openmausbot 0.1.93 → 0.1.95

package/dist-server/permission-proxy.js

@@ -94,7 +94,70 @@ function questionAnswersById(message, questions) {
   return only && flat ? { [only.id]: flat } : {};
 }
 
+// shared/tool-scope.ts
+var SERVER_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
+var CONTROL_CHARACTER = /[\x00-\x1f\x7f]/;
+var MAX_SELECTORS = 256;
+var MAX_SELECTOR_LENGTH = 1024;
+function validName(name) {
+  return typeof name === "string" && name.trim().length > 0 && name.length <= MAX_SELECTOR_LENGTH && !CONTROL_CHARACTER.test(name) && !name.includes("*");
+}
+function selectorIdentity(selector) {
+  if (selector.length > MAX_SELECTOR_LENGTH || CONTROL_CHARACTER.test(selector)) return;
+  if (selector.startsWith("native:")) {
+    const name = selector.slice(7);
+    if (name === "*" || validName(name)) return { kind: "native", name };
+  } else if (selector.startsWith("mcp:")) {
+    const separator = selector.indexOf(":", 4);
+    if (separator < 0) return;
+    const server = selector.slice(4, separator);
+    const name = selector.slice(separator + 1);
+    if (SERVER_NAME.test(server) && (name === "*" || validName(name))) {
+      return { kind: "mcp", server, name };
+    }
+  }
+}
+function parseToolScope(value) {
+  if (value === void 0) return { ok: true, scope: void 0 };
+  const invalid = { ok: false, error: "Tool selection must contain only valid allow and deny lists." };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return invalid;
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return invalid;
+  const scope = {};
+  for (const key of Reflect.ownKeys(value)) {
+    if (key !== "allow" && key !== "deny") return invalid;
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor)) return invalid;
+    const list = descriptor.value;
+    if (!Array.isArray(list) || list.length > MAX_SELECTORS) return invalid;
+    if (!Array.from(list).every((entry) => typeof entry === "string" && selectorIdentity(entry))) return invalid;
+    scope[key] = [...new Set(list)];
+  }
+  return { ok: true, scope };
+}
+function matches(selector, tool) {
+  const selected = selectorIdentity(selector);
+  return selected?.kind === tool.kind && (selected.kind !== "mcp" || tool.kind === "mcp" && selected.server === tool.server) && (selected.name === "*" || selected.name === tool.name);
+}
+function permits(scope, tool) {
+  if (!validName(tool.name) || tool.kind === "mcp" && !SERVER_NAME.test(tool.server)) return false;
+  return (scope?.allow === void 0 || scope.allow.some((selector) => matches(selector, tool))) && !scope?.deny?.some((selector) => matches(selector, tool));
+}
+function allowsTool(scope, tool) {
+  const parsed = parseToolScope(scope);
+  return parsed.ok && permits(parsed.scope, tool);
+}
+
 // server/permission-proxy.ts
+var selection = parseToolScope(process.env.OMB_PERMISSION_TOOL_SCOPE === void 0 ? void 0 : (() => {
+  try {
+    return JSON.parse(process.env.OMB_PERMISSION_TOOL_SCOPE);
+  } catch {
+    return null;
+  }
+})());
+if (!selection.ok) throw new Error(selection.error);
+var allowQuestion = allowsTool(selection.scope, { kind: "mcp", server: "ogb", name: "ask_user" });
 var socketPath = process.argv[2] ?? "";
 var waiting = /* @__PURE__ */ new Map();
 var conn = connect(socketPath);
@@ -203,11 +266,12 @@ async function handle(msg) {
       }
     });
   }
-  if (msg.method === "tools/list") return send({ jsonrpc: "2.0", id: msg.id, result: { tools: TOOLS } });
+  if (msg.method === "tools/list") return send({ jsonrpc: "2.0", id: msg.id, result: { tools: TOOLS.filter((tool) => tool.name === "approve" || allowQuestion) } });
   if (msg.method === "tools/call") {
     const name = msg.params?.name;
     const args = msg.params?.arguments ?? {};
     const reply = (text3) => send({ jsonrpc: "2.0", id: msg.id, result: { content: [{ type: "text", text: text3 }] } });
+    if (name === "ask_user" && !allowQuestion) return reply("OpenMausBot: this question tool is excluded by the bot's tool selection.");
     if (name === "approve" && args.tool_name === ASK_USER_QUESTION) {
       return reply(await answerNativeQuestions(args.input));
     }

