensureWorkspace, ensureTaskWorkspace, workspaceLocationsPrompt, support
 import { listMemoryTopics, memoryDate, readMemoryFile, readMemoryTopic, writeMemoryFile, writeMemoryTopic } from "./workspace.js";
 import { beginMemoryTurn, endMemoryTurn, flushAllMemoryJournals, journalMemoryWrite, } from "./memory-journal.js";
 import { readSectionContext, readSections, sectionContextKey, sectionContextLabel, sectionContextSystemPrompt, writeSectionContext, SECTION_CONTEXT_MAX_BYTES, } from "./section-context.js";
-import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
+import { applyStagedSkillWrite, applySkillWriteWithReceipt, getStagedSkillWrite, installOrgSkill, installSkill, listBotSkillsWithOrigin, resolveBotSkills, parseSkillMd, scanSkillText, listSkills, listStagedSkillWrites, isSkillName, readSkillFile, rejectStagedSkillWrite, removeSkill, setSkillEnabled, skillPackageStamps, skillsSystemPrompt, stageSkillWrite, } from "./skills.js";
 import { fetchSkillFromSource } from "./skill-fetch.js";
 import { pickBotName } from "./names.js";
 import { botSkillTemplateSchema, newBotDefaultsSchema, resolveBotCreationDefaults } from "./new-bot-defaults.js";
@@ -145,6 +153,7 @@ import { checkSoulDrift, readSoulDrift, soulFile, writeSoulMirror } from "./bot-
 import { buildSystemPrompt, userProfileSystemPrompt, cloudHomePrompt, computerPrompt, composioSystemPrompt, customMcpPrompt, CREDENTIAL_PROMPT, mentionPrompt, THREADS_PROMPT, LEARN_PROMPT, PROFILE_PROMPT, ROUTINE_PROMPT, ROUTINE_EXECUTION_PROMPT, WEBHOOK_PROMPT, resolveComputerPromptKind, } from "./system-prompt.js";
 import { readCuaConnection, readCuaUnavailableReason, gatedLocalComputer } from "./local-computer.js";
 import { discoverExistingPerBotLocalVms, discoverExistingPoolLocalVms, localVmInventoryEntry, shouldArmLocalVmIdle, } from "./local-vm-inventory.js";
+import { localVmStopReason, recordLocalVmIdleStop } from "./local-vm-stop-reason.js";
 import { LocalVmIdleTimer } from "./local-vm-idle.js";
 import { LocalVmLeasePool } from "./local-vm-lease.js";
 import { LocalVmSeatPool } from "./local-vm-seat-pool.js";
@@ -179,7 +188,8 @@ import { listenWebhookIngress, webhookCredential } from "./webhook-ingress.js";
 import { assertModelVariantSupported, memberTurnSelection } from "./member-turn.js";
 import { WebhookManager } from "./webhooks.js";
 import { SPAWNED_PROXIES } from "./proxy-paths.js";
-import { loadBundledSkills, loadUserSkills, mergeSkills, renderSkillInstructions, selectBundledSkills } from "./skill-library.js";
+import { installLibrarySkill, listLibrarySkills, loadBundledSkills, loadUserSkills, mergeSkills, readLibrarySkillFile, readSkillLibraryIndex, renderSkillInstructions, selectBundledSkills, setLibrarySkillReviewState, } from "./skill-library.js";
+import { runSkillsLibraryBootSweep } from "./skills-library-migration.js";
 import { installedPlaybookInstructions } from "./installed-playbooks.js";
 import { createBotPackageExport, createLibraryPackageExport, createTeamPackageExport, picture as sharedPicture, TeamExportError } from "./package-export.js";
 import { importPackageDocument, importTeamManifest, PackageImportError } from "./package-import.js";
@@ -191,7 +201,7 @@ import { MAX_TEAM_BACKUP_BYTES } from "../shared/team-backup.js";
 import { shouldMountLocalComputer } from "./local-routing.js";
 import { autoLocalVmAttachable } from "./container-computer.js";
 import { startAutoVmClaim } from "./auto-vm-claims.js";
-import { computerFreeAfterText, computerStillBusyText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
+import { computerFreeAfterText, computerParkedText, computerStoppedWaitingText, computerWaitingText } from "./computer-wait.js";
 import { CloudOverflowConsent, CloudSeatLease, cloudOverflowAction, cloudOverflowConsentText, cloudOverflowOfferText, cloudSeatStartedText, cloudSeatStoppedText } from "./cloud-overflow.js";
 import { modelContextWindow } from "./model-context-window.js";
 import { parseSurface, resolveSurface, surfaceLabel, surfaceOfComputerKind, surfacePrompt } from "./surface.js";
@@ -226,6 +236,7 @@ import { createDesktopViewer, desktopViewerUrl } from "./routes/desktop-viewer.j
 import { localDesktopTarget, localVmViewerStatus, viewerTargetId } from "./desktop-viewer-targets.js";
 import { createAntigravityLeftoverRoutes } from "./routes/antigravity-leftovers.js";
 import { findAntigravityLeftovers, removeAntigravityLeftovers } from "./drivers/antigravity-temp.js";
+import { createLiveRoutes } from "./routes/live.js";
 const PORT = Number(process.env.OMB_PORT || process.env.OGB_PORT || 8799);
 const WEBHOOK_PORT = Number(process.env.OMB_WEBHOOK_PORT || PORT + 1);
 // Behind a proxy or tunnel, the base URL senders should use (docs/self-hosting.md).
@@ -992,9 +1003,10 @@ function cloudCardAnswerer(card) {
     return card.requestId ? cloudCardAnswersInFlight.get(card.requestId) : undefined;
 }
 /** Answer a card as `auth`: the decision rows written meanwhile name the
- * answerer, and a card this answer settled records who settled it. A card
- * that was already settled keeps whatever it said. */
-async function answeringCardAs(auth, threadId, requestId, work) {
+ * answerer, and a card this answer settled records who settled it (and
+ * `via: "call"` when it was decided by voice on a Live call). A card that
+ * was already settled keeps whatever it said. */
+async function answeringCardAs(auth, threadId, requestId, work, via) {
     const open = (() => {
         const card = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId)?.card;
         return Boolean(card && !card.answered && !card.dismissed && !card.expired);
@@ -1002,13 +1014,13 @@ async function answeringCardAs(auth, threadId, requestId, work) {
     if (CLOUD_HOME && open)
         cloudCardAnswersInFlight.set(requestId, auth.kind === "session" ? actorKey(auth) : undefined);
     try {
-        await withDecisionActor(decisionActorFor(auth), work);
+        await withDecisionActor(decisionActorFor(auth), work, via);
     }
     finally {
         const message = open ? store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId) : undefined;
         const card = message?.card;
         if (message && card && !card.answeredBy && card.answered !== "unavailable" && (card.answered || card.dismissed)) {
-            store.patchMessage(threadId, message.id, { card: { ...card, answeredBy: cardAnswererFor(auth) } });
+            store.patchMessage(threadId, message.id, { card: { ...card, answeredBy: { ...cardAnswererFor(auth), ...(via ? { via } : {}) } } });
         }
         if (CLOUD_HOME && open)
             cloudCardAnswersInFlight.delete(requestId);
@@ -1518,6 +1530,25 @@ function resyncOpenCodeProviderKeys() {
 await registry.load(providerConfigs(), decorateHostedProvider);
 const bundledSkills = loadBundledSkills();
 const availableSkills = () => mergeSkills(bundledSkills, loadUserSkills(join(DATA_DIR, "skills")));
+// Skills library (features.skillsLibrary). While the flag is off both
+// helpers reduce exactly to today's per-bot calls; assignments recorded on
+// bot records stay inert until it is on.
+const listBotSkills = (bot) => skillsLibraryEnabled(cfg) ? resolveBotSkills(bot.id, bot.assignedSkills) : listSkills(bot.id);
+const readBotSkillFile = (bot, name) => {
+    const own = readSkillFile(bot.id, name);
+    if (own !== null || !skillsLibraryEnabled(cfg))
+        return own;
+    // A private listing whose stored bytes no longer verify must not fall
+    // through to a same-named library skill: private wins collisions, so a
+    // broken private file stays unreadable instead of exporting another
+    // bot's library instructions under this bot's name.
+    if (listSkills(bot.id).some((skill) => skill.name === name))
+        return null;
+    // The library fallback is by assignment only, never by name alone.
+    if (!bot.assignedSkills?.includes(name))
+        return null;
+    return readLibrarySkillFile(name);
+};
 // SAFETY: Electron's utility-process runtime is the only environment that
 // supplies parentPort; plain Node intentionally leaves it absent.
 const utilityParentPort = process.parentPort;
@@ -1974,7 +2005,20 @@ function hooksIntegration(botId, threadId, generation) {
 }
 class DirectTurnSetupCancelled extends Error {
 }
-class ComputerWaitGaveUp extends Error {
+/** The computer wait ceiling fired (ADR-2, #1651). The turn parks — settled
+ * with a registered resume — instead of failing; the carried resource names
+ * the seat the resume must wait to free. */
+class ComputerWaitParked extends Error {
+    resource;
+    /** The parked turn's generation: the drain distinguishes the turn's own
+     * settle window (keep, retry later) from a newer turn that superseded it
+     * (delete). */
+    generation;
+    constructor(message, resource, generation) {
+        super(message);
+        this.resource = resource;
+        this.generation = generation;
+    }
 }
 const directTurnDispatchClaims = new Map();
 const directTurnGenerationByThread = new Map();
@@ -2018,6 +2062,12 @@ const turnResources = new TurnResources();
 const sharedComputerControl = new SharedComputerControl(turnResources, () => store.bots.some(bot => botComputerControlSnapshot(bot.id).held));
 const turnResourceOwners = new Map();
 const turnComputerResources = new Map();
+/** Screen-touching computer calls that started before their turn's computer
+ * claim was bound (#1653 over the lazy attach of #1361): the start event
+ * finds no claim to fence, so it waits here and bindTurnComputer carries it
+ * into the fresh claim, keeping the quiet window from releasing a seat
+ * under a call the desktop is already executing. */
+const pendingComputerCallStarts = new Map();
 const teamComputerTurns = new Map();
 const settlingResourceOwners = new Map();
 /** Idle release for computer claims (#1653), disabled until the feature
@@ -2027,10 +2077,11 @@ const settlingResourceOwners = new Map();
  * yields once another turn holds the seat. The durable VM profile keeps
  * its login state, so that re-claim is cheap. Read per claim: a flag
  * change applies to new claims, never to a seat held under the old
- * setting. */
+ * setting. computer:phone is excluded: it is the #1663 exclusivity lock,
+ * claimed once per turn with no activity signal to renew it. */
 const COMPUTER_CLAIM_IDLE_POLICY = new IdleReleasePolicy();
 function computerClaimIdlePolicy(resource) {
-    return resource.startsWith("computer:") && computerClaimIdleReleaseEnabled(cfg) ? COMPUTER_CLAIM_IDLE_POLICY : undefined;
+    return resource.startsWith("computer:") && resource !== "computer:phone" && computerClaimIdleReleaseEnabled(cfg) ? COMPUTER_CLAIM_IDLE_POLICY : undefined;
 }
 /** #1655: the consent ledger for local-wait cloud overflow, and the live
  * cloud seats it has started. One seat per bot — it is the bot's own Box,
@@ -2190,11 +2241,17 @@ function releaseTurnResources(owner) {
         turnResourceOwners.delete(owner.threadId);
     if (turnComputerResources.get(owner.threadId)?.owner.generation === owner.generation)
         turnComputerResources.delete(owner.threadId);
+    if (pendingComputerCallStarts.get(owner.threadId)?.generation === owner.generation)
+        pendingComputerCallStarts.delete(owner.threadId);
     const teamTurn = teamComputerTurns.get(owner.threadId);
     if (teamTurn?.owner.generation === owner.generation) {
         stopScreenPoller(teamTurn.botId, owner.threadId);
         teamComputerTurns.delete(owner.threadId);
     }
+    // A freed seat is the parked-resume drain's trigger (#1651). Deferred past
+    // this synchronous settle so the drain reads post-cleanup state.
+    if (pendingComputerResumes.size > 0)
+        queueMicrotask(drainComputerResumes);
 }
 async function bindTurnComputer(owner, resource, exclusive = false) {
     // Every computer claim passes here: a kind the organisation disallows, or a
@@ -2209,7 +2266,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
     // bot running a titled thread, or a room. Read once, when the wait begins.
     let holder;
     let holderThreadRef;
-    const deadline = Date.now() + GROUP_GOAL_WAIT_MAX_MS;
+    const deadline = Date.now() + COMPUTER_WAIT_MAX_MS;
     // The wait is history the transcript keeps (#1647): the waiting chip stays
     // exactly as written, a resolution line is appended beside it, and the
     // turn.wait_* events carry the same facts for the inspector log.
@@ -2235,15 +2292,18 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
             return;
         waitEnded = true;
         const waitedMs = waitedSince === undefined ? 0 : Date.now() - waitedSince;
+        // Acquisition is the only wait that completes: it is the sample the
+        // per-resource estimate is built from (#1652).
+        if (outcome === "acquired")
+            turnResources.noteWait(resource, waitedMs);
         const text = outcome === "acquired"
             ? computerFreeAfterText(holder, waitedMs)
-            : outcome === "gave_up"
-                ? computerStillBusyText(holder, waitedMs)
+            : outcome === "parked"
+                ? computerParkedText(holder, COMPUTER_WAIT_MAX_MS)
                 : computerStoppedWaitingText(holder, waitedMs);
         store.appendMessage(owner.threadId, {
             role: "bot", kind: "activity",
-            ...(outcome === "gave_up" ? { turnSucceeded: false } : {}),
-            tool: { name: text, ok: outcome !== "gave_up" },
+            tool: { name: text, ok: true },
             ...(holderThreadRef ? { threadRef: holderThreadRef } : {}),
         });
         bus.publish({
@@ -2262,6 +2322,10 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
             if (!exclusive || claimTurnResource(owner, resource))
                 break;
             if (!waitingMessage) {
+                // Arrival in the waitlist is the chip's timestamp: the position it
+                // reads is where this turn sits the moment it starts waiting (#1652).
+                const position = turnResources.startWaiting(resource, owner);
+                const estimateMs = turnResources.waitEstimateMs(resource);
                 const blocker = turnResources.blocker(resource, owner);
                 const holderBot = blocker && store.botByThread(blocker.threadId);
                 const holderTask = holderBot && blocker && store.taskByThread(holderBot.id, blocker.threadId);
@@ -2274,7 +2338,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
                     : undefined;
                 waitingMessage = store.appendMessage(owner.threadId, {
                     role: "bot", kind: "activity",
-                    tool: { name: computerWaitingText(holder) },
+                    tool: { name: computerWaitingText(holder, { position, estimateMs }) },
                     ...(holderThreadRef ? { threadRef: holderThreadRef } : {}),
                 });
                 waitedSince = Date.now();
@@ -2282,6 +2346,7 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
                     ...waitEventBase(),
                     type: "turn.wait_started",
                     resource,
+                    position,
                     ...(holder ? { holder } : {}),
                 });
                 // #1655: the wait is where an overflow choice gets made. The card
@@ -2311,8 +2376,12 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
             }
             sweepIdleCloudSeats();
             if (Date.now() >= deadline) {
-                endWait("gave_up");
-                throw new ComputerWaitGaveUp(computerStillBusyText(holder, GROUP_GOAL_WAIT_MAX_MS));
+                // ADR-2 (#1651): the ceiling parks the turn — settled, with a
+                // registered resume — instead of failing it. The owner mark lets the
+                // live lazy-claim rejection path park the same way.
+                endWait("parked");
+                owner.computerParkedOn = resource;
+                throw new ComputerWaitParked(computerParkedText(holder, COMPUTER_WAIT_MAX_MS), resource, owner.generation);
             }
             await new Promise(resolve => setTimeout(resolve, 100));
         }
@@ -2321,9 +2390,21 @@ async function bindTurnComputer(owner, resource, exclusive = false) {
         // Never patch the waiting chip over: the queue position this turn held
         // stays visible beside what the wait came to.
         endWait(active() && turnResources.owns(resource, owner) ? "acquired" : "stopped");
+        // Whatever the wait came to, this turn is no longer waiting: an owner
+        // left at the front would block the grant for everyone behind it.
+        turnResources.stopWaiting(resource, owner);
     }
     turnResourceOwners.set(owner.threadId, owner);
     turnComputerResources.set(owner.threadId, { owner, resource });
+    // A screen call that started before this bind (#1653) fenced nothing
+    // because no claim existed yet: carry its pending start into the fresh
+    // claim so the idle window still defers to the running call.
+    const pendingStarts = pendingComputerCallStarts.get(owner.threadId);
+    if (pendingStarts?.generation === owner.generation && pendingStarts.count > 0) {
+        pendingComputerCallStarts.delete(owner.threadId);
+        for (let i = 0; i < pendingStarts.count; i += 1)
+            turnResources.beginComputerCall(resource, owner);
+    }
 }
 function botForThread(botId, threadId) {
     return directTurnBots.get(threadId) ?? store.projectBotForTask(botId, threadId) ?? store.bot(botId);
@@ -2412,7 +2493,13 @@ function requestedTaskBot(botId, rawThreadId) {
         throw Object.assign(new Error("no such task"), { status: 404 });
     return task;
 }
-async function interruptDirectThread(botId, threadId) {
+async function interruptDirectThread(botId, threadId, options) {
+    // A parked turn has settled its provider but still owns a future resume.
+    // Stop cancels that work too. The parking teardown itself preserves it.
