openmausbot 0.1.93 → 0.1.94

package/dist-server/server/skills.js

@@ -33,6 +33,7 @@ import { writeFileAtomic } from "./atomic.js";
 import { DATA_DIR } from "./config.js";
 import { redactSecretsInText } from "./redact.js";
 import { LEARN_SOURCE_PREFIX } from "./skill-learn.js";
+import { librarySkillFilePath, listLibrarySkills } from "./skill-library.js";
 import { workspaceDir } from "./workspace.js";
 import { isSkillName, parseSkillMd, scanSkillText, SKILL_FILE_MAX_BYTES } from "../shared/skill-md.js";
 // SKILL.md parsing and the static scan live in shared/ so the package
@@ -1191,11 +1192,14 @@ export function applySkillWriteWithReceipt(botId, staged, recordApplied) {
  * index lines only — the same progressive-disclosure shape the spec asks
  * agents for. Bodies never ride the prompt; the bot reads the file when a
  * task matches. */
-export function skillsSystemPrompt(botId) {
+export function skillsSystemPrompt(botId, assignedLibrary) {
+    return composeSkillsSystemPrompt(botId, assignedLibrary);
+}
+function composeSkillsSystemPrompt(botId, assignedLibrary) {
     // Reconcile links on every turn. If the workspace copy changed since its
     // review, integrity filtering below removes it from native discovery too.
     syncSkillLinks(botId);
-    const enabled = listSkills(botId).filter((skill) => skill.enabled);
+    const enabled = resolveBotSkills(botId, assignedLibrary).filter((skill) => skill.enabled);
     if (!enabled.length) {
         loggedIndexOmissions.delete(botId);
         return "";
@@ -1212,7 +1216,7 @@ export function skillsSystemPrompt(botId) {
         (omitted ? `${entries.length ? "\n" : ""}${notice(omitted, entries.length)}` : "");
     for (const skill of enabled.slice(0, INDEX_MAX_SKILLS)) {
         const entry = manifest[skill.name];
-        const file = join(skillTarget(root, skill.name, entry), "SKILL.md");
+        const file = entry ? join(skillTarget(root, skill.name, entry), "SKILL.md") : librarySkillFilePath(skill.name);
         const line = `- ${skill.name}: ${skill.description} Read ${JSON.stringify(file)}.`;
         if (Buffer.byteLength(block([...lines, line], enabled.length - lines.length - 1), "utf8") > INDEX_MAX_BYTES)
             break;
@@ -1231,3 +1235,62 @@ export function skillsSystemPrompt(botId) {
     }
     return block(lines, omitted.length);
 }
+// --- Skills library composition (features.skillsLibrary) ---
+/** One bot's private skills plus its assigned library skills, private
+ * winning any name collision (the lane's resolution order: bot-private >
+ * library > bundled). `undefined` assignments return exactly
+ * `listSkills(botId)` — the flag-off contract. */
+export function resolveBotSkills(botId, assignedLibrary) {
+    const own = listSkills(botId);
+    if (!assignedLibrary?.length)
+        return own;
+    const ownNames = new Set(own.map((skill) => skill.name));
+    const assigned = new Set(assignedLibrary);
+    const fromLibrary = listLibrarySkills().filter((skill) => assigned.has(skill.name) && !ownNames.has(skill.name));
+    return [...own, ...fromLibrary];
+}
+export function listBotSkillsWithOrigin(botId, assignedLibrary) {
+    const own = listSkills(botId);
+    const ownNames = new Set(own.map((skill) => skill.name));
+    const assigned = new Set(assignedLibrary ?? []);
+    const skills = resolveBotSkills(botId, assignedLibrary).map((skill) => ({
+        ...skill,
+        origin: ownNames.has(skill.name) ? "private" : "library",
+    }));
+    const library = listLibrarySkills().filter((entry) => !ownNames.has(entry.name) && !assigned.has(entry.name));
+    return { skills, library };
+}
+export function listMigratableSkills(botId) {
+    return Object.entries(readManifest(botId))
+        .map(([name, entry]) => ({
+        name,
+        directory: skillDirectory(botId, name, entry),
+        sha256: entry.sha256,
+        enabled: entry.enabled,
+        source: entry.source,
+        description: entry.description,
+        ...(entry.license ? { license: entry.license } : {}),
+        ...(entry.compatibility ? { compatibility: entry.compatibility } : {}),
+        ...(entry.package ? { package: { ...entry.package } } : {}),
+        intact: skillContentMatches(botId, name, entry),
+    }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Drop manifest entries the migration has archived. The caller archives
+ * the bytes first and passes the sha256 it read, so a skill that changed
+ * between read and removal is left untouched. */
+export function removeManifestEntry(botId, name, expectSha256) {
+    if (!isSkillName(name))
+        return { error: "invalid skill name" };
+    const manifest = readManifest(botId);
+    const entry = manifest[name];
+    if (!entry)
+        return { removed: true };
+    if (entry.sha256 !== expectSha256) {
+        return { error: `skill "${name}" changed since it was read — leaving it in place` };
+    }
+    delete manifest[name];
+    writeManifest(botId, manifest);
+    syncSkillLinks(botId);
+    return { removed: true };
+}