package/dist-server/proxy-paths.js

@@ -8,7 +8,8 @@ function resolveProxy(relative) {
   return existsSync(source) ? source : join(SERVER_ROOT, `${relative}.js`);
 }
 var SPAWNED_PROXIES = {
-  browser: resolveProxy("browser-proxy"),
+  // The built-in browser and the cloud computer: argv[2] picks which.
+  harnessMcp: resolveProxy("harness-mcp-proxy"),
   localComputer: resolveProxy("local-computer-proxy"),
   permission: resolveProxy("permission-proxy"),
   containerMcp: resolveProxy("container-mcp"),
@@ -17,6 +18,7 @@ var SPAWNED_PROXIES = {
   dweb: resolveProxy("drivers/dweb-proxy"),
   connectors: resolveProxy("connector-proxy"),
   mcpGate: resolveProxy("mcp-gate"),
+  mcpRemote: resolveProxy("mcp-remote-proxy"),
   phone: resolveProxy("drivers/phone-proxy"),
   hook: resolveProxy("hooks/omb-hook"),
   // Loaded by the external `pi` process via `-e`, not by this server — but

package/dist-server/server/account-signin.js

@@ -11,8 +11,6 @@
 // not expose the routes.
 import { resolveCompanionControlPlaneURL } from "../electron/companion-account-service.mjs";
 import { ControlPlaneError, createControlPlaneClient, normalizeAccountEmail } from "../electron/control-plane-client.mjs";
-export const ADMIN_EMAILS_ENV = "OMB_SIGNIN_EMAILS";
-export const MEMBER_EMAILS_ENV = "OMB_SIGNIN_MEMBER_EMAILS";
 /** Commas, spaces or newlines between entries; case does not matter. */
 export function parseAllowList(value) {
     return (value ?? "")