+    if (!options?.preserveComputerResume && pendingComputerResumes.delete(threadId)
+        && store.taskByThread(botId, threadId)?.activity === "parked.computer") {
+        store.setTaskActivity(botId, threadId, "idle");
+    }
     const requestOwner = directRequestOwners.get(threadId);
     if (requestOwner) {
         requestOwner.stopped = true;
@@ -2454,7 +2541,7 @@ function noteTeammatesLeftRunning(botId, threadId, running) {
     }
 }
 async function interruptAllDirectThreads(botId) {
-    const threads = store.tasks(botId).filter((task) => task.busy || directTurnDispatchClaims.has(task.threadId) || roomHandoffs.activeDirect(task.threadId));
+    const threads = store.tasks(botId).filter((task) => task.busy || directTurnDispatchClaims.has(task.threadId) || roomHandoffs.activeDirect(task.threadId) || pendingComputerResumes.has(task.threadId));
     // Revoke every sibling before yielding to any provider teardown.
     for (const task of threads) {
         cancelDirectTurnDispatch(botId, task.threadId);
@@ -2936,7 +3023,7 @@ function checkedExportSkillNames(value, bots) {
         return { ok: false, error: "skillIds must not contain duplicates" };
     if (names.length > BOT_PACKAGE_MAX_SKILLS)
         return { ok: false, error: `skillIds must contain at most ${BOT_PACKAGE_MAX_SKILLS} names` };
-    const available = new Set(bots.flatMap((bot) => listSkills(bot.id).map((skill) => skill.name)));
+    const available = new Set(bots.flatMap((bot) => listBotSkills(bot).map((skill) => skill.name)));
     const unknown = names.find((name) => !available.has(name));
     if (unknown)
         return { ok: false, error: `skillIds contains unknown imported skill "${unknown}"` };
@@ -2949,10 +3036,10 @@ function collectExportSkills(bots, names) {
         return byBot;
     for (const bot of bots) {
         const assigned = [];
-        for (const listing of listSkills(bot.id)) {
+        for (const listing of listBotSkills(bot)) {
             if (!selected.has(listing.name))
                 continue;
-            const instructions = readSkillFile(bot.id, listing.name);
+            const instructions = readBotSkillFile(bot, listing.name);
             if (instructions === null) {
                 throw new Error(`Skill "${listing.name}" changed or is unavailable and cannot be exported safely`);
             }
@@ -2980,7 +3067,7 @@ function collectExportSkills(bots, names) {
  * skill choices from it, so a refused choice can always be changed. */
 function collectTeamSkills(bots, selection) {
     const all = selection === undefined || selection === "all";
-    const available = [...new Set(bots.flatMap((bot) => listSkills(bot.id).map((skill) => skill.name)))].sort();
+    const available = [...new Set(bots.flatMap((bot) => listBotSkills(bot).map((skill) => skill.name)))].sort();
     if (!all && (!Array.isArray(selection) || selection.some((name) => typeof name !== "string" || !isSkillName(name)))) {
         return { ok: false, error: "skills must be \"all\" or a list of skill names", available };
     }
@@ -2992,10 +3079,10 @@ function collectTeamSkills(bots, selection) {
     const skipped = [];
     for (const bot of bots) {
         const assigned = [];
-        for (const listing of listSkills(bot.id)) {
+        for (const listing of listBotSkills(bot)) {
             if (!chosen.has(listing.name))
                 continue;
-            const instructions = readSkillFile(bot.id, listing.name);
+            const instructions = readBotSkillFile(bot, listing.name);
             if (instructions === null) {
                 if (!all)
                     return { ok: false, error: `Skill "${listing.name}" changed or is unavailable and cannot be shared safely`, available };
@@ -3132,6 +3219,26 @@ const sendSequencer = new SendSequencer();
 bootSelection = await defaultSelection();
 store.seedIfEmpty();
 hostedModels?.reconcile(store);
+// Skills library boot sweep (features.skillsLibrary): migrate per-bot
+// copies into the shared library and apply assignments. Flag-off boots
+// never enter this block, keeping per-bot behavior byte-identical.
+if (skillsLibraryEnabled(cfg)) {
+    try {
+        const sweep = runSkillsLibraryBootSweep({
+            bots: store.bots,
+            patch: (botId, assignedSkills) => {
+                store.patchBot(botId, { assignedSkills });
+            },
+        });
+        const applied = sweep.outcomes.filter((outcome) => outcome.outcome !== "skipped").length;
+        if (sweep.outcomes.length) {
+            console.log(`[skills-library] boot sweep: ${applied} skill(s) migrated or deduplicated, ${sweep.outcomes.length - applied} skipped`);
+        }
+    }
+    catch (error) {
+        console.error(`[skills-library] boot sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 // A committed profile cleanup means both its config deletion and bot-reference
 // cleanup were intended to be durable. Reconcile stale secondary references
 // before Electron can ACK and remove the journal: a crash between those writes
@@ -3173,7 +3280,7 @@ const wireTask = (task) => {
     return asleep ? { ...coordinated, snoozedUntil } : coordinated;
 };
 const wireBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
     // An elevated selection is inert until the desktop confirms its exact
     // private reply. Every ordinary client sees the effective Ask state during
     // that two-phase window, never a grant that may still roll back.
@@ -3183,10 +3290,19 @@ const wireBot = (bot) => {
     return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
         avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
+function toolScopeForTurn(botId) {
+    const bot = store.bot(botId);
+    if (!bot)
+        throw Object.assign(new Error("no such bot"), { status: 404 });
+    const parsed = parseToolScope(bot.toolScope);
+    if (!parsed.ok)
+        throw Object.assign(new Error("This bot's tool selection is invalid. Open Access settings and save a valid selection before starting a turn."), { status: 409, code: "tool_scope" });
+    return parsed.scope;
+}
 /** The correlated private response carries the requested value so Electron
  * can validate it before sending the confirmation that makes it effective. */
 const wireTrustedApprovalBot = (bot) => {
-    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, ...rest } = bot;
+    const { resumeCursors: _resumeCursors, tasks, approvalGrant: _approvalGrant, lastProfileRequestId: _lastProfileRequestId, lastTighteningRequestId: _lastTighteningRequestId, lastTeamSetupReceipt: _lastTeamSetupReceipt, packageBase: _packageBase, assignedSkills: _assignedSkills, ...rest } = bot;
     return { ...rest, approvalMode: approvalModeFor(rest), avatarUrl: rest.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** A settings-based preview, not a receipt of a dispatched turn. No
@@ -3260,7 +3376,7 @@ function previewSystemPrompt(bot) {
         { id: "profile", label: "Profile changes", text: agentsMounted ? PROFILE_PROMPT : "" },
         { id: "section-context", label: "Section context", text: sectionContextSystemPrompt(bot.section) },
         { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: agentsMounted, fileTools: Boolean(privateWorkspace), enabled: bot.memoryEnabled !== false }) },
-        { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
+        { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? bot.assignedSkills : undefined) : "" },
     ]);
     const totalBytes = built.sections.reduce((n, s) => n + s.bytes, 0);
     return {
@@ -3325,7 +3441,7 @@ async function botOverview(bot) {
         webhooks: webhooks.list()
             .filter((webhook) => webhook.botId === bot.id)
             .map((webhook) => ({ name: webhook.name, enabled: webhook.enabled })),
-        skills: listSkills(bot.id).map((skill) => ({
+        skills: listBotSkills(bot).map((skill) => ({
             name: skill.name,
             description: skill.description,
             enabled: skill.enabled,
@@ -3344,9 +3460,9 @@ async function botOverview(bot) {
  * this too, but no provider dispatch or later permission callback relies on
  * persistence having been produced exclusively by that route. Delegation
  * uses the receiving bot's grant, never the sender's (approvalModeForOrigin) —
- * with one deliberate exception: a Chief of Staff with Full access makes the
- * threads it delegates Full too (delegatedFullAccess), so the grant the
- * person gave the Chief covers the work the Chief hands out. */
+ * with one deliberate exception: a Chief of Staff's level flows down to the
+ * threads it delegates (delegatedLevel), so the level the person gave the
+ * Chief covers the work the Chief hands out. */
 const approvalModeForTurn = (bot, peerInitiated = false, threadId = bot.threadId) => {
     // On a Cloud home a turn a guest drives runs in Ask, whatever the bot's
     // own level. Judged by the conversation the turn runs in (a room's, for a
@@ -3359,51 +3475,62 @@ const approvalModeForTurn = (bot, peerInitiated = false, threadId = bot.threadId
     }
     return mode;
 };
-/** Full belongs to the requesting conversation, not whichever sibling is
+/** A level belongs to the requesting conversation, not whichever sibling is
  * selected in the UI or the bot's default for future conversations. */
-function fullAccessForSource(botId, threadId) {
+function sourceApprovalMode(botId, threadId) {
     const owner = connectorThread(botId, threadId);
     if (!owner)
-        return false;
+        return "ask";
     const bot = store.projectBotForTask(botId, threadId) ?? owner.bot;
     // Origin changes Custom to Auto, never Full; no live-turn state is needed.
-    return approvalModeForTurn(bot, false, threadId) === "full";
+    return approvalModeForTurn(bot, false, threadId);
+}
+function fullAccessForSource(botId, threadId) {
+    return sourceApprovalMode(botId, threadId) === "full";
 }
 function peerReviewRequired(bot, threadId) {
     return Boolean(bot.approvePeerComms && !fullAccessForSource(bot.id, threadId));
 }
-/** Full access flows down a Chief of Staff's delegation. The person gave the
- * Chief Full access so its work runs without prompts; a teammate stopping
- * that same work to ask defeats the grant — and in practice the person was
- * answering every one of those cards, all day, for the whole team. So a
- * teammate a Full-access Chief delegates to runs Full for that work: the
- * recipient switches, whatever its own level says. The recipient's engine
- * has to implement Full (supportsApprovalMode); otherwise the work keeps the
- * recipient's own level, as before. Only a Chief passes access on — an
- * ordinary bot's delegation still uses the recipient's setting. */
-function delegatedFullAccess(from, fromThreadId, target) {
-    return delegationInheritsFullAccess({
+/** A Chief of Staff's level flows down its delegation. The person set the
+ * Chief's level so its work runs that way; a teammate the Chief brings in
+ * starting at "Ask for approval" meant switching every such thread by hand,
+ * all day, for the whole team. So a teammate a Chief delegates to starts at
+ * the Chief's level for that work: Auto-accept edits, Approve for me or Full
+ * access (delegatedApprovalMode: never lower than the teammate's own level,
+ * capped at what its engine implements). Only a Chief passes its level on —
+ * an ordinary bot's delegation still uses the recipient's setting. Returns
+ * null to keep the recipient's own level. */
+function delegatedLevel(from, fromThreadId, target, recipientMode) {
+    return delegatedApprovalMode({
         senderIsChief: Boolean(from.chiefOfStaff),
-        senderHasFullAccess: fullAccessForSource(from.id, fromThreadId),
+        senderMode: sourceApprovalMode(from.id, fromThreadId),
         sameBot: from.id === target.id,
+        recipientMode,
         recipientDriverKind: registry.cliTarget(target.modelSelection.instanceId)?.driverKind,
     });
 }
-/** Make a delegated thread Full and say so in it once, so the level the
- * chip shows and the level the turns run at agree, and the person can see
- * where the access came from. */
-function grantDelegatedFullAccess(from, target, threadId) {
-    if (store.taskByThread(target.id, threadId)?.approvalMode === "full")
+/** The teammate's own level for a thread of its own, before any delegation. */
+function ownThreadLevel(target, threadId) {
+    return approvalModeForTurn(store.projectBotForTask(target.id, threadId) ?? target, false, threadId);
+}
+const DELEGATED_LEVEL_NAMES = { edits: "Auto-accept edits", auto: "Approve for me", full: "Full access" };
+/** Start a thread the Chief opened at the Chief's level, and say so in it
+ * once, so the level the chip shows and the level the turns run at agree,
+ * and the person can see where it came from (and change it there). */
+function applyDelegatedLevel(from, fromThreadId, target, threadId) {
+    const level = delegatedLevel(from, fromThreadId, target, ownThreadLevel(target, threadId));
+    if (!level || store.taskByThread(target.id, threadId)?.approvalMode === level)
         return;
-    store.patchTask(target.id, threadId, { approvalMode: "full", autoApprove: false, alwaysAllow: [] });
+    store.patchTask(target.id, threadId, { approvalMode: level, autoApprove: false, alwaysAllow: [] });
+    const name = DELEGATED_LEVEL_NAMES[level] ?? level;
     store.appendMessage(threadId, {
         role: "bot",
         kind: "activity",
-        tool: { name: `Full access — delegated by ${from.name}, a Chief of Staff with Full access`, ok: true },
+        tool: { name: `${name} — delegated by ${from.name}, a Chief of Staff on ${name}`, ok: true },
     });
 }
-/** A room member's level for one turn. Work a Full-access Chief hands out
- * in a room runs Full for that turn: the room thread is shared, so the
+/** A room member's level for one turn. Work a Chief hands out in a room runs
+ * at the Chief's level for that turn: the room thread is shared, so the
  * level is not stored on it — it rides the handoff. */
 function roomTurnApprovalMode(bot, threadId, orchestration) {
     // On a Cloud home a room turn a guest drives runs in Ask (cloudGuestDriven).
@@ -3412,9 +3539,8 @@ function roomTurnApprovalMode(bot, threadId, orchestration) {
     const handoff = orchestration?.roomHandoffId ? roomHandoffs.nodes.get(orchestration.roomHandoffId) : undefined;
     const source = handoff?.parentId ? roomHandoffs.nodes.get(handoff.parentId) : undefined;
     const from = source ? store.bot(source.botId) : undefined;
-    if (from && source && delegatedFullAccess(from, source.threadId, bot))
-        return "full";
-    return approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId), threadId);
+    const own = approvalModeForTurn(bot, Boolean(orchestration?.roomHandoffId), threadId);
+    return (from && source && delegatedLevel(from, source.threadId, bot, own)) || own;
 }
 /** Privileged approval-mode transitions are deliberately absent from the
  * loopback HTTP authority model: a bot with shell access can curl that
@@ -3466,6 +3592,9 @@ function handleDesktopTrustedApprovalMessage(raw) {
             if (bot.approvalGrant.allThreads && mode === "full") {
                 store.setAllThreadApprovalMode(botId, mode);
             }
+            else if (bot.approvalGrant.refreshPermissions && bot.approvalGrant.threadId) {
+                store.refreshTaskPermissions(botId, bot.approvalGrant.threadId);
+            }
             else if (bot.approvalGrant.threadId) {
                 store.patchTask(botId, bot.approvalGrant.threadId, { approvalMode: mode, autoApprove: false });
             }
@@ -3671,6 +3800,39 @@ function handleDesktopTrustedApprovalMessage(raw) {
         respond({ ok: false, error: "Invalid thread approval scope" });
         return true;
     }
+    if (message.refreshPermissions !== undefined && message.refreshPermissions !== true) {
+        respond({ ok: false, error: "Invalid permission refresh" });
+        return true;
+    }
+    if (message.refreshPermissions === true) {
+        const target = typeof threadId === "string" ? store.projectBotForTask(botId, threadId) : null;
+        const savedMode = approvalModeFor({ ...existing, approvalGrant: undefined });
+        if (message.threadOnly !== true || !target || message.allThreads === true || message.modelSelection !== undefined || message.updateBotDefault !== undefined || savedMode !== mode) {
+            respond({ ok: false, error: "Choose this bot's approval level in bot settings before refreshing a thread" });
+            return true;
+        }
+        if (existing.approvalGrant || threadBusy(botId, target.threadId)) {
+            respond({ ok: false, error: "Stop this thread and finish its pending approval change first" });
+            return true;
+        }
+        if (!supportsApprovalMode(target.modelSelection, mode)) {
+            respond({ ok: false, error: "This thread's provider does not support that approval level" });
+            return true;
+        }
+        if (mode === "auto" && target.computer === "local" && approvalModeFor(target) !== "auto" && message.acknowledgeLocalAuto !== true) {
+            respond({ ok: false, error: "Auto mode on this computer requires confirming the warning" });
+            return true;
+        }
+        if (mode === "full" || mode === "custom") {
+            store.patchBot(botId, { approvalGrant: { requestId, mode, phase: "prepared", threadId: target.threadId, threadOnly: true, refreshPermissions: true } });
+        }
+        else if (!store.refreshTaskPermissions(botId, target.threadId)) {
+            respond({ ok: false, error: "That thread is no longer available" });
+            return true;
+        }
+        respond({ ok: true, bot: wireTrustedApprovalBot(store.bot(botId)) });
+        return true;
+    }
     if (message.threadOnly === true) {
         const target = typeof threadId === "string" ? store.projectBotForTask(botId, threadId) : null;
         if (!target || message.modelSelection !== undefined || message.updateBotDefault !== undefined) {
@@ -4044,6 +4206,7 @@ function updateChannel(groupId, value) {
 const channelTaskBlocked = (group) => groupIsWorking(group) ||
     store.groupTasks(group.id).some((task) => store.messagesFor(task.threadId).some((message) => message.kind === "options" &&
         message.card?.requestId &&
+        (!isPersistentQuestionCard(message.card) || runningTurnEngines.has(task.threadId)) &&
         !message.card.answered &&
         !message.card.dismissed && !message.card.expired));
 // Recovery can synchronously emit room changes. Load coordination state
@@ -4580,6 +4743,7 @@ function cancelGroupTurnOperations(groupId, threadId, outcome = {
     status: "stopped",
     detail: "Stopped by you.",
 }) {
+    pendingComputerResumes.delete(threadId);
     cancelTeamSetupResumesForThread(threadId);
     roomHandoffs.cancelRoom(groupId, threadId);
     for (const operation of groupTurnOperations.get(groupId) ?? []) {
@@ -4864,6 +5028,18 @@ const desktopViewer = createDesktopViewer({
         });
     },
     live: auth => auth.kind === "loopback" || sessions.isLive(auth.session.id),
+    // A phone paired with this server directly drives a bot's Local VM through
+    // this proxy under its control lease (see the local-computer join route).
+    // The lease must hold the bot's computer, and that computer must be the
+    // desktop being viewed: a lease on one bot opens no other bot's VM.
+    lease: (id, botId, controlLeaseId, threadId) => {
+        const bot = store.bot(botId);
+        if (!bot || viewerTargetId(localVmTargetForStatus(bot.id, threadId)) !== id)
+            return;
+        const key = botComputerControlKey(bot);
+        const holds = () => computerControl.ownsLease(key, controlLeaseId);
+        return holds() ? holds : undefined;
+    },
 });
 function closeSessionStreams(sessionId) {
     browserLive.closeForOwner(sessionId);
@@ -5012,7 +5188,7 @@ const askMessageByRequest = new Map(); // threadId:requestId -> messageId
 const pendingCommandRules = new Map();
 function commandRememberRefusal(auth, threadId, requestId, behavior) {
     if (!canManageCommandAllowlist(auth))
-        return "Only the workspace owner or an admin can save bot-wide command permissions.";
+        return "Only the owner or an admin can save bot-wide command permissions.";
     if (behavior !== "allow" || !pendingCommandRules.has(`${threadId}:${requestId}`)) {
         return "This live request does not contain a command that can be saved. Allow it once instead.";
     }
@@ -5066,7 +5242,7 @@ always, rememberCommand) {
     // An answered question keeps its words. `request.resolved` only records
     // the behavior, so without this the card reads "answer" forever and the
     // person can no longer see what they told the bot.