package/dist-server/server/steer-queue.js

@@ -28,8 +28,11 @@ export function restoreSteeredMessages() {
         const entry = queues.get(row.threadId) ?? { botId: row.ownerId, items: [] };
         if (entry.botId !== row.ownerId)
             throw new Error("queued task belongs to another bot");
+        // a 1:1 line is only ever stamped "call"; "api" belongs to channel rows
+        const { via, ...payload } = row.payload;
         entry.items.push({
-            ...row.payload,
+            ...payload,
+            ...(via === "call" ? { via } : {}),
             messageId: row.id,
             prompt: row.payload.prompt ?? row.payload.text,
             // rows queued before timestamps were kept read as queued at restore
@@ -83,6 +86,7 @@ export function queueSteeredMessage(botId, threadId, text, options = {}) {
         sender: options.sender,
         trigger: options.trigger,
         queuedAt: Date.now(),
+        via: options.via,
     };
     saveChatFollowup({ id, kind: "bot", ownerId: botId, threadId, payload: item });
     entry.items.push(item);
@@ -112,6 +116,13 @@ export function hasQueuedSteeredMessages(botId, threadId) {
     const entry = queues.get(threadId);
     return entry?.botId === botId && entry.items.length > 0;
 }
+/** Whether one send still waits in its thread's queue. False while it is
+ * out of the queue: drained onto the thread, held for a steer into the
+ * running turn, or cancelled (editing a queued line cancels it). */
+export function isSteeredMessageQueued(botId, threadId, queueId) {
+    const entry = queues.get(threadId);
+    return entry?.botId === botId && entry.items.some((item) => item.messageId === queueId);
+}
 /** Drain every queue whose task is idle: append the held lines (leaf is now
  * the finished turn's last item), then one run per thread whose prompt is
  * the drained group's texts separated by a blank line. `userMessage` is the last appended line
@@ -161,6 +172,7 @@ export function drainSteeredMessages(store, run, isBlocked) {
                 queueId: item.messageId,
                 peerAsk: item.peerAsk,
                 sender: item.sender,
+                ...(item.via ? { via: item.via } : {}),
             }));
         }
         const last = appended.at(-1);