package/dist-server/server/activity.js

@@ -0,0 +1,201 @@
+// A bot's activity log: what it did, in plain words, with the outcome.
+//
+// Nothing here is captured for the log's sake. Two records already on disk
+// between them know everything a receipt needs: the per-thread runtime
+// events (harness/bus.ts) say what ran and whether it finished, and the
+// fleet-wide decision log (decision-log.ts) says what was asked, with which
+// arguments, and who allowed it. This module reads both back and folds
+// them into one row per thing that happened.
+//
+// Connector calls pass through the harness relay, whose approval and scope
+// decisions share the decision log. Read those alongside native tool runs.
+import { join } from "node:path";
+import { readDecisions } from "./decision-log.js";
+import { isRuntimeEvent, readRecentLines } from "./thread-events.js";
+/** Composio toolkit slugs whose display name is not just a capitalised word. */
+const TOOLKIT_NAMES = {
+    GMAIL: "Gmail",
+    GITHUB: "GitHub",
+    GOOGLESHEETS: "Google Sheets",
+    GOOGLECALENDAR: "Google Calendar",
+    GOOGLEDRIVE: "Google Drive",
+    GOOGLEDOCS: "Google Docs",
+    HUBSPOT: "HubSpot",
+    LINKEDIN: "LinkedIn",
+    YOUTUBE: "YouTube",
+    TWITTER: "X",
+    WHATSAPP: "WhatsApp",
+    ONEDRIVE: "OneDrive",
+};
+/** The agent's own built-in tools, phrased as what they did. */
+const BUILTIN_LABELS = {
+    Bash: "Ran a command",
+    Read: "Read a file",
+    Edit: "Edited a file",
+    MultiEdit: "Edited files",
+    Write: "Wrote a file",
+    Glob: "Searched files",
+    Grep: "Searched files",
+    LS: "Listed a folder",
+    WebSearch: "Searched the web",
+    WebFetch: "Fetched a page",
+    Skill: "Used a skill",
+    Task: "Ran a subagent",
+    Agent: "Ran a subagent",
+    AskUserQuestion: "Asked you a question",
+    TodoWrite: "Updated its task list",
+};
+/** "save_issue" → "Save issue", "TaskUpdate" → "Task update",
+ * "CREATE_AN_ISSUE" → "Create an issue". */
+function humanize(raw) {
+    const spaced = raw
+        .replace(/_+/g, " ")
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .replace(/\s+/g, " ")
+        .trim()
+        .toLowerCase();
+    return spaced ? spaced[0].toUpperCase() + spaced.slice(1) : raw;
+}
+function toolkitName(slug) {
+    return TOOLKIT_NAMES[slug] ?? slug[0] + slug.slice(1).toLowerCase();
+}
+/** Composio names its tools TOOLKIT_ACTION_WORDS, all upper case. */
+const COMPOSIO_TOOL = /^([A-Z][A-Z0-9]+)_([A-Z0-9_]+)$/;
+/** Turn a raw tool name into the app it touched and the action, in words. */
+export function describeTool(name) {
+    const builtin = BUILTIN_LABELS[name];
+    if (builtin)
+        return { app: null, label: builtin };
+    if (name.startsWith("mcp__")) {
+        const [, server = "", ...rest] = name.split("__");
+        const action = rest.join("__");
+        if (server === "composio")
+            return describeTool(action);
+        if (server === "computer")
+            return { app: "Computer", label: humanize(action) };
+        if (server === "agents")
+            return { app: "Team", label: humanize(action) };
+        if (server.startsWith("claude_ai_")) {
+            return { app: server.slice("claude_ai_".length).replace(/_/g, " "), label: humanize(action) };
+        }
+        return { app: humanize(server), label: humanize(action) };
+    }
+    const composio = COMPOSIO_TOOL.exec(name);
+    if (composio)
+        return { app: toolkitName(composio[1]), label: humanize(composio[2]) };
+    return { app: null, label: humanize(name) };
+}
+/** How many decision rows to read back before filtering to one bot. The
+ * file is rotation-capped, so this is a ceiling on parse work, not a
+ * window that quietly drops history. */
+const DECISION_SCAN = 20_000;
+/** Runtime events read per thread, newest first; the reader tail-walks. */
+const EVENTS_PER_THREAD = 2_000;
+/** An approval is folded into the tool run it unblocked when the run
+ * started inside this window around the decision. A verdict is written
+ * as the request opens; the run follows it, occasionally by a clock skew's
+ * worth in the other direction. */