-    if (outcome !== "unavailable" && behavior === "answer" && message && cardMessage) {
+    if (outcome === "answered" && behavior === "answer" && message && cardMessage) {
         const settled = store.messagesFor(threadId).find((m) => m.id === cardMessage.id)?.card;
         if (settled) {
             store.patchMessage(threadId, cardMessage.id, { card: { ...settled, answeredText: message } });
@@ -5098,19 +5274,78 @@ always, rememberCommand) {
         const existing = messageId
             ? thread.find((m) => m.id === messageId)
             : thread.find((m) => m.card?.requestId === requestId);
-        if (existing?.card && !existing.card.answered) {
+        const persistentQuestion = isPersistentQuestionCard(existing?.card);
+        if (existing?.card && !existing.card.answered && !persistentQuestion) {
             store.patchMessage(threadId, existing.id, { card: { ...existing.card, answered: "unavailable", dismissed: true } });
         }
         if (messageId)
             askMessageByRequest.delete(`${threadId}:${requestId}`);
-        store.appendMessage(threadId, {
-            role: "bot",
-            kind: "activity",
-            tool: { name: "Couldn't deliver that answer — the request is no longer open, so the action was not run", ok: false },
-        });
+        if (!persistentQuestion)
+            store.appendMessage(threadId, {
+                role: "bot",
+                kind: "activity",
+                tool: { name: "Couldn't deliver that answer — the request is no longer open, so the action was not run", ok: false },
+            });
     }
     return outcome;
 }
+/** A decision or answer on a provider/peer card, made on behalf of `auth`
+ * (a Live call answers as the person who started the call). Harness-native
+ * proposals (skill, routine, profile, default model, tightening, team setup)
+ * are not handled here; they are reviewed on screen (liveDecisionRefusal).
+ * Mirrors POST /api/threads/:id/respond. */
+async function respondToCard(input) {
+    const { auth, threadId, requestId, behavior, message } = input;
+    // A call outlives the request that started it: the session must still be valid.
+    if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+        return { ok: false, status: 401, error: "The session that started this call has ended." };
+    }
+    const refusal = cardAnswerRefusal(auth, threadId, requestId, behavior);
+    if (refusal)
+        return { ok: false, status: 403, error: refusal };
+    const bot = store.botByThread(threadId);
+    if (!bot)
+        return { ok: false, status: 404, error: "The chat is gone." };
+    const cardMessage = store.messagesFor(threadId).find((candidate) => candidate.card?.requestId === requestId);
+    const card = cardMessage?.card;
+    // Refused before anything runs: answerRequest would close a proposal it
+    // cannot deliver as "unavailable", and would add a false "not run" line to
+    // a card someone settled on screen a moment ago.
+    const refused = liveDecisionRefusal(card);
+    if (refused)
+        return { ok: false, status: 409, error: refused };
+    let result = { ok: true };
+    await answeringCardAs(auth, threadId, requestId, async () => {
+        // peer-approval intercept, as the route: only a card on this thread
+        if (card && resolvePeerComms(approvalBus, requestId, behavior))
+            return;
+        const outcome = await answerRequest(threadId, botForThread(bot.id, threadId)?.modelSelection.instanceId ?? "", requestId, behavior, message, { id: bot.id, name: bot.name });
+        if (outcome === "unavailable" && isPersistentQuestionCard(card) && behavior === "answer" && cardMessage) {
+            const answer = message?.trim() ?? "";
+            if (!answer) {
+                result = { ok: false, status: 400, error: "A question answer is required." };
+            }
+            else if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                result = { ok: false, status: 401, error: "The session that started this call has ended." };
+            }
+            else {
+                try {
+                    await deliverLateQuestionAnswer(auth, threadId, requestId, answer, cardMessage, bot, "call");
+                }
+                catch (error) {
+                    result = { ok: false, status: 409, error: error instanceof Error ? error.message : "The late answer could not be queued." };
+                }
+            }
+        }
+        else if (outcome === "unavailable") {
+            result = { ok: false, status: 409, error: "The request is no longer open." };
+        }
+        else if (behavior === "answer" && outcome !== "answered") {
+            result = { ok: false, status: 409, error: "The provider did not accept that answer. Try an offered option." };
+        }
+    }, "call");
+    return result;
+}
 /** Close every provider-owned approval still open on a thread. Interrupting a
  * turn kills the process that raised its questions, so those cards can never
  * be answered. Routine proposals are harness-owned and durable, so they stay
@@ -5128,6 +5363,12 @@ function closeOpenApprovals(threadId) {
             continue;
         if (card.routineRequest || card.skillRequest)
             continue;
+        if (isPersistentQuestionCard(card)) {
+            // Keep the durable card; its in-flight adapter mapping cannot survive
+            // turn cleanup, and the response route can resume it from the transcript.
+            askMessageByRequest.delete(`${threadId}:${card.requestId}`);
+            continue;
+        }
         store.patchMessage(threadId, message.id, { card: { ...card, answered: "unavailable", dismissed: true } });
         askMessageByRequest.delete(`${threadId}:${card.requestId}`);
     }
@@ -5189,6 +5430,9 @@ const ASK_BOT_TIMEOUT_MS = Math.max(5_000, Number(process.env.OMB_ASK_BOT_TIMEOU
 // free up and reassigns, and a chat round moves on with a chip that says so —
 // the wait ends as data, not as a dead room. Tests shrink it.
 const GROUP_GOAL_WAIT_MAX_MS = Math.max(1_000, Number(process.env.OMB_GOAL_WAIT_MAX_MS) || 30 * 60_000);
+// ADR-2 (#1651): the computer wait has its own ceiling, decoupled from the
+// room cap above, and the deadline parks the turn instead of failing it.
+const COMPUTER_WAIT_MAX_MS = Math.max(1_000, Number(process.env.OMB_COMPUTER_WAIT_MAX_MS) || 30 * 60_000);
 // Reassigning around a busy teammate is bounded too: after this many
 // exhausted waits in one run the team is blocked on availability, not stuck.
 const GROUP_GOAL_MAX_WAIT_EXHAUSTIONS = 3;
@@ -5199,10 +5443,9 @@ const watchdog = new TurnWatchdog({
     onStall: (turn) => {
         const stalledResourceOwner = turnResourceOwners.get(turn.threadId);
         const stalledGeneration = directTurnGenerationByThread.get(turn.threadId);
+        const stalledProviderTurn = directRequestOwners.get(turn.threadId);
         cancelDirectTurnDispatch(turn.botId, turn.threadId);
-        // Room targets carry an invocation identity; only those claims belong
-        // to the room grace cleanup added here.
-        const stalledVmTarget = groupSpeakers.has(turn.threadId) ? localVmThreadTargets.get(turn.threadId) : undefined;
+        const stalledVmTarget = localVmThreadTargets.get(turn.threadId);
         revokeInternalCapabilitiesForThread(turn.threadId);
         repeats.settle(turn.threadId);
         const bot = botForThread(turn.botId, turn.threadId);
@@ -5240,6 +5483,9 @@ const watchdog = new TurnWatchdog({
                 return;
             if (stalledResourceOwner && turnResourceOwners.get(turn.threadId)?.generation !== stalledResourceOwner.generation)
                 return;
+            if (stalledGeneration && stalledProviderTurn?.generation === stalledGeneration && stalledProviderTurn.turnId) {
+                retireProviderTurn(stalledProviderTurn.turnId);
+            }
             // A goal coordinator can stall before sendTurn reveals its provider
             // turn id. Reusing the room during that ambiguous pre-id window would
             // make old and replacement events indistinguishable. Keep ownership
@@ -5254,7 +5500,8 @@ const watchdog = new TurnWatchdog({
             }
             const group = store.groupByThread(turn.threadId);
             const speaker = groupSpeakers.get(turn.threadId);
-            if (group && group.busyBotId === turn.botId && speaker?.botId === turn.botId) {
+            const stalledRoomSpeaker = group && group.busyBotId === turn.botId && speaker?.botId === turn.botId;
+            if (stalledRoomSpeaker) {
                 groupSpeakers.delete(turn.threadId);
                 store.patchGroup(group.id, { busyBotId: null, unread: true });
             }
@@ -5262,7 +5509,7 @@ const watchdog = new TurnWatchdog({
             // computer claim. The generation checks above protect replacements.
             releaseTurnResources(stalledResourceOwner);
             const currentBot = store.bot(turn.botId);
-            if (currentBot?.busy) {
+            if (currentBot?.busy && (threadBusy(currentBot.id, turn.threadId) || stalledRoomSpeaker)) {
                 stopScreenPoller(currentBot.id, turn.threadId);
                 vpsThreadEnded(currentBot.id, turn.threadId);
                 if (store.taskByThread(currentBot.id, turn.threadId))
@@ -5276,6 +5523,7 @@ const watchdog = new TurnWatchdog({
                 // connector and credential continuations.
                 drainQueuedSends();
                 drainConnectorResumes();
+                drainComputerResumes();
                 drainSecretResumes();
                 drainTeamSetupResumes();
             }
@@ -6378,11 +6626,11 @@ function localVmIdleFor(target) {
         localVmLifecycleBusy.add(target.key);
         try {
             const status = await containerComputerStatus(undefined, undefined, target);
-            // The desktop leaves a stale X lock after stop, so idle cleanup
-            // removes only the disposable container. Its target-specific durable
-            // workspace and the shared prepared image remain.
-            if (status.container === "running") {
-                await containerComputerAction("remove", undefined, undefined, target);
+            // The pinned VNC startup clears stale X locks. Keep the container's
+            // home and installed software so inactivity is a reversible stop.
+            if (status.container === "running" && status.managed) {
+                const stopped = await containerComputerAction("stop", undefined, undefined, target);
+                recordLocalVmIdleStop(target.key, stopped.stopped_at);
             }
         }
         finally {
@@ -6424,7 +6672,7 @@ function releaseLocalVmThread(threadId) {
 // Browser, This computer, Auto, or Off does not delete its old Local VM.
 void (async () => {
     if (localVmMode(cfg) === "pool") {
-        // Same restore rule as per-bot: idle cleanup removes the container, not
+        // Same restore rule as per-bot: idle shutdown preserves the container and
         // its provisioned workspace, so every surviving seat stays Auto-eligible.
         const seats = localVmMaxInstances(cfg);
         for (let seat = 0; seat < seats; seat += 1) {
@@ -6667,8 +6915,23 @@ bus.subscribe((event) => {
                     // they cannot keep a quiet seat held.
                     if (touches && surface === "computer") {
                         const computer = turnComputerResources.get(event.threadId);
-                        if (computer)
+                        if (computer) {
+                            // A quiet window cannot expire while this call executes.
+                            turnResources.endComputerCall(computer.resource, computer.owner);
                             turnResources.activity(computer.resource, computer.owner);
+                        }
+                        else {
+                            // The call never forwarded onto a bound desktop, or the lazy
+                            // bind never landed: drop its pending start so it cannot
+                            // fence a claim taken later (#1653).
+                            const pending = pendingComputerCallStarts.get(event.threadId);
+                            if (pending) {
+                                if (pending.count > 1)
+                                    pendingComputerCallStarts.set(event.threadId, { ...pending, count: pending.count - 1 });
+                                else
+                                    pendingComputerCallStarts.delete(event.threadId);
+                            }
+                        }
                         // Real cloud-screen work refreshes the #1655 idle stop for
                         // that seat; the poller's own frames never arrive here, so
                         // preview traffic cannot keep a paid machine awake.
@@ -6700,6 +6963,26 @@ bus.subscribe((event) => {
                 });
                 if (event.itemId)
                     toolMessageByItem.set(`${event.threadId}:${event.itemId}`, message.id);
+                // A screen-touching computer tool opening is an in-flight call on
+                // that turn's claim (#1653): the seat cannot be idle-released out
+                // from under I/O the desktop is still executing. Its completion —
+                // or the turn settling — drops the fence.
+                if (screenTouchingTool(name) && screenSurfaceForTool(name) === "computer") {
+                    const computer = turnComputerResources.get(event.threadId);
+                    if (computer) {
+                        turnResources.beginComputerCall(computer.resource, computer.owner);
+                    }
+                    else {
+                        // A lazy attach (#1361) may not have seated the claim yet: the
+                        // gate finishes the bind before the call forwards, so hold the
+                        // start here and let bindTurnComputer fence the fresh claim.
+                        const generation = activeInternalGenerationByThread.get(event.threadId);
+                        if (generation) {
+                            const pending = pendingComputerCallStarts.get(event.threadId);
+                            pendingComputerCallStarts.set(event.threadId, pending?.generation === generation ? { generation, count: pending.count + 1 } : { generation, count: 1 });
+                        }
+                    }
+                }
             }
             break;
         case "request.opened": {
@@ -6820,6 +7103,7 @@ bus.subscribe((event) => {
                     subtitle: event.summary,
                     options: event.choices?.length ? event.choices : permission ? ["Allow", "Deny"] : [],
                     requestId: event.requestId,
+                    requestType: permission ? "permission" : "question",
                     tool: permission ? event.tool : undefined,
                     questionRequest: questions
                         ? { version: 1, questions, ...(event.origin === "output" ? { origin: "output" } : {}) }
@@ -6887,9 +7171,15 @@ bus.subscribe((event) => {
             if (messageId) {
                 const existing = store.messagesFor(event.threadId).find((m) => m.id === messageId);
                 if (existing?.card && !existing.card.answered) {
-                    store.patchMessage(event.threadId, messageId, {
-                        card: { ...existing.card, answered: event.behavior, dismissed: event.source !== "user" },
-                    });
+                    if (shouldSettleRequestCard(existing.card, event.source)) {
+                        store.patchMessage(event.threadId, messageId, {
+                            card: {
+                                ...existing.card,
+                                answered: event.behavior,
+                                dismissed: isPersistentQuestionCard(existing.card) ? false : event.source !== "user",
+                            },
+                        });
+                    }
                 }
                 if (event.requestId)
                     askMessageByRequest.delete(`${event.threadId}:${event.requestId}`);
@@ -7017,9 +7307,13 @@ bus.subscribe((event) => {
             // interrupted the turn; Claude settles that interrupt as
             // exit_before_result, not "interrupted", so this generation's marker
             // keeps the same failure from reporting a second incident.
+            // A turn parked at the computer ceiling (#1651) settles itself the
+            // same way: interrupted for a resume, not broken.
             const lazyClaimAlreadyReported = event.stopReason === "exit_before_result" &&
                 turnResourceOwners.get(event.threadId)?.lazyClaimFailureReported === true;
-            if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !routines?.runForThread(event.threadId)) {
+            const computerParked = event.stopReason === "exit_before_result" &&
+                turnResourceOwners.get(event.threadId)?.computerParkedOn !== undefined;
+            if (!event.ok && event.stopReason !== "interrupted" && !lazyClaimAlreadyReported && !computerParked && !routines?.runForThread(event.threadId)) {
                 const broken = bot ?? (speaker ? store.bot(speaker.botId) : undefined);
                 if (broken)
                     reportIncident({ kind: "failed", bot: broken, threadId: event.threadId, detail: event.stopReason?.trim() || "the run ended without a result" });
@@ -7049,7 +7343,7 @@ bus.subscribe((event) => {
                     if (!isCurrent())
                         return;
                     if (store.taskByThread(bot.id, event.threadId)?.activity !== "dead") {
-                        store.setTaskActivity(bot.id, event.threadId, "idle");
+                        store.setTaskActivity(bot.id, event.threadId, resourceOwner?.computerParkedOn !== undefined ? "parked.computer" : "idle");
                     }
                     directTurnBots.delete(event.threadId);
                     if (continueComputerSelection(event.threadId, generation, event.ok))
@@ -7060,6 +7354,7 @@ bus.subscribe((event) => {
                         retryDelegationsWaitingOn(bot.id);
                         drainQueuedSends();
                         drainConnectorResumes();
+                        drainComputerResumes();
                         drainSecretResumes();
                         drainTeamSetupResumes();
                         drainDelegationWakes();
@@ -7567,7 +7862,7 @@ function finalizeDelegationWatch(threadId, ok, reply = "", failureName = "Delega
     const source = watched.sourceBotId
         ? store.bot(watched.sourceBotId)
         : (watched.sourceThreadId ? store.botByThread(watched.sourceThreadId) : undefined);
-    if (source && target && !canReachPeer(source, target)) {
+    if (!watched.oneWay && source && target && !canReachPeer(source, target)) {
         ok = false;
         reply = "";
         failureName = "Result withheld: team or peer access changed while the teammate was working";
@@ -7585,6 +7880,16 @@ function finalizeDelegationWatch(threadId, ok, reply = "", failureName = "Delega
             result: ok ? reply : failureName,
         });
     }
+    if (watched.oneWay) {
+        if (!ok && store.taskByThread(watched.toBotId, threadId)) {
+            store.appendMessage(threadId, {
+                role: "bot",
+                kind: "activity",
+                tool: { name: `Send failed — ${failureName}`, ok: false, ...(watched.taskId ? { handoffId: watched.taskId } : {}) },
+            });
+        }
+        return true;
+    }
     let channel = watched.channelId ? store.group(watched.channelId) : undefined;
     let terminalThreadId = watched.sourceThreadId;
     if (source && watched.sourceThreadId) {
@@ -7728,7 +8033,7 @@ bus.subscribe((event) => {
 /** How a drained delegation becomes a real turn on the target. Shared by
  * the settle-time drain and the boot-time drain of what a previous process
  * left queued. */
-const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel, taskId, sourceBotId, openedThreadId) => {
+const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel, taskId, sourceBotId, openedThreadId, oneWay) => {
     // startTurn REJECTS on an ordinary condition — busy target, deleted bot,
     // unavailable provider. Unhandled, that rejection is fatal to the
     // harness (Node's default), which in the packaged app kills the server
@@ -7749,7 +8054,7 @@ const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel,
         ? { botId: opener.id, name: opener.name, unattended: unattended || undefined }
         : undefined;
     const text = openedThreadId && opener
-        ? withPeerProvenance(rawText, { botName: opener.name, delivery: "start_thread", unattended })
+        ? withPeerProvenance(rawText, { botName: opener.name, delivery: oneWay ? "send_to_bot" : "start_thread", unattended })
         : rawText;
     if (targetThreadId) {
         delegationWatch.set(targetThreadId, {
@@ -7761,6 +8066,7 @@ const runDelegatedTurn = (toBotId, rawText, commsDepth, sourceThreadId, channel,
             sourceBotId,
             routineRunId: activeRoutineRunForThread(sourceThreadId)?.id,
             startedAtMs: Date.now(),
+            ...(oneWay ? { oneWay: true } : {}),
         });
     }
     let failureReported = false;
@@ -7846,8 +8152,7 @@ bus.subscribe((event) => {
     // that turn queued to run anyway, minutes later, on an unrelated turn.
     if (!event.ok)
         discardDelegations(commsBus, event.threadId);
-    else
-        drainThreadDelegations(event.threadId);
+    drainThreadDelegations(event.threadId);
     // A settling bot frees itself as a delegation TARGET too: handoffs that
     // found it busy earlier were kept queued — waiting until it's free or the
     // 24-hour expiry, not counting retries — on their own source threads, and
@@ -7968,7 +8273,7 @@ function drainAsideLane() {
 }
 /** Keep a person's words off the transcript until a direct-thread slot is
  * available. Reuse the existing cancellable, idempotent composer queue. */
-async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger) {
+async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger, via) {
     const decision = admit("direct", {}, {
         // A room turn holds the bot exactly like the sibling opened-thread queue
         // below: the drain's own block check waits it out, so the words queue
@@ -7986,12 +8291,235 @@ async function startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId,
             prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
             sender,
             trigger,
+            via,
         });
         return { ok: true, queued: true, queueId: queued.id, threadId, reason: decision.reason };
     }
-    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender, trigger });
+    const message = await startTurn(botId, text, { threadId, replyTo, sendId, sender, trigger, via });
     return { ok: true, threadId, message };
 }
+/** Refusal from acceptDirectSend: the route turns it into its HTTP answer. */
+class DirectSendRefused extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(typeof body.error === "string" ? body.error : "send refused");
+        this.status = status;
+        this.body = body;
+    }
+}
+/** The refusals a direct send meets before it is sequenced, or null. */
+function directSendRefusal(botId, threadId) {
+    // The send is acknowledged before the turn starts, so a workspace at its
+    // spend limit is refused here, where the person can see it.