package/dist-server/server/store.js

@@ -6,6 +6,7 @@ import { createHash } from "node:crypto";
 import { chmodSync, existsSync, readFileSync, mkdirSync, rmSync, statSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
+import { parseToolScope, toolScopeWidens } from "../shared/tool-scope.js";
 import { ensureSections, readSections, changeEmptySection } from "./section-context.js";
 import { removeBotFolder, soulFile, soulHash, writeSoulMirror } from "./bot-folder.js";
 import { peerAllowKey } from "./peer-approval-key.js";
@@ -32,8 +33,10 @@ export const taskWireProjectionIsExact = true;
 /** The typed wire projection for one task. Pairs with the assertion above:
  * returning WireTask means an undeclared server field cannot ride silently. */
 export function toWireTask(task) {
-    const { resumeCursors: _resumeCursors, lastInstanceId: _lastInstanceId, handedMessages: _handedMessages, appliedCompactionId: _appliedCompactionId, contextFloor: _contextFloor, lastContextModel: _lastContextModel, surfaceSource: _surfaceSource, ...wire } = task;
-    return wire;
+    const { resumeCursors: _resumeCursors, lastInstanceId: _lastInstanceId, handedMessages: _handedMessages, appliedCompactionId: _appliedCompactionId, contextFloor: _contextFloor, lastContextModel: _lastContextModel, surfaceSource, ...wire } = task;
+    // Who pinned stays private. A client learns only whether the pin is the
+    // machine's own record, so it never presents one as the person's choice.
+    return surfaceSource === "auto" && wire.surface !== undefined ? { ...wire, surfaceAuto: true } : wire;
 }
 const TASK_PATCH_FIELDS = [
     "title", "projectId", "modelSelection", "approvalMode", "autoApprove", "alwaysAllow",
@@ -1586,6 +1589,9 @@ export class Store {
         return this.completeNewBotSelection(requested ?? this.defaultSelection());
     }
     createBot(profile = {}, opts = {}) {
+        const toolScope = parseToolScope(profile.toolScope);
+        if (!toolScope.ok)
+            throw new Error(toolScope.error);
         this.rememberSections([profile.section]);
         const name = profile.name?.trim() || pickBotName(this.bots.map((b) => b.name));
         const section = sectionKey(profile.section);
@@ -1603,6 +1609,7 @@ export class Store {
             ...(profile.mascotBody ? { mascotBody: profile.mascotBody } : {}),
             // Restricted from its first frame: no one else is ever told it exists.
             ...(profile.visibility && profile.visibility !== "everyone" ? { visibility: structuredClone(profile.visibility) } : {}),
+            ...(toolScope.scope ? { toolScope: toolScope.scope } : {}),
             unread: false,
             modelSelection: this.newBotSelection(profile.modelSelection),
             resumeCursors: {},
@@ -1623,8 +1630,10 @@ export class Store {
                 activity: "idle",
                 busy: false,
             }];
+        // Persist the selection in the first record, before publishing the bot
+        // or starting its greeting. An interrupted creation cannot inherit tools.
+        this.saveBots([bot, ...this.bots]);
         this.bots.unshift(bot);
-        this.saveBots();
         // The folder exists from the first moment, so the user can open
         // SOUL.md before the bot has said a word. The record is canonical: a
         // mirror-write failure must never fail bot creation.
@@ -1838,6 +1847,18 @@ export class Store {
                 throw new Error(parsed.error);
             patch = { ...patch, connectorTools: parsed.grants };
         }
+        if (Object.hasOwn(patch, "toolScope")) {
+            const parsed = parseToolScope(patch.toolScope);
+            if (!parsed.ok)
+                throw new Error(parsed.error);
+            patch = { ...patch, toolScope: parsed.scope };
+        }
+        const wideningToolScope = Object.hasOwn(patch, "toolScope") && toolScopeWidens(bot.toolScope, patch.toolScope);
+        const nextToolScope = patch.toolScope;
+        if (wideningToolScope) {
+            patch = { ...patch };
+            delete patch.toolScope;
+        }
         // Runtime revocations must become effective in memory even when disk is
         // unavailable. Profile edits use the separate atomic path below.
         Object.assign(bot, patch);
@@ -1850,7 +1871,14 @@ export class Store {
             }
             bot.unread = bot.tasks.some(taskCountsAsBotUnread);
         }
-        this.saveBots();
+        if (wideningToolScope) {
+            // New authority becomes live only after its durable save succeeds.
+            // Other runtime revocations above still take effect on a failed write.
+            this.saveBots(this.bots.map((candidate) => candidate === bot ? { ...bot, toolScope: nextToolScope } : candidate));
+            bot.toolScope = nextToolScope;
+        }
+        else
+            this.saveBots();
         this.emit({ type: "bot", botId: id });
         return bot;
     }