+const MATCH_BEFORE_MS = 5_000;
+const MATCH_AFTER_MS = 30_000;
+const OUTCOME_OF_DECISION = {
+    "auto-approved": "allowed",
+    "auto-denied": "denied",
+    "user-approved": "allowed",
+    "review-would-approve": "allowed",
+    "user-denied": "denied",
+    "review-would-deny": "denied",
+    "card-shown": "waiting",
+};
+function describeRow(base) {
+    const { app, label } = describeTool(base.tool);
+    return { ...base, app, label };
+}
+/** One row per request: the decision log writes a row when a card is shown
+ * and another when it is answered, and the receipt wants the answer. */
+function foldDecisions(rows) {
+    const byRequest = new Map();
+    rows.forEach((row, index) => {
+        const key = row.requestId ?? `row:${index}`;
+        const group = byRequest.get(key);
+        if (group)
+            group.push(row);
+        else
+            byRequest.set(key, [row]);
+    });
+    const folded = [];
+    for (const group of byRequest.values()) {
+        const opened = group[0];
+        const latest = group[group.length - 1];
+        const summary = group.find((row) => row.summary)?.summary;
+        folded.push(describeRow({
+            at: opened.at,
+            threadId: opened.threadId,
+            requestId: opened.requestId,
+            tool: latest.tool ?? opened.tool ?? "unknown",
+            ...(summary ? { summary } : {}),
+            outcome: OUTCOME_OF_DECISION[latest.decision],
+        }));
+    }
+    return folded;
+}
+function readToolRuns(eventsDir, threadId) {
+    const { lines } = readRecentLines(join(eventsDir, `${threadId}.ndjson`), EVENTS_PER_THREAD, isRuntimeEvent);
+    const runs = new Map();
+    for (const event of lines) {
+        if (event.type === "item.started" && event.itemType === "tool") {
+            const key = JSON.stringify([event.turnId ?? "", event.itemId ?? event.eventId]);
+            runs.set(key, describeRow({
+                at: event.createdAt,
+                threadId,
+                ...(event.turnId ? { turnId: event.turnId } : {}),
+                tool: event.title ?? "unknown",
+                outcome: "running",
+            }));
+        }
+        else if (event.type === "item.completed" && event.itemType === "tool" && event.itemId) {
+            const run = runs.get(JSON.stringify([event.turnId ?? "", event.itemId]));
+            if (run)
+                run.outcome = event.ok ? "ran" : "failed";
+        }
+    }
+    return [...runs.values()];
+}
+/** The bot's activity, newest first: every tool run in the threads named,
+ * and every decision the broker logged for the bot, with an approval folded
+ * into the run it unblocked wherever the two can be matched. */
+export function readBotActivity(input) {
+    const { dataDir, eventsDir, botId, threadIds, limit } = input;
+    const runs = threadIds.flatMap((threadId) => readToolRuns(eventsDir, threadId));
+    const decisions = foldDecisions(readDecisions(dataDir, DECISION_SCAN).filter((row) => row.botId === botId));
+    const matched = new Set();
+    const rows = [...runs];
+    for (const decision of decisions) {
+        if (decision.outcome !== "allowed") {
+            rows.push(decision);
+            continue;
+        }
+        const askedAt = Date.parse(decision.at);
+        let best = null;
+        for (const run of runs) {
+            if (matched.has(run) || run.threadId !== decision.threadId || run.tool !== decision.tool)
+                continue;
+            const delta = Date.parse(run.at) - askedAt;
+            if (delta < -MATCH_BEFORE_MS || delta > MATCH_AFTER_MS)
+                continue;
+            if (!best || Math.abs(delta) < Math.abs(Date.parse(best.at) - askedAt))
+                best = run;
+        }
+        if (best) {
+            matched.add(best);
+            if (decision.summary)
+                best.summary = decision.summary;
+            if (decision.requestId)
+                best.requestId = decision.requestId;
+        }
+        else {
+            rows.push(decision);
+        }
+    }
+    rows.sort((a, b) => (a.at < b.at ? 1 : a.at > b.at ? -1 : 0));
+    return rows.slice(0, Math.max(1, limit));
+}