+    try {
+        assertWithinBudget(cfg, DATA_DIR);
+    }
+    catch (error) {
+        return new DirectSendRefused(409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
+    }
+    if (!store.taskByThread(botId, threadId)) {
+        return new DirectSendRefused(409, { error: "the bot switched tasks before it could receive the message" });
+    }
+    return null;
+}
+/** The one path a person's direct message takes into a bot turn: spend cap,
+ * idempotency, steer into a running turn, queue, or start. Used by
+ * POST /api/bots/:id/messages and by Live calls (via "call").
+ * `guardedStart` is POST /api/bots/:id/messages/guarded's own start, in
+ * place of steer, queue or start: it checks its preconditions against the
+ * task as it stands, then starts a turn or refuses. */
+async function acceptDirectSend(input, guardedStart) {
+    const { botId, threadId, text, sendId, replyTo, sender, trigger, via, personPresent } = input;
+    const refused = directSendRefusal(botId, threadId);
+    if (refused)
+        throw refused;
+    return sendSequencer.run(sendId ? `bot:${botId}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id), async () => {
+        if (sendId) {
+            if (cancelledChatFollowup("bot", botId, threadId, sendId)) {
+                throw Object.assign(new Error("this queued sendId was cancelled; send a new message to try again"), { status: 409 });
+            }
+            const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id);
+            if (accepted.kind === "conflict") {
+                throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
+            }
+            if (accepted.kind === "match") {
+                const canonical = {
+                    ok: true,
+                    threadId,
+                    message: accepted.message,
+                };
+                return accepted.message.steered
+                    ? { ...canonical, steered: true }
+                    : canonical;
+            }
+            const queued = queuedSteeredMessage(botId, threadId, sendId);
+            if (queued) {
+                if (queued.text !== text || queued.replyToId !== replyTo?.id) {
+                    throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
+                }
+                return { ok: true, queued: true, queueId: queued.id, threadId, reason: queued.reason };
+            }
+        }
+        const currentAtStart = store.projectBotForTask(botId, threadId);
+        if (!currentAtStart)
+            throw Object.assign(new Error("no such bot"), { status: 404 });
+        if (!store.taskByThread(currentAtStart.id, threadId)) {
+            throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
+        }
+        if (guardedStart)
+            return guardedStart(currentAtStart);
+        // Claude can accept the message inside its live turn. If the write
+        // loses a race with turn settlement, or the engine cannot steer, the
+        // existing server-side queue records it atomically for the next turn.
+        if (currentAtStart.busy) {
+            const instance = runningTurnInstance(currentAtStart, threadId);
+            let steered = "refused";
+            // A live text steer has no image side channel. Keep an attachment
+            // message intact for the next ordinary turn, where central image
+            // admission can hand it to the provider natively.
+            const carriesImages = extractTurnImages(text).images.length > 0;
+            const steerTarget = handoffs.current(threadId);
+            const busyAdmission = admit("direct-busy", {
+                carriesImages,
+                pendingComputerSelection: Boolean(computerSelectionTurns.get(threadId)?.selected),
+                engineCanSteer: Boolean(instance?.adapter.capabilities.queueing && instance.adapter.steer),
+            });
+            // steer was offered only when a live instance could take it;
+            // the second check carries that fact to the type system.
+            if (busyAdmission.action === "steer" && instance?.adapter.steer) {
+                steered = await instance.adapter
+                    .steer(threadId, promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"))
+                    .catch(() => "indeterminate");
+            }
+            // steer() is awaited adapter work. The turn can settle, the task can
+            // switch, or the whole bot can be deleted before its acknowledgement
+            // arrives. Re-read every ownership invariant before appending even a
+            // successful steer; otherwise that late acknowledgement writes a user
+            // message into a task the bot no longer owns. A conflict leaves the
+            // text in the client's composer/outbox to resend deliberately.
+            const current = store.projectBotForTask(botId, threadId);
+            if (!current)
+                throw Object.assign(new Error("no such bot"), { status: 404 });
+            if (!store.taskByThread(botId, threadId)) {
+                throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
+            }
+            const delivered = steered !== "refused";
+            if (delivered) {
+                if (steered === "steered" && !current.busy) {
+                    throw Object.assign(new Error("the running turn ended before the steered message could be recorded"), { status: 409 });
+                }
+                // "indeterminate" falls through to the same record: the words
+                // may already be folded into a turn whose acknowledgement was
+                // lost, and handing them back for a resend could run them
+                // twice. Recording them once is the honest outcome.
+                // A person steering a webhook turn is present, and auto mode may
+                // follow them again; words that do not prove a person never lift it.
+                if (personPresent)
+                    clearUnattended(threadId);
+                const message = store.appendMessage(threadId, {
+                    role: "user",
+                    kind: "text",
+                    text,
+                    replyToId: replyTo?.id,
+                    sendId,
+                    steered: true,
+                    sender,
+                    ...(via ? { via } : {}),
+                });
+                // Offered to the next turn again unless the person stops this one.
+                handoffs.steered(threadId, steerTarget, instance?.instanceId, message.id);
+                return { ok: true, steered: true, threadId, message };
+            }
+            if (!current.busy) {
+                return startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger, via);
+            }
+            const queued = queueSteeredMessage(current.id, threadId, text, {
+                replyToId: replyTo?.id,
+                sendId,
+                prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
+                sender,
+                trigger,
+                via,
+            });
+            return { ok: true, queued: true, queueId: queued.id, threadId };
+        }
+        return startOrQueueDirectMessage(botId, threadId, text, replyTo, sendId, sender, trigger, via);
+    });
+}
+/** A provider can finish its run before the owner answers. Persist that answer
+ * as a normal reply and run/queue it against the original conversation. */
+async function deliverLateQuestionAnswer(auth, threadId, requestId, answer, cardMessage, owner, via) {
+    const group = store.groupByThread(threadId);
+    const roomTarget = group
+        ? group.dm
+            ? group.threadId === threadId
+            : Boolean(store.groupTaskByThread(group.id, threadId))
+        : false;
+    if (group && (!roomTarget || !group.memberIds.includes(owner.id))) {
+        throw Object.assign(new Error("the bot that asked this question is no longer in this conversation"), { status: 409 });
+    }
+    if (!group && !store.taskByThread(owner.id, threadId)) {
+        throw Object.assign(new Error("the question's conversation no longer exists"), { status: 409 });
+    }
+    const text = group ? `@${owner.name}: ${answer}` : answer;
+    const sendId = `late-question-${createHash("sha256").update(`${threadId}:${requestId}`).digest("hex").slice(0, 32)}`;
+    const key = group
+        ? `group:${group.id}:${threadId}:${sendId}`
+        : `bot:${owner.id}:${threadId}:${sendId}`;
+    const receipt = await sendSequencer.run(key, sendFingerprint(text, cardMessage.id, group ? "chat" : undefined), async () => {
+        const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, cardMessage.id, group ? "chat" : undefined);
+        if (accepted.kind === "conflict")
+            throw Object.assign(new Error("this question already has a different recorded answer"), { status: 409 });
+        if (accepted.kind === "match")
+            return { queued: false };
+        const queuedDirect = group ? null : queuedSteeredMessage(owner.id, threadId, sendId);
+        if (queuedDirect) {
+            if (queuedDirect.text !== text || queuedDirect.replyToId !== cardMessage.id) {
+                throw Object.assign(new Error("this question already has a different queued answer"), { status: 409 });
+            }
+            return { queued: true };
+        }
+        const queuedRoom = group ? queuedChannelMessage(group.id, threadId, sendId) : null;
+        if (queuedRoom) {
+            if (queuedRoom.text !== text || queuedRoom.replyToId !== cardMessage.id || queuedRoom.mode !== "chat") {
+                throw Object.assign(new Error("this question already has a different queued answer"), { status: 409 });
+            }
+            return { queued: true };
+        }
+        const latestCard = store.messagesFor(threadId).find((message) => message.id === cardMessage.id)?.card;
+        if (!latestCard || latestCard.answered || latestCard.dismissed) {
+            throw Object.assign(new Error("this question has already been answered"), { status: 409 });
+        }
+        assertWithinBudget(cfg, DATA_DIR);
+        const sender = messageSender(auth);
+        const trigger = usageTriggerFor(auth);
+        if (group) {
+            const current = store.group(group.id);
+            if (!current || !roomTarget)
+                throw Object.assign(new Error("the room switched tasks before it could receive the answer"), { status: 409 });
+            if (groupIsWorking(current)) {
+                const queued = queueChannelMessage(current.id, threadId, text, {
+                    replyToId: cardMessage.id,
+                    sendId,
+                    mode: "chat",
+                    sender,
+                    trigger,
+                });
+                return { queued: true, queueId: queued.id };
+            }
+            startGroupTurn(current.id, text, cardMessage, sendId, "chat", undefined, { threadId, sender, trigger });
+            return { queued: false };
+        }
+        const direct = await startOrQueueDirectMessage(owner.id, threadId, text, cardMessage, sendId, sender, trigger, via);
+        return { queued: "queued" in direct && Boolean(direct.queued) };
+    });
+    const latest = store.messagesFor(threadId).find((message) => message.id === cardMessage.id)?.card;
+    if (latest && !latest.answered && !latest.dismissed) {
+        store.patchMessage(threadId, cardMessage.id, { card: { ...latest, answered: "answer", answeredText: answer, dismissed: false } });
+    }
+    return receipt;
+}
 /** How many start_thread calls one turn may make. Same spirit as the
  * create-bot ceiling above: a handful is a plan, more is a fan-out. */
 const MAX_THREADS_OPENED_PER_TURN = 5;
@@ -8277,6 +8805,7 @@ async function startTurn(botId, text, opts) {
     const policyRefusal = policyModelRefusal(instance);
     if (policyRefusal)
         throw Object.assign(new Error(policyRefusal), { status: 409, code: "managed_policy" });
+    const toolScope = toolScopeForTurn(bot.id);
     // On a Cloud home a guest's turn never gets a shell or reads outside its
     // own folder (docs/cloud-pro.md): an engine that cannot run it that way is
     // refused, in one plain line, before anything is recorded.
@@ -8319,7 +8848,14 @@ async function startTurn(botId, text, opts) {
                 .catch(() => undefined);
         }
     }
-    console.error(`[omb-turn] bot=${botId} text=${JSON.stringify(resolvedImages.text.slice(0, 70))} images=${turnImages.length} depth=${commsDepth} card=${Boolean(opts?.cardContinuation)}`);
+    // Spoken words never reach the log. A direct send says so itself; a
+    // drained queue (or a continuation) carries it on the user lines it runs.
+    const turnLineIds = new Set(opts?.excludeMessageIds ?? []);
+    const spoken = opts?.via === "call" || opts?.userMessage?.via === "call" ||
+        (turnLineIds.size > 0 && store.messagesFor(threadId).some((message) => turnLineIds.has(message.id) && message.via === "call"));
+    console.error(turnStartLogLine({
+        botId, text: resolvedImages.text, images: turnImages.length, depth: commsDepth, card: Boolean(opts?.cardContinuation), spoken,
+    }));
     const instanceId = instance.instanceId;
     if (providerInstancesChanging.has(instanceId)) {
         throw Object.assign(new Error("this provider account is being updated — try again shortly"), { status: 409 });
@@ -8357,6 +8893,8 @@ async function startTurn(botId, text, opts) {
                 sendId: opts?.sendId,
                 peerAsk: opts?.peerAsk,
                 sender: opts?.sender,
+                ...(opts?.via ? { via: opts.via } : {}),
+                ...(opts?.relayed ? { relayed: true } : {}),
             });
     }
     const recoveryUserMessageId = opts?.coordination
@@ -8471,6 +9009,7 @@ async function startTurn(botId, text, opts) {
                 retryDelegationsWaitingOn(bot.id);
                 drainQueuedSends();
                 drainConnectorResumes();
+                drainComputerResumes();
                 drainSecretResumes();
                 drainTeamSetupResumes();
                 drainDelegationWakes();
@@ -8759,7 +9298,7 @@ async function startTurn(botId, text, opts) {
              * desktop, not whatever localVmTargetForBot resolves to by the time
              * the first screen call arrives. */
             const claimAutoLocalVm = async (claimThreadId, pinnedTarget) => {
-                const localVmTarget = pinnedTarget ?? localVmTargetForThread(bot.id, claimThreadId);
+                const localVmTarget = pinnedTarget ?? localVmThreadTargets.get(claimThreadId) ?? { ...localVmTargetForThread(bot.id, claimThreadId) };
                 await bindTurnComputer(resourceOwner, `computer:vm:${localVmTarget.key}`, true);
                 if (localVmImageBusy || localVmModeChangeBusy || localVmLifecycleBusy.has(localVmTarget.key)) {
                     throw new Error("this Local VM is being started, stopped, or replaced — wait for setup to finish");
@@ -8783,6 +9322,8 @@ async function startTurn(botId, text, opts) {
                 // without this the exclusive lease would sit held for the rest of a
                 // turn that never got the VM — the very serialisation #1361 removes.
                 const dropLease = () => {
+                    if (localVmThreadTargets.get(claimThreadId) !== localVmTarget)
+                        return;
                     localVmLeaseFor(localVmTarget).release(claimThreadId);
                     if (localVmActiveThreads.get(localVmTarget.key) === claimThreadId)
                         localVmActiveThreads.delete(localVmTarget.key);
@@ -8839,6 +9380,22 @@ async function startTurn(botId, text, opts) {
             const surfaceLazyClaimRejection = (label) => (failure) => {
                 if (activeInternalGenerationByThread.get(threadId) !== resourceOwner.generation || !threadBusy(bot.id, threadId))
                     return;
+                // The wait ceiling parked this turn (#1651): register the resume and
+                // settle the live turn. No error entry, no incident — the parked chip
+                // the wait appended is the whole story. The slot still fails, so the
+                // gate keeps refusing screen calls for the rest of this generation
+                // while the interrupt lands.
+                if (resourceOwner.computerParkedOn) {
+                    registerComputerResume({
+                        botId: bot.id,
+                        threadId,
+                        resource: resourceOwner.computerParkedOn,
+                        generation: resourceOwner.generation,
+                        afterMessageId: store.activePath(threadId).findLast((entry) => entry.role === "user")?.id,
+                    });
+                    void interruptDirectThread(bot.id, threadId, { preserveComputerResume: true }).catch(() => { });
+                    return;
+                }
                 const message = `computer unavailable — ${label} could not be claimed for this turn (${failure})`;
                 store.appendMessage(threadId, {
                     role: "bot",
@@ -8876,7 +9433,7 @@ async function startTurn(botId, text, opts) {
                     if (!localVmSeen.has(poolCandidate.key) && !opts?.automationSource)
                         return false;
                 }
-                const localVmTarget = localVmTargetForThread(bot.id, threadId);
+                const localVmTarget = { ...localVmTargetForThread(bot.id, threadId) };
                 let lazyReadyVm = null;
                 if (!strict) {
                     // Nothing this process has ever seen for this target, and nobody is
@@ -8939,9 +9496,13 @@ async function startTurn(botId, text, opts) {
                     return true;
                 }
                 catch (error) {
-                    if (strict)
+                    // A wait ceiling settled this turn as parked, not as an unavailable
+                    // Auto destination. Let dispatch register its resume instead of
+                    // continuing the provider without the requested computer.
+                    if (strict || error instanceof ComputerWaitParked)
                         throw error;
-                    releaseLocalVmThread(threadId);
+                    if (directTurnGenerationByThread.get(threadId) === dispatchClaimId)
+                        releaseLocalVmThread(threadId);
                     return false;
                 }
             };
@@ -9264,7 +9825,9 @@ async function startTurn(botId, text, opts) {
                 // never redoes — or forgets — what another one already did
                 { id: "recent", label: "Recent work", text: recentWorkPrompt(recentWork(recentWorkSources(bot), bot, { userName: cfg.profile?.name?.trim() || "User", currentThreadId: threadId, ...recentWorkFilter() })) },
                 { id: "memory", label: "Memory", text: memorySystemPrompt(bot.id, { managedWrites: Boolean(integrations.agents), fileTools: worksInWorkspace, enabled: bot.memoryEnabled !== false }) },
-                { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id) : "" },
+                // liveBot was captured before awaited setup work; an assignment PUT
+                // in that window must still reach this turn's prompt.