package/dist-server/server/surface.js

@@ -85,7 +85,13 @@ export function surfaceLabel(surface) {
 /** Said once per task, so the person hears the place before the first click
  * lands there. Same words as the panel and the composer chip. */
 const RESTATE_SENTENCE = " Before your first action on a screen or page in a task, say in one short sentence where you are working, using that same name.";
-const SURFACE_AUTHORITY = " For browser and computer tasks, use OpenMausBot's mounted browser/computer tools first: inspect the target, perform the action, and verify its result before claiming success. Discover deferred tools by their server/name when needed. Do not substitute the provider's own desktop, a shell-launched browser, or another automation path for the selected OpenMausBot surface. Ordinary code and file tasks may still use their normal tools. Announcing an action is not performing it. A request naming another place does not move these tools: this computer is the user's host, Local VM is an isolated desktop, the cloud computer is remote, and the built-in browser is a separate browser. If the requested place differs from the mounted one, explain the mismatch and ask the user to change the conversation's computer selector; never act on a different computer or describe a host window as a VM.";
+/** Where a person moves a conversation: the Computer panel is the one place
+ * control both interface modes show (Simple has no composer chip). */
+const PLACE_CONTROL = "the Computer panel";
+/** Without select_computer the person has to switch; with it, surfacePrompt
+ * swaps exactly this phrase for the model's own switch. */
+const ASK_TO_SWITCH = `explain the mismatch and ask the user to change where this conversation works in ${PLACE_CONTROL}`;
+const SURFACE_AUTHORITY = ` For browser and computer tasks, use OpenMausBot's mounted browser/computer tools first: inspect the target, perform the action, and verify its result before claiming success. Discover deferred tools by their server/name when needed. Do not substitute the provider's own desktop, a shell-launched browser, or another automation path for the selected OpenMausBot surface. Ordinary code and file tasks may still use their normal tools. Announcing an action is not performing it. A request naming another place does not move these tools: this computer is the user's host, Local VM is an isolated desktop, the cloud computer is remote, and the built-in browser is a separate browser. If the requested place differs from the mounted one, ${ASK_TO_SWITCH}; never act on a different computer or describe a host window as a VM.`;
 /** A Cloud home offers neither this computer nor a Local VM
  * (server/cloud-home.ts), so its bots are told only about the places it has.
  * Each pair rewrites one phrase of the desktop wording above. */
@@ -116,13 +122,13 @@ export function surfacePrompt(mounted, opts = {}) {
     }
     if (text)
         text += RESTATE_SENTENCE + (opts.canSelect
-            ? SURFACE_AUTHORITY.replace("explain the mismatch and ask the user to change the conversation's computer selector", "inspect connected choices with select_computer and select the requested available place; on a pending result end this turn so OpenMausBot can reconnect the correct tools and continue the original request")
+            ? SURFACE_AUTHORITY.replace(ASK_TO_SWITCH, "inspect connected choices with select_computer and select the requested available place; on a pending result end this turn so OpenMausBot can reconnect the correct tools and continue the original request")
             : SURFACE_AUTHORITY);
     else if (!opts.note && !opts.canSelect) {
         text = " No computer or built-in browser tools are mounted this turn. You cannot open apps, click, or inspect a screen through OpenMausBot. If asked for screen work, explain this and ask the user to choose and connect a computer in the Computer panel; do not claim to have opened or checked it.";
     }
     if (opts.pinned) {
-        text += ` This conversation is pinned to ${surfaceLabel(opts.pinned)}; changing places requires ${opts.canSelect ? "select_computer or " : ""}the conversation's computer selector, not a different tool name.`;
+        text += ` This conversation is pinned to ${surfaceLabel(opts.pinned)}; changing places requires ${opts.canSelect ? "select_computer or " : ""}the user's choice in ${PLACE_CONTROL}, not a different tool name.`;
     }
     if (opts.canSelect)
         text += " For a screen task, use select_computer with no arguments when you need to inspect the actual available targets. Choose the requested place from its result; if the user left the place open, use a suitable available target or surface auto instead of asking them to operate the menu. Browser-only work can stay in Browser; when it needs desktop apps or capabilities the current Browser lacks, select an available Local VM without asking the user to switch it manually. Choose before taking actions, and do not repeat actions already completed if the task must continue elsewhere. OpenMausBot can start an existing configured computer and highlight the selected target. If the right tools are already mounted, use them directly. On a pending switch, end this turn: the original request resumes automatically with the new tools, and then you must carry out the task. Only ask for input for a genuine blocker, such as missing setup, required sign-in or an approval. Never silently replace an explicitly requested VM with the host desktop.";