package/dist-server/server/auto-approve.js

@@ -7,6 +7,7 @@
 // grants the app applies are Full access and the person's exact saved commands.
 // Questions never come through here: a bot's question always reaches a human.
 import { supportsApprovalMode } from "../shared/approval-mode.js";
+import { isOutboundTool } from "../shared/outbound.js";
 /** A failed delivery is a runtime error, not another permission decision.
  * An expired ask must never become a fresh Allow/Deny card. */
 export async function deliverFullAccessApproval(adapter, threadId, requestId, turnId, isCurrent = () => false) {
@@ -25,7 +26,7 @@ export async function deliverFullAccessApproval(adapter, threadId, requestId, tu
 }
 /** Full access is the person's explicit grant to this receiving bot, including
  * delegated work. It never inherits the sender's mode or elevates another bot
- * — with the one exception below (delegationInheritsFullAccess), applied
+ * — with the one exception below (delegatedApprovalMode), applied
  * where a Chief's delegated thread is created rather than here.
  * Custom is a provider-config choice rather than an app Full-access grant, so
  * peer-started Custom turns use Auto. Provider support and grant confirmation
@@ -35,16 +36,38 @@ export function approvalModeForOrigin(mode, origin) {
         return "auto";
     return mode;
 }
-/** Whether work a bot hands to a teammate runs with Full access. Only a Chief
- * of Staff passes access on, and only the Full access the person gave it for
- * the conversation it is delegating from: the Chief exists to get the team's
- * work done without the person answering every card, and a teammate stopping
- * that work to ask defeats the grant. The recipient's engine has to implement
- * Full, or the work keeps the recipient's own level. A bot never elevates
- * itself this way. */
-export function delegationInheritsFullAccess(input) {
-    return input.senderIsChief && input.senderHasFullAccess && !input.sameBot
-        && supportsApprovalMode(input.recipientDriverKind, "full");
+/** Levels by how much runs without asking. Custom is a provider config of
+ * its own and is never compared. */
+const LEVEL_RANK = { ask: 0, edits: 1, auto: 2, full: 3 };
+/** The level work a bot hands to a teammate starts at, or null to keep the
+ * teammate's own. A Chief of Staff's level flows down: the person set it on
+ * the Chief so the team's work runs that way, and switching every thread the
+ * Chief opens with a teammate back off "Ask for approval" was the friction
+ * people reported. Only a Chief passes its level on, only the level of the
+ * conversation it delegates from, and only upward: a teammate already on a
+ * higher level keeps it, and one on Custom keeps its own config. The level
+ * is capped at what the teammate's engine implements (Full or Auto-accept
+ * edits are not everywhere), stepping down to the next level it has. A bot
+ * never raises itself this way. */
+export function delegatedApprovalMode(input) {
+    if (!input.senderIsChief || input.sameBot)
+        return null;
+    // A Chief's Custom config is its own; for a teammate it reads as Approve
+    // for me, as for any peer-started Custom turn (approvalModeForOrigin).
+    const sender = LEVEL_RANK[approvalModeForOrigin(input.senderMode, { peerInitiated: true })] ?? 0;
+    const own = LEVEL_RANK[input.recipientMode];
+    if (own === undefined)
+        return null;
+    for (const mode of ["full", "auto", "edits"]) {
+        const rank = LEVEL_RANK[mode];
+        if (rank > sender)
+            continue;
+        if (rank <= own)
+            return null;
+        if (supportsApprovalMode(input.recipientDriverKind, mode))
+            return mode;
+    }
+    return null;
 }
 // Tools that ask a PERSON something. A question exists so that a human
 // decides; any mode answering one on their behalf defeats the only reason
@@ -69,6 +92,8 @@ export function autoVerdict(mode, tool, context) {
         return { approve: `approved ${tool} (full access)`, source: "full-access" };
     if (context?.requiresExplicitApproval)
         return { approve: null, source: "explicit-approval-block" };
+    if (isOutboundTool(tool))
+        return { approve: null, source: "outbound-guard" };
     if (context?.commandAllowed)
         return { approve: `approved ${tool} (saved command)`, source: "command-allowlist" };
     if (mode === "auto" || mode === "custom")
@@ -83,6 +108,7 @@ export function autoVerdict(mode, tool, context) {
  * the server keeps sending: cards saved before the key existed still render,
  * and so do the free-text apply errors that have no key at all. */
 export const HELD_NOTE = {
+    "approval.held.outbound": "This sends something on your behalf, so it always asks first.",
     "approval.held.native": "The provider requires your approval for this action.",
     "approval.held.sandbox": "This changes the provider sandbox, so only Full access can approve it automatically.",
     "approval.held.undeliveredFull": "Full access couldn't deliver this approval.",
@@ -93,6 +119,8 @@ export const HELD_NOTE = {
 export function approvalHeldNote(context) {
     if (!context.permission)
         return undefined;
+    if (context.source === "outbound-guard")
+        return "approval.held.outbound";
     if (context.source === "explicit-approval-block")
         return "approval.held.sandbox";
     if (context.source === "native-approval")

package/dist-server/server/automatic-recovery.js

@@ -7,7 +7,7 @@ export function recoveryCapabilityError(from, to) {
         supportsWorkspaceFiles(from.driverKind) !== supportsWorkspaceFiles(to.driverKind)) {
         return "The backup cannot use the same workspace.";
     }
-    const tools = ["agentsMcp", "computerMcp", "cloudComputerMcp", "composioMcp",
+    const tools = ["agentsMcp", "computerMcp", "composioMcp",
         "phoneMcp", "browserMcp", "localComputerMcp", "customMcp", "images"];
     if (tools.some(key => from.capabilities[key] === true && to.capabilities[key] !== true)) {
         return "The backup does not support all of this engine's tools and attachments.";

package/dist-server/server/boat-create-idempotency.js

@@ -388,13 +388,6 @@ export function resolveBoatCreate(request) {
         return { ...resolved };
     });
 }
-/** Read-only deletion guard. Both a key-only request with an ambiguous
- * provider outcome and a known-but-not-yet-named Boat must keep its bot owner. */
-export function hasUnresolvedBoatCreate(botId) {
-    if (!BOT_ID.test(botId))
-        throw new Error("invalid bot id for cloud computer creation");
-    return withJournalLock((requests) => (requests.some((request) => request.botId === botId && request.resolved !== true)));
-}
 /** Sanitized local recovery authority for configuration guards. The fresh,
  * lock-protected read can prove a remembered provider id even while the
  * account-wide LIST endpoint is eventually consistent. Provider request