+                { id: "skills", label: "Skills index", text: privateWorkspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? (store.bot(bot.id)?.assignedSkills ?? bot.assignedSkills) : undefined) : "" },
                 { id: "skill-instructions", label: "Skill instructions", text: skillInstructions },
                 { id: "playbooks", label: "Playbooks", text: packagePlaybooks },
                 { id: "webhook", label: "Webhook provenance", text: opts?.automationSource === "webhook" ? WEBHOOK_PROMPT : "" },
@@ -9308,6 +9871,7 @@ async function startTurn(botId, text, opts) {
                 refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: approvalModeForTurn(bot, commsDepth > 0, threadId),
+                toolScope,
                 ...(guestConfined ? { guestConfined: true, confinedWhy: confinedWhy(threadId) } : {}),
                 model,
                 effort,
@@ -9382,6 +9946,7 @@ async function startTurn(botId, text, opts) {
                 retryDelegationsWaitingOn(bot.id);
                 drainQueuedSends();
                 drainConnectorResumes();
+                drainComputerResumes();
                 drainSecretResumes();
                 drainTeamSetupResumes();
                 drainDelegationWakes();
@@ -9427,6 +9992,7 @@ async function startTurn(botId, text, opts) {
                 if (ownsLatestGeneration) {
                     drainQueuedSends();
                     drainConnectorResumes();
+                    drainComputerResumes();
                     drainSecretResumes();
                     drainTeamSetupResumes();
                     drainDelegationWakes();
@@ -9437,6 +10003,31 @@ async function startTurn(botId, text, opts) {
                 settleDirectFollowup(dispatchClaimId);
                 return;
             }
+            if (e instanceof ComputerWaitParked) {
+                settleDirectFollowup(dispatchClaimId, { ok: false, text: e.message });
+                registerComputerResume({
+                    botId: bot.id,
+                    threadId,
+                    resource: e.resource,
+                    generation: e.generation,
+                    afterMessageId: store.activePath(threadId).findLast((entry) => entry.role === "user")?.id,
+                });
+                // Settled as parked, not failed (#1651): the chip the wait appended
+                // is the whole transcript story, and the registered resume owns what
+                // happens next on this thread.
+                if (store.taskByThread(bot.id, threadId)?.activity !== "dead") {
+                    store.setTaskActivity(bot.id, threadId, "parked.computer");
+                }
+                directTurnBots.delete(threadId);
+                retryDelegationsWaitingOn(bot.id);
+                drainQueuedSends();
+                drainConnectorResumes();
+                drainComputerResumes();
+                drainSecretResumes();
+                drainTeamSetupResumes();
+                drainDelegationWakes();
+                return;
+            }
             let message = e instanceof Error ? e.message : String(e);
             const backup = cfg.automaticRecovery?.enabled ? cfg.automaticRecovery.backup : undefined;
             const current = store.projectBotForTask(bot.id, threadId);
@@ -9481,13 +10072,12 @@ async function startTurn(botId, text, opts) {
             settleDirectFollowup(dispatchClaimId, { ok: false, text: message });
             // The wait already wrote its failure resolution; keep all dispatch
             // failure bookkeeping below without adding the same error twice.
-            if (!(e instanceof ComputerWaitGaveUp))
-                store.appendMessage(threadId, {
-                    role: "bot",
-                    kind: "activity",
-                    turnSucceeded: false,
-                    tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
-                });
+            store.appendMessage(threadId, {
+                role: "bot",
+                kind: "activity",
+                turnSucceeded: false,
+                tool: { name: `error: ${message.slice(0, 160)}`, ok: false },
+            });
             // Worth a buzz for the same reason a routine failure is, and the rule
             // notify.ts encodes: the bot is not working, and the cause is usually
             // a setting only a person can change — an unattended user would
@@ -9510,6 +10100,7 @@ async function startTurn(botId, text, opts) {
             // drain would strand anything queued behind this turn
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
             drainDelegationWakes();
@@ -10304,8 +10895,24 @@ const tighteningRequests = new TighteningRequestService({
     // The card judges the effective mounts, so the snapshot resolves the same
     // way the engine does: through the config-aware custom-server filter.
     mountedMcpServers: (bot) => Object.keys(engineMcpServers(bot)),
-    enabledSkills: (botId) => listSkills(botId).filter((skill) => skill.enabled).map((skill) => skill.name),
+    enabledSkills: (botId) => {
+        const record = store.bot(botId);
+        return (record ? listBotSkills(record) : listSkills(botId)).filter((skill) => skill.enabled).map((skill) => skill.name);
+    },
     disableSkill: (botId, name) => {
+        const record = store.bot(botId);
+        // Private skills win collisions, including disabled/private copies.
+        // Disabling one must not reveal a same-named shared skill instead.
+        if (skillsLibraryEnabled(cfg) && !listSkills(botId).some((skill) => skill.name === name)
+            && record?.assignedSkills?.includes(name)) {
+            try {
+                const saved = store.patchBot(botId, { assignedSkills: record.assignedSkills.filter((assigned) => assigned !== name) });
+                return saved ? { ok: true } : { ok: false, error: "that bot no longer exists" };
+            }
+            catch (error) {
+                return { ok: false, error: error instanceof Error ? error.message : String(error) };
+            }
+        }
         const disabled = setSkillEnabled(botId, name, false);
         return typeof disabled === "object" && "error" in disabled ? { ok: false, error: disabled.error } : { ok: true };
     },
@@ -10414,7 +11021,7 @@ async function resolveAndSendTeamSetup(res, args, ownerReview) {
     if (!card)
         return false;
     if (args.behavior === "allow" && !ownerReview) {
-        json(res, 403, { error: "Approve team setup or deletion from the desktop app or a paired owner device. In a local browser, wait until every bot is idle." });
+        json(res, 403, { error: "Approve team setup or deletion from the desktop app or a paired Full-access device. In a local browser, wait until every bot is idle." });
         return true;
     }
     if (args.behavior === "allow" && !card.answered && !card.dismissed && !card.expired) {
@@ -11041,6 +11648,7 @@ setupRetry = 0) {
         const readyBot = store.bot(bot.id);
         if (!readyBot)
             return false;
+        toolScopeForTurn(readyBot.id);
         const readyGroup = store.group(group.id);
         const stillOwnsThread = readyGroup?.dm
             ? readyGroup.threadId === threadId
@@ -11403,7 +12011,9 @@ setupRetry = 0) {
             // mounted, exactly as the 1:1 path decides it: memory_update is on the
             // agents server, so a room turn with it must be told to use it too.
             { id: "memory", label: "Memory", text: roomMemory ? `\n${roomMemory.trim()}` : "" },
-            { id: "skills", label: "Skills index", text: workspace ? skillsSystemPrompt(bot.id) : "" },
+            // readyBot was captured before awaited setup work; an assignment PUT in
+            // that window must still reach this turn's prompt.
+            { id: "skills", label: "Skills index", text: workspace ? skillsSystemPrompt(bot.id, skillsLibraryEnabled(cfg) ? (store.bot(bot.id)?.assignedSkills ?? bot.assignedSkills) : undefined) : "" },
             { id: "skill-instructions", label: "Skill instructions", text: renderSkillInstructions(selectedSkills, { includeRoot: Boolean(workspace) }) },
             { id: "playbooks", label: "Playbooks", text: installedPlaybookInstructions(text, bot.playbooks) },
         ]);
@@ -11530,6 +12140,7 @@ setupRetry = 0) {
                 refreshSystemPrompt: true,
                 images: turnImages,
                 approvalMode: roomTurnApprovalMode(readyBot, threadId, orchestration),
+                toolScope: toolScopeForTurn(readyBot.id),
                 ...(roomGuestConfined ? { guestConfined: true, confinedWhy: confinedWhy(threadId) } : {}),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
@@ -11612,6 +12223,7 @@ setupRetry = 0) {
             watchdog.settle(threadId);
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
             return false;
@@ -11642,6 +12254,7 @@ setupRetry = 0) {
                     retryDelegationsWaitingOn(bot.id);
                     drainQueuedSends();
                     drainConnectorResumes();
+                    drainComputerResumes();
                     drainSecretResumes();
                     drainTeamSetupResumes();
                 }
@@ -11670,6 +12283,7 @@ setupRetry = 0) {
             // queued while this bot briefly owned the room must be retried now.
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
         }
@@ -11735,15 +12349,35 @@ setupRetry = 0) {
             return false;
         const isSpendCap = typeof error === "object" && error !== null && error.code === "spend_cap";
         const isVariantError = typeof error === "object" && error !== null && error.code === "unsupported_model_variant";
-        if (!roomSpeaker && !isSpendCap && !isVariantError)
+        const isToolScopeError = typeof error === "object" && error !== null && error.code === "tool_scope";
+        if (error instanceof ComputerWaitParked) {
+            registerComputerResume({
+                botId: bot.id,
+                threadId,
+                resource: error.resource,
+                generation: error.generation,
+                afterMessageId: store.activePath(threadId).findLast((entry) => entry.role === "user")?.id,
+            });
+            // The room settles with the parked chip the wait appended (#1651);
+            // the registered resume re-runs the speaker turn through the group
+            // queue once the seat frees. "parked" is its own outcome, not "busy":
+            // the member never ran, an in-step retry would only wait the ceiling
+            // out again and burn goal turns, and the goal loop routes around the
+            // member while the registered resume owns the re-run.
+            if (orchestration) {
+                orchestration.result.outcome = "parked";
+                orchestration.result.stopReason = `${bot.name} parked waiting for the computer`;
+            }
+            return false;
+        }
+        if (!roomSpeaker && !isSpendCap && !isVariantError && !isToolScopeError)
             throw error;
         const message = error instanceof Error ? error.message : "Local VM setup failed";
-        if (!(error instanceof ComputerWaitGaveUp))
-            store.appendMessage(threadId, {
-                role: "bot", kind: "activity",
-                from: { botId: bot.id, name: bot.name, color: bot.color },
-                tool: { name: `error: ${message}`, ok: false },
-            });
+        store.appendMessage(threadId, {
+            role: "bot", kind: "activity",
+            from: { botId: bot.id, name: bot.name, color: bot.color },
+            tool: { name: `error: ${message}`, ok: false },
+        });
         onDispatchError?.(message);
         if (orchestration) {
             // A spend-cap refusal is deterministic: record it as its own
@@ -11753,7 +12387,7 @@ setupRetry = 0) {
             if (isSpendCap)
                 orchestration.result.stopReason = message;
         }
-        return false;
+        return isToolScopeError;
     }
     finally {
         // Covers connector/setup failures, cancellation before dispatch, and all
@@ -11774,6 +12408,7 @@ setupRetry = 0) {
             }
             drainQueuedSends();
             drainConnectorResumes();
+            drainComputerResumes();
             drainSecretResumes();
             drainTeamSetupResumes();
         }
@@ -11832,6 +12467,12 @@ async function runGroupGoalStep(args) {
                         coordinatorTurn.turnId = turnId;
                 },
             });
+            // Busy here is a lost claim race — a 1:1 re-claiming the bot between
+            // the wait settling and this turn starting — so wait and retry
+            // in-step. A parked member is deliberately absent from both this
+            // retry and the transient one below: the computer seat is still held,
+            // an immediate retry would wait the ceiling out again while the
+            // registered resume already owns re-running the member.
             if (result.outcome === "busy")
                 continue;
             // One retry for a transient provider failure: a 13-turn goal must not
@@ -11935,6 +12576,13 @@ async function runGroupGoalOperation(args) {
             finishGroupGoalRun(args.groupId, args.operation, "blocked", `${coordinatorResult.stopReason ?? `${args.coordinator.name} stayed busy`} — send the goal again when they are free.`);
             return;
         }
+        if (coordinatorResult.outcome === "parked") {
+            // The lead parked at the computer wait ceiling: like lead-busy, the
+            // run cannot route around them, but the parked lead turn itself
+            // resumes through the registered entry once the seat frees.
+            finishGroupGoalRun(args.groupId, args.operation, "blocked", `${coordinatorResult.stopReason ?? `${args.coordinator.name} parked waiting for the computer`} — send the goal again when the computer is free.`);
+            return;
+        }
         if (!coordinatorResult.ran || coordinatorResult.outcome !== "settled") {
             const reason = coordinatorResult.stopReason?.trim().slice(0, 120);
             finishGroupGoalRun(args.groupId, args.operation, "failed", `${args.coordinator.name} could not complete the coordination step${reason ? ` — ${reason}` : ""}.`);
@@ -11992,9 +12640,10 @@ async function runGroupGoalOperation(args) {
             finishGroupGoalRun(args.groupId, args.operation, "blocked", workerResult.stopReason ?? `${workerBot.name} hit the workspace spend cap.`);
             return;
         }
-        if (workerResult.outcome === "busy") {
-            // bounded: a team that keeps landing on busy teammates is blocked, not
-            // looping — three exhausted waits per run, then stop and say so
+        if (workerResult.outcome === "busy" || workerResult.outcome === "parked") {
+            // bounded: a team that keeps landing on busy or computer-parked
+            // teammates is blocked, not looping — three exhausted waits per run,
+            // then stop and say so
             waitExhaustions += 1;
             if (waitExhaustions >= GROUP_GOAL_MAX_WAIT_EXHAUSTIONS) {
                 finishGroupGoalRun(args.groupId, args.operation, "blocked", `Teammates stayed busy past the wait limit ${waitExhaustions} times — try again when the team is free.`);
@@ -12889,6 +13538,95 @@ function drainConnectorResumes() {
         dispatchConnectorResume(entry);
     }
 }
+const pendingComputerResumes = new Map();
+function registerComputerResume(entry) {
+    // One per thread: the newest park replaces an older one.
+    pendingComputerResumes.set(entry.threadId, entry);
+    // The seat may already be free (it freed before this park registered):
+    // an idle install would otherwise never drain. #1651.
+    queueMicrotask(drainComputerResumes);
+}
+function markComputerResumeFailed(entry, message) {
+    const owner = connectorThread(entry.botId, entry.threadId);
+    if (!owner)
+        return;
+    store.appendMessage(entry.threadId, {
+        role: "bot", kind: "activity",
+        ...(owner.group ? { from: { botId: owner.bot.id, name: owner.bot.name, color: owner.bot.color } } : {}),
+        tool: { name: `Parked turn could not continue: ${message.slice(0, 160)}`, ok: false },
+    });
+}
+function dispatchComputerResume(entry) {
+    const owner = connectorThread(entry.botId, entry.threadId);
+    if (!owner)
+        return;
+    const prompt = "OpenMausBot computer update: the computer this conversation waited for is free again. Continue the task that parked waiting for it.";
+    if (owner.group) {
+        const groupId = owner.group.id;
+        const operation = beginGroupTurnOperation(groupId, entry.threadId, [entry.botId]);
+        const previous = groupQueues.get(groupId) ?? Promise.resolve();
+        const next = previous.then(async () => {
+            if (operation.cancelled)
+                return;
+            const current = connectorThread(entry.botId, entry.threadId);
+            if (!current?.group)
+                return;
+            if (current.bot.busy) {
+                pendingComputerResumes.set(entry.threadId, entry);
+                return;
+            }
+            await runGroupMemberTurn(current.group.id, entry.threadId, entry.botId, 0, new Set(), prompt, (message) => markComputerResumeFailed(entry, message), () => operation.cancelled, () => groupProviderHandshakeStarted(operation), () => groupProviderHandshakeSettled(operation));
+        });
+        const tracked = next.finally(() => finishGroupTurnOperation(groupId, operation));
+        groupQueues.set(groupId, tracked.catch((error) => {
+            markComputerResumeFailed(entry, error instanceof Error ? error.message : String(error));
+        }));
+        return;
+    }
+    void startTurn(entry.botId, prompt, {
+        threadId: entry.threadId,
+        cardContinuation: true,
+        onDispatchError: (message) => markComputerResumeFailed(entry, message),
+    }).catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
+        if (isTurnAdmissionBlocked(error))
+            pendingComputerResumes.set(entry.threadId, entry);
+        else
+            markComputerResumeFailed(entry, message);
+    });
+}
+function drainComputerResumes() {
+    for (const [key, entry] of pendingComputerResumes) {
+        if (!connectorThread(entry.botId, entry.threadId)) {
+            pendingComputerResumes.delete(key);
+            continue;
+        }
+        // A newer ask replaced the parked work: the resume is stale, not blocked.
+        const latestUser = store.activePath(entry.threadId).findLast((message) => message.role === "user")?.id;
+        if (entry.afterMessageId !== undefined && latestUser !== entry.afterMessageId) {
+            pendingComputerResumes.delete(key);
+            continue;
+        }
+        // A newer generation owns the thread — a new turn superseded the parked
+        // one — so the parked resume is stale too. The parked turn's OWN
+        // generation is still current while it settles: the lazy-claim park
+        // registers its resume before the interrupt lands, and a drain in that
+        // window must keep the entry (#1651), not read busy as superseded.
+        const activeGeneration = activeInternalGenerationByThread.get(entry.threadId);
+        if (activeGeneration !== undefined && activeGeneration !== entry.generation) {
+            pendingComputerResumes.delete(key);
+            continue;
+        }
+        // Busy under the parked generation: the turn is still settling. Keep the
+        // entry; the next drain (its completion, the next release) dispatches.
+        if (threadBusy(entry.botId, entry.threadId))
+            continue;
+        if (!turnResources.free(entry.resource))
+            continue;
+        pendingComputerResumes.delete(key);
+        dispatchComputerResume(entry);
+    }
+}
 const pendingSecretResumes = new Map();
 const phoneSecretSubmissions = new PhoneSecretSubmissionRegistry();
 function claimPhoneSecretBotDeletion(botId) {
@@ -13120,6 +13858,7 @@ bus.subscribe((event) => {
         return;
     if (event.type === "turn.completed") {
         drainConnectorResumes();
+        drainComputerResumes();
         drainSecretResumes();
         drainTeamSetupResumes();
     }
@@ -13183,34 +13922,15 @@ async function localVmPayload(target, auth) {
     const status = await containerComputerStatus(undefined, undefined, target);
     return {
         ...localVmViewerStatus(status, auth),
+        stop_reason: localVmStopReason(target.key, status),
         commands: setupCommands(status.runtime, process.platform, target),
         idle_timeout_ms: localVmIdleMs(),
         mode: localVmMode(cfg),
         max_instances: localVmMaxInstances(cfg),
     };
 }
-/** The Local VM a turn is about to use, recreated if the idle timer took it.
- *
- * `LocalVmIdleTimer` REMOVES an unused Local VM rather than pausing it. The
- * turn then failed with "Create the Local VM (App Settings → Local VM)" —
- * which reads like a fault the person must repair by hand, for a container the
- * app itself deleted eight hours earlier. Someone who steps away overnight
- * comes back to an error on their first message.
- *
- * The cloud branch below already does the opposite: an absent boat is
- * provisioned on first use behind a `provisioning` broadcast. This gives the
- * Local VM the same lifecycle for the same reason.
- *
- * Only `missing` is recovered, and only when a fresh `run` is all it takes.