package/dist-server/server/team-backup.js

@@ -119,6 +119,7 @@ export function createTeamBackup(store, routines, name) {
             // so the team's shape is not lost, but the import below still lands
             // every bot grant-less — restoring them is a deliberate later choice.
             ...(bot.connectorTools ? { connectorTools: structuredClone(bot.connectorTools) } : {}),
+            ...(bot.toolScope !== undefined ? { toolScope: structuredClone(bot.toolScope) } : {}),
             memory: memoryFor(bot.id),
             activeTask: bot.threadId, tasks: history(bot),
         })),
@@ -188,7 +189,7 @@ export function importTeamBackup(store, routines, input, selection, options = {}
             bots.push(bot);
             botIds.set(source.key, bot.id);
             store.patchBot(bot.id, { composio: false, computer: "off", browser: false, approvalMode: "ask", autoApprove: false,
-                connectorTools: {}, hidden: source.hidden, chiefOfStaff: source.chiefOfStaff, playbooks: source.playbooks });
+                connectorTools: {}, toolScope: source.toolScope, hidden: source.hidden, chiefOfStaff: source.chiefOfStaff, playbooks: source.playbooks });
             if (source.memory)
                 restoreMemory(bot.id, source.memory);
         }

package/dist-server/server/thread-events.js

@@ -187,7 +187,7 @@ function isRuntimeEvent(value) {
                 typeof value.waitedMs === "number" &&
                 Number.isFinite(value.waitedMs) &&
                 value.waitedMs >= 0 &&
-                (value.outcome === "acquired" || value.outcome === "gave_up" || value.outcome === "stopped"));
+                (value.outcome === "acquired" || value.outcome === "gave_up" || value.outcome === "parked" || value.outcome === "stopped"));
         case "item.started":
             return (value.itemType === "tool" || value.itemType === "reasoning") && stringOrMissing(value.title);
         case "item.updated":

package/dist-server/server/tunnel.js

@@ -91,20 +91,38 @@ export function tunnelAccess(document) {
 export function platformName(platform = process.platform) {
     return platform === "darwin" ? "darwin" : platform === "win32" ? "windows" : "linux";
 }
+const STOPPED_TUNNEL = { status: "stopped", ready: false };
 /** The desktop honours OMB_CONTROL_PLANE_URL only in development builds; a
  * server's operator owns its environment, so it is honoured here always and
- * the caller says so in its output. */
+ * the caller says so in its output. One-shot commands (login, status) pass no
+ * `recovery` and so start no background timers. */
 export function createTunnelAccount(options) {
     const env = options.env ?? process.env;
     const credentials = openTunnelCredentials(options.dataDir);
     const controlPlane = resolveCompanionControlPlaneURL({ isPackaged: true, environment: env });
     const client = controlPlane ? createControlPlaneClient({ baseURL: controlPlane, fetchImpl: options.fetchImpl }) : null;
+    const recovery = options.recovery;
     const service = createCompanionAccountService({
         client,
         readCredentials: () => credentials.read(),
         updateCredentials: (derive, afterPersist) => credentials.update(derive, afterPersist),
         identity: { name: options.machineName ?? hostname(), platform: platformName(), appVersion: options.version },
         newClientInstanceId: () => randomUUID(),
+        ...(recovery
+            ? {
+                autoRecover: true,
+                companionIsOn: () => recovery.running() !== null,
+                managedConnectionState: () => recovery.running()?.state() ?? STOPPED_TUNNEL,
+                activatePersistedEndpoint: async () => {
+                    const tunnel = recovery.running();
+                    const access = tunnelAccess(credentials.read());
+                    if (!tunnel || !access)
+                        return tunnel?.state() ?? STOPPED_TUNNEL;
+                    return tunnel.restart(access);
+                },
+                ...options.clock,
+            }
+            : {}),
     });
     return { service, credentials, controlPlane };
 }
@@ -206,6 +224,7 @@ export function startTunnel(options) {
         address: options.access.endpoint,
         state: () => current,
         started,
+        restart: (access) => tunnel.start({ endpoint: access.endpoint, token: access.token, originTarget: options.originTarget }),
         stop: async () => {
             await tunnel.stop();
         },