package/dist-server/server/boat-delete-journal.js

@@ -442,7 +442,6 @@ export function markBoatDeletionBlocked(boxId, value) {
 export function boatDeletionSnapshot() {
     return withJournalLock((records) => records.map(clone));
 }
-export const listBoatDeletions = boatDeletionSnapshot;
 export function getBoatDeletion(boxId) {
     if (!BOAT_ID.test(boxId))
         throw new Error("invalid cloud computer id for deletion");
@@ -451,9 +450,6 @@ export function getBoatDeletion(boxId) {
         return record ? clone(record) : null;
     });
 }
-export function isBoatDeletionPending(boxId) {
-    return getBoatDeletion(boxId) !== null;
-}
 export function hasPendingBoatDeletionForBot(botId) {
     if (!BOT_ID.test(botId))
         throw new Error("invalid bot id for cloud computer deletion");

package/dist-server/server/bot-package.js

@@ -1,15 +1,11 @@
 import { stringify as stringifyYaml } from "yaml";
 import { cronScheduleLabel } from "../shared/cron-label.js";
-import { BOTMRR_MARKDOWN_VERSION, isPackageDocument, PACKAGE_FORMAT, PACKAGE_V1_MAX_SKILLS, PACKAGE_V1_VERSION, parsePackageV1, utf8Bytes, } from "../shared/package-format.js";
+import { BOTMRR_MARKDOWN_VERSION, isPackageDocument, PACKAGE_V1_MAX_SKILLS, parsePackageV1, utf8Bytes, } from "../shared/package-format.js";
 // The package file format (v1 and v2) lives in shared/package-format.ts: one
 // validation gate for the server, the renderer and Admin. This module keeps
 // the v1 names the v1 exporter and its Markdown playbook are written in, and
 // re-exports the v2 reader so server code has one place to import from.
 export { canonicalJson, downgradeToV1, PACKAGE_MAX_BYTES, PACKAGE_VERSION, PackageFormatError, packageKeys, packageScanFindings, packageSecretFindings, packageSummary, parsePackageDocument, redactPackageSecrets, upgradeV1, } from "../shared/package-format.js";
-export const BOT_PACKAGE_FORMAT = PACKAGE_FORMAT;
-export const BOT_PACKAGE_VERSION = PACKAGE_V1_VERSION;
-export { BOTMRR_MARKDOWN_VERSION };
-export const BOT_PACKAGE_SKILLS_VERSION = 1;
 export const BOT_PACKAGE_MAX_SKILLS = PACKAGE_V1_MAX_SKILLS;
 const BOT_PACKAGE_MARKDOWN_MAX_BYTES = 1_000_000;
 export function isBotPackage(value) {
@@ -98,17 +94,3 @@ export function renderBotPackageMarkdown(document) {
         throw new Error("The bot playbook is too large");
     return markdown;
 }
-export function packageAgentAsMember(agent) {
-    return {
-        key: agent.key,
-        name: agent.name,
-        title: agent.title ?? "",
-        description: agent.description ?? "",
-        ...(agent.soul !== undefined ? { soul: agent.soul } : {}),
-        appearance: {
-            color: agent.appearance.color,
-            ...(agent.appearance.mascotExpression ? { mascotExpression: agent.appearance.mascotExpression } : {}),
-            ...(agent.appearance.mascotBody ? { mascotBody: agent.appearance.mascotBody } : {}),
-        },
-    };
-}