- * Every other problem still surfaces: no runtime installed, no image pulled,
- * `create_supported` false, or an existing container that is stale, unmanaged
- * or unsafe. Those need a decision — install podman, download 1.4 GB, replace
- * a container someone else made — and a stopped container is deliberately not
- * resumed here, because `localVmProblem` says this desktop image cannot safely
- * resume and asks for a recreate rather than a start. Per-bot mode keeps its
- * instance cap; creating past it would quietly do what the lifecycle route
- * refuses.
- */
+/** Wake an idle desktop, or recreate a missing one from an already prepared
+ * image. Incompatible or unsafe containers still require an explicit decision. */
 async function readyLocalVmForTurn(botId, target, isCurrent = () => true) {
     localVmLifecycleBusy.add(target.key);
     // Fence this target, and the cross-target capacity decision for creates,
@@ -13230,21 +13950,22 @@ async function readyLocalVmForTurn(botId, target, isCurrent = () => true) {
         noteLocalVmSeen(target, status);
         if (!isCurrent())
             return status;
-        if (status.ready || !localVmRecreatableOnDemand(status))
+        const action = localVmWakeAction(status);
+        if (status.ready || !action || !status.runtime)
             return status;
         // Another creation is already mid-flight and its container is not yet
         // visible to a count, so the safe answer is the inspected status —
         // exactly what the over-cap path below returns.
-        if (!pooled && !ownsProvision)
+        if (action === "run" && !pooled && !ownsProvision)
             return status;
-        if (target.key.startsWith("bot:")) {
+        if (action === "run" && target.key.startsWith("bot:")) {
             const count = await existingPerBotLocalVmCount(status.runtime);
             if (!isCurrent() || count >= localVmMaxInstances(cfg))
                 return status;
         }
         broadcast({ kind: "computer", botId, state: "provisioning" });
         try {
-            status = await containerComputerAction("run", undefined, undefined, target);
+            status = await containerComputerAction(action, undefined, undefined, target);
         }
         catch {
             // Keep the inspected status: its `problem` names the real obstacle,
@@ -13312,6 +14033,7 @@ function configStatus() {
     return {
         xai: { configured: Boolean(cfg.xai?.key) },
         mistral: { configured: Boolean(cfg.mistral?.key) },
+        cerebras: { configured: Boolean(cfg.cerebras?.key) },
         anthropic: { configured: Boolean(cfg.anthropic?.key), everyClaudeBot: cfg.anthropic?.everyClaudeBot !== false },
         openai: { configured: Boolean(cfg.openai?.key) },
         openrouter: { configured: Boolean(cfg.openrouter?.key) },
@@ -13344,6 +14066,8 @@ function configStatus() {
         // the decision model: switches and configured-or-not, never the key
         decider: describeDecider(cfg),
         imageGen: avatarImageStatus(cfg),
+        // Live calls: configured-or-not only; the voice name is a setting
+        live: liveSettingsFor(cfg),
         // not a secret — the sidebar shows it
         profile: { name: cfg.profile?.name ?? "", email: cfg.profile?.email ?? "", aboutMe: cfg.profile?.aboutMe ?? "" },
         // the enrolled organisation's read-only desktop policy; null when not enrolled
@@ -13369,6 +14093,7 @@ function configStatus() {
         },
         features: {
             skillAuthoring: skillAuthoringEnabled(cfg),
+            skillsLibrary: skillsLibraryEnabled(cfg),
             showToolCalls: showToolCallsEnabled(cfg),
             routinesInConversation: routinesInConversationEnabled(cfg),
             browser: builtInBrowserEnabled(cfg),
@@ -13670,6 +14395,7 @@ async function reloadProviders() {
     // queued behind them drains now — onto the freshly loaded fleet
     drainQueuedSends();
     drainConnectorResumes();
+    drainComputerResumes();
     drainSecretResumes();
     drainTeamSetupResumes();
 }
@@ -13826,6 +14552,102 @@ ROUTES.push(createAntigravityLeftoverRoutes({
     remove: () => removeAntigravityLeftovers(),
 }));
 ROUTES.push(desktopViewer.route);
+// Live calls (GPT-Live as the voice, the bot as the brain). A client holds
+// the WebRTC audio; the harness creates the session with the key (which
+// never leaves it) and runs the call in LiveCallController.
+/** Who the voice speaks for, for its instructions. */
+function liveBotFor(botId) {
+    const bot = store.bot(botId);
+    if (!bot)
+        throw new LiveSessionError("That bot no longer exists.", 404);
+    return { name: bot.name, title: bot.title, description: bot.description };
+}
+/** The chat's text so far, so the voice can follow "and the other one?". */
+function liveHistoryFor(threadId) {
+    return store.activePath(threadId)
+        .filter((message) => message.kind === "text" && typeof message.text === "string" && (message.role === "user" || message.role === "bot"))
+        .map((message) => ({ role: message.role === "user" ? "user" : "assistant", text: message.text ?? "" }));
+}
+/** A call outlives the request that started it: a signed-out or removed
+ * person's call must not keep reaching the bot (or spending the key). */
+function liveSignedIn(auth) {
+    return auth.kind !== "session" || sessions.isLive(auth.session.id);
+}
+const liveCalls = new LiveCallController({
+    store,
+    send: async ({ auth, botId, threadId, text }) => {
+        // the controller ends the call on this error
+        if (!liveSignedIn(auth))
+            throw new LiveCallSignedOutError();
+        const receipt = await acceptDirectSend({
+            botId, threadId, text,
+            sendId: randomUUID().replaceAll("-", ""),
+            sender: messageSender(auth),
+            trigger: usageTriggerFor(auth),
+            via: "call",
+            // a person is on the call: these are their words
+            personPresent: true,
+        });
+        if ("queued" in receipt)
+            return { kind: "queued", queueId: receipt.queueId };
+        return { kind: receipt.steered ? "steered" : "started", messageId: receipt.message.id };
+    },
+    respond: async (input) => {
+        const result = await respondToCard(input);
+        if (result.ok)
+            return { ok: true };
+        // respondToCard's 401: the session that started the call has ended
+        if (result.status === 401)
+            throw new LiveCallSignedOutError();
+        return { ok: false, error: result.error };
+    },
+    // send() queues through the steer queue; an edit or cancel there removes a request undelivered
+    queued: isSteeredMessageQueued,
+    signedIn: liveSignedIn,
+    // the caller's own typed lines carry this sender (none for the owner)
+    personKey: (auth) => messageSender(auth)?.id,
+    activity: (botId, threadId) => {
+        const task = store.taskByThread(botId, threadId);
+        if (!task?.busy)
+            return "idle";
+        return task.activity === "waiting-on-you" ? "waiting" : "working";
+    },
+    broadcast: (frame) => broadcast(frame, { adminOnly: true }),
+    settings: () => ({ key: cfg.live?.key ?? "", ...liveSettingsFor(cfg) }),
+    createSession: ({ key, sdp, botId, threadId, voice }) => createLiveSession({ key, sdp, voice, bot: liveBotFor(botId), history: liveHistoryFor(threadId) }),
+    // Node's WebSocket (undici) accepts headers in its second argument.
+    openSocket: (url, key) => new WebSocket(url, { headers: { authorization: `Bearer ${key}` } }),
+    attachUrl: (sessionId) => liveAttachUrl(sessionId),
+    speakable: (text) => toUtterances(text),
+    log: (line) => console.log(line),
+});
+// A signed-out or revoked sign-in ends the call it started at once (the idle
+// check would only notice within 15 s). A paired phone's unpairing arrives
+// from the companion instead (POST /api/live/device-revoked).
+sessions.onSessionRevoked((sessionId) => liveCalls.sessionRevoked(sessionId));
+ROUTES.push(createLiveRoutes({
+    calls: liveCalls,
+    resolveTarget: (botId, threadId) => {
+        const bot = store.bot(botId);
+        if (!bot)
+            return null;
+        const target = threadId ?? bot.threadId;
+        if (store.botByThread(target)?.id !== bot.id)
+            return null;
+        return { botId: bot.id, botName: bot.name, threadId: target };
+    },
+    settings: () => liveSettingsFor(cfg),
+    // Non-secret settings only, written the way PUT /api/config writes a
+    // section: saveConfig merges into `live`, so the key stays where it is.
+    saveSettings: async (patch) => {
+        if (providerConfigBusy)
+            throw Object.assign(new Error("Settings are already being updated. Try again in a moment."), { status: 409 });
+        saveConfig({ live: patch });
+        Object.assign(cfg, loadConfig());
+        broadcast({ kind: "config", ...configStatus() });
+        return liveSettingsFor(cfg);
+    },
+}));
 const toolResults = new ToolResults();
 const handleRequest = async (req, res) => {
     let url;
@@ -13882,7 +14704,7 @@ const handleRequest = async (req, res) => {
         if (method === "GET" && !path.startsWith("/api/") && !path.startsWith("/.well-known/") && serveStatic(res, path))
             return;
         if (method === "GET" && path === "/.well-known/openmausbot/environment") {
-            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled() }));
+            return json(res, 200, environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !HOSTED_WORKSPACE && !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled(), cloudHome: Boolean(CLOUD_HOME) }));
         }
         const domainCheck = /^\/\.well-known\/openmausbot\/domain-check\/([a-f0-9]{64})$/.exec(path);
         if (method === "GET" && domainCheck) {
@@ -13981,7 +14803,7 @@ const handleRequest = async (req, res) => {
                 console.warn(`pairing refused from ${requestSource(req)}: ${result.error}`);
                 return json(res, result.status, { error: result.error });
             }
-            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled() });
+            const environment = environmentDescriptor({ environmentId: ENVIRONMENT_ID, desktopManaged: DESKTOP_MANAGED, emailSignIn: !CLOUD_HOME && emailSignIn.enabled(), sharedComputers: lendingEnabled(), cloudHome: Boolean(CLOUD_HOME) });
             if (wantsCookie) {
                 // A browser sign-in replaces this browser's own session here, if it had one, rather than leaving it behind.
                 const previous = browser ? sessions.authenticate(parseCookies(req.headers.cookie).get(SESSION_COOKIE)) : null;
@@ -15252,7 +16074,7 @@ const handleRequest = async (req, res) => {
                     return json(res, 403, { error: "source conversation does not belong to sender" });
                 }
                 return json(res, 200, {
-                    skills: listSkills(from.id),
+                    skills: listBotSkills(from),
                     staged: listStagedSkillWrites(from.id).map(stagedSkillListing),
                 });
             }
@@ -15907,9 +16729,7 @@ const handleRequest = async (req, res) => {
                                 if (!task)
                                     throw new Error("The recipient no longer exists");
                                 target.threadId = createdThread = task.threadId;
-                                if (delegatedFullAccess(internalSender, internalCapability.threadId, store.bot(target.botId))) {
-                                    grantDelegatedFullAccess(internalSender, store.bot(target.botId), target.threadId);
-                                }
+                                applyDelegatedLevel(internalSender, internalCapability.threadId, store.bot(target.botId), target.threadId);
                             }
                             const { node, duplicate } = roomHandoffs.enqueue(address, internalCapability.generation, internalCapability.roomHandoffId, target, parsed.data.requestKey + ":" + target.botId, parsed.data.message, approvalGranted, parsed.data.rework, [...store.messagesFor(address.threadId)].reverse().find(m => m.role === "user" && m.kind === "text")?.text ?? "", destination ? parsed.data.requestKey : undefined);
                             // A retry keeps its original task; discard the speculative row.
@@ -16180,11 +17000,15 @@ const handleRequest = async (req, res) => {
                 const target = store.bot(toBotId);
                 if (!target)
                     return json(res, 404, { error: "no such bot" });
+                const oneWay = body.oneWay === true;
+                if (oneWay && target.id === from.id) {
+                    return json(res, 409, { error: "send_to_bot is cross-bot only; use start_thread to send independent work to yourself" });
+                }
                 if (internalCapability.roomCoordination) {
-                    if (target.id !== from.id) {
+                    if (target.id !== from.id && !oneWay) {
                         return json(res, 409, { error: "Use coordinate_bots for teamwork; it queues actual teammates and resumes you automatically." });
                     }
-                    if (!internalCapability.ownThreadCreation) {
+                    if (target.id === from.id && !internalCapability.ownThreadCreation) {
                         return json(res, 409, { error: "Only a direct user request can open separate self-owned threads. Finish this assigned work here; use coordinate_bots for teammates." });
                     }
                 }
@@ -16236,7 +17060,7 @@ const handleRequest = async (req, res) => {
                 // classic handoff has applies unchanged, here at queue time and
                 // again in the drain at dispatch time.
                 const depth = internalCapability.depth;
-                if (depth >= MAX_COMMS_DEPTH) {
+                if (!oneWay && depth >= MAX_COMMS_DEPTH) {
                     return json(res, 200, { error: "thread chains are limited to one hop — open the thread on yourself, or do this one here" });
                 }
                 if (!canAccessTeam(from, target.section) || target.hidden) {
@@ -16250,9 +17074,11 @@ const handleRequest = async (req, res) => {
                     return json(res, 500, { error: "couldn't create that thread" });
                 // The work is still for the person whose request the opener is on.
                 threadStarters.set(task.threadId, openerFrom(fromThreadId));
-                if (delegatedFullAccess(from, fromThreadId, target))
-                    grantDelegatedFullAccess(from, target, task.threadId);
-                const queued = queueDelegation(commsBus, from, { toBotId: target.id, message, depth, targetThreadId: task.threadId }, MAX_COMMS_DEPTH, fromThreadId);
+                applyDelegatedLevel(from, fromThreadId, target, task.threadId);
+                const sourceUrl = threadRefUrl({ botId: owner.group?.id ?? from.id, threadId: fromThreadId });
+                const queued = queueDelegation(commsBus, from, { toBotId: target.id, message: oneWay
+                        ? `${message}\n\n[Source conversation](${sourceUrl}). This link grants no additional access and contains no copied transcript.`
+                        : message, depth, targetThreadId: task.threadId, oneWay }, MAX_COMMS_DEPTH, fromThreadId);
                 if (queued.result !== "ok" || !queued.id) {
                     // nothing will ever run there: take the row back before the person
                     // sees a thread that goes nowhere
@@ -18077,6 +18903,7 @@ const handleRequest = async (req, res) => {
                 return true;
             const openApprovalThreads = store.groupTasks(group.id).flatMap((task) => store.messagesFor(task.threadId).some((message) => message.kind === "options" &&
                 message.card?.requestId &&
+                (!isPersistentQuestionCard(message.card) || runningTurnEngines.has(task.threadId)) &&
                 !message.card.answered &&
                 !message.card.dismissed && !message.card.expired) ? [task.threadId] : []);
             return openApprovalThreads.length > 0 && !openApprovalThreads.includes(targetThreadId);
@@ -18828,10 +19655,11 @@ const handleRequest = async (req, res) => {
             if (created && !created.ok)
                 return json(res, 400, { error: created.error });
             const bot = store.createBot({ ...profile.patch, soul: settings.soul, section, modelSelection: selection,
+                toolScope: settings.toolScope ?? undefined,
                 ...(created?.ok ? { visibility: created.visibility } : {}) });
             const createdRoutines = [];
             try {
-                const { chiefOfStaff: _chief, managedSections: _managed, ...ordinary } = settings;
+                const { chiefOfStaff: _chief, managedSections: _managed, toolScope: _toolScope, ...ordinary } = settings;
                 store.patchBot(bot.id, {
                     // Store creation completes workspace defaults (including effort).
                     // Applying the rest of the template must not undo that selection.
@@ -19045,7 +19873,7 @@ const handleRequest = async (req, res) => {
         m = path.match(/^\/api\/bots\/([\w-]+)\/command-allowlist(?:\/([\w-]+))?$/);
         if (m && ["GET", "POST", "DELETE"].includes(method)) {
             if (!canManageCommandAllowlist(auth))
-                return json(res, 403, { error: "Only the workspace owner or an admin can manage command permissions." });
+                return json(res, 403, { error: "Only the owner or an admin can manage command permissions." });
             const bot = requestedTaskBot(m[1], url.searchParams.get("threadId") ?? undefined);
             if (method === "GET" && !m[2])
                 return json(res, 200, commandAllowlistResponse(bot));
@@ -19271,6 +20099,12 @@ const handleRequest = async (req, res) => {
             // Per-bot selection of app-wide MCP servers. Omitted keeps the current
             // selection; null restores all enabled servers; [] explicitly mounts none.
             let requestedMcpServers = existingBot?.mcpServers;
+            if (Object.hasOwn(body, "toolScope")) {
+                const parsed = parseToolScope(body.toolScope === null ? undefined : body.toolScope);
+                if (!parsed.ok)
+                    return json(res, 400, { error: parsed.error });
+                patch.toolScope = parsed.scope;
+            }
             if (body.mcpServers !== undefined) {
                 if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
                     return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
@@ -19529,7 +20363,7 @@ const handleRequest = async (req, res) => {
             // come from local scripts only when all bots are idle; paired owners
             // and the packaged desktop's private capability can grant it mid-turn.
             if (loosened.includes("managedSections") && auth.kind === "loopback" && !DESKTOP_MANAGED && store.bots.some(bot => bot.busy)) {
-                return json(res, 409, { error: "Stop running bots before granting access to another team, or use the desktop app or a paired owner session." });
+                return json(res, 409, { error: "Stop running bots before granting access to another team, or use the desktop app or a paired Full-access session." });
             }
             if (body.peers !== undefined && Array.isArray(existingBot?.peers)) {
                 const nextPeers = patch.peers;
@@ -19548,6 +20382,8 @@ const handleRequest = async (req, res) => {
                 (requestedMcpServers === undefined || requestedMcpServers.some((name) => !existingBot.mcpServers.includes(name)))) {
                 loosened.push("mcpServers");
             }
+            if (Object.hasOwn(body, "toolScope") && toolScopeWidens(existingBot?.toolScope, patch.toolScope))
+                loosened.push("toolScope");
             const browserOrigin = typeof req.headers.origin === "string" && req.headers.origin.trim() !== "";
             if (loosened.length && auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin) {
                 if (store.bots.some((candidate) => candidate.busy)) {
@@ -19583,6 +20419,18 @@ const handleRequest = async (req, res) => {
                 (freshBrowserBot.busy || activeGroupTurnForBot(freshBrowserBot.id))) {
                 return json(res, 409, { error: "stop this bot's turn before changing its memory setting" });
             }
+            if (Object.hasOwn(body, "toolScope")) {
+                if (auth.kind === "session" && !sessions.isLive(auth.session.id)) {
+                    return json(res, 401, { error: "unauthorized: this session has expired or was revoked" });
+                }
+                if (toolScopeWidens(freshBrowserBot?.toolScope, patch.toolScope) && auth.kind === "loopback" && !DESKTOP_MANAGED && !browserOrigin && store.bots.some((candidate) => candidate.busy)) {
+                    return json(res, 409, { error: "A bot is working right now, so this change has to come from the desktop app or a paired device. Try again once every bot is idle." });
+                }
+                if (freshBrowserBot && JSON.stringify(freshBrowserBot.toolScope) !== JSON.stringify(patch.toolScope)
+                    && (freshBrowserBot.busy || activeGroupTurnForBot(freshBrowserBot.id))) {
+                    return json(res, 409, { error: "Stop this bot's turns before changing its tool selection." });
+                }
+            }
             // Custom servers are process configuration: a running turn cannot
             // unmount them. Recheck after any awaited runtime revocation above.
             if (body.mcpServers !== undefined) {
@@ -19734,8 +20582,19 @@ const handleRequest = async (req, res) => {
         if (m && method === "GET") {
             if (!store.bot(m[1]))
                 return json(res, 404, { error: "no such bot" });
+            if (skillsLibraryEnabled(cfg)) {
+                const { skills, library } = listBotSkillsWithOrigin(m[1], store.bot(m[1]).assignedSkills);
+                return json(res, 200, {
+                    skills,
+                    library,
+                    // the authoritative assignment list: merged rows hide
+                    // assignments a same-name private skill shadows
+                    assignedSkills: store.bot(m[1]).assignedSkills,
+                    staged: listStagedSkillWrites(m[1]).map(stagedSkillListing),
+                });
+            }
             return json(res, 200, {
-                skills: listSkills(m[1]),
+                skills: listBotSkills(store.bot(m[1])),
                 staged: listStagedSkillWrites(m[1]).map(stagedSkillListing),
             });
         }
@@ -19757,7 +20616,8 @@ const handleRequest = async (req, res) => {
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/skills\/([a-z0-9-]+)$/);
         if (m && method === "GET") {
-            const text = readSkillFile(m[1], m[2]);
+            const bot = store.bot(m[1]);
+            const text = bot ? readBotSkillFile(bot, m[2]) : null;
             if (text === null)
                 return json(res, 404, { error: "no such skill" });
             return json(res, 200, { text });
@@ -19777,6 +20637,95 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: result.error });
             return json(res, 200, { ok: true });
         }
+        // ── skills library (features.skillsLibrary): local browse surface ────
+        // Everything here is local: the library on disk, assignments on bot
+        // records, imports from pasted SKILL.md text. No registry, no network.