package/dist-server/server/turn-log.js

@@ -0,0 +1,10 @@
+// The line the harness prints when a turn starts (stderr, which the desktop
+// app keeps in server.log). It shows the start of the prompt, so a stuck turn
+// can be traced to what was asked. Words spoken on a Live call are never
+// logged — the call's summary line (liveCallSummaryLine) has counters only —
+// so a turn carrying any of them shows `text=(spoken)` instead.
+const LOGGED_CHARS = 70;
+export function turnStartLogLine(turn) {
+    const text = turn.spoken ? "(spoken)" : JSON.stringify(turn.text.slice(0, LOGGED_CHARS));
+    return `[omb-turn] bot=${turn.botId} text=${text} images=${turn.images} depth=${turn.depth} card=${turn.card}`;
+}

package/dist-server/server/turn-resources.js

@@ -7,6 +7,71 @@ import { relative, resolve, sep } from "node:path";
 export class TurnResources {
     owners = new Map();
     reclaims = new Map();
+    /** Arrival-ordered waiters per requested resource (#1652). Entries exist
+     * only while a turn is genuinely waiting (the exclusive bind's poll loop):
+     * a lazy claim that failed once and moved on must not sit at the front and
+     * block an actively waiting turn behind it from being granted the seat. */
+    waiters = new Map();
+    /** Exponentially weighted moving average of recent wait durations per
+     * resource, recorded when a waiting turn finally acquires. No history,
+     * no estimate: the chip shows one only once this map has an entry. */
+    waitStats = new Map();
+    /** Join the waitlist for a resource and return the stable position: where
+     * this turn sits among the waiters, in arrival order. Joining twice keeps
+     * the original place; positions only improve (a waiter ahead leaving),
+     * never jitter. */
+    startWaiting(resource, owner) {
+        const queue = this.waiters.get(resource);
+        if (!queue) {
+            this.waiters.set(resource, [owner]);
+            return 1;
+        }
+        const index = queue.findIndex(waiting => sameOwner(waiting, owner));
+        if (index >= 0)
+            return index + 1;
+        queue.push(owner);
+        return queue.length;
+    }
+    /** Leave the waitlist without claiming: the wait stopped, parked, or was
+     * cancelled. Idempotent, and safe for an owner who never joined. */
+    stopWaiting(resource, owner) {
+        const queue = this.waiters.get(resource);
+        if (!queue)
+            return;
+        const next = queue.filter(waiting => !sameOwner(waiting, owner));
+        if (next.length)
+            this.waiters.set(resource, next);
+        else
+            this.waiters.delete(resource);
+    }
+    /** This owner's current position in a resource's waitlist, or undefined
+     * when they are not waiting for it. */
+    waitPosition(resource, owner) {
+        const queue = this.waiters.get(resource);
+        if (!queue)
+            return undefined;
+        const index = queue.findIndex(waiting => sameOwner(waiting, owner));
+        return index < 0 ? undefined : index + 1;
+    }
+    /** Record how long a wait lasted once it ended in acquisition, feeding the
+     * per-resource estimate. Clamped to sane values so a clock skew cannot
+     * poison the average. */
+    noteWait(resource, waitedMs) {
+        if (!Number.isFinite(waitedMs) || waitedMs < 0)
+            return;
+        const sample = Math.min(waitedMs, 24 * 60 * 60_000);
+        const stats = this.waitStats.get(resource);
+        // Weight 1/4: recent waits dominate, one outlier does not rewrite the
+        // estimate, and the very first wait seeds the history on its own.
+        this.waitStats.set(resource, stats
+            ? { ewmaMs: stats.ewmaMs + 0.25 * (sample - stats.ewmaMs), samples: stats.samples + 1 }
+            : { ewmaMs: sample, samples: 1 });
+    }
+    /** The smoothed recent wait for a resource, or undefined until at least one
+     * wait has completed — the chip's estimate condition (#1652). */
+    waitEstimateMs(resource) {
+        return this.waitStats.get(resource)?.ewmaMs;
+    }
     blocker(resource, owner, now = Date.now()) {
         this.expireIdle(resource, now);
         for (const [key, current] of this.owners) {
@@ -26,6 +91,16 @@ export class TurnResources {
             // hold the seat past every quiet window (#1653).
             return true;
         }
+        // The free seat belongs to the front waiter; a current holder's