package/dist-server/server/browser-live.js

@@ -10,6 +10,9 @@ const HEARTBEAT_MS = 10_000;
 // The native press resolver supplies the virtual key codes and Enter/Tab text
 // that its raw input_keyboard relay omits. Keep unknown keys literal.
 const DISCRETE_KEYS = new Set(["Backspace", "Enter", "Tab", "Escape", "Delete", "ArrowUp", "ArrowDown", "ArrowLeft", "ArrowRight", "Home", "End", "PageUp", "PageDown"]);
+// The panel has no take-control button: interacting takes control, and an
+// interrupted action is recovered from the panel's menu.
+const RESTART_NEEDED = "A browser action was interrupted. Choose Restart browser… in the browser menu before continuing.";
 export class BrowserLiveError extends Error {
     status;
     constructor(message, status = 400) { super(message); this.name = "BrowserLiveError"; this.status = status; }
@@ -569,22 +572,24 @@ export class BrowserLive {
             try {
                 const taking = this.runtime.take(viewer.session, viewer.id);
                 this.control(viewer.session);
-                await taking;
+                // waited: the bot's own action finished first, so input the person
+                // aimed at the page before the grant may no longer fit it.
+                const waited = await taking;
                 if (!this.current(viewer)) {
                     this.close(viewer);
                     throw new BrowserLiveError("This browser view closed.", 409);
                 }
-                return { ok: true };
+                return { ok: true, waited: waited === true };
             }
             catch {
-                throw new BrowserLiveError("Another browser view or bot action is using this browser. Try again shortly.", 409);
+                throw this.refusal(viewer, "Another browser view or bot action is using this browser. Try again shortly.");
             }
             finally {
                 this.control(viewer.session);
             }
         }
         if (!this.runtime.canControl(viewer.session, viewer.id))
-            throw new BrowserLiveError("Take control of this browser before interacting.", 409);
+            throw this.refusal(viewer, "Browser control changed. Try again.");
         if (viewer.pendingActions >= 32)
             throw new BrowserLiveError("Too many browser actions are pending. Try again shortly.", 429);
         viewer.pendingActions += 1;
@@ -600,13 +605,17 @@ export class BrowserLive {
             return { ok: true };
         }
         catch (error) {
-            throw error instanceof BrowserLiveError ? error : new BrowserLiveError("Browser control changed. Take control again to continue.", 409);
+            throw error instanceof BrowserLiveError ? error : this.refusal(viewer, "Browser control changed. Try again.");
         }
         finally {
             viewer.pendingActions -= 1;
             this.control(viewer.session);
         }
     }
+    /** Why this viewer cannot act now: an interrupted browser needs a restart. */
+    refusal(viewer, otherwise) {
+        return new BrowserLiveError(this.runtime.interrupted(viewer.session) ? RESTART_NEEDED : otherwise, 409);
+    }
     closeForSession(session) { for (const viewer of this.viewers.values())
         if (viewer.session === session)
             this.close(viewer); }

package/dist-server/server/browser-runtime.js

@@ -216,8 +216,7 @@ export class BrowserRuntime {
     options;
     closeBrowser;
     constructor({ closeBrowser, ...options } = {}) {
-        const budget = Number(process.env.OMB_BROWSER_RESULT_BUDGET);
-        this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: Number.isFinite(budget) && budget > 0 ? budget : DEFAULT_BROWSER_RESULT_BUDGET, ...options };
+        this.options = { requestTimeoutMs: 120_000, takeoverTimeoutMs: 15_000, idleMs: 60_000, maxPending: 16, resultBudget: DEFAULT_BROWSER_RESULT_BUDGET, ...options };
         this.closeBrowser = closeBrowser ?? (async () => false);
     }
     gate(session) {
@@ -364,6 +363,8 @@ export class BrowserRuntime {
         };
         return method === "tools/call" ? this.withAgentAction(session, invoke) : invoke();
     }
+    /** Resolves true when the grant had to wait for the bot's own browser
+     * action to finish: the page may have changed since the person aimed. */
     async take(session, owner) {
         if (!owner)
             throw new Error("Browser control requires an owner.");
@@ -374,6 +375,7 @@ export class BrowserRuntime {
             throw new Error("Another person controls this browser.");
         gate.owner = owner; // synchronous: no new agent work slips in while draining.
         gate.ready = false;
+        const waited = gate.agents > 0;
         await new Promise((resolve, reject) => {
             const finish = (error) => {
                 clearTimeout(timer);
@@ -398,12 +400,15 @@ export class BrowserRuntime {
             gate.changed.add(check);
             check();
         });
+        return waited;
     }
     canControl(session, owner) {
         const gate = this.gates.get(session);
         return Boolean(owner && gate?.owner === owner && gate.ready && !gate.releasing && !gate.closing && !gate.uncertain && gate.agents === 0);
     }
     heldBy(session) { return this.gates.get(session)?.owner ?? null; }
+    /** An interrupted action left the browser's state unknown; only a restart clears it. */
+    interrupted(session) { return this.gates.get(session)?.uncertain === true; }
     /** A disconnected viewer may leave a physical key/button pressed. Never
      * let an agent inherit that input state; explicit restart clears it. */
     abandonHumanInput(session, owner) {