+        m = path.match(/^\/api\/skills-library$/);
+        if (m && method === "GET") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const index = readSkillLibraryIndex();
+            const skills = listLibrarySkills()
+                .map((listing) => ({
+                name: listing.name,
+                description: listing.description,
+                source: listing.source,
+                enabled: listing.enabled,
+                tags: listing.tags ?? [],
+                version: index[listing.name]?.package?.release ?? null,
+                importedAt: listing.importedAt,
+                ...(listing.license ? { license: listing.license } : {}),
+                ...(listing.compatibility ? { compatibility: listing.compatibility } : {}),
+                warnings: listing.warnings,
+                assignedBots: store.bots
+                    .filter((bot) => bot.assignedSkills?.includes(listing.name))
+                    .map((bot) => ({ id: bot.id, name: bot.name })),
+            }))
+                .sort((a, b) => a.name.localeCompare(b.name));
+            return json(res, 200, { skills });
+        }
+        if (m && method === "POST") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const parsed = z.object({ text: z.string().min(1) }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "text must be the SKILL.md contents to import" });
+            const skill = parseSkillMd(parsed.data.text);
+            if ("error" in skill)
+                return json(res, 400, { error: skill.error });
+            // Imports land disabled with their scan warnings attached: enabling is
+            // a separate, explicit review step on the row.
+            const installed = installLibrarySkill({
+                name: skill.name,
+                instructions: parsed.data.text,
+                source: "local-import",
+                license: skill.license,
+                compatibility: skill.compatibility,
+                tags: skill.tags,
+                warnings: scanSkillText(parsed.data.text),
+                reviewState: "disabled",
+            });
+            if ("error" in installed)
+                return json(res, 422, { error: installed.error });
+            return json(res, 201, { skill: installed });
+        }
+        m = path.match(/^\/api\/skills-library\/([a-z0-9-]+)$/);
+        if (m && method === "GET") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const text = readLibrarySkillFile(m[1]);
+            if (text === null)
+                return json(res, 404, { error: "no such skill" });
+            return json(res, 200, { text });
+        }
+        if (m && method === "PATCH") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            const parsed = z.object({ enabled: z.boolean() }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "enabled must be true or false" });
+            const result = setLibrarySkillReviewState(m[1], parsed.data.enabled ? "approved" : "disabled");
+            if ("error" in result)
+                return json(res, 404, { error: result.error });
+            return json(res, 200, { skill: result });
+        }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/skills-library$/);
+        if (m && method === "PUT") {
+            if (!skillsLibraryEnabled(cfg))
+                return json(res, 404, { error: "skills library is not enabled" });
+            if (!store.bot(m[1]))
+                return json(res, 404, { error: "no such bot" });
+            const parsed = z.object({ skills: z.array(z.string().min(1).max(64)).max(200) }).safeParse(await readBody(req));
+            if (!parsed.success)
+                return json(res, 400, { error: "skills must be a list of skill names" });
+            const index = readSkillLibraryIndex();
+            const names = [...new Set(parsed.data.skills)];
+            const unknown = names.filter((name) => !index[name]);
+            if (unknown.length)
+                return json(res, 422, { error: "not in the library: " + unknown.join(", ") });
+            store.patchBot(m[1], { assignedSkills: names });
+            return json(res, 200, { assignedSkills: names });
+        }
         // ── section context: a user-owned team brief ────────────────────────
         // Bots receive this in their system context, but no agent tool can write
         // it. That keeps one bot from silently changing every teammate's future
@@ -20121,53 +21070,17 @@ const handleRequest = async (req, res) => {
             const trigger = onBehalfOf
                 ? { kind: "user", ...(onBehalfOf.email ? { email: onBehalfOf.email } : {}), ...(onBehalfOf.name ? { label: onBehalfOf.name } : {}) }
                 : usageTriggerFor(auth);
-            // The send is acknowledged before the turn starts, so a workspace at its
-            // spend limit is refused here, where the person can see it.
-            try {
-                assertWithinBudget(cfg, DATA_DIR);
-            }
-            catch (error) {
-                return json(res, 409, { error: error instanceof Error ? error.message : String(error), code: "spend_cap" });
-            }
-            if (!store.taskByThread(bot.id, threadId)) {
-                return json(res, 409, { error: "the bot switched tasks before it could receive the message" });
-            }
+            // The spend cap and a task that is gone answer before a malformed
+            // sendId or reply target does. acceptDirectSend checks both again for
+            // callers that do not come through this route; nothing awaits between.
+            const refused = directSendRefusal(bot.id, threadId);
+            if (refused)
+                return json(res, refused.status, refused.body);
             const sendId = parseSendId(body.sendId);
             const replyTo = resolveReplyTarget(threadId, body.replyToId);
-            const receipt = await sendSequencer.run(sendId ? `bot:${bot.id}:${threadId}:${sendId}` : undefined, sendFingerprint(text, replyTo?.id), async () => {
-                if (sendId) {
-                    if (cancelledChatFollowup("bot", bot.id, threadId, sendId)) {
-                        throw Object.assign(new Error("this queued sendId was cancelled; send a new message to try again"), { status: 409 });
-                    }
-                    const accepted = acceptedSendMatch(store.messagesFor(threadId), sendId, text, replyTo?.id);
-                    if (accepted.kind === "conflict") {
-                        throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
-                    }
-                    if (accepted.kind === "match") {
-                        const canonical = {
-                            ok: true,
-                            threadId,
-                            message: accepted.message,
-                        };
-                        return accepted.message.steered
-                            ? { ...canonical, steered: true }
-                            : canonical;
-                    }
-                    const queued = queuedSteeredMessage(bot.id, threadId, sendId);
-                    if (queued) {
-                        if (queued.text !== text || queued.replyToId !== replyTo?.id) {
-                            throw Object.assign(new Error("sendId already belongs to another message"), { status: 409 });
-                        }
-                        return { ok: true, queued: true, queueId: queued.id, threadId, reason: queued.reason };
-                    }
-                }
-                const currentAtStart = store.projectBotForTask(bot.id, threadId);
-                if (!currentAtStart)
-                    throw Object.assign(new Error("no such bot"), { status: 404 });
-                if (!store.taskByThread(currentAtStart.id, threadId)) {
-                    throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
-                }
-                if (guarded) {
+            const sender = messageSender(auth);
+            const guardedStart = guarded
+                ? async (currentAtStart) => {
                     // There is no await between these checks and startTurn's
                     // synchronous transcript append / runtime reservation. In
                     // particular, never steer or enqueue under stale permissions.
@@ -20189,91 +21102,32 @@ const handleRequest = async (req, res) => {
                     if (guardedAdmission.action === "refuse") {
                         throw Object.assign(new Error("wait for a free thread slot before retrying this message"), { status: 409, code: "guarded_busy" });
                     }
-                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender: messageSender(auth), trigger });
+                    // Stored as relayed: a worker's line for someone else, which a
+                    // Live call on this thread must not read back as typed there.
+                    const message = await startTurn(bot.id, text, { threadId, replyTo, sendId, sender, trigger, relayed: true });
                     return { ok: true, threadId, message };
                 }
-                // Claude can accept the message inside its live turn. If the write
-                // loses a race with turn settlement, or the engine cannot steer, the
-                // existing server-side queue records it atomically for the next turn.
-                if (currentAtStart.busy) {
-                    const instance = runningTurnInstance(currentAtStart, threadId);
-                    let steered = "refused";
-                    // A live text steer has no image side channel. Keep an attachment
-                    // message intact for the next ordinary turn, where central image
-                    // admission can hand it to the provider natively.
-                    const carriesImages = extractTurnImages(text).images.length > 0;
-                    const steerTarget = handoffs.current(threadId);
-                    const busyAdmission = admit("direct-busy", {
-                        carriesImages,
-                        pendingComputerSelection: Boolean(computerSelectionTurns.get(threadId)?.selected),
-                        engineCanSteer: Boolean(instance?.adapter.capabilities.queueing && instance.adapter.steer),
-                    });
-                    // steer was offered only when a live instance could take it;
-                    // the second check carries that fact to the type system.
-                    if (busyAdmission.action === "steer" && instance?.adapter.steer) {
-                        steered = await instance.adapter
-                            .steer(threadId, promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"))
-                            .catch(() => "indeterminate");
-                    }
-                    // steer() is awaited adapter work. The turn can settle, the task can
-                    // switch, or the whole bot can be deleted before its acknowledgement
-                    // arrives. Re-read every ownership invariant before appending even a
-                    // successful steer; otherwise that late acknowledgement writes a user
-                    // message into a task the bot no longer owns. A conflict leaves the
-                    // text in the client's composer/outbox to resend deliberately.
-                    const current = store.projectBotForTask(bot.id, threadId);
-                    if (!current)
-                        throw Object.assign(new Error("no such bot"), { status: 404 });
-                    if (!store.taskByThread(bot.id, threadId)) {
-                        throw Object.assign(new Error("the target task no longer exists"), { status: 409 });
-                    }
-                    const delivered = steered !== "refused";
-                    if (delivered) {
-                        if (steered === "steered" && !current.busy) {
-                            throw Object.assign(new Error("the running turn ended before the steered message could be recorded"), { status: 409 });
-                        }
-                        // "indeterminate" falls through to the same record: the words
-                        // may already be folded into a turn whose acknowledgement was
-                        // lost, and handing them back for a resend could run them
-                        // twice. Recording them once is the honest outcome.
-                        // A person steering a webhook turn is present, and auto mode may
-                        // follow them again. But this route is also reachable from the
-                        // bot's own shell on a headless server (loopback is the owner
-                        // there), and "continue" typed by the turn itself must not be
-                        // the thing that lifts the block written against it — so only
-                        // a request that proves a person (a paired session, or the
-                        // desktop's owner capability, which every mutation there has
-                        // already shown) clears the mark.
-                        if (auth.kind === "session" || DESKTOP_MANAGED)
-                            clearUnattended(threadId);
-                        const message = store.appendMessage(threadId, {
-                            role: "user",
-                            kind: "text",
-                            text,
-                            replyToId: replyTo?.id,
-                            sendId,
-                            steered: true,
-                            sender: messageSender(auth),
-                        });
-                        // Offered to the next turn again unless the person stops this one.
-                        handoffs.steered(threadId, steerTarget, instance?.instanceId, message.id);
-                        return { ok: true, steered: true, threadId, message };
-                    }
-                    if (!current.busy) {
-                        return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth), trigger);
-                    }
-                    const queued = queueSteeredMessage(current.id, threadId, text, {
-                        replyToId: replyTo?.id,
-                        sendId,
-                        prompt: promptWithReply(text, replyTo, cfg.profile?.name?.trim() || "User"),
-                        sender: messageSender(auth),
-                        trigger,
-                    });
-                    return { ok: true, queued: true, queueId: queued.id, threadId };
-                }
-                return startOrQueueDirectMessage(bot.id, threadId, text, replyTo, sendId, messageSender(auth), trigger);
-            });
-            return json(res, 202, receipt);
+                : undefined;
+            try {
+                const receipt = await acceptDirectSend({
+                    botId: bot.id, threadId, text, sendId, replyTo, sender, trigger,
+                    // A person steering a webhook turn is present, and auto mode may
+                    // follow them again. But this route is also reachable from the
+                    // bot's own shell on a headless server (loopback is the owner
+                    // there), and "continue" typed by the turn itself must not be the
+                    // thing that lifts the block written against it — so only a
+                    // request that proves a person (a paired session, or the desktop's
+                    // owner capability, which every mutation there has already shown)
+                    // clears the mark.
+                    personPresent: auth.kind === "session" || DESKTOP_MANAGED,
+                }, guardedStart);
+                return json(res, 202, receipt);
+            }
+            catch (error) {
+                if (error instanceof DirectSendRefused)
+                    return json(res, error.status, error.body);
+                throw error;
+            }
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/queue\/([\w-]+)$/);
         if (m && method === "DELETE") {
@@ -20340,6 +21194,7 @@ const handleRequest = async (req, res) => {
                     peerAsk: item.peerAsk,
                     steered: true,
                     sender: item.sender,
+                    ...(item.via ? { via: item.via } : {}),
                 }));
                 // Offered to the next turn again unless the person stops this one.
                 for (const message of messages)
@@ -20529,7 +21384,32 @@ const handleRequest = async (req, res) => {
                     resolvePeerComms(approvalBus, String(body.requestId), behavior)) {
                     return json(res, 200, { ok: true, outcome: behavior === "allow" ? "allowed-once" : "rejected" });
                 }
-                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, String(body.requestId), behavior, body.message, { id: bot.id, name: bot.name }, body.always === true, body.rememberCommand === true);
+                const requestId = String(body.requestId);
+                const pending = store.messagesFor(bot.threadId).find((message) => message.card?.requestId === requestId);
+                if (isPersistentQuestionCard(pending?.card) && (body.dismiss === true || body.message === QUESTION_DISMISS_MESSAGE)) {
+                    if (!pending?.card)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    if (pending.card.answered !== "answer" || pending.card.dismissed) {
+                        return json(res, 409, { error: "answer this question before dismissing it" });
+                    }
+                    store.patchMessage(bot.threadId, pending.id, { card: { ...pending.card, dismissed: true } });
+                    return json(res, 200, { ok: true, dismissed: true });
+                }
+                const outcome = await answerRequest(bot.threadId, bot.modelSelection.instanceId, requestId, behavior, body.message, { id: bot.id, name: bot.name }, body.always === true, body.rememberCommand === true);
+                if (outcome === "unavailable" && isPersistentQuestionCard(pending?.card) && behavior === "answer") {
+                    if (!pending)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    const answer = typeof body.message === "string" ? body.message.trim() : "";
+                    if (!answer)
+                        return json(res, 400, { error: "a question answer is required" });
+                    try {
+                        const reply = await deliverLateQuestionAnswer(auth, bot.threadId, requestId, answer, pending, bot);
+                        return json(res, 200, { ok: true, outcome: "answered", late: true, ...(reply.queued ? { queued: true } : {}) });
+                    }
+                    catch (error) {
+                        return json(res, 409, { error: error instanceof Error ? error.message : "the late answer could not be queued" });
+                    }
+                }
                 return json(res, 200, { ok: true, outcome });
             });
         }
@@ -20655,14 +21535,46 @@ const handleRequest = async (req, res) => {
                 // answerRequest closes an unreachable card, and a pending approval owns
                 // the composer, so a dead end here locks the room for good.
                 const pending = store.messagesFor(threadId).find((message) => message.card?.requestId === requestId);
+                if (isPersistentQuestionCard(pending?.card) && (body.dismiss === true || body.message === QUESTION_DISMISS_MESSAGE)) {
+                    if (!pending?.card)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    if (pending.card.answered !== "answer" || pending.card.dismissed) {
+                        return json(res, 409, { error: "answer this question before dismissing it" });
+                    }
+                    store.patchMessage(threadId, pending.id, { card: { ...pending.card, dismissed: true } });
+                    return json(res, 200, { ok: true, dismissed: true });
+                }
+                const persistentQuestion = isPersistentQuestionCard(pending?.card);
                 const owner = group
-                    ? (group.busyBotId ? store.bot(group.busyBotId) : undefined) ??
-                        (pending?.from ? store.bot(pending.from.botId) : undefined)
+                    ? persistentQuestion
+                        ? (pending?.from ? store.bot(pending.from.botId) : undefined)
+                        : (group.busyBotId ? store.bot(group.busyBotId) : undefined) ??
+                            (pending?.from ? store.bot(pending.from.botId) : undefined)
                     : store.botByThread(threadId);
+                // A surviving question belongs to its original asker, never a later speaker.
+                if (group && persistentQuestion && !owner) {
+                    return json(res, 409, { error: "the bot that asked this question is no longer available" });
+                }
                 if (!owner && !pending)
                     return json(res, 404, { error: "nothing is waiting on an answer in this conversation" });
                 const requestOwner = owner ? botForThread(owner.id, threadId) : null;
                 const outcome = await answerRequest(threadId, requestOwner?.modelSelection.instanceId ?? "", requestId, behavior, body.message, owner ? { id: owner.id, name: owner.name } : undefined, body.always === true, body.rememberCommand === true);
+                if (outcome === "unavailable" && isPersistentQuestionCard(pending?.card) && behavior === "answer") {
+                    if (!pending?.card)
+                        return json(res, 404, { error: "this question is no longer available" });
+                    const answer = typeof body.message === "string" ? body.message.trim() : "";
+                    if (!answer)
+                        return json(res, 400, { error: "a question answer is required" });
+                    if (!owner)
+                        return json(res, 409, { error: "the bot that asked this question is no longer available" });
+                    try {
+                        const reply = await deliverLateQuestionAnswer(auth, threadId, requestId, answer, pending, owner);
+                        return json(res, 200, { ok: true, outcome: "answered", late: true, ...(reply.queued ? { queued: true } : {}) });
+                    }
+                    catch (error) {
+                        return json(res, 409, { error: error instanceof Error ? error.message : "the late answer could not be queued" });
+                    }
+                }
                 return json(res, 200, { ok: true, outcome });
             });
         }
@@ -20867,7 +21779,7 @@ const handleRequest = async (req, res) => {
             const current = store.projectBotForTask(m[1], m[2]);
             if (!current)
                 return json(res, 404, { error: "no such task" });
-            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "pinned", "snoozedUntil", "surface"]);
+            const allowed = new Set(["title", "projectId", "modelSelection", "updateBotDefault", "resetApprovalToAsk", "approvalMode", "autoApprove", "requireAvailableModel", "pinnedMessageId", "acknowledgeLocalAuto", "archivedAt", "pinned", "snoozedUntil", "surface", "refreshPermissions"]);
             if (Object.keys(body).some((key) => !allowed.has(key)))
                 return json(res, 400, { error: "unsupported thread setting" });
             const notYours = cloudThreadRefusal(auth, m[2]);
@@ -20877,7 +21789,7 @@ const handleRequest = async (req, res) => {
             // asking them, even in a conversation someone else started, and what
             // the bot itself defaults to.
             if (CLOUD_HOME && !cloudOwnerSession(auth) &&
-                (body.approvalMode !== undefined || body.autoApprove !== undefined || body.acknowledgeLocalAuto !== undefined || body.updateBotDefault === true)) {
+                (body.approvalMode !== undefined || body.autoApprove !== undefined || body.acknowledgeLocalAuto !== undefined || body.updateBotDefault === true || body.refreshPermissions === true)) {
                 return json(res, 403, { error: "On this Cloud only its owner can change how a bot asks for approval, or its default model." });
             }
             for (const key of ["requireAvailableModel", "acknowledgeLocalAuto", "updateBotDefault", "resetApprovalToAsk"]) {
@@ -20892,6 +21804,50 @@ const handleRequest = async (req, res) => {
                 (body.approvalMode !== undefined && body.approvalMode !== "ask") || body.autoApprove === true)) {
                 return json(res, 400, { error: "resetApprovalToAsk requires a model selection and cannot be combined with another approval mode" });
             }
+            if (body.refreshPermissions !== undefined && body.refreshPermissions !== true) {
+                return json(res, 400, { error: "refreshPermissions must be true" });
+            }
+            if (body.refreshPermissions === true) {
+                const extra = Object.keys(body).filter((key) => key !== "refreshPermissions" && key !== "acknowledgeLocalAuto");
+                if (extra.length)
+                    return json(res, 400, { error: "refreshPermissions cannot be combined with other thread settings" });
+                const profile = store.bot(m[1]);
+                if (!profile)
+                    return json(res, 404, { error: "no such bot" });
+                if (profile.approvalGrant)
+                    return json(res, 409, { error: "the bot's approval mode is still being confirmed" });
+                if (threadBusy(profile.id, m[2]))
+                    return json(res, 409, { error: "stop this thread before changing its approval mode" });
+                const nextMode = approvalModeFor({ ...profile, approvalGrant: undefined });
+                // Full and Custom never travel over the bot-reachable HTTP surface.
+                // The desktop's private channel copies those levels, and it is also
+                // the only way to leave Custom.
+                if (nextMode === "full" || nextMode === "custom") {
+                    return json(res, 403, { error: "Refresh Full or Custom access from the packaged desktop app" });
+                }
+                if (approvalModeFor(current) === "custom") {
+                    return json(res, 403, { error: "Leaving Custom approval requires the packaged desktop app" });
+                }
+                if (!supportsApprovalMode(current.modelSelection, nextMode)) {
+                    return json(res, 400, { error: "This provider does not support the selected approval level" });
+                }
+                if (nextMode === "auto" && current.computer === "local" && approvalModeFor(current) !== "auto" && body.acknowledgeLocalAuto !== true) {
+                    return json(res, 400, { error: "Auto mode on this computer requires confirming the warning first (acknowledgeLocalAuto)" });
+                }
+                const approvalRank = { ask: 0, edits: 1, auto: 2, full: 3, custom: 4 };
+                const widensMode = approvalRank[nextMode] > approvalRank[approvalModeFor(current)];
+                const nextAllow = profile.alwaysAllow ?? [];
+                const widensAllow = nextAllow.some((key) => !(current.alwaysAllow ?? []).includes(key));
+                if ((widensMode || widensAllow) && auth.kind === "loopback" && !DESKTOP_MANAGED && !req.headers.origin && store.bots.some((bot) => bot.busy)) {
+                    return json(res, 409, { error: "Change approval mode from the app or a paired device while bots are working." });
+                }
+                const task = store.refreshTaskPermissions(profile.id, m[2]);
+                if (!task)
+                    return json(res, 404, { error: "no such task" });
+                const fresh = botWithThread(store.bot(profile.id));
+                broadcast({ kind: "bot", bot: fresh });
+                return json(res, 200, { task: wireTask(task), bot: fresh });
+            }
             const patch = {};
             if (body.projectId !== undefined) {
                 if (body.projectId === null)
@@ -21311,8 +22267,10 @@ const handleRequest = async (req, res) => {
                 localVmLifecycleBusy.add(SHARED_LOCAL_VM_TARGET.key);
             try {
                 const status = await containerComputerAction(action, undefined, undefined, SHARED_LOCAL_VM_TARGET);
-                if (action === "run" || action === "start")
+                if (action === "run" || action === "start") {
+                    localVmSeen.add(SHARED_LOCAL_VM_TARGET.key);
                     localVmIdleFor(SHARED_LOCAL_VM_TARGET).touch();
+                }
                 if (action === "stop" || action === "remove")
                     localVmIdleFor(SHARED_LOCAL_VM_TARGET).cancel();
                 return json(res, 200, {
@@ -21344,7 +22302,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such bot" });
             return json(res, 200, await localVmPayload(localVmTargetForStatus(bot.id, bot.threadId), auth));
         }
-        m = path.match(/^\/api\/bots\/([\w-]+)\/local-computer\/(run|stop|remove)$/);
+        m = path.match(/^\/api\/bots\/([\w-]+)\/local-computer\/(run|start|stop|remove)$/);
         if (m && method === "POST") {
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
@@ -21355,7 +22313,7 @@ const handleRequest = async (req, res) => {
             if (boatLifecycleBusyBots.has(bot.id)) {
                 return json(res, 409, { error: "this bot's computer is being changed or deleted — wait for it to finish" });
             }
-            const action = z.enum(["run", "stop", "remove"]).parse(m[2]);
+            const action = z.enum(["run", "start", "stop", "remove"]).parse(m[2]);
             const target = localVmTargetForBot(bot.id);
             if (target.key === SHARED_LOCAL_VM_TARGET.key) {
                 return json(res, 409, { error: "Shared mode manages this desktop in App Settings → Computers" });
@@ -21394,8 +22352,10 @@ const handleRequest = async (req, res) => {
                     }
                 }
                 const status = await containerComputerAction(action, undefined, undefined, target);
-                if (action === "run")
+                if (action === "run" || action === "start") {
+                    localVmSeen.add(target.key);
                     localVmIdleFor(target).touch();
+                }
                 if (action === "stop" || action === "remove")
                     localVmIdleFor(target).cancel();
                 return json(res, 200, {
@@ -21427,6 +22387,61 @@ const handleRequest = async (req, res) => {
                 image: await containerComputerScreenshot(undefined, undefined, target),
             });
         }
+        // The Local VM's live desktop for a phone, granted only to the control
+        // lease that holds this bot's computer right now. Two callers:
+        //
+        // The companion sidecar (a loopback caller) gets the VM's own noVNC
+        // address, VNC password included, relays it to a paired phone the owner
+        // has allowed computer access, keeps re-checking the lease with
+        // `action: "check"`, and cuts the relay when it no longer holds.
+        //
+        // A phone paired with this server directly (`openmausbot serve`, no
+        // sidecar) never sees that address. It gets this server's own
+        // authenticated desktop proxy, bound to its lease: the proxy re-checks
+        // the lease and the session every few seconds and closes the socket when
+        // either lapses. Reaching here at all took the admin scope, which a
+        // chat-only pairing (`openmausbot pair --client`) does not have, so
+        // computer access is the same explicit choice the owner's browser makes.
+        m = path.match(/^\/api\/bots\/([\w-]+)\/local-computer\/join$/);
+        if (m && method === "POST") {
+            if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
+                return json(res, 415, { error: "content-type must be application/json" });
+            }
+            const bot = computerPreviewBot(m[1], url);
+            if (!bot)
+                return json(res, 404, { error: "no such bot" });
+            const threadId = url.searchParams.has("threadId") ? bot.threadId : undefined;
+            if (threadId && await computerPreviewSurface(bot, threadId) !== "vm") {
+                return json(res, 409, { error: "This conversation is not using the Local VM" });
+            }
+            // A bot's human-control hold does not reserve a shared desktop or pool
+            // seat. Another bot could drive it while the phone is holding this bot.
+            if (localVmMode(cfg) !== "per-bot") {
+                return json(res, 409, { error: "Phone control requires a per-bot Local VM. Select per-bot mode in Settings → Computers." });
+            }
+            const lease = controlLeaseIdSchema.safeParse(url.searchParams.get("controlLeaseId") ?? undefined);
+            if (!lease.success)
+                return json(res, 400, { error: "controlLeaseId is required" });
+            const controlBot = store.bot(bot.id);
+            if (!controlBot || !computerControl.ownsLease(botComputerControlKey(controlBot), lease.data)) {
+                return json(res, 409, { error: "Take control of this computer first" });
+            }
+            const target = localVmTargetForStatus(bot.id, threadId);
+            const status = await containerComputerStatus(undefined, undefined, target);
+            if (!status.ready || !status.managed || status.container !== "running" || status.network !== "loopback"
+                || !status.viewer_url) {
+                return json(res, 409, { error: status.problem ?? "The Local VM is not ready" });
+            }
+            localVmIdleFor(target).touch();
+            res.setHeader("cache-control", "private, no-store");
+            if (auth.kind === "loopback")
+                return json(res, 200, { joinUrl: status.viewer_url });
+            const socket = new URLSearchParams({ botId: bot.id, ...(threadId ? { threadId } : {}), controlLeaseId: lease.data });
+            return json(res, 200, {
+                socketPath: `api/desktop-viewer/${viewerTargetId(target)}/websockify?${socket}`,
+                password: new URLSearchParams(new URL(status.viewer_url).hash.slice(1)).get("password"),
+            });
+        }
         // identity handshake for the packaged app's port fallback: the forked
         // child proves it is OURS by echoing its pid (a stray dev server has
         // the same API shape but a different pid)
@@ -21556,6 +22571,16 @@ const handleRequest = async (req, res) => {
                 billing: prices ? { currency: cfg.billing?.currency ?? "USD" } : null,
             });
         }
+        // Subscription windows (5-hour and weekly), not the token ledger above.
+        // Same admin gate as /api/usage: this route is unlisted, so it stays admin.
+        if (method === "GET" && path === "/api/plan-usage") {
+            res.setHeader("cache-control", "no-store");
+            const report = await loadPlanUsage({
+                accounts: planAccountsFromInstances(instanceConfigs(cfg)),
+                refresh: url.searchParams.get("refresh") === "1",
+            });
+            return json(res, 200, report);
+        }
         // ── provider key check: does a pasted or saved key open the provider's door ──
         // One read-only request from this server; the verdict never carries the
         // key. Admin scope by default, like every route not opened to clients.
@@ -21566,7 +22591,7 @@ const handleRequest = async (req, res) => {
                 return json(res, 400, { error: `provider must be one of ${PROVIDER_KEY_KINDS.join(", ")}` });
             }
             const kind = provider;
-            const saved = { anthropic: cfg.anthropic, openai: cfg.openai, openrouter: cfg.openrouter, openaiCompat: cfg.openaiCompat, mistral: cfg.mistral, xai: cfg.xai }[kind];
+            const saved = { anthropic: cfg.anthropic, openai: cfg.openai, openrouter: cfg.openrouter, openaiCompat: cfg.openaiCompat, mistral: cfg.mistral, cerebras: cfg.cerebras, xai: cfg.xai }[kind];
             if (body?.key !== undefined && typeof body.key !== "string") {
                 return json(res, 400, { error: "key must be a string" });
             }
@@ -21907,8 +22932,8 @@ const handleRequest = async (req, res) => {
                     return json(res, 400, { error: "Account settings are currently available for Claude only." });
                 }
                 if (body.tools !== undefined) {
-                    if (!["openai-compat", "grok", "minimax", "mistral"].includes(entry.driver)) {
-                        return json(res, 400, { error: "The tools setting is available for OpenAI-compatible, Grok API, MiniMax API and Mistral API instances only." });
+                    if (!["openai-compat", "grok", "minimax", "mistral", "cerebras"].includes(entry.driver)) {
+                        return json(res, 400, { error: "The tools setting is available for OpenAI-compatible, Grok API, MiniMax API, Mistral API and Cerebras API instances only." });
                     }
                     entry.config = { ...entry.config, tools: body.tools };
                 }
@@ -22187,7 +23212,7 @@ const handleRequest = async (req, res) => {
         }
         if ((method === "PUT" || method === "PATCH") && path === "/api/config") {
             const body = await readBody(req);
-            if (hostedModels && ["instances", "anthropic", "openai", "openrouter", "openaiCompat", "xai", "mistral", "opencodeGo"].some(key => Object.hasOwn(body, key)))
+            if (hostedModels && ["instances", "anthropic", "openai", "openrouter", "openaiCompat", "xai", "mistral", "cerebras", "opencodeGo"].some(key => Object.hasOwn(body, key)))
                 return json(res, 403, { error: HOSTED_PROVIDER_SETTINGS_ERROR });
             const patch = parseConfigPatch(body);
             // A Cloud home is personal: nobody is invited to sign in to it.
@@ -22605,6 +23630,8 @@ const handleRequest = async (req, res) => {
                             persisted.imageGen.key = "";
                         if (persisted.imageGen?.customApiKey !== undefined)
                             persisted.imageGen.customApiKey = "";
+                        if (persisted.live?.key !== undefined)
+                            persisted.live.key = "";
                         saveConfig(persisted);
                         configWriteCommitted = true;
                         syncCredentialEnv(patch);
@@ -22715,6 +23742,7 @@ const handleRequest = async (req, res) => {
                             drainQueuedSends();
                             drainDelegationWakes();
                             drainConnectorResumes();
+                            drainComputerResumes();
                             drainSecretResumes();
                             drainTeamSetupResumes();
                         }
@@ -23065,13 +24093,19 @@ const handleRequest = async (req, res) => {
                     const result = computerControl.releaseLease(controlKey, controlLeaseId);
                     return json(res, 200, { ...result.snapshot, released: result.released });
                 }
+                // Read-only: does this lease still hold the wheel? The companion
+                // sidecar asks this while it relays a phone's live Local VM desktop,
+                // and cuts the relay the moment the answer is no.
+                if (action === "check" && controlLeaseId) {
+                    return json(res, 200, { ...computerControl.snapshot(controlKey), owned: computerControl.ownsLease(controlKey, controlLeaseId) });
+                }
                 if (action === "take")
                     return json(res, 200, computerControl.take(controlKey));
                 if (action === "release")
                     return json(res, 200, computerControl.release(controlKey));
                 if (action === "dismiss-help")
                     return json(res, 200, computerControl.dismissHelp(controlKey));
-                return json(res, 400, { error: "action must be take, release, or dismiss-help" });
+                return json(res, 400, { error: "action must be take, release, check, or dismiss-help" });
             }
             return json(res, 405, { error: "method not allowed" });
         }
@@ -23083,7 +24117,13 @@ const handleRequest = async (req, res) => {
             if (!String(req.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) {
                 return json(res, 415, { error: "content-type must be application/json" });
             }
-            return json(res, 200, bot.cloudBackend === "vps" ? vps.closeVpsDesktopTunnel(bot.id) : { closed: false });
+            // A directly paired phone's Local VM desktop runs through this server's
+            // own proxy under its lease on this bot; hand-back closes it here, ahead
+            // of the lease re-check. The session's other viewers are left alone.
+            const closedViewers = auth.kind === "session" ? desktopViewer.closeForOwner(auth.session.id, bot.id) : 0;
+            if (bot.cloudBackend === "vps")
+                return json(res, 200, vps.closeVpsDesktopTunnel(bot.id));
+            return json(res, 200, { closed: closedViewers > 0 });
         }
         m = path.match(/^\/api\/bots\/([\w-]+)\/computer\/(provision|join|sleep|exec|screenshot|remove)$/);
         if (m && method === "POST") {
@@ -23349,6 +24389,7 @@ for (const row of chatFollowups()) {
         role: "user", kind: "text", text: row.kind === "aside" ? row.payload.prompt ?? row.payload.text : row.payload.text, replyToId: row.payload.replyToId,
         sendId: row.payload.sendId, queueId: row.id, sender: row.payload.sender,
         ...(row.kind === "channel" ? { channelMode: row.payload.mode, via: row.payload.via } : {}),
+        ...(row.kind === "bot" && row.payload.via === "call" ? { via: "call" } : {}),
         ...(row.kind === "aside" ? {
             aside: true,
             peerAsk: row.payload.aside
@@ -23464,6 +24505,7 @@ const gracefulShutdown = createGracefulShutdown({
             await Promise.all([...temporaryBrowserSessions.keys()].map((botId) => forgetTemporaryBrowser(botId)));
             await browserRuntime.closeAll();
         },
+        () => liveCalls.shutdown(),
         () => flushAllProfileHistory(),
         () => flushAllMemoryJournals(),
         () => flushUsageLedger(DATA_DIR),