+        // revalidation above never loses its own claim to this queue.
+        const queue = this.waiters.get(resource);
+        if (queue?.length && !sameOwner(queue[0], owner))
+            return false;
+        if (queue?.length) {
+            queue.shift();
+            if (!queue.length)
+                this.waiters.delete(resource);
+        }
         const record = { owner };
         if (options.idle) {
             record.idle = options.idle;
@@ -60,6 +135,28 @@ export class TurnResources {
         if (current?.idle && sameOwner(current.owner, owner))
             current.activityAt = now;
     }
+    /** A screen-touching computer tool call started on this claim (#1653):
+     * the desktop is executing real I/O for the sitting owner, so the seat
+     * cannot be idle-released mid-call. Only the sitting owner's start
+     * counts; a start whose completion never arrives holds the seat until
+     * settle — the pre-#1653 behavior, never an overlapping handoff. */
+    beginComputerCall(resource, owner) {
+        const current = this.owners.get(resource);
+        if (current?.idle && sameOwner(current.owner, owner)) {
+            current.computerCallsInFlight = (current.computerCallsInFlight ?? 0) + 1;
+        }
+    }
+    /** The in-flight computer call finished: drop its fence and let the
+     * completion's own activity tick govern the quiet window. A no-op when
+     * the claim lapsed or another turn seated itself in between. */
+    endComputerCall(resource, owner) {
+        const current = this.owners.get(resource);
+        if (!current?.idle || !sameOwner(current.owner, owner))
+            return;
+        const inFlight = current.computerCallsInFlight ?? 0;
+        if (inFlight > 0)
+            current.computerCallsInFlight = inFlight - 1;
+    }
     /** Who may still re-claim `resource` directly after an idle release
      * (#1653): the mid-task turn that went quiet, until its reclaim window
      * ends or another turn seats itself. The direct re-claim itself is
@@ -76,6 +173,13 @@ export class TurnResources {
         return reclaimed.owner;
     }
     release(owner) {
+        for (const [key, queue] of this.waiters) {
+            const next = queue.filter(waiting => !sameOwner(waiting, owner));
+            if (next.length)
+                this.waiters.set(key, next);
+            else
+                this.waiters.delete(key);
+        }
         for (const [key, current] of this.owners) {
             if (sameOwner(current.owner, owner))
                 this.owners.delete(key);
@@ -92,6 +196,7 @@ export class TurnResources {
     releaseOne(resource, owner, now = Date.now()) {
         if (this.owns(resource, owner, now))
             this.owners.delete(resource);
+        this.stopWaiting(resource, owner);
         // owns() may have just expired a quiet claim into a reclaim record
         // for this same owner: an early release keeps no reclaim priority.
         const reclaimed = this.reclaims.get(resource);
@@ -106,11 +211,30 @@ export class TurnResources {
         const current = this.owners.get(resource);
         if (!current?.idle || current.activityAt === undefined)
             return;
+        // A call the desktop is still executing fences the seat (#1653):
+        // releasing mid-call would hand one desktop to two turns at once.
+        if ((current.computerCallsInFlight ?? 0) > 0)
+            return;
         if (!current.idle.quietElapsed(current.activityAt, now))
             return;
         this.owners.delete(resource);
         this.reclaims.set(resource, { owner: current.owner, until: now + current.idle.reclaimMs });
     }
+    /** Whether any live owner holds this resource: the parked-resume drain's
+     * gate (#1651) — a resume fires only when the seat it queued on is free. */
+    free(resource, now = Date.now()) {
+        for (const key of this.owners.keys()) {
+            if (!overlaps(key, resource))
+                continue;
+            // A quiet-window claim expires the moment anything needs to know
+            // whether the seat is free: the parked-resume gate must not wait on
+            // a claim whose window already elapsed (#1653).
+            this.expireIdle(key, now);
+            if (this.owners.has(key))
+                return false;
+        }
+        return true;
+    }
 }
 function sameOwner(a, b) {
     return a.threadId === b.threadId && a.generation === b.generation;