package/dist-server/server/channel-queue.js

@@ -17,8 +17,11 @@ export function restoreChannelMessages() {
         const entry = queues.get(row.threadId) ?? { groupId: row.ownerId, items: [] };
         if (entry.groupId !== row.ownerId)
             throw new Error("queued task belongs to another channel");
+        // a channel line is only ever stamped "api"; "call" belongs to 1:1 rows
+        const { via, ...payload } = row.payload;
         entry.items.push({
-            ...row.payload,
+            ...payload,
+            ...(via === "api" ? { via } : {}),
             id: row.id,
             mode: row.payload.mode ?? "chat",
             // rows queued before timestamps were kept read as queued at restore

package/dist-server/server/chief-of-staff.js

@@ -9,7 +9,7 @@ const sectionKey = (section) => section?.trim() || "";
 /** Dynamic system context for a section's Chief of Staff.
  * It names the current team on every turn, while list_bots remains the
  * authoritative tool for IDs and live availability at delegation time. */
-export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpenMausStatus = "", boundedCoordination = false) {
+export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, boundedCoordination = false) {
     const chief = bots.find((bot) => bot.id === chiefId);
     const chiefSection = sectionKey(chief?.section);
     const sectionName = peerName(chiefSection) || "General";
@@ -29,7 +29,7 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
     });
     const delegation = canDelegate
         ? boundedCoordination
-            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Outside a room, each distinct assignment starts a fresh thread for that teammate, using their own model and permissions. Include the context they need in each brief. Busy teammates queue. Give self-contained briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
+            ? "Use list_bots or list_room_targets for the live reachable roster. Use coordinate_bots to ask actual teammates for advice or assign concrete work. Give clear briefs, then end your turn; you resume automatically after their results return. Leads can coordinate their own specialists. Do not poll, send acknowledgements as new work, or substitute native helpers for named bots. On return, verify the requested outcome, resolve decisions within the user's scope, request concrete corrections with rework=true when necessary, and return one consolidated answer. Consultations are advice, not proof that work or tests ran. A refusal from coordinate_bots means nothing was sent: fix what it names (usually the id — copy it from list_bots or your roster; a unique teammate name also works) and retry, and never describe a handoff the tool did not accept."
             : [
                 "Use list_bots to confirm the live roster and IDs. When assigning work to a teammate, use delegate_bot: it returns immediately, keeps you available to the user, and delivers the teammate's outcome back into this conversation automatically — success or failure. When the result arrives you are woken with it: report it to the user and act. If the teammate fails or stalls, tell the user plainly and decide the next step yourself.",
                 "After delegate_bot accepts the task, acknowledge the handoff and continue with any independent work or end your turn. Do not call wait_delegation or repeatedly poll check_delegation in the same turn.",
@@ -52,6 +52,5 @@ export function chiefOfStaffSystemPrompt(chiefId, bots, canDelegate, trustedOpen
         canDelegate ? "When the user asks you to assemble or configure a team, use list_team_setup for the exact authorized teams, bot IDs and model catalog, then propose_team_setup once with all named specialists and their profile/model changes. Include new teams explicitly; the plan covers their creation and your access. Existing thread models and other bots' execution permissions stay unchanged. Follow the tool result: granted Full Access may apply the plan immediately; after an applied result, continue already-requested work without another confirmation. Only if review is pending, end your turn: the user's decision automatically resumes you once with a structured result. Report failed or cancelled results honestly. Do not ask for another yes, poll, or repeat the proposal. After successful setup, use the available coordination tools for already requested work. Use create_bot only for a single specialist when no combined setup was requested. For explicitly requested bot deletion, use propose_bot_deletion separately and follow its applied or pending result too. Do not create duplicate or unnecessary bots." : "",
         chief?.managedSections?.length ? "Reachable teammates in your allowed teams:" : `Current ${sectionName} section team:`,
         roster,
-        trustedOpenMausStatus,
     ].filter(Boolean).join("\n");
 }