package/dist-server/shared/ask-question.js

@@ -15,6 +15,7 @@
  */
 /** The provider tool whose input this module understands. */
 export const ASK_USER_QUESTION_TOOL = "AskUserQuestion";
+export const QUESTION_DISMISS_MESSAGE = "The user closed this question without answering. Use your best judgment and continue.";
 /** Caps. Claude Code's own limits are smaller (1-4 questions, 2-4 options);
  * these leave room for a provider that widens them without letting a card
  * grow without bound. */
@@ -27,6 +28,18 @@ const MAX_LABEL = 120;
 const MAX_DESCRIPTION = 400;
 /** One free-text answer. Long enough for a sentence or two of context. */
 export const MAX_CUSTOM_ANSWER = 2000;
+/** Older live question cards predate requestType and only omit the permission
+ * tool. Keep those actionable too, while excluding other durable proposal
+ * card kinds that share requestId. */
+export function isPersistentQuestionCard(card) {
+    return Boolean(card && (card.requestType === "question" || card.questionRequest ||
+        (!card.requestType && !card.tool && !card.routineRequest && !card.skillRequest && !card.profileRequest &&
+            !card.modelRequest && !card.tighteningRequest && !card.teamSetupRequest)));
+}
+/** System/provider completion ends the live run, not the human's question. */
+export function shouldSettleRequestCard(card, source) {
+    return !isPersistentQuestionCard(card) || source === "user";
+}
 function text(value, limit) {
     if (typeof value !== "string")
         return undefined;

package/dist-server/shared/call-consent.js

@@ -0,0 +1,28 @@
+// Spoken answers to a permission card, shared by both call modes. Anything
+// else is read as a reply to the bot, not as consent — an approval must
+// never be granted by a sentence that merely contained the word "sure".
+export const YES = /^(yes|yeah|yep|yup|sure|ok|okay|go ahead|do it|allow|approve|approved|fine|please do)\b/i;
+export const NO = /^(no|nope|don'?t|do not|stop|deny|denied|cancel|never|skip it)\b/i;
+const FILLER = /^(?:(?:um+|uh+|er+|so|well|hmm+)[\s,.!?-]+)+/i;
+/** On a Live call these only hedge: "okay…" then a pause then "wait, what
+ * does it delete?", a bystander's "okay", or the voice's own "Okay, I need
+ * your permission" heard back through a phone's speaker. They are filler
+ * there, never the answer; a clear yes or no after them still counts. */
+const LIVE_HEDGES = /^(?:(?:um+|uh+|er+|so|well|hmm+|ok|okay|sure|fine)(?:[\s,.!?-]+|$))+/i;
+// A Live approval grants the entire action on the card. Extra conditions,
+// questions or corrections are not permission for that unchanged action.
+const LIVE_YES = /^(?:yes|yeah|yep|yup|go ahead|do it|allow(?: it)?|approve(?: it)?|approved|please do)(?:[\s,]+(?:please|go ahead|do it))*[.!]*$/i;
+/** "allow", "deny", or null when the words are not a clear decision. The
+ * answer must open the utterance; filler before it ("uh, yes") is dropped.
+ * `live`: a Live call, whose microphone stays open while the voice speaks
+ * and which decides after a short quiet window — hedges never decide there.
+ * `turns` (take turns) keeps its own rule: its microphone is closed while
+ * the bot talks. */
+export function spokenConsent(text, mode = "turns") {
+    const said = text.trim().replace(mode === "live" ? LIVE_HEDGES : FILLER, "");
+    if ((mode === "live" ? LIVE_YES : YES).test(said))
+        return "allow";
+    if (NO.test(said))
+        return "deny";
+    return null;
